From a3e9363271161b139044921d1a42b48afcb065d5 Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Tue, 11 Aug 2020 23:29:42 +0200 Subject: [PATCH 01/17] Added Layer 2 Network Detection to detect Rogue DHCP Servers --- .../detect_rogue_dhcp_server_in_network.yml | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 detections/detect_rogue_dhcp_server_in_network.yml diff --git a/detections/detect_rogue_dhcp_server_in_network.yml b/detections/detect_rogue_dhcp_server_in_network.yml new file mode 100644 index 0000000000..8ba951872c --- /dev/null +++ b/detections/detect_rogue_dhcp_server_in_network.yml @@ -0,0 +1,40 @@ +name: Detect Rogue DHCP Server in Network +id: 6e1ada88-7a0d-4ac1-92c6-03d354686079 +version: 1 +date: '2020-08-11' +description: By enabling DHCP Snooping as a Layer 2 Security measure on the organization's + network devices, we will be able to detect unauthorized DHCP servers handing out DHCP + leases to devices on the network. +how_to_implement: This search uses a standard SPL query on logs from Cisco Network + devices. The network devices must be configured with DHCP Snooping enabled + (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html) + and log with a severity level of minimum "5 - notification". + The search also requires that the Cisco Networks Add-on for Splunk + (https://splunkbase.splunk.com/app/1467) is used to + parse the logs from the Cisco network devices. +type: ESCU +references: [] +author: Mikael Bjerkeland, Splunk +search: 'eventtype=cisco_ios-dhcp_snooping_untrusted_port | stats min(_time) AS firstTime max(_time) AS lastTime count values(message_type) AS message_type values(src_mac) AS src_mac BY host' +known_false_positives: This search might be prone to high false positives if + DHCP Snooping has been incorrectly configured or in the unlikely event that + the DHCP server has been moved to another network interface. +tags: + analytics_story: + - Router and Infrastructure Security + kill_chain_phases: + - Reconnaissance + - Delivery + - Actions on Objectives + mitre_attack_id: + - T1200 + - T1498 + - T1557 + cis20: + - CIS 1 + - CIS 11 + nist: + - ID.AM + - PR.DS + security_domain: network + asset_type: Infrastructure From 9eb49b723cd70d4d6080d014466da6d0aabf5408 Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Tue, 11 Aug 2020 23:33:57 +0200 Subject: [PATCH 02/17] Description update --- detections/detect_rogue_dhcp_server_in_network.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/detect_rogue_dhcp_server_in_network.yml b/detections/detect_rogue_dhcp_server_in_network.yml index 8ba951872c..f410a15855 100644 --- a/detections/detect_rogue_dhcp_server_in_network.yml +++ b/detections/detect_rogue_dhcp_server_in_network.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-08-11' description: By enabling DHCP Snooping as a Layer 2 Security measure on the organization's network devices, we will be able to detect unauthorized DHCP servers handing out DHCP - leases to devices on the network. + leases to devices on the network (Man in the Middle attack). how_to_implement: This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with DHCP Snooping enabled (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html) From dd10e6e3cbffb3677f55fc1111ecc2349a347c66 Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Wed, 12 Aug 2020 09:17:32 +0200 Subject: [PATCH 03/17] Adding macros --- detections/detect_rogue_dhcp_server_in_network.yml | 6 +++++- macros/cisco_networks.yml | 4 ++++ macros/detect_rogue_dhcp_server_output_filter.yml | 3 +++ 3 files changed, 12 insertions(+), 1 deletion(-) create mode 100644 macros/cisco_networks.yml create mode 100644 macros/detect_rogue_dhcp_server_output_filter.yml diff --git a/detections/detect_rogue_dhcp_server_in_network.yml b/detections/detect_rogue_dhcp_server_in_network.yml index f410a15855..407c348131 100644 --- a/detections/detect_rogue_dhcp_server_in_network.yml +++ b/detections/detect_rogue_dhcp_server_in_network.yml @@ -15,7 +15,11 @@ how_to_implement: This search uses a standard SPL query on logs from Cisco Netwo type: ESCU references: [] author: Mikael Bjerkeland, Splunk -search: 'eventtype=cisco_ios-dhcp_snooping_untrusted_port | stats min(_time) AS firstTime max(_time) AS lastTime count values(message_type) AS message_type values(src_mac) AS src_mac BY host' +search: '`cisco_ios` facility="DHCP_SNOOPING" mnemonic="DHCP_SNOOPING_UNTRUSTED_PORT" + | stats min(_time) AS firstTime max(_time) AS lastTime count values(message_type) AS + message_type values(src_mac) AS src_mac BY host + | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| + `detect_rogue_dhcp_server_output_filter`' known_false_positives: This search might be prone to high false positives if DHCP Snooping has been incorrectly configured or in the unlikely event that the DHCP server has been moved to another network interface. diff --git a/macros/cisco_networks.yml b/macros/cisco_networks.yml new file mode 100644 index 0000000000..3c2e8c0a1e --- /dev/null +++ b/macros/cisco_networks.yml @@ -0,0 +1,4 @@ +definition: eventtype=cisco_ios +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: cisco_networks diff --git a/macros/detect_rogue_dhcp_server_output_filter.yml b/macros/detect_rogue_dhcp_server_output_filter.yml new file mode 100644 index 0000000000..a52c2fcc96 --- /dev/null +++ b/macros/detect_rogue_dhcp_server_output_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Use this macro to add additional filters to prevent i.e. false positives +name: detect_rogue_dhcp_server_output_filter From c12f8b2a6e5352e789d3de4894034e303b17af76 Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Wed, 12 Aug 2020 10:55:10 +0200 Subject: [PATCH 04/17] Added ARP Poisoning Detection for Cisco Devices --- detections/detect_arp_poisoning.yml | 45 +++++++++++++++++++ macros/detect_arp_poisoning_output_filter.yml | 3 ++ 2 files changed, 48 insertions(+) create mode 100644 detections/detect_arp_poisoning.yml create mode 100644 macros/detect_arp_poisoning_output_filter.yml diff --git a/detections/detect_arp_poisoning.yml b/detections/detect_arp_poisoning.yml new file mode 100644 index 0000000000..a6c07a4459 --- /dev/null +++ b/detections/detect_arp_poisoning.yml @@ -0,0 +1,45 @@ +name: Detect ARP Poisoning +id: b44bebd6-bd39-467b-9321-73971bcd7aac +version: 1 +date: '2020-08-11' +description: By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organization's + network devices, we will be able to detect ARP Poisoning attacks in the Infrastructure. +how_to_implement: This search uses a standard SPL query on logs from Cisco Network + devices. The network devices must be configured with DHCP Snooping + (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html) + and Dynamic ARP Inspection + (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-2_2_e/security/configuration_guide/b_sec_1522e_2960x_cg/b_sec_1522e_2960x_cg_chapter_01111.html) + and log with a severity level of minimum "5 - notification". + The search also requires that the Cisco Networks Add-on for Splunk + (https://splunkbase.splunk.com/app/1467) is used to + parse the logs from the Cisco network devices. +type: ESCU +references: [] +author: Mikael Bjerkeland, Splunk +search: '`cisco_ios` facility="PM" mnemonic="ERR_DISABLE" disable_cause="arp-inspection" + | stats min(_time) AS firstTime max(_time) AS lastTime count + BY host src_interface + | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| + `detect_arp_poisoning_output_filter`' +known_false_positives: This search might be prone to high false positives if + DHCP Snooping or ARP inspection has been incorrectly configured, + or if a device normally sends many ARP packets (unlikely). +tags: + analytics_story: + - Router and Infrastructure Security + kill_chain_phases: + - Reconnaissance + - Delivery + - Actions on Objectives + mitre_attack_id: + - T1200 + - T1498 + - T1557 + cis20: + - CIS 1 + - CIS 11 + nist: + - ID.AM + - PR.DS + security_domain: network + asset_type: Infrastructure diff --git a/macros/detect_arp_poisoning_output_filter.yml b/macros/detect_arp_poisoning_output_filter.yml new file mode 100644 index 0000000000..af3470e6c9 --- /dev/null +++ b/macros/detect_arp_poisoning_output_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Use this macro to add additional filters to prevent i.e. false positives +name: detect_arp_poisoning_output_filter From d820c2d914e5f0bb90b803349769343f008f0068 Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Wed, 12 Aug 2020 23:21:43 +0200 Subject: [PATCH 05/17] Retrying --- ...ue_dhcp_server_in_network.yml => detect_rogue_dhcp_server.yml} | 0 ...t_arp_poisoning_output_filter.yml => detect_arp_poisoning.yml} | 0 ...dhcp_server_output_filter.yml => detect_rogue_dhcp_server.yml} | 0 3 files changed, 0 insertions(+), 0 deletions(-) rename detections/{detect_rogue_dhcp_server_in_network.yml => detect_rogue_dhcp_server.yml} (100%) rename macros/{detect_arp_poisoning_output_filter.yml => detect_arp_poisoning.yml} (100%) rename macros/{detect_rogue_dhcp_server_output_filter.yml => detect_rogue_dhcp_server.yml} (100%) diff --git a/detections/detect_rogue_dhcp_server_in_network.yml b/detections/detect_rogue_dhcp_server.yml similarity index 100% rename from detections/detect_rogue_dhcp_server_in_network.yml rename to detections/detect_rogue_dhcp_server.yml diff --git a/macros/detect_arp_poisoning_output_filter.yml b/macros/detect_arp_poisoning.yml similarity index 100% rename from macros/detect_arp_poisoning_output_filter.yml rename to macros/detect_arp_poisoning.yml diff --git a/macros/detect_rogue_dhcp_server_output_filter.yml b/macros/detect_rogue_dhcp_server.yml similarity index 100% rename from macros/detect_rogue_dhcp_server_output_filter.yml rename to macros/detect_rogue_dhcp_server.yml From cc4d23469cf5865d8ae9941d0060fef529be223d Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Wed, 12 Aug 2020 23:26:26 +0200 Subject: [PATCH 06/17] . --- detections/detect_rogue_dhcp_server.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/detect_rogue_dhcp_server.yml b/detections/detect_rogue_dhcp_server.yml index 407c348131..ad27e4669f 100644 --- a/detections/detect_rogue_dhcp_server.yml +++ b/detections/detect_rogue_dhcp_server.yml @@ -1,4 +1,4 @@ -name: Detect Rogue DHCP Server in Network +name: Detect Rogue DHCP Server id: 6e1ada88-7a0d-4ac1-92c6-03d354686079 version: 1 date: '2020-08-11' @@ -15,11 +15,11 @@ how_to_implement: This search uses a standard SPL query on logs from Cisco Netwo type: ESCU references: [] author: Mikael Bjerkeland, Splunk -search: '`cisco_ios` facility="DHCP_SNOOPING" mnemonic="DHCP_SNOOPING_UNTRUSTED_PORT" +search: '`cisco_networks` facility="DHCP_SNOOPING" mnemonic="DHCP_SNOOPING_UNTRUSTED_PORT" | stats min(_time) AS firstTime max(_time) AS lastTime count values(message_type) AS message_type values(src_mac) AS src_mac BY host | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| - `detect_rogue_dhcp_server_output_filter`' + `detect_rogue_dhcp_server`' known_false_positives: This search might be prone to high false positives if DHCP Snooping has been incorrectly configured or in the unlikely event that the DHCP server has been moved to another network interface. From ff4cf63e3e13ed0153b7ad77875a29060100d992 Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Wed, 12 Aug 2020 23:26:57 +0200 Subject: [PATCH 07/17] Fixed up my mistakes. Should hopefully validate now --- detections/detect_arp_poisoning.yml | 4 ++-- macros/detect_arp_poisoning.yml | 2 +- macros/detect_rogue_dhcp_server.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/detect_arp_poisoning.yml b/detections/detect_arp_poisoning.yml index a6c07a4459..3162cb1dcf 100644 --- a/detections/detect_arp_poisoning.yml +++ b/detections/detect_arp_poisoning.yml @@ -16,11 +16,11 @@ how_to_implement: This search uses a standard SPL query on logs from Cisco Netwo type: ESCU references: [] author: Mikael Bjerkeland, Splunk -search: '`cisco_ios` facility="PM" mnemonic="ERR_DISABLE" disable_cause="arp-inspection" +search: '`cisco_networks` facility="PM" mnemonic="ERR_DISABLE" disable_cause="arp-inspection" | stats min(_time) AS firstTime max(_time) AS lastTime count BY host src_interface | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| - `detect_arp_poisoning_output_filter`' + `detect_arp_poisoning`' known_false_positives: This search might be prone to high false positives if DHCP Snooping or ARP inspection has been incorrectly configured, or if a device normally sends many ARP packets (unlikely). diff --git a/macros/detect_arp_poisoning.yml b/macros/detect_arp_poisoning.yml index af3470e6c9..abbaba25fc 100644 --- a/macros/detect_arp_poisoning.yml +++ b/macros/detect_arp_poisoning.yml @@ -1,3 +1,3 @@ definition: search * description: Use this macro to add additional filters to prevent i.e. false positives -name: detect_arp_poisoning_output_filter +name: detect_arp_poisoning diff --git a/macros/detect_rogue_dhcp_server.yml b/macros/detect_rogue_dhcp_server.yml index a52c2fcc96..c552c6d584 100644 --- a/macros/detect_rogue_dhcp_server.yml +++ b/macros/detect_rogue_dhcp_server.yml @@ -1,3 +1,3 @@ definition: search * description: Use this macro to add additional filters to prevent i.e. false positives -name: detect_rogue_dhcp_server_output_filter +name: detect_rogue_dhcp_server From 289cec6fdeb0bd65e64812a1ba84109173633579 Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Wed, 12 Aug 2020 23:32:48 +0200 Subject: [PATCH 08/17] Now validating? --- detections/detect_arp_poisoning.yml | 2 +- detections/detect_rogue_dhcp_server.yml | 2 +- ...detect_arp_poisoning.yml => detect_arp_poisoning_filter.yml} | 2 +- ...ogue_dhcp_server.yml => detect_rogue_dhcp_server_filter.yml} | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) rename macros/{detect_arp_poisoning.yml => detect_arp_poisoning_filter.yml} (75%) rename macros/{detect_rogue_dhcp_server.yml => detect_rogue_dhcp_server_filter.yml} (73%) diff --git a/detections/detect_arp_poisoning.yml b/detections/detect_arp_poisoning.yml index 3162cb1dcf..38afb9fdcb 100644 --- a/detections/detect_arp_poisoning.yml +++ b/detections/detect_arp_poisoning.yml @@ -20,7 +20,7 @@ search: '`cisco_networks` facility="PM" mnemonic="ERR_DISABLE" disable_cause="ar | stats min(_time) AS firstTime max(_time) AS lastTime count BY host src_interface | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| - `detect_arp_poisoning`' + `detect_arp_poisoning_filter`' known_false_positives: This search might be prone to high false positives if DHCP Snooping or ARP inspection has been incorrectly configured, or if a device normally sends many ARP packets (unlikely). diff --git a/detections/detect_rogue_dhcp_server.yml b/detections/detect_rogue_dhcp_server.yml index ad27e4669f..5f6dfae79d 100644 --- a/detections/detect_rogue_dhcp_server.yml +++ b/detections/detect_rogue_dhcp_server.yml @@ -19,7 +19,7 @@ search: '`cisco_networks` facility="DHCP_SNOOPING" mnemonic="DHCP_SNOOPING_UNTRU | stats min(_time) AS firstTime max(_time) AS lastTime count values(message_type) AS message_type values(src_mac) AS src_mac BY host | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| - `detect_rogue_dhcp_server`' + `detect_rogue_dhcp_server_filter`' known_false_positives: This search might be prone to high false positives if DHCP Snooping has been incorrectly configured or in the unlikely event that the DHCP server has been moved to another network interface. diff --git a/macros/detect_arp_poisoning.yml b/macros/detect_arp_poisoning_filter.yml similarity index 75% rename from macros/detect_arp_poisoning.yml rename to macros/detect_arp_poisoning_filter.yml index abbaba25fc..93706055bb 100644 --- a/macros/detect_arp_poisoning.yml +++ b/macros/detect_arp_poisoning_filter.yml @@ -1,3 +1,3 @@ definition: search * description: Use this macro to add additional filters to prevent i.e. false positives -name: detect_arp_poisoning +name: detect_arp_poisoning_filter diff --git a/macros/detect_rogue_dhcp_server.yml b/macros/detect_rogue_dhcp_server_filter.yml similarity index 73% rename from macros/detect_rogue_dhcp_server.yml rename to macros/detect_rogue_dhcp_server_filter.yml index c552c6d584..accfe2bbaf 100644 --- a/macros/detect_rogue_dhcp_server.yml +++ b/macros/detect_rogue_dhcp_server_filter.yml @@ -1,3 +1,3 @@ definition: search * description: Use this macro to add additional filters to prevent i.e. false positives -name: detect_rogue_dhcp_server +name: detect_rogue_dhcp_server_filter From 897d25a7f874d2b606246844c731f76d54edb67b Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Wed, 12 Aug 2020 23:45:53 +0200 Subject: [PATCH 09/17] Present times in ISO8601 instead of US style --- macros/security_content_ctime.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/macros/security_content_ctime.yml b/macros/security_content_ctime.yml index 716c440c77..3c18a1d7af 100644 --- a/macros/security_content_ctime.yml +++ b/macros/security_content_ctime.yml @@ -1,5 +1,5 @@ arguments: - field -definition: 'convert timeformat="%m/%d/%Y %H:%M:%S" ctime($field$)' +definition: 'convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)' description: convert epoch time to string name: security_content_ctime From 584ef0aff9ebc69ee3f2a65c061768ebd44394f2 Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Fri, 14 Aug 2020 22:59:11 +0200 Subject: [PATCH 10/17] Updates --- deployments/11_detect_arp_poisoning.yml | 22 ++++++++++++++++++++++ deployments/12_detect_dhcp_poisoning.yml | 23 +++++++++++++++++++++++ detections/detect_arp_poisoning.yml | 3 +++ detections/detect_rogue_dhcp_server.yml | 1 + 4 files changed, 49 insertions(+) create mode 100644 deployments/11_detect_arp_poisoning.yml create mode 100644 deployments/12_detect_dhcp_poisoning.yml diff --git a/deployments/11_detect_arp_poisoning.yml b/deployments/11_detect_arp_poisoning.yml new file mode 100644 index 0000000000..8977dbf0c1 --- /dev/null +++ b/deployments/11_detect_arp_poisoning.yml @@ -0,0 +1,22 @@ +name: Detect ARP Poisoning deployment configuration +id: e1d5b4dc-4cf3-404f-905c-b478bbb20474 +date: '2020-08-14' +description: This configuration file applies to the Detect ARP Poisoning detection +author: Mikael Bjerkeland +scheduling: + cron_schedule: '59 * * * *' + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto +alert_action: + notable: + rule_description: 'ARP Poisoning has been detected on interface $src_interface$ on host $host$. + This may be an indication of a MITM attack.' + rule_title: 'ARP Poisoning Detected on $host$' + nes_fields: + - src_interface + - firstTime + - lastTime + - count +tags: + detection_name: Detect ARP Poisoning diff --git a/deployments/12_detect_dhcp_poisoning.yml b/deployments/12_detect_dhcp_poisoning.yml new file mode 100644 index 0000000000..9c9addf118 --- /dev/null +++ b/deployments/12_detect_dhcp_poisoning.yml @@ -0,0 +1,23 @@ +name: Detect Rogue DHCP Server deployment configuration +id: 6e4e20ac-e719-4ebe-a52d-d672cd451dbb +date: '2020-08-14' +description: This configuration file applies to the Detect Rogue DHCP Server detection +author: Mikael Bjerkeland +scheduling: + cron_schedule: '59 * * * *' + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto +alert_action: + notable: + rule_description: 'DHCP Snooping has detected a Rogue DHCP Server on $host$ from $src_mac$. + This may be an indication of a MITM attack.' + rule_title: 'Rogue DHCP Server Detected on $host$' + nes_fields: + - src_mac + - firstTime + - lastTime + - count + - message_type +tags: + detection_name: Detect Rogue DHCP Server diff --git a/detections/detect_arp_poisoning.yml b/detections/detect_arp_poisoning.yml index 38afb9fdcb..2a447af268 100644 --- a/detections/detect_arp_poisoning.yml +++ b/detections/detect_arp_poisoning.yml @@ -17,6 +17,7 @@ type: ESCU references: [] author: Mikael Bjerkeland, Splunk search: '`cisco_networks` facility="PM" mnemonic="ERR_DISABLE" disable_cause="arp-inspection" + | eval src_interface=src_int_prefix_long+src_int_suffix | stats min(_time) AS firstTime max(_time) AS lastTime count BY host src_interface | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| @@ -41,5 +42,7 @@ tags: nist: - ID.AM - PR.DS + detection_name: Detect ARP Poisoning security_domain: network asset_type: Infrastructure + diff --git a/detections/detect_rogue_dhcp_server.yml b/detections/detect_rogue_dhcp_server.yml index 5f6dfae79d..afd91c41ed 100644 --- a/detections/detect_rogue_dhcp_server.yml +++ b/detections/detect_rogue_dhcp_server.yml @@ -40,5 +40,6 @@ tags: nist: - ID.AM - PR.DS + detection_name: Detect Rogue DHCP Server security_domain: network asset_type: Infrastructure From 4c7cb2488cfa67a3da7769cbb74b89cab0d8757d Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Fri, 14 Aug 2020 23:08:02 +0200 Subject: [PATCH 11/17] Polish --- deployments/11_detect_arp_poisoning.yml | 4 ++-- deployments/12_detect_dhcp_poisoning.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/deployments/11_detect_arp_poisoning.yml b/deployments/11_detect_arp_poisoning.yml index 8977dbf0c1..669772a8e8 100644 --- a/deployments/11_detect_arp_poisoning.yml +++ b/deployments/11_detect_arp_poisoning.yml @@ -10,9 +10,9 @@ scheduling: schedule_window: auto alert_action: notable: - rule_description: 'ARP Poisoning has been detected on interface $src_interface$ on host $host$. + rule_description: 'ARP Poisoning has been detected on interface $src_interface$ on host $orig_host$. This may be an indication of a MITM attack.' - rule_title: 'ARP Poisoning Detected on $host$' + rule_title: 'ARP Poisoning Detected on $orig_host$' nes_fields: - src_interface - firstTime diff --git a/deployments/12_detect_dhcp_poisoning.yml b/deployments/12_detect_dhcp_poisoning.yml index 9c9addf118..a01cdc431d 100644 --- a/deployments/12_detect_dhcp_poisoning.yml +++ b/deployments/12_detect_dhcp_poisoning.yml @@ -10,9 +10,9 @@ scheduling: schedule_window: auto alert_action: notable: - rule_description: 'DHCP Snooping has detected a Rogue DHCP Server on $host$ from $src_mac$. + rule_description: 'DHCP Snooping has detected a Rogue DHCP Server on $orig_host$ from $src_mac$. This may be an indication of a MITM attack.' - rule_title: 'Rogue DHCP Server Detected on $host$' + rule_title: 'Rogue DHCP Server Detected on $orig_host$' nes_fields: - src_mac - firstTime From 00f51defe8530e972bef7e6b70ec4495b7f89f14 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 19 Aug 2020 14:37:01 -0700 Subject: [PATCH 12/17] shannons PR bug fixes --- ...etect_gcp_storage_access_from_a_new_ip.yml | 48 +++++++++++++++++++ .../detect_new_open_gcp_storage_buckets.yml | 39 +++++++++++++++ stories/suspicious_gcp_storage_activities.yml | 23 +++++++++ 3 files changed, 110 insertions(+) create mode 100644 detections/detect_gcp_storage_access_from_a_new_ip.yml create mode 100644 detections/detect_new_open_gcp_storage_buckets.yml create mode 100644 stories/suspicious_gcp_storage_activities.yml diff --git a/detections/detect_gcp_storage_access_from_a_new_ip.yml b/detections/detect_gcp_storage_access_from_a_new_ip.yml new file mode 100644 index 0000000000..ab57ad4e4b --- /dev/null +++ b/detections/detect_gcp_storage_access_from_a_new_ip.yml @@ -0,0 +1,48 @@ +name: Detect GCP Storage access from a new IP +id: ccc3246a-daa1-11ea-87d0-0242ac130022 +version: 1 +date: '2020-08-10' +description: This search looks at GCP Storage bucket-access logs and detects new or previously + unseen remote IP addresses that have successfully accessed a GCP Storage bucket. +how_to_implement: This search relies on the Splunk Add-on for Google Cloud Platform, setting up a Cloud Pub/Sub input, along with the relevant GCP PubSub topics and logging sink to capture GCP Storage Bucket events (https://cloud.google.com/logging/docs/routing/overview). In order to capture public GCP Storage Bucket access logs, you must also enable storage bucket logging to your PubSub Topic as per https://cloud.google.com/storage/docs/access-logs. These logs are deposited into the nominated Storage Bucket on an hourly basis and typically show up by 15 minutes past the hour. It is recommended to configure any saved searches or correlation searches in Enterprise Security to run on an hourly basis at 30 minutes past the hour (cron definition of 30 * * * *). A lookup table (previously_seen_gcp_storage_access_from_remote_ip.csv) stores the previously seen access requests, and is used by this search to determine any newly seen IP addresses accessing the Storage Buckets. +type: ESCU +references: [] +author: Shannon Davis, Splunk +search: '`google_gcp_pubsub_message` +| multikv +| rename sc_status_ as status +| rename cs_object_ as bucket_name +| rename c_ip_ as remote_ip +| rename cs_uri_ as request_uri +| rename cs_method_ as operation +| search status="\"200\"" +| stats earliest(_time) as firstTime latest(_time) as lastTime by bucket_name remote_ip operation request_uri +| table firstTime, lastTime, bucket_name, remote_ip, operation, request_uri +| inputlookup append=t previously_seen_gcp_storage_access_from_remote_ip.csv +| stats min(firstTime) as firstTime, max(lastTime) as lastTime by bucket_name remote_ip operation request_uri +| outputlookup previously_seen_gcp_storage_access_from_remote_ip.csv +| eval newIP=if(firstTime >= relative_time(now(),"-70m@m"), 1, 0) +| where newIP=1 +| eval first_time=strftime(firstTime,"%m/%d/%y %H:%M:%S") +| eval last_time=strftime(lastTime,"%m/%d/%y %H:%M:%S") +| table first_time last_time bucket_name remote_ip operation request_uri +| `detect_gcp_storage_access_from_a_new_ip_filter`' +known_false_positives: GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow it), + as long as it can make a successful connection. This will be a false postive, since the search is looking + for a new IP within the past two hours. +tags: + analytics_story: + - Suspicious GCP Storage Activities + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1530 + cis20: + - CIS 13 + - CIS 14 + nist: + - PR.DS + - PR.AC + - DE.CM + security_domain: network + asset_type: GCP Storage Bucket \ No newline at end of file diff --git a/detections/detect_new_open_gcp_storage_buckets.yml b/detections/detect_new_open_gcp_storage_buckets.yml new file mode 100644 index 0000000000..50987b2983 --- /dev/null +++ b/detections/detect_new_open_gcp_storage_buckets.yml @@ -0,0 +1,39 @@ +name: Detect New Open GCP Storage Buckets +id: f6ea3466-d6bb-11ea-87d0-0242ac130003 +version: 1 +date: '2020-08-05' +description: This search looks for GCP PubSub events where a user has created an open/public GCP Storage bucket. +how_to_implement: 'This search relies on the Splunk Add-on for Google Cloud Platform, setting up a Cloud Pub/Sub input, along with the relevant GCP PubSub topics and logging sink to capture GCP Storage Bucket events (https://cloud.google.com/logging/docs/routing/overview).' +type: ESCU +references: [] +author: Shannon Davis, Splunk +search: '`google_gcp_pubsub_message` data.resource.type=gcs_bucket data.protoPayload.methodName=storage.setIamPermissions +| spath output=action path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.action +| spath output=user path=data.protoPayload.authenticationInfo.principalEmail +| spath output=location path=data.protoPayload.resourceLocation.currentLocations{} +| spath output=src path=data.protoPayload.requestMetadata.callerIp +| spath output=bucketName path=data.protoPayload.resourceName +| spath output=role path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.role +| spath output=member path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.member +| search (member=allUsers AND action=ADD) +| table _time, bucketName, src, user, location, action, role, member +| search `detect_new_open_gcp_storage_buckets_filter`' +known_false_positives: While this search has no known false positives, it is possible + that a GCP admin has legitimately created a public bucket for a specific purpose. + That said, GCP strongly advises against granting full control to the "allUsers" + group. +tags: + analytics_story: + - Suspicious GCP Storage Activities + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1530 + cis20: + - CIS 13 + nist: + - PR.DS + - PR.AC + - DE.CM + security_domain: network + asset_type: GCP Storage Bucket \ No newline at end of file diff --git a/stories/suspicious_gcp_storage_activities.yml b/stories/suspicious_gcp_storage_activities.yml new file mode 100644 index 0000000000..4024a43e26 --- /dev/null +++ b/stories/suspicious_gcp_storage_activities.yml @@ -0,0 +1,23 @@ +name: Suspicious GCP Storage Activities +id: 4d656b2e-d6be-11ea-87d0-0242ac130003 +version: 1 +date: '2020-08-05' +description: Use the searches in this Analytic Story to monitor your GCP Storage buckets + for evidence of anomalous activity and suspicious behaviors, such as detecting open + storage buckets and buckets being accessed from a new IP. The contextual and investigative + searches will give you more information, when required. +narrative: 'Similar to other cloud providers, GCP operates on a shared responsibility model. + This means the end user, you, are responsible for setting appropriate access control lists + and permissions on your GCP resources.\ + This Analytics Story concentrates on detecting things like open storage buckets (both read and write) + along with storage bucket access from unfamiliar users and IP addresses.' +author: Shannon Davis, Splunk +type: ESCU +references: +- https://cloud.google.com/blog/products/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security +- https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/ +tags: + analytics_story: Suspicious GCP Storage Activities + usecase: Security Monitoring + category: + - Cloud Security \ No newline at end of file From 31a332bb9b8855f187d96ecf12167bdd21de928f Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 19 Aug 2020 14:39:24 -0700 Subject: [PATCH 13/17] adding story to response --- response_tasks/get_notable_info.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/response_tasks/get_notable_info.yml b/response_tasks/get_notable_info.yml index 91a66fbd5d..e6aa2727cd 100644 --- a/response_tasks/get_notable_info.yml +++ b/response_tasks/get_notable_info.yml @@ -71,3 +71,4 @@ tags: - Kubernetes Sensitive Object Access Activity - F5 TMUI RCE CVE-2020-5902 - Windows DNS SIGRed CVE-2020-1350 + - Suspicious GCP Storage Activities From c0c6c4db9785776a8d7b9abe71b7fc73d6575a9f Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Thu, 20 Aug 2020 16:39:25 -0400 Subject: [PATCH 14/17] newfixawsdetectpkey --- detections/aws_detect_permanent_key_creation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/aws_detect_permanent_key_creation.yml b/detections/aws_detect_permanent_key_creation.yml index 7a87ba7621..5637090c3d 100644 --- a/detections/aws_detect_permanent_key_creation.yml +++ b/detections/aws_detect_permanent_key_creation.yml @@ -6,7 +6,7 @@ id: 12d6d713-3cb4-4ffc-a064-1dca3d1cca01 known_false_positives: "Not all permanent key creations are malicious. If there is a policy of rotating keys this search can be adjusted to provide better context." name: "aws detect permanent key creation" references: [] -search: '`aws_cloudwatchlogs_eks` AKIA | spath eventName | search eventName=CreateAccessKey "userIdentity.type!=AssumedRole" | table sourceIPAddress userName src_user userIdentity.type userAgent action status responseElements.accessKey.createDate responseElements.accessKey.status responseElements.accessKey.accessKeyId +search: '`aws_cloudwatchlogs_eks` CreateAccessKey | spath eventName | search eventName=CreateAccessKey "userIdentity.type"=IAMUser | table sourceIPAddress userName userIdentity.type userAgent action status responseElements.accessKey.createDate responseElements.accessKey.status responseElements.accessKey.accessKeyId |`aws_detect_permanent_key_creation_filter`' tags: analytics_story: From fb69d6f6c487fed700a875ef23963ab981c7d150 Mon Sep 17 00:00:00 2001 From: divious1 Date: Sat, 22 Aug 2020 01:18:14 -0400 Subject: [PATCH 15/17] updated both maps fixed errors with coverage --- README.md | 2 +- bin/generate-actors-map.py | 26 +- bin/generate-coverage-map.py | 30 +- docs/mitre-map/coverage.csv | 179869 +++++++++++- docs/mitre-map/coverage.json | 220777 ++++++++++++++- docs/mitre-map/coverage.png | Bin 635104 -> 999341 bytes docs/mitre-map/detections.csv | 105987 ++++++- docs/mitre-map/detections.json | 440863 +++++++++++++++++++++++++++++- docs/mitre-map/priority.png | Bin 784752 -> 821644 bytes 9 files changed, 945491 insertions(+), 2063 deletions(-) diff --git a/README.md b/README.md index 1c4b42f2e0..87c4b6c262 100644 --- a/README.md +++ b/README.md @@ -30,7 +30,7 @@ Create your customized version of Security Content by forking this project and f # MITRE ATT&CK ### Detection Coverage -To view an up-to-date detection coverage map for all the content tagged with MITRE techniques visit: [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/) under the **Detection Coverage** layer. Below is a snapshot in time of what we are covering. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security-content/blob/mitre_maps/bin/generate-coverage-map.py). +To view an up-to-date detection coverage map for all the content tagged with MITRE techniques visit: [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/) under the **Detection Coverage** layer. Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security-content/blob/mitre_maps/bin/generate-coverage-map.py). ![](docs/mitre-map/coverage.png) diff --git a/bin/generate-actors-map.py b/bin/generate-actors-map.py index 0a31b505c9..936b7c0bbb 100644 --- a/bin/generate-actors-map.py +++ b/bin/generate-actors-map.py @@ -20,8 +20,8 @@ def main(argv): # parse input variables parser = argparse.ArgumentParser(description='Detection Priority based on APT groups') - parser.add_argument('--projects_path', default='.', action='store', metavar='N', help='folder containing the projects Mitre Cyber Threat Intelligence Repository, Security Content and Sigma') - parser.add_argument('--output', default='output', action='store', help='result output directory, defaults to output') + parser.add_argument('-p', '--projects_path', default='.', action='store', metavar='N', help='folder containing the projects Mitre Cyber Threat Intelligence Repository, Security Content and Sigma') + parser.add_argument('-o', '--output', default='output', action='store', help='result output directory, defaults to output') cmdargs = parser.parse_args() print("get all techniques for group") @@ -45,6 +45,7 @@ def main(argv): def count_techniques(techniques, all_techniques): counted_techniques = [] + final_counted_techniques = [] max_count = 0 actors = [] @@ -54,7 +55,15 @@ def count_techniques(techniques, all_techniques): counted_techniques.append({'name': all_technique['name'], 'object': all_technique, 'count': count_technique}) max_count = count_technique if count_technique > max_count else max_count - counted_techniques = sorted(counted_techniques, key = lambda i: i['count'], reverse=True) + for all_technique in all_techniques: + if "." in all_technique["external_references"][0]["external_id"]: + parent_id = all_technique["external_references"][0]["external_id"].split(".")[0] + for counted in counted_techniques: + if parent_id == counted["object"]["external_references"][0]["external_id"]: + counted['count'] += 1 + final_counted_techniques.append(counted) + + counted_techniques = sorted(final_counted_techniques, key = lambda i: i['count'], reverse=True) return counted_techniques, max_count @@ -131,13 +140,16 @@ def generate_navigator_layer(matched_techniques, max_count, output): for technique in matched_techniques: comments = [] + layer_technique = { + "techniqueID": technique["ID"], + "score" : technique["score"], + "showSubtechniques": True + } + + if len(technique["splunk_rules"]) > 0: for splunk_rule in technique["splunk_rules"]: comments.append("https://github.com/splunk/security-content/blob/develop/detections/" + splunk_rule['filename']) - layer_technique = { - "techniqueID": technique["ID"], - "score" : technique["score"] - } if len(comments) > 0: layer_technique["comment"] = "\n\n".join(comments) diff --git a/bin/generate-coverage-map.py b/bin/generate-coverage-map.py index 8a51cb3700..1229816b4a 100644 --- a/bin/generate-coverage-map.py +++ b/bin/generate-coverage-map.py @@ -20,14 +20,14 @@ def main(argv): # parse input variables parser = argparse.ArgumentParser(description='Detection Coverage') - parser.add_argument('--projects_path', default='.', action='store', metavar='N', help='folder containing the projects Mitre Cyber Threat Intelligence Repository, Security Content and Sigma') - parser.add_argument('--output', default='output', action='store', help='result output directory, defaults to output') + parser.add_argument('-p', '--projects_path', default='.', action='store', metavar='N', help='folder containing the projects Mitre Cyber Threat Intelligence Repository, Security Content and Sigma') + parser.add_argument('-o', '--output', default='output', action='store', help='result output directory, defaults to output') cmdargs = parser.parse_args() print("get all techniques") techniques = get_all_techniques(cmdargs.projects_path) - print("count techniques") + print("load detections") detections = load_objects(path.join(cmdargs.projects_path),'detections/*.yml') print("get matched techniques") @@ -45,6 +45,7 @@ def main(argv): def count_detections(matched_techniques): scored_detections = [] + final_scored_detections = [] max_count = 0 for technique in matched_techniques: @@ -52,7 +53,16 @@ def count_detections(matched_techniques): technique['score'] = len(technique['splunk_rules']) max_count = technique['score'] if technique['score'] > max_count else max_count scored_detections.append(technique) - return scored_detections, max_count + + for technique in matched_techniques: + if "." in technique['ID']: + parent_id = technique['ID'].split(".")[0] + for scored in scored_detections: + if parent_id == scored['ID']: + scored['score'] += len(technique['splunk_rules']) + final_scored_detections.append(scored) + + return final_scored_detections, max_count def get_all_techniques(projects_path): @@ -108,6 +118,7 @@ def generate_navigator_layer(matched_techniques, max_count, output): layer_technique = { "techniqueID": technique["ID"], "score" : technique["score"] + } else: layer_technique = {} @@ -120,11 +131,12 @@ def generate_navigator_layer(matched_techniques, max_count, output): # ranging from zero (white) to the maximum score in the file (red) layer_json["gradient"] = { "colors": [ - "##ffffff", - "#8ec843" + "#ffffff", + "#66b1ff", + "#096ed7" ], "minValue": 0, - "maxValue": 0 + "maxValue": max_count } layer_json["filters"] = { @@ -146,8 +158,8 @@ def generate_navigator_layer(matched_techniques, max_count, output): "color": "#ffffff" }, { - "label": "Available detections", - "color": "#8ec843" + "label": "Some detections available", + "color": "#66b1ff" } ] diff --git a/docs/mitre-map/coverage.csv b/docs/mitre-map/coverage.csv index 4e2d935f4d..5322c53c44 100644 --- a/docs/mitre-map/coverage.csv +++ b/docs/mitre-map/coverage.csv @@ -1,660 +1,179249 @@ Technique ID,Detection Available,Link,score -T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 -T1102,No,-,0 -T1059.002,No,-,0 -T1009,No,-,0 -T1027.005,No,-,0 -T1495,No,-,0 -T1568,No,-,0 -T1050,No,-,0 -T1567,No,-,0 -T1011.001,No,-,0 -T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,1 -T1003.005,No,-,0 -T1110.002,No,-,0 -T1130,No,-,0 -T1542.001,No,-,0 -T1124,No,-,0 -T1215,No,-,0 -T1164,No,-,0 -T1501,No,-,0 -T1556,No,-,0 -T1176,No,-,0 -T1020,No,-,0 -T1205,No,-,0 -T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 -T1011,No,-,0 -T1018,No,-,0 -T1552.003,No,-,0 -T1053.002,No,-,0 -T1206,No,-,0 -T1107,No,-,0 -T1070.002,No,-,0 -T1570,No,-,0 -T1550.004,No,-,0 -T1110.001,No,-,0 -T1218.010,No,-,0 -T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 -T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 -T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 -T1014,No,-,0 -T1074.002,No,-,0 -T1499.001,No,-,0 -T1558.001,No,-,0 -T1192,No,-,0 -T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 -T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 -T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 -T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 -T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 -T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 -T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 -T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 -T1118,No,-,0 -T1195,No,-,0 -T1042,No,-,0 -T1218.004,No,-,0 -T1498,No,-,0 -T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 -T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 -T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 -T1548.004,No,-,0 -T1574.010,No,-,0 -T1035,No,-,0 -T1061,No,-,0 -T1175,No,-,0 -T1547.008,No,-,0 -T1183,No,-,0 -T1110.004,No,-,0 -T1134.003,No,-,0 -T1037.002,No,-,0 -T1148,No,-,0 -T1064,No,-,0 -T1165,No,-,0 -T1559,No,-,0 -T1546,No,-,0 -T1574,No,-,0 -T1187,No,-,0 -T1046,No,-,0 -T1106,No,-,0 -T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 -T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1493,No,-,0 -T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 -T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 -T1218.002,No,-,0 -T1563.001,No,-,0 -T1565,No,-,0 -T1070.004,No,-,0 -T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 -T1537,No,-,0 -T1218.009,No,-,0 -T1480,No,-,0 -T1218.005,No,-,0 -T1219,No,-,0 -T1025,No,-,0 -T1032,No,-,0 -T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 -T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,1 -T1029,No,-,0 -T1087,No,-,0 -T1184,No,-,0 -T1189,No,-,0 -T1002,No,-,0 -T1113,No,-,0 -T1561.001,No,-,0 -T1562.002,No,-,0 -T1547.007,No,-,0 -T1127,No,-,0 -T1186,No,-,0 -T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,1 -T1216,No,-,0 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 -T1555.001,No,-,0 -T1063,No,-,0 -T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 -T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 -T1562.007,No,-,0 -T1069.003,No,-,0 -T1137,No,-,0 -T1114.003,No,-,0 -T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 -T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 -T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 -T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 -T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 -T1098.004,No,-,0 -T1487,No,-,0 -T1132.001,No,-,0 -T1177,No,-,0 -T1134,No,-,0 -T1017,No,-,0 -T1059.005,No,-,0 -T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 -T1131,No,-,0 -T1055.003,No,-,0 -T1195.003,No,-,0 -T1548,No,-,0 -T1027.004,No,-,0 -T1077,No,-,0 -T1217,No,-,0 -T1557.001,No,-,0 -T1547.003,No,-,0 -T1496,No,-,0 -T1578.004,No,-,0 -T1539,No,-,0 -T1059.006,No,-,0 -T1037.003,No,-,0 -T1564.005,No,-,0 -T1126,No,-,0 -T1074,No,-,0 -T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 -T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 -T1001,No,-,0 -T1559.002,No,-,0 -T1223,No,-,0 -T1573.002,No,-,0 -T1090.003,No,-,0 -T1552.005,No,-,0 -T1172,No,-,0 -T1542.003,No,-,0 -T1099,No,-,0 -T1073,No,-,0 -T1574.001,No,-,0 -T1504,No,-,0 -T1213,No,-,0 -T1133,No,-,0 -T1556.001,No,-,0 -T1216.001,No,-,0 -T1055.014,No,-,0 -T1008,No,-,0 -T1208,No,-,0 -T1499.003,No,-,0 -T1569.001,No,-,0 -T1499.004,No,-,0 -T1547.005,No,-,0 -T1076,No,-,0 -T1529,No,-,0 -T1210,No,-,0 -T1052.001,No,-,0 -T1111,No,-,0 -T1102.002,No,-,0 -T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 -T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 -T1559.001,No,-,0 -T1140,No,-,0 -T1055.001,No,-,0 -T1499.002,No,-,0 -T1547.011,No,-,0 -T1211,No,-,0 -T1120,No,-,0 -T1497.003,No,-,0 -T1062,No,-,0 -T1080,No,-,0 -T1137.002,No,-,0 -T1005,No,-,0 -T1069.001,No,-,0 -T1505.001,No,-,0 -T1205.001,No,-,0 -T1560.002,No,-,0 -T1097,No,-,0 -T1045,No,-,0 T1568.001,No,-,0 -T1123,No,-,0 -T1139,No,-,0 -T1166,No,-,0 -T1197,No,-,0 -T1137.001,No,-,0 -T1567.001,No,-,0 -T1104,No,-,0 -T1049,No,-,0 -T1196,No,-,0 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 -T1089,No,-,0 -T1514,No,-,0 -T1560.001,No,-,0 -T1115,No,-,0 -T1528,No,-,0 -T1056.004,No,-,0 -T1218.007,No,-,0 -T1546.010,No,-,0 -T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 -T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 -T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 -T1066,No,-,0 -T1531,No,-,0 -T1110.003,No,-,0 -T1218.001,No,-,0 -T1548.001,No,-,0 -T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 -T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 -T1574.007,No,-,0 -T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 -T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 -T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 -T1505.002,No,-,0 -T1213.001,No,-,0 -T1105,No,-,0 -T1546.005,No,-,0 -T1546.004,No,-,0 -T1055.009,No,-,0 -T1007,No,-,0 -T1564.001,No,-,0 -T1003.008,No,-,0 -T1491.002,No,-,0 -T1546.003,No,-,0 -T1146,No,-,0 -T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 -T1101,No,-,0 -T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 -T1574.002,No,-,0 -T1169,No,-,0 -T1546.012,No,-,0 -T1021.003,No,-,0 -T1209,No,-,0 -T1547.010,No,-,0 -T1167,No,-,0 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 -T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 -T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 -T1056.002,No,-,0 -T1564.006,No,-,0 -T1574.011,No,-,0 -T1573,No,-,0 -T1490,No,-,0 -T1037.005,No,-,0 -T1542.002,No,-,0 -T1188,No,-,0 -T1142,No,-,0 -T1039,No,-,0 -T1543.002,No,-,0 -T1553.002,No,-,0 -T1556.003,No,-,0 -T1547,No,-,0 -T1578,No,-,0 -T1578.001,No,-,0 -T1053.003,No,-,0 -T1561,No,-,0 -T1074.001,No,-,0 -T1151,No,-,0 -T1034,No,-,0 -T1134.005,No,-,0 -T1055.004,No,-,0 -T1543.001,No,-,0 -T1027.003,No,-,0 -T1550.003,No,-,0 -T1564.003,No,-,0 -T1013,No,-,0 -T1518.001,No,-,0 -T1505.003,No,-,0 -T1572,No,-,0 -T1534,No,-,0 -T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 -T1036.002,No,-,0 -T1483,No,-,0 -T1022,No,-,0 -T1574.004,No,-,0 -T1558,No,-,0 -T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 -T1546.009,No,-,0 -T1574.012,No,-,0 -T1218,No,-,0 -T1558.002,No,-,0 -T1036.003,No,-,0 -T1552.004,No,-,0 -T1560,No,-,0 -T1564.002,No,-,0 -T1562.003,No,-,0 -T1135,No,-,0 -T1212,No,-,0 -T1555.003,No,-,0 -T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 -T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,1 -T1546.015,No,-,0 -T1505,No,-,0 -T1059,No,-,0 -T1003.006,No,-,0 -T1114,No,-,0 -T1555.002,No,-,0 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1128,No,-,0 -T1060,No,-,0 -T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 -T1134.004,No,-,0 -T1553,No,-,0 -T1547.004,No,-,0 -T1056,No,-,0 -T1001.003,No,-,0 -T1083,No,-,0 -T1498.001,No,-,0 -T1553.003,No,-,0 -T1093,No,-,0 -T1198,No,-,0 -T1094,No,-,0 -T1218.008,No,-,0 -T1199,No,-,0 -T1090.004,No,-,0 -T1087.003,No,-,0 -T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 -T1055.012,No,-,0 -T1001.002,No,-,0 -T1182,No,-,0 -T1562.006,No,-,0 -T1040,No,-,0 -T1574.006,No,-,0 -T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 -T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 -T1043,No,-,0 -T1174,No,-,0 -T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,1 -T1090.001,No,-,0 -T1546.013,No,-,0 -T1003.007,No,-,0 -T1564.004,No,-,0 -T1168,No,-,0 -T1552,No,-,0 -T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 -T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 -T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 -T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 -T1059.007,No,-,0 -T1162,No,-,0 -T1546.006,No,-,0 -T1087.004,No,-,0 -T1117,No,-,0 -T1087.001,No,-,0 -T1218.003,No,-,0 -T1547.006,No,-,0 -T1055.005,No,-,0 -T1156,No,-,0 -T1001.001,No,-,0 -T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 -T1087.002,No,-,0 -T1491,No,-,0 -T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 -T1053.004,No,-,0 -T1143,No,-,0 -T1037.001,No,-,0 -T1055.011,No,-,0 -T1021,No,-,0 -T1222.002,No,-,0 -T1030,No,-,0 -T1054,No,-,0 -T1568.003,No,-,0 -T1053.001,No,-,0 -T1132,No,-,0 -T1070.006,No,-,0 -T1147,No,-,0 -T1085,No,-,0 -T1173,No,-,0 -T1024,No,-,0 -T1486,No,-,0 -T1181,No,-,0 -T1567.002,No,-,0 -T1573.001,No,-,0 -T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 -T1122,No,-,0 -T1522,No,-,0 -T1121,No,-,0 -T1134.002,No,-,0 -T1557,No,-,0 -T1191,No,-,0 -T1550,No,-,0 -T1546.007,No,-,0 -T1056.003,No,-,0 -T1548.002,No,-,0 -T1565.003,No,-,0 -T1037.004,No,-,0 -T1084,No,-,0 -T1048.002,No,-,0 -T1569,No,-,0 -T1500,No,-,0 -T1563.002,No,-,0 -T1553.001,No,-,0 -T1015,No,-,0 -T1137.005,No,-,0 -T1202,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 T1027.002,No,-,0 -T1144,No,-,0 -T1547.002,No,-,0 -T1149,No,-,0 -T1538,No,-,0 -T1220,No,-,0 -T1489,No,-,0 -T1550.001,No,-,0 -T1556.002,No,-,0 -T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 -T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 -T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 -T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 -T1010,No,-,0 -T1116,No,-,0 -T1574.005,No,-,0 -T1036.004,No,-,0 -T1543.004,No,-,0 -T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 -T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 -T1102.003,No,-,0 -T1482,No,-,0 -T1499,No,-,0 -T1578.002,No,-,0 -T1204.001,No,-,0 -T1194,No,-,0 -T1016,No,-,0 -T1071.003,No,-,0 -T1075,No,-,0 -T1051,No,-,0 -T1160,No,-,0 -T1497.002,No,-,0 -T1163,No,-,0 -T1023,No,-,0 -T1222,No,-,0 -T1561.002,No,-,0 -T1200,No,-,0 -T1055.008,No,-,0 -T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 -T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1518,No,-,0 -T1213.002,No,-,0 -T1031,No,-,0 -T1036.006,No,-,0 -T1152,No,-,0 -T1178,No,-,0 -T1098.001,No,-,0 -T1019,No,-,0 -T1154,No,-,0 -T1185,No,-,0 -T1527,No,-,0 -T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 -T1494,No,-,0 -T1056.001,No,-,0 -T1070.003,No,-,0 -T1096,No,-,0 -T1214,No,-,0 -T1492,No,-,0 -T1021.006,No,-,0 -T1108,No,-,0 -T1180,No,-,0 -T1484,No,-,0 -T1136.002,No,-,0 -T1488,No,-,0 -T1086,No,-,0 -T1055.013,No,-,0 -T1502,No,-,0 -T1044,No,-,0 -T1055,No,-,0 -T1552.001,No,-,0 -T1546.002,No,-,0 -T1157,No,-,0 -T1134.001,No,-,0 -T1574.008,No,-,0 -T1006,No,-,0 -T1090.002,No,-,0 -T1578.003,No,-,0 -T1555,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 T1201,No,-,0 -T1207,No,-,0 -T1021.005,No,-,0 -T1547.009,No,-,0 -T1138,No,-,0 -T1221,No,-,0 -T1125,No,-,0 -T1026,No,-,0 -T1161,No,-,0 -T1070.005,No,-,0 -T1069.002,No,-,0 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 -T1204,No,-,0 -T1195.001,No,-,0 -T1033,No,-,0 -T1110,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 T1037,No,-,0 -T1090,No,-,0 -T1565.002,No,-,0 -T1542,No,-,0 -T1562,No,-,0 -T1568.002,No,-,0 -T1565.001,No,-,0 -T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 -T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 T1052,No,-,0 -T1071,No,-,0 -T1564,No,-,0 -T1503,No,-,0 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 -T1519,No,-,0 -T1158,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 -T1038,No,-,0 -T1004,No,-,0 -T1067,No,-,0 -T1055.002,No,-,0 -T1109,No,-,0 -T1081,No,-,0 -T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 -T1506,No,-,0 -T1098.003,No,-,0 -T1098.002,No,-,0 -T1048.001,No,-,0 -T1137.003,No,-,0 -T1150,No,-,0 -T1057,No,-,0 -T1137.004,No,-,0 -T1103,No,-,0 -T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 -T1195.002,No,-,0 -T1179,No,-,0 -T1058,No,-,0 -T1091,No,-,0 -T1563,No,-,0 -T1021.004,No,-,0 -T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 -T1536,No,-,0 -T1069,No,-,0 -T1036.001,No,-,0 -T1092,No,-,0 -T1129,No,-,0 -T1132.002,No,-,0 -T1159,No,-,0 -T1497.001,No,-,0 -T1065,No,-,0 -T1552.002,No,-,0 -T1560.003,No,-,0 -T1003,No,-,0 -T1170,No,-,0 -T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 -T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 -T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 -T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 -T1136.003,No,-,0 -T1098,No,-,0 -T1491.001,No,-,0 -T1053,No,-,0 -T1027.001,No,-,0 -T1137.006,No,-,0 -T1127.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 -T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1543,No,-,0 -T1171,No,-,0 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 T1059.004,No,-,0 -T1155,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 -T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 -T1153,No,-,0 -T1145,No,-,0 -T1100,No,-,0 -T1079,No,-,0 -T1480.001,No,-,0 -T1552.006,No,-,0 -T1548.003,No,-,0 -T1041,No,-,0 -T1193,No,-,0 -T1036.005,No,-,0 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 T1554,No,-,0 -T1571,No,-,0 -T1102.001,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 T1141,No,-,0 -T1119,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 T1028,No,-,0 -T1497,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json index a07e978f46..b52e18ea73 100644 --- a/docs/mitre-map/coverage.json +++ b/docs/mitre-map/coverage.json @@ -4,24 +4,23 @@ "description": "security-content detection coverage", "domain": "mitre-enterprise", "techniques": [ + {}, + {}, + {}, + {}, { - "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" }, {}, {}, {}, {}, - {}, - {}, - {}, - {}, - {}, { - "techniqueID": "T1078", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" }, {}, {}, @@ -35,27 +34,17 @@ {}, {}, {}, - { - "techniqueID": "T1204.002", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" - }, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, {}, {}, {}, { - "techniqueID": "T1485", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" }, + {}, + {}, + {}, { "techniqueID": "T1114.002", "score": 2, @@ -66,76 +55,72 @@ {}, {}, {}, + {}, + {}, + {}, + {}, + {}, + {}, { - "techniqueID": "T1535", - "score": 8, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml" + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" }, {}, {}, {}, {}, {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, { "techniqueID": "T1546.011", "score": 3, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" }, {}, {}, {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, { - "techniqueID": "T1071.001", + "techniqueID": "T1068", "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" - }, - {}, - { - "techniqueID": "T1021.002", - "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" }, {}, {}, {}, {}, { - "techniqueID": "T1027", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" - }, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - { - "techniqueID": "T1546.001", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" - }, - { - "techniqueID": "T1566", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" }, {}, {}, @@ -148,41 +133,59 @@ {}, {}, {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, { - "techniqueID": "T1070", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, { "techniqueID": "T1059.003", "score": 7, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" }, {}, {}, + {}, + {}, + {}, { - "techniqueID": "T1569.002", + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" - }, - { - "techniqueID": "T1566.003", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" }, {}, {}, {}, {}, - { - "techniqueID": "T1526", - "score": 5, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" - }, - {}, - {}, - {}, {}, {}, {}, @@ -209,123 +212,30 @@ {}, {}, {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, { - "techniqueID": "T1048.003", - "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml" + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" }, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, { - "techniqueID": "T1068", - "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml" - }, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - { - "techniqueID": "T1047", - "score": 6, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml" - }, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - { - "techniqueID": "T1136.001", - "score": 3, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml" - }, - {}, - {}, - {}, - {}, - {}, - { - "techniqueID": "T1095", + "techniqueID": "T1562.004", "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" }, - { - "techniqueID": "T1550.002", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" - }, - {}, - { - "techniqueID": "T1530", - "score": 3, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" - }, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, {}, { "techniqueID": "T1558.003", @@ -334,9 +244,9 @@ }, {}, { - "techniqueID": "T1553.004", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" }, {}, {}, @@ -345,15 +255,118 @@ {}, {}, {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, { "techniqueID": "T1071.004", "score": 7, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" }, + {}, + {}, + {}, { - "techniqueID": "T1203", + "techniqueID": "T1071.001", "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -361,46 +374,19 @@ {}, {}, {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, { - "techniqueID": "T1114.001", + "techniqueID": "T1498.002", "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" }, {}, {}, {}, {}, - {}, { - "techniqueID": "T1222.001", + "techniqueID": "T1553.004", "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" }, {}, {}, @@ -419,10 +405,40 @@ "score": 1, "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, { - "techniqueID": "T1136", + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" }, {}, {}, @@ -430,17 +446,18 @@ {}, {}, {}, - { - "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml" - }, + {}, + {}, + {}, + {}, + {}, + {}, {}, {}, { - "techniqueID": "T1574.009", + "techniqueID": "T1078.002", "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" }, {}, {}, @@ -456,69 +473,113 @@ {}, {}, {}, - {}, - { - "techniqueID": "T1546.008", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" - }, - {}, - {}, - {}, - {}, - {}, - {}, - { - "techniqueID": "T1190", - "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" - }, - {}, - {}, { "techniqueID": "T1048", - "score": 1, + "score": 3, "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" }, - {}, - {}, - {}, - {}, - {}, - {}, { - "techniqueID": "T1547.001", - "score": 3, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml" - }, - { - "techniqueID": "T1566.002", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" - }, - { - "techniqueID": "T1078.004", - "score": 13, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml" - }, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - { - "techniqueID": "T1070.001", + "techniqueID": "T1525", "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" }, {}, {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -544,6 +605,76 @@ {}, {}, {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, { "techniqueID": "T1003.002", "score": 1, @@ -568,6 +699,536 @@ {}, {}, {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, {}, {}, {}, @@ -582,17 +1243,14 @@ { "techniqueID": "T1021.001", "score": 4, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" }, {}, {}, - {}, - {}, - {}, { - "techniqueID": "T1003.003", - "score": 4, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml" + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" }, {}, {}, @@ -608,26 +1266,6 @@ {}, {}, {}, - {}, - {}, - {}, - {}, - { - "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" - }, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, { "techniqueID": "T1078.002", "score": 1, @@ -647,6 +1285,52 @@ {}, {}, {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, {}, {}, {}, @@ -671,9 +1355,16 @@ {}, {}, { - "techniqueID": "T1059.001", - "score": 8, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml" + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" }, {}, {}, @@ -685,27 +1376,246 @@ {}, {}, {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, {}, { "techniqueID": "T1566.001", "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" }, {}, {}, {}, {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, { "techniqueID": "T1036", "score": 5, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - {}, - {}, - { - "techniqueID": "T1112", - "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" }, {}, {}, @@ -714,9 +1624,80 @@ {}, {}, { - "techniqueID": "T1525", + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" }, {}, {}, @@ -730,7 +1711,286 @@ { "techniqueID": "T1078.003", "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -747,6 +2007,14 @@ {}, {}, {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, {}, {}, {}, @@ -756,11 +2024,637 @@ {}, {}, {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, { "techniqueID": "T1053.005", "score": 4, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, {}, {}, {}, @@ -771,8 +2665,754 @@ { "techniqueID": "T1078.001", "score": 4, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, {}, {}, {}, @@ -782,10 +3422,26 @@ "score": 2, "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" }, + {}, + {}, + {}, { - "techniqueID": "T1562.004", + "techniqueID": "T1566.002", "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" }, {}, {}, @@ -807,15 +3463,217420 @@ {}, {}, {}, - {} + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + } ], "gradient": { "colors": [ - "##ffffff", - "#8ec843" + "#ffffff", + "#66b1ff", + "#096ed7" ], "minValue": 0, - "maxValue": 0 + "maxValue": 13 }, "filters": { "platforms": [ @@ -835,8 +220896,8 @@ "color": "#ffffff" }, { - "label": "Available detections", - "color": "#8ec843" + "label": "Some detections available", + "color": "#66b1ff" } ], "showTacticRowBackground": true, diff --git a/docs/mitre-map/coverage.png b/docs/mitre-map/coverage.png index 8a3077b0eaf2b6df30698796d84aec59f5b4bbf3..a2fb672bffb15af3646c9dd912912ab2c561753e 100644 GIT binary patch literal 999341 zcmd42by$^K*Z)fii;$F(?vRvjq!9^Gk!}Q}yFnVH8>AFOKqLhgA&s;k-3^k9?)=TA zdp~uq_ndRR&-vr*>vB`;t~tjX^E*D{dxxv3$lt}dkAZ-Ia92@5MjZhGV+H}?P6-4R z{07E!&jJAfOU_bST1`<}np(}#?vyTdE=;6F*tZP7Y zVRucr9);yS&M55o{y3wggOD{nND#YS1d)2!T~vz^VM#Y$vd6_v58PI(CB}Z~C(Zp8k&r_(7Lv*`5FPV;+K@k(R>ip~>Iq(c z-#n_Z!3TO#%^xw!eX+scEw{~T4{kimgK4=1v;!X;%An)j&&u@9V)dg7OAo?#HI|4` z6X*ZjMC8v!|6EVRRf}11WF(?W=`diKx3M%&sQkWH25TSs%gthH{-m`|EARa`qBYc` zSMHU(ocxb6nX7M2Po%iw`P(>jdgFZMy(rr=*UEa1&L(>$j`p0c_^ah zF!(d6(cQ2JQ~i2}9O}4ZPC@oMhxfj$1gBE|d_2ixEE+l7wy@|LbjmlEi%<9NqlA*} zL|q=4U;fD2OZ+M4E>ojo!8DUa&k=vEhJzW23gePW{q*Z-*Qx_XU4%v%c`5DN6~*H~ zun-XQCT_x=IueFhMXvm-XVY)xM*i-+i=K(RL*DzuM~T#L+hVe&RHi7A*?O{k=V@F@ zHjsT*vHGq^vJdt0@9a^Y=Q32|PKRc;M4POYNo&#>8p)S4ZqvGIhNEc=5{$BL#t`NA zFp(XE`MvENZh!8ozN5W1wQ->(mcqoQ=1YZWUg7-iNd`-gN%>-mLD$mbGwIN>8Qoc3 zM75jf0*PmKsh{W3f;?{0OV-5^ZdiPLd_o&Hau&SmZiNs=O6-I$g%Q@}5d=lDOJi4y zTxt%a5T3tBo@X{O#Qx%s{H61*JCX!0ic||TE;7C(Mk=J9EnrIv^-}<;AqO*}nIWm> zUDg)VGE!@_`eyx~5N!YD1>PD2j=-%24qY*dg*)r0yONv%)bv5oT(~CfNaeB_cmnNY z=#o-#%=FlbkA`BO$OJIQl6HxH#M1JAPMaR9y&|we?MN;ZT1f+q3sqn`xPKmG%zT$m z@`sv;Gs$LD#h?N&V&;eD(BdyQ)wp^#B}q2Ac&;eetve(o2Zebv>m#9 z_e}AM^#*shqX~Z<>B85xTp7){d)?&G@jb0r^)KoYVTN5m?;wVKU0ooZK^82fAw@t z{XxO;$g>fz5dm#&Z4GU4ZIjA&ZKq1s$`gysQO|;V z$AMV=xFTspG&Owyg!u-j0%VhlFO5;k18SadH9Mn^u9S6r+_VQ zqg_C{U|J-1+UttBl|;pH!@w5b!1F*Qv|S4C&U<_=52JW8ZR;kFax7!gYPD+8My!h` z(Z6yyee#I)NIqvhr2CaggcX5+S^k|hBA3Xo0!zzU1G^}|C4SV#@-?YZVcCr7|wI{z{rGY<*tF)7Dt$S@WyL)}cW} z*YB)gQMN5Tw8_=Uak>6Qt)5eUeQ51~tDU1CU#mxueftF-RFs4=SB%KL(%pOi=pfN! z%*)kt(ml`Ph1cv6|6cU5{JmDQE)*vIT`EOydD@Z#`#>1-W;)Og#nL%kBm z3(|5`sjer85Fq~acSaCVwb;2A|D1E7dEtQD%c3(NM z`V;kb7UjZ^BOgbK3&obDI*TdCx#vv0yU)l7wwdld5fm6SHSTY3OK@h~XM`!yePqao zDO~nNERODZ4%KdqZp?aP``x__rdB9>{FCK~xCB?ccW*#5ZeMg*!pZDaKC{|$j!k^0 z_N1kkT6kJy6?5jDrgptMy^8&lnM(c2y<*IRDW*y)D*V~HT(!!ZZ0vE>s{5H0o{yny z>eVlzyO_Gt53m+Ou5(%+aU1M&Nl-Vj-nNZ=EWE@x!l1uHoG+xT!wb_g(p)SZ-ru;| zVCP{o@5|h`XY~5@NvrG2krw;cVsqkwom2vG^Gn^$neAG?d$mNx%$_2g9{Nt@TKgGG zori5}<4G1NU5{-!_H@dOXd2bNmAS-S=2S&ACSyDvNU2RuO7YR}Gw{AiS!{ZKH3X$M zQQT4=$lFT6OHoXo)ugQPzQkxC41PdaO5RXmL}>M5<1@5~saX7_c#e15{muK|-<`ZI zc>Ae}-zuf}T9@VXH+@3gs`{x)&!@+iE&(nt$IyyP=MAerShwXzEk!~3gY8}ylozqg zKbgsBI^RhC$Zqa?d{gCG)IC;FY*4LOU1b+D?OQQcRP7qN5uN8^k(pECw04%6;ugI9 z`m+a;=1~>2!{(hk)QhR@clY6*(jJYi?R)x zJcYI8iIw=?<VN z({xug-AklW@}~Qa$47iSRhZ+srO;W0Zw_0(&eCB}6lm6bf9>_A%1!26z0(ffPSV_X zgTYPn(W4(tJ497c_g>WfyD(_^Jq-i^{cnYvjm=IOMKQ)B@fbwxa|A2%9_N zT)eac_HNId1{cCZ_db;FMv)?Xe1*{1b#dW2ethgRiImWAx4E2U^Ds|6Y|pxkTQa8z>zMA*d6hQr9z z&e)8@-Nqh#8UaDnT^M|8W9Do`?QUaj>m=+hM*I5{!r*)OuQ_R{e}BZ;N{m)hS&drS z&e4pTkAs(ki&h+inwnbF(e#zDx{Takhl8KQXf2$b?S(lx-Q3(b+;}+b9L+hog@lAS zxgK&pe8>(y!S3W?>uluCZtFz%=OllhN5;&_#L?2;+0xFI8h&0QV>=gTFdg#CW>90dYIpL4+FOT$Ryng={4462EDCa*0UmW8| zFBu2S2f3w;>T~cF2|hXC%Q*NS^PjKad&s!GH}`!z1O!P0MVUv>-4VAl(XY&(op%nz znn7}dxD*0SyP2mg-u6&3;?r3rNJ%AR#Uns(!N6VX16&xseCOyI+cZ#vDq zJ%rV+x$T_J?Virf-+1Vk&hO57?bNPiU7pW*^*d#)Ic4!I!QAK-g5KcbB1uU?Ac!>7 zDF4eJ*8Q8Mam4P)h1pLd6EplbXZmw1{#b~3w#T&pADoCE0`3WwJQM%FeMDR&+L=v? z|9Yfwk!)~r7pw0I3N!p~2m7D*AX76c^1q(5f1YNFn!447%-;F&e-#72&v!&U6Hkrz z-;cG_f*&N({gR?w8qfAFx=rwZ9iz?8C}6bG|Nk{wVfICC|J}m-J?NE>B!i~;7uFO1 z`-P0VsImKBkM$c|i@-M!s7>=A%l|&5{3ASDi{}vk`_ueH1sP@fP42V*%ydT-NW-6$ zF~9Z;Tb0i4{ScVP;_2g(PIc%Y^@35dYW~ZTaKT%*$tzT?u65TSlj2Kk||BtobM&fe#W6QxbRtih|sT8 zy6u|f=*0+wD`S(@BIPJ4 z<(-t%pS#h-_x$Z)RpTLebaItLo7-0>(5AZtOe%eZ4&WApPMdD8wWiEc^oST$vob_( zn~`yNU2k<;g#VtSpPi7aHHlmF7|{a-_lu4EuZ?yef{8GA21K2x#&ag8DID7I7LSHi z?Fj4o9`>SK9JX*Y6chLl+_(CIN9l7kNc8-2r`|4=*HV2;Q{*3GCTR{Su!CW7t`Z?h zz4ybVrfx}46;F%0yY|kiq-;GWB4pA$yTOk&xBdhZsp)E!v+ZQsF1ud9_3*Uuw4t{0 zgCo~WmRrGco(}IBO#t)--=$F6AfmI%cwPo z4HhbKWh8jE5a_ffTl1sk1M;6)BQb@D9`^ApCO%U^cboGtuUX6T@*K(PW|#3=v*U`l z3y-`Fq`G>4totO#=;05;l)16+W;DJ2UP`ZRJl6>$wCs;Qf1QXH@}+XJeIMI$t)~1*KuDAZu3W@B+)SNIUd@Iej93aYB(O-`jBp40d=9>p;53JS;cq3^^Q-kodNx zx4T)#!P#`>C~HH!N-xL4$^+D>W61beGhUp=f^CqISdmim!l4W3%)^dWZqxZ3FN`Nbjyn$6p_F~*j5W4sxdG|${yq{oQB!Na_;KM% zO$@#`Sb@RB2HxDF=PL=_Na%0Ne!a6|9AI&lc4Ys|DP_L{>Qx@aRzQS#DW zz3V2PcD)6e($4*8P`<6wa=0~>+r(1_ax$>AuS9t9E8XrD%I8i>FSb6g3>T59&LmT9 zswdU8k{IFRfQux3&;J%=(Z#RX*VZ++HKm(9eRX6LF(JJ91GK-IsAcTMYf`8-BAPw(Fr9 z;|;^V0m&dVl+u%#t!5!$v0>N8?tzs+(6q|sPL6p#zUZ{i=`3-U=VsyW>>5m@T@Y+n z6mQGKC`u?>ibg_3j5?-9sgk@OtzmIP53MY_?12MzvmGj9*46KC|GvdV{4+< zN5g5@Z?YcEn^eD{{kbVqV^eWkVjQ#ni*yu9bbauc7)-PTuHhHAlS%W_n&Uxvs?6du zKF5`=ZSv*XHf)hEp_wV&so-ht+StDK4dr4f8IpIIs&vpC-I&`t#t3&Bt?{RDPmlZm#M$CCGFggIA1K{EW)@ zYNP}v#O9(G1AaF=!*_n7mno;iT6VUeu&nVpLh!5RCuyNJv5O3I!z ztw?c1#x0P#InS-tc(+-XafA;Hg!?!{Tyl~hSr>@{7r^IJyxx{0oS*_x0mxcTP5|jMOf44Adslw3BHfo z#7XLi4M^k5YK6th$8xs%_` zVYW_x`@~aBnv}+?RFmlL%0+SlW>vyN!EOiWhlHN;r14%^Ov%~Y@(Ro zml&q+*-6QJd+QXiT~@p zV`zA)16juXPGcqUr7${h(I^v^%Y^JJ(+R)ZYaS#{pMh?sY;um;m3Yd5&Q05C>#xf3 z3O)4qI%c2ctH1`w9dJ5)5|~u6k6O6#_+E_j^b69pogMUY?s6-h6d7E=$W!*?2%Gl4R2mCF+*5@FtukMc>m>5F`n&kpYfL8|duA zZ@)5}RFrzEU+THMnDAK3bh1RLTxc+6!`hg_^@t`p;Y>f&7&~}4 z1zU~dvE`IiPiQ1UbjTxPy=lIB?sv4a2I)kWL$v4wQW)99qYnn zAuV;{IHbsAhC-**MiTus_UNG&kW)NurdsVEDjc2l|LmTq{742@OTUGR&%iV!dBVJ$LMWLcwn8nj;Y&ApZVT8w@;r?I~zP*ll4&Xkr@=9AGw^ke3D zpyGswk-d5KOGPGJTrPJsvnN5pz!Ui_?go|>8%2#mXXwvU`NaO-p$;|7nYMp9wu1(X zruJ4p`uPXdI3GsR2agjoce<>Xql5k=YPjHF_B-hGu_aNJ6Z+auz^J zl4Q4_Mrn=5fF|Bi94b|dr=6*Id*383r<~5!M4^eyy6jOjJ=y#j*a7=B&dZKQ1YK)a zlY2FM%SC;AClb*aA~{XAy&E}wHk69dlajF?B{tua9WXqfD5)CLCjBrjU#~ox^oA%l zHX`W#-H8elqe!@b>+CKz>B%dZC~j~kt5sEn4a)~2U%RGp$(bLEQswc>)|hR_h~+Aj zrSL2|1Ibm(=Cl8;mTdFy1S}Z@DpWjb;s4OJZFv4F5GdRHDqW3#ifn?J1Y<#Lay)C$ zv{SzjQv_tI^cLhqat&=uhU`RHlRXrYNKX=7Ze#vOHNng}!PZtu#>uz&64#a@Sa2ao z^u4+dAp(!PpMbzNoDGGv@U!=Muffivg3q4C2k3}@^rhq*U%a&x^r!w|Tx9Y;%MY!! z~RCf{#8uDVdTlL0y{qXN;Km~mf@GCEox6ff))_rIrU*@uG9il?XS z3QAOaP)!H`3k|CYp>+@19e1YWr5lK3#r;bMp-* zO?`)KW%Q-NkDQYZSKZ$9sfta~k1rE!H+!neXVVt$IUu0bht78_TlBj~)xauaLQJvB zr%+m5$v@J*VCuD-o~WLEIbd}<4#M&Gz)50&)&H!3S^3|UDi#llFwM*-2tBSV|Dg> z`ZAFdR;3LOb+xJw3v#13%a10(qf&H4k|sQOiS}pL=i0J5a__wst)Q&=n-i#3BE3pSf~z~D zjw@L__8ASx5Xpk8_iwKf1BZv5(G^t6rSH%91U-ricvx_(3Li->HrxWG8U{y^UO6wC z3X0W6pbY#Set|u8N!46QcKDXy?jS7;CFWB^YZ@(WJcm%7xOpA|(_DvngD3#-$%1m?XD;iYvDsQ61eS(!7KjJE*>XtA}B z2TSN;JvZjpW~ScCjn5K6HUti3Xf{%~e*z{GtM`;Q+U)AB%{`_3OLge^TDC-6BsD2_^%H9&wwR9)=*MA+ z(#DI;$;bRMUyn`nMQ%GKZsKO2Tr7FO^rtX>N8}q^W+_lB(wZjz2W$z!LwbP@jWyEj zdB8t(PI|)<&;utfk&w4W+{vyh_y_n;TSWG$$EBFL&yP#}C^RX5M3k!PwZi1cY!Y=? zBQC#MkM{8l%+xV-SVvCjvl(O4(}h))x5TZ@0ez#BVkmjsTQ!NUS`$3sJ!P3cS!f+W z;|KuE>%2$bT0J(R64-v+K~$hc`BP@#_4bGvPO8~r?U8Z@du>)C?`?a8D(U=3&Xb(SwF&NkD>sOTu!%FplcpDs9S=?Km}2 zJ&>$8kh=8%QXU#lLe)u6uX3VsJKIk=*v|9W&gQyu3SK{E97~R0uKS9jP*zw-D%rREn-+Hycg@X}Lj%BOn=-Ik1O}tvC0l^Jo$| z%9@cT^9mi(RG63P|=FkgKy z!ylNkD$V?ApIyDvcp55R-4M(%D^HtLz!aAa?hy}g=V(nZbl_0W3w>2ih8!PhnQ0- zbINXh_yRbd5V=zyw}!Q*!*{}jK}K!TO1eMc8A#-RZ}PaT4ZD}Nf6SvG@o<1Kp?$R@ zZl(eG=bEemHGWA7ob_ovuh*oaRwd6&ssttXu2!YniL&Tob$DaCqlphH+Gf?b{m`=3%i~9e#(~fhb&%l$Hiul&2J!Jef$xsrwKJQY21qHVB!Q1 zG-unC;*@y^U5o2KJpyI`Qe zIa6M>@SzSJ{$efo8%nwY^dhqD>nK(RUw?lqqc^zg;gWCdr+Hoq-!a~SQ<$;t)b$p8 zO^K^T9G$i0%v8f=MV=L(#bDwJNcoMh>Y4wgsUeQ(H^_p~4fQ=+niKCW2g!b;M1WqH5Nw>zAFWNm7dJriHvNrK;9lUcd z7n(Z?yDR1dCnlvZPH0<;<)trwOQpqN5DNE>&CCjLNn>u3!UC@Fe4>3rU+9LppROdR zR=-_Owx8Cyc1sg$Wz}CJm962sR|Qv35_s<^bd19p9A7BJX*-cV##XoCi8Ee)(a0P! z+64#b5AXsQ;%uJAC)4 z@ypl#o+Oh$x|Q7d=c8JuNOWQy>vG-uXkVn-cGtd7clmhM`_SIyaUi;E28X9aNh`L! zQufgAfk0mx__&bpyozk1H>7J8U-<5uedDfgfCKx@*uXBr1u)?st@zKN0ic7#-xeL3 zz^IG?r}@~msqdwpkEQR{@FVJv-_Dx`f z!Y}=v3;k@Ug#_aa{^BTS+D2*H;(gVVy|roBvf#(vh!j?KZQFMh#`0g7X7~r)oMJ%z z`m4vnO--)Gtf~go)B-P25}$nfqzMv96VN&4&cVF*F(Kt`=md6-nNS-!ZlMngYZ6X_Z> zjf^cw{k}fcz10S+=2eYR^NY9km!Rnr3WLr!#vWN~w(H>8n#ef+0psG3_KQdPLDM6z zxy;t{oN<#kUTxdPZ!TZf-B#D}?nlzj+(s}_Gu-#Y!2|5HrHtz^Axjb;h<@-zBs=Cs#SZ?4`>*i*8Un&M`NpP zfU5(gP@Bp@xmq^1JJsjE($|Ir4ZAsW&OP_>sEk8dqI(B?PrizKE#9mT=C*+{Qqx_Z z>CY`2?$Jsf5tIAszoo^|%7Vju|AJ!utBR~lT-)#oPjE-oZ?#RL_>g=Y2|WO0B7T+a zbFx=e>ch^Z_#GvmtA8=k`s)w=#bg~@%glq{8TZc1-*eQfo(_6z&$iMg7i-fJzqVpL z2m%@UH*a4AEYq@wA-8>;dyIs)znxGUw8sYaPEafaN2-7n7FSU_YE+)N%z+5Y%U`y!C$E+ z@&1U>;uq`97)<3KHO`E^q2TXK(>iv$l@+KU6}x}y;wf|N-7G4lENgkl4|*ii6=7v3 z-qz`iGg+YaUwj{keE{vcFxx&Y&j5sc5mb3S3@@YXdpBL4sP6|9-#p8{cy74FF>nbm zM+g8~W9HpCyT(+K>W^52qwJ?&4y1cQ{yZTVZUuO7Al+m5!vOwnxce`LfQ=Wk+@vp+ zn?f3oj65RQusWa!*S1@UUMD%`A)NfQ!3iCl>NB8A9?Okk@hQc?c@%-4GOdAjhwE`|&AF>0zd5qg3O02UL zGK_e!-!g!fHv;hbP;n86<-5Piz7k~FPs_|J*S&u=IocV|_R8NoK8ZeLgk}a_+W6n}U?!;2;CqBK^*yJVk!n0h zux2g=bH6hQpL@)A`0$<&5>hO2IiaUfMLXy;#l=bb)WPyQNO9fJDVuBd0gNm&`%(Qx z1wUq5@DT!{1Y#g>MCAogwWbMt3OxHKDoSK*LDK+7vXHrHHB25{0YMn5ioxP&F&s4g z{N57KU_!VbTQDEYa9M`zR}$MH?``ah@3x7Z&I~^evG(d_NU4mTtOZ2sYm$|>@i3n4 z<)+6qj|HfJ5#hP?f94dZ$cy~^1x8#arqkfYx#6T&%(oUKQH%(5f!HvxPP11bPe|Uw z6`WZd)fc2##~+VKITMsA`w1uv!QO&R@;aQ=9W-tyR*Q=TBs*7_9_ED&%6vuOB%pmj z4xYoc0M3@d1Y>cdtmA~U9m3rQr>24}Va7b54zC)b0?j4s3REQlFB;aU7 zJ-5uJk5vN|d29xocRFF9(Y%z<3OM9_>M{H~lxapGqz~~~d}#XXX5Hq+QnI~NGKKlr zDt}682@j@FpDZYxETKa`3Jkh+n%z^T-VCv?-)qG*CkQZ>as+#v=srXYLjDS{X`*|? z`tC*(pcvKZ+zzu(50w55O8kw2C7;wVunI5tyS9E*qaEPkp9LVqQEQ{xoyKCa^c$2RF#0{zEFJeZ5q6} z!sW0elbr|~2UtQuM(`$#2muk&#u7(+H8eJJ2DcJe6<29!gr>4(Fx=cWr3!8jl<(gC zd3)9=;VE-($ul{$t^9oZ>i}vpBqqF5HtuN2YvV6J3o0iP=%_kSUwA#H9_FYTQC|dU zr7yYa$!a)Vjhj>rgLc2U#O0*@?e*!}+fTPz*O?0LZ0sJO!FC$fs??C$jEumOU z?&g(wcMy<3fOh6JcbFB~>;-y6=fjhY5U3dS(}3SNV1gPq!Q`{(8EerO{4$)f1B?e{ z?*5|3-#LA`$B!39<{+hQNQpCZ(!3nAbI=sA)UuV`YzK7YYrDUGq>0ScLXW=TV7yTo zh|5ASS-VQ^>fUdEIY(%H{DdAP3Ma3OwF@8}5+{iVdVT2sWL#>LDH^Z~h&Vf|{0G7$ zKmn;CIXhrA#pGe(wak7+PqKc>Z>3}2TMk-7HX5cIL`-x%7c{sui7i93`og5LjRm;6)AA%VfW_4;)Bnd)JKu!m-NJJWc!exL`4mNAtH z=t(B+rz`k__S3W@K3LFye|%ApWL|H3WI}AYlfS# z5B}6G&3n=S&n=#&Z-xK88vjbsI4G!?i`8L$3ECY!locF{$&Oj>OW|dpS^wPeYH_bk zP`OfwQ$_;r>%l~ClWCiU%P}VLeRMx9>KqCszjsg4`Pp@%FTrA~{s=h7b6PC6`t6Ef z4`-=AQyYSfBoogNkBvR{S?V4o?Q%s>Wr_+qRQGb3>Q->8*IP*TGFC}o)_Hiwl6Ey- zMM9fiW+)izD0A04KZ${H#xcisUN5Qa8AB_(ixz0-CVb2TEv~E$;1_|FTQhAi%G9sw z0|ZRP#-cNpxT>rygYob;$_JU>2W1o2_7R#RA$<|8(P~Q4OMM}M4rM&sjrs88txG0@ zPk6S9TSYh1JM(ac#>We_=a`3~o4`6A?mH93`0E1pE4ITbAM+FfMVByD#|r zE3B9W_$0jO0E-4sUaEg zHtVJy!IO>rY;1V)OhVLGVk?*7h$`6e#qR=%H06#IH9=7UH%C3= z7^uYA!0UaOKHoRnOZC${(2l&ghIR1-V1cfV-J?m_*2@m}xd^720PY7J9xY=M!0B}H z@rl71a8zU~EuVk$sfT6@xHFA-q;TPODD9RhdBuV|q&uvw(D7kdCEYo_GbNy?>* zFKY|VjRn{H-gPdKMrS4UI~XL)G>cM|{(|jPsM`|@=?^8JkqiXm@tCbwn)NZNWRL)? zlQq^*^%o#(Lq^Q`@UWY1RGtJ$hN6|G8dR2A>b6Sro(J7b&>>B^3*x3T*{vFjHTYH~ z7a|*@fc{k5;UG<#Hz|~PU+~usnAI^$h-gu1qbK$KU0~}=9-URmDgC(fGJm(^^T0NM zZ;N32tNI)y_%0#S9h~;-`YC*`wzVAO8`Gro(l|)kkdfhT1QMEOsn~7%;7ZW1X+O%& zw5|(u&rPB13^NZW&4GrtS{;x6OMpWJ0BJHBwtg7dz( z@#bO+v#3QdhES*@hRPtdQ$-gLMbf7yH)X$`(qEL;pM4oiNuhtN|1Q>t+4*%a+%Hclp;JX`cYrQ}{&l7&J|dJ0~o1qr9sl z)wa>08QZY6A1@^T>K##|&;sNVg)sQx-$@-wG(_^s8#p($W5j`FiECWfsVcfEK_0<; z5x^yKP5ir34?+}arvh{+6iK57fa$D{OZz#;AQt!DfxudZ6Dn4r466Hh{oD)Z@S(rJ zN-DMFt%_f;bfS0!voySMrfC`{+gk86*OTy0SBaoImB&gPR~r_O>Gkl{;lRAB`eR)h z=LER1X={9Qlc8bM?JxtZde@@ObtF-{w7uy*(2Ger=rD7T$a(0$3+hg%1gpAYRc{=M zzj@LgHuiTNFCae;wIq{f9wa5FmzS z%b1$!o}DengvQayS9b&-{tz%IQZCh&pR#AvmeT!B`M7C;N#!{^Q$O)3%MroY{Mome z`CcGXws9W70>e|D&&w{L&3DEzCB-;Aa96wKHt8^37JX3PENf zwW=5P+Hi0{%SBPswsy4@I0r~I^jt=l^6i{ZnT8xXDTqI*WZnm*dbH%nLQdcP2%D0h zzy0IQ3v!aMxrLkS=a+NR3vVBkbU7m>FU^7)qE+7u#;|0w+fp1K+#D;r0NihwfN{!J zJL`;wdIPOO#ZkAOgTVcg7G;xq59qgGKz8_a9+vIIZ@X-MutF0+8VW}}-Oc~w9{fyA zJ*`HVm?-}bJysAPnc#cLdisp=kCI}RLy&@Da(=^o_0IAW*Xxl2jpi0$aS_41caT1R z#R#CQu+eVADR!=W3&@ZhcPR?s}W2L}aER*X28?TPZ@<;IDY!7||B zLXCWBRsj-cC}4yp6ZfG#dxPhWD7L_4YY$8_%Anj zAhJK)u(&XM1@DaRDW_W3EQYY_6Fx$-tB3K65LVAP_U^&#{OVmqGv@9@h3ZJu!x3D; z8_8^dtpXf-Sn^jsx9zuLa%LzMdF{dJ#}%+u4iGvGD+}DYSFExMG6)V+hP~8I#a|mb zO^U{vVJL-b7dzP{+yQsB7b@}PnJK(xOfZ9MpGozqDva^(Qtxqa4Qp2=ZuVm+=EK9r zBG@VvI>$ExZfSlJ!{%;xJ~gz2ARu$7K35v`Ydrsj37Qn9C!O^1z{0_hWTTe%NMj0M za7P!pdFq@-83-0C%1EioZPE>pENGDm`W(Qcxi=W&JHm84>ANkn*wJ_Ywo6_-euF3b zdfU7WUx{td{CF@*SbhOeD_c^Ah>}kRy1+-!26wM-$IL@ZFFN3rnGq=BR5f6+(%2i^ zwY+Ih!`V?t%ng9yx_J4s21WEckh~SWR<8x^JKAmNysy~KkCkI! z!YPuk!v}+EL5WDd@TKQuOvjFp=w`>QNrWsnhLnd9HzNQ&PlksTe=_84?9)2<=Q@Jn zKG2ed{pC*c1X-u>J7`Z<;7HCZ<2!Nt=O}ol`$V?~tgdW(ZU8u}cFASrWt--W*m*CL zY57g2rzV{T_4c2>n)NK&2GP^-LOw}E5Z4_@p@${i0Li2&v&C3NWkujbNW|HhIM<1E zWNidD<5oV4H%6fZP{V%0D3s8gS@0`(-@tUaE?`)XX&#UU|M!$EEw{}RIC_bfUNi_a z{t)Gm;rjRcW!Ib1e!cBcr9LpLTC{6mKhBc%=w|?Kp~^?^RUuHgsk#*rjXbsp75g!k zk8%%a>ml_^69|X)a@6->e`Sw;NcAFF=GDaa9^wzfCXVbp_upl}CddNwOTAYgECPxK zJX>g3M8NyMM!E4A7YX?;qHskv@cUA{jIa~afQWFIhUs&~PBqYA?3cN-DM*42&v znl4%}XTHn2k;COg%h(Js*nY7~9N)db=E(j}C>5=b&?pigU>^i9;;m2*K1zWU7-VAW z8UQo6;5@JYZ5HIVg8Ee_xoXVg!s-G> zi?>(}Nn1Ly^|gB(C{qpqC=sz}SpQM53UAng+Kc%|3n05;$n-^NagaNU1{K`-yAkm3K#jmlff*pkuM0 z3TQqN9YzSAh)1#RBI$m7sqc~Jf~kQXRjW~)a9#GSYJSMQhRQd?x6W+SYqaOhk82X- zh8U|&#n5|;$qd-4V#g!)fVG78)#31*;4F+Ge zZs9LdkePoK5OenghqQvNYGPSP;mw&d@XIg^usnre(WA&bA}rtd|7DM@f8Ia8pOsFW}jL9p!vy;m~fw~dPOhI@>ANoqSy!F zFATzHmxJ9L0H*Jyg>it=0Z!GA@~aF2B%w{GYP2&*Pr-{t3=)AVI9w?FQx>_VrZk_s z>mLIDG)~$5B4H`Rb(&a5+!sENY0H+Mcmm`;zKp+7_?y|R6QaDew)ujsMZ``?HVUL> z!j}{XR8bSvEXO)z_SPD}BZF%CY6J25$CghhO&Eq4ZJJ!?A7-4Tn6jj$y_-?gCRxU<&g~TRb?CvD&>~tPS`qQ!|-{m=G~Q7Mf~)ttWGxVV>ooJ+9$FY~0`q3@PaF_dtpw zZ{`Z8?4GJdgC@7H@?KPO>gskf9jwtwgKK4&_Fb!zAjV7$+G{o`*lD(m}}uG z2E8jd%|!}wM1Vw#%7=3$`TF#opK#K|OGtZQ-se+>hiC-iGTSV2PdW~bt(`xKBW=FS zHxa}|haUUsCH>5XI4d<*3hy@E-WY*!|Jo)8g*#!-fO#VA!84N5%oiL!<)o{}21Q$X^(Re7KXv_J^1f>4++OPv6DeddgTM{u*f{QIu46Zm#T zcU9FEsxT@O{UjW?2A`vvzXQX6Z3~y={ELa*1uQg3zd+-Mgc7`kHnPFC&5bI{OX|a?8Xj$Eh>VW-9(4+u$M7&}jw1WGqh=dyH}WwG1G7`FKYzn4*B41ehazuRsk?Zh`;VN09*>hD&XIUY zArl2xkPfP(zFZ{9ps+W1TM2ow9^mL7lDt`OF?(h`H|nF5oirn& zbBB{@qm{0>!Y|#t_Ny20Iwjpw`s3W>t914>fuu9Ad4@1$dp|5Y!Zzb}3KfRG1yZry~wK&OM7}b5%eK)~{kWVa>RZ zVQRgCA!TY5+I^CBq4-Xknv$&;ShE)4mU!D{ujWf1pi_dEqeV(W{d27iWyvBC(;Uwl z&-j;4CnOZ>-NG8T=Dc=)M1I0TT85k)-8mZd9_DN~QXexo6uX#wccY)V<2JlI!ky(d ztXka`lQ#xT;u2=p^i8spr`!8RwIoxDM>MZG1FV?F1qR11E-d_nks1a|T@SN5o8&W3 zgWZB%1MNul?lxeHC7hNN7{C(kd!eI+wgWsTpW6IaXEy9C?JSvywM^sG8|r3HOT-0y zABc#k;Bjfad)pZ5mN+VJF|V~$WpVzve}Ar;pfL%J%A3n;?fi$OPA~1UzGF9o5l9RJ zgi54lL&_pEWV@OKHcteuO+>uan*@p$*?@kBabSYRms=61H85W&Bz^n+h6yG74HN$p ze^>wNvL4Np%YCoY@9rrVkNRbPvi~2Z-YTrh?~U4(lJ4$qknTo0r9q@cx;qv~cS(0h zhjd6c2-3|07AXzVNbYz2{@=IvKJkbnuQliUJY(ErOd@r!s(lSB8l9P!5HX9#B2S5q z!j~HoSQ&94VBkd^Hv#q!SO*OqVx-$L$5qK!e-H3G`>5-SP6#ymxwvtqdY6_vuw?WY zLKu`15_utjU5kR69F7hTq<*gs`qeH5LR?p8fkZ^dBiYbKVyB3UdOXu;M;+Qk&3Y z{q=$D7V5|^f4$xJPIBq74&k!iJ$#t<|F;Xk^E>Szr115v2yx6(Ju!jUl(Rz5QDs#F z{)Zi_=gah-oEkxkZt{)HWHn)CMdMe18e6>;IUeTF{Db>Wgi-=?BzJWoW~_H(K8jNB zwifT3k{u3AH&R)J%@lkw&qPJlIs-^OXhfH-0li1-M^`>D4B0X?}D?P(K z9sC(zQq}xhPtS;t<8JK(z;Q-DQGU%r-ak^$@c({4AzaqJXUR(ZFZL5m+BiGX5SgkqL_X zRCIpGW44T-4Dcq96XUZ3(4q$&)~0r&1hehVt4UNg)x<2Rux$aK%iX%IaMG4Dvn5X+ z?*_Xac1mWR{4RTdVmBCdQx19Z1HjwVfUi)c=N=e~v$4}oK7yqKir;4eOI_hizSIho zA&jg}0ccBT+5$j@`+@wg&Cu;K_f?9)Dz9e!-wtWAczlBVgtwRTTIv(*hsRSP`1d2{ zwUWvP zdAA6;Z=}3pZy(05O>o%*zGGc-;I^DffOYLh5X&G16nBQt!|3l*Ll-&lb zC@*|&NEUSJ$UW@X@xWBOH-GqJq(jGp#t|in5FEQSUd??VfYkx;F+Fr!q9ywd?T4i+ z8PPhp{-nwVf(w9jZ8~HJmPaa}eYlOXZei;>-h=KbvA@LGHz=VuBUsWeP1u3(RICLS z={M9}s2*J-AVuIuN4vtI#-iEcRnWsbcqYpDqA?W{xU+^vL{j)wEeB`Sh3-xF&vjP_QC?Vp?Lrc`c%N zAcN-iwAl~@Z+MQ(n3EWS+Vf7?c4W53B-C}xzu$7d=AFmMk*=ITz?$QU$?4OrE+KgA z#Zti<6;|TkFLmGRkY%Z@&&3S2R}&VLH_tG8rnvEp`n_-km{LnIS8nK@_^Yu{ZG9jI z@6b8-UQhUDonW1(M1X{2m}ULcYv@KtAxQ42oPq}>CEy; z8)ZMr8bL2}$z0)`GlgLVDA|R)y*|Qo&Pj(D(+cxuvd6Kfmcd=NDx_td_QRf^>Pp3- z9R?8i`yFrYwGV>wZ#*J={Qlh<_B+dRr@0Iq5at&uK(4O)HR#LO?RTx_kFt#Md^f2d zDU20ML+{~Vp=;dApRM*N*a0zJ$Iu7vU)i@qF9@+xz^(LOOr}JaTaE#Vl7V--b6c z)$njUBi?)h=)~fedE~GZF_!^XDsc$`q6yj0_;|9S_Z^Ulv5-&&ZDS4@xB{)PlaCBC zdV`T<@_!ZC3qNWTyd9qcow?P_@djWqSa*)?zNdWn(A$O&={XV3bxM#tF)a-_3Ux-+ z2tQ|kdFQgr4&}ZlGJmSb|GE0B_TInofQw0yDN0IC`q)R?H3a zvJl=d5dG)pFnry=t(Z{I$#u8I@sT{om&ju*)HA6YzXGgY8p|_JeU<>qy(j!*R<{@+_3aKS>o4_4tjg!tcP+>E zB%DZ^E855)tKIl?vf!Vy0gK>6)X0LSX5mGgq_ zX_3ja7dpKTh7EK10mqO*aU-O*zLnqFsF`bOF6Y+~>~<R~Q$YvtxLW6#zU8+NQ$uBq#cEa6^kj#jD4uc9xyHE`I-otK|@ zugZ*k0(=;9d}Nb?H7$Xp4@#=9jVe}%v;LOp?KZ7M@s~f}4+{TMdqF^6m<{b5tQ%$Q zG%T0E`~f8OxaC^Z7(A&E3o}Rx9SU$9r-b%%?1xphvA-z_zM+aG;_9ln75Cwxzh!}~ z$1Nb=B9P@~K&cO)I+3|Gt%fD(*Vv)(9N*kBOZ0@YZSh$vLc z8zyziDM?LIKDriJCz?9GO=d13FX^m4kAE~wEBu=C2``Ej@!*wmv$r?NY*xn5&eFy( zRucEwHuo+ki|?Ylcr|sq3}eMKRjNvnc&jDe5n>olTI6T~c$l|HC5G3|lu}wCN9NDX z-0tst>3qMbA~k0})+5>Eb|2?SV&5%zCV1NcKbTWzt#kc#{_y=Ou*5LY(8&7JMmHML zTNVGCXLf$9u^VZ?{og>{ac7wIeDKqFJJU^6l`&6zo^~j+M!T@M+7;7+MF5)5sPr}d zM4`4*6#3+0OuqD<%Jb!Kz-3+o4)%^YE<-a;svtdF-^=`=0Di*baf^{D!WSKcY?xu+ z#y*`cwSVFKusUQiT(HZo|K4_)YK=ICr>qPfcXz19q95G~Br&^=RA%XJQsRkQ?VlVTM6Jj=y~YC%x8(B)}5vnBYV@x z6M!3RK>WL(ip0XeA}fm?0VXvez9GZRk%#ZZ>d#KFsjVizcZ0trI3buk@}foq+`pKT$H>AnkjL(kk`9g@|C>}yBsenT;=*!CCP;7XOeOBu=N)tP{ic#n@S;?6|P2hGgBPVP!c zS$-W+`Lf~n*3+2kBFpUwN~EM+$3S#87&l~BX^wEbz5#t7Zl0854#Cb~_YV0ko1G^C zC8H>K>Ceu2h_jOZd3zlH;uAfUJ~N(zbTeLVnE!VN@avXZkF#I8R^~Fy3gQx3muYZ< z=D$#UyON<3uqoS|eK%({U5nip{PHfIN!~~0YhnIih1|UA>&9g+H!B)5ZF+HDnQc!< zVOjw4draRD!Xo!&94?|TDsJ8x_0km2GgL>co~((?0TGHo3GpmEjf+hG5B!TvS#1L+m-K1+G;6@+D0c0bmw6!8)ED`%h8Ax8 zxP%VF!^a%Ehi?;@G=HuZ*z2V-_$5~IAm_!XwcM&x@1W|MIYHvZ``xUlC6B>;H)5Ka z5db9E9(SsCS$Kdm7#`#~Z5b;d*)A*~<0MYG>m)r*I+zFD2YuY4=0WVX>T|jycp$p2 z@>xpWf^ED_kiq@&LU#SaF;h+ZbF2lMDxP7{ng#CPDyqM1ojc2l_Lt^KdGg|s>IdG; z*o-ddXw~DlB>1(_0)q1vE z5cR^q_wJV8k+UzH3xGa74b6SBro}Wptk(~6$r;$GV)LUuDnkfsRYKGRY-WquC|@;` zF7erl5T?GaML9Sum-|eq5Zy_?y}?Ol+O``#Ms8L0=kd5%X6Vk;Cim9mB;om@0`)K5 zcIYNEP16ShRC`Fl$G>)dX{#O}sm3M?HxsWm+LCfp7Oi-oW7_A+DxZDK^E3>YYY)I4 zWBG&hV=j5R3VCE7}D)0CIy`SVGBM)ggzIz`To9)j}=k*u>;ff2dtaA`l0$J zKk_#Xiw88+bbvdm8(ie~k=&xIKI%NW0Z2=QRyk?y@OX3IPshOf5r+!&z>=I(OF4I9 zg{6(QFy|tPSp(5?1J7WdUWDK_Qu(dx0Qq4L0<%UiQtLrZ3yU6EXq1yV)Db%x>Ri>JKJ=*|7-NlJI{xV zozct793~!PDzbl8*ZWNnA=rxZ(rP>{ZjgA|eq1`^-W`2#b%ObCs%Xz4n!3`IWx;BZ zyQm%$2{+E>P}oqRw{E4J09_7Pd84Xtz9uR&hVx3bO`!Phn`oU29cGjbDxk~qyhQ49$cH^wp0YZ%>0t2w271jcRn>Ok`98^F2wv5VpF1|(k!UPQ} zurnj1-{vV2tL*-T4H|gsns!ExS!~AH=i|^XIenxp_pV~@eEFFIu-NNvSM2~uwWKyW z{lUH{UxoQ}Gx~iXw4>~7LdE$AH*iEnrjBWit0D_^r~D?-)_SgssJlP3RSWZb7uR*;0$ zpuCgsa>>$`PqHbcCVV}Ir&H#?Ji?fBlk#*LO8V_gB=yzDds4Dg=io|WD(M| z`*jI4r_?3!pSClsZk298w;bH(?^~Kps?Qs;KJ4V6es$eK$|0%Uq2yh~{m%UR5hB_X!$Lchc$DTlaubO|Q>qZY1%>3R!m z{PHd%YzV&R2L=OEM4rNDfr!)+8<9@z@@=YUY$Z^Yc#&de-p9N38WDc$qMkwt>8VR; z%0CW>Dle_#8UEMD*E7pE*}yeq;dU1C9nG)fCbyWn33(aGUxJcDHg6VphimY9_ByZt zs?>PzPrE%Sg>Nk4$n)-W(JeDz{Yobd7 zp}lcpT4rx#aZ&z9c)m%2LRwxvwIXpHhw$B06?rQBAu^LBNF9kCN|SHwA#sClW>{)ss@bj>y&V6%&_)kT zNTjbQcU4Cns_V(eG1tQk-K=ATTLgH*$@BNsO33hsG^63^DJF<{F!0(O7j&W`5j}bJ z>FGuFQcshTf}!5lntMi(H>*aTEA&_goM|a)5o*f9?M9uI>PCL$>piy6OD4X)=!r=0 zp99)WP?svGRtKrI`fKk!OrcX0oYJ>=)%*gIWz0=@Gt`ovi*1mw?5QXSN1PV-p7%bv z^Y3$StA)yZC`a>;iQyyN=7h$l5DyVkjLe?PBwqJOJ^7%(CyUXTVXE?3D?pEKLD7QK(#9DH>2w!> zbkC$5w@CutlZ-7-ul!)kJ*Egsfi=)28B$Yl~<6=G9uz7L@A%Ty&g-8oXD|f z{rL;>%#ita(SH_~f;RpF-CA@H?>?IfLxL3A;(9cMox2TCy{34mWz07XugybOQ~K(& zZ#RH)^lqq%j7=OIL>9agv8Q?gG(ze#6OGGdMxhBZABA$`WzpArOZxJpH+-WVtD8k( z{XxZ?OPlv5%hLXeV|Z5mph{#zbzzG1dD|=6_962@_f*?27KY-zD9*9ZGQ+kdtya8w z_NL|COp6y*B&5DAF#3_6ETQLNq1F{6Imk3H8nWa#{LDo_WxVhrvvF@!HX)hN+ik{b zl&DSvL=Qd;Nu{)lQ$XIQwZ3_4$$uey?ucs*|^5EEE&1E{=nBx)y?N-)Zl~ItI<-W=IbI98R5Iy+RwlgbN(SEUJ#!IdR zjO;WxI!8my#!lur`a$FV{il-xW_nKj33m57&Cn%j{KeARmXtOz>j?_^ShDgB`BYH= z`La{?;1r{se|Txb@E8n257wdL1=5wZhx0w=ca>uXitCLEPWDF~Me%^{dds$|CQrpD zUKOkw?VR1PGh}IY$73wz@5l)hN?mXU#Iual=N+6DdV&@Ls@A>RD$c7Ejb`%H!IRhu z|DA4?`0KTd`{(Zr@Fmx{e=hbm=Pu0GkY_bdMU&5-?>BzL3CR>c7Fed$T7xIkS3@U; z&kX;+gMBfM)?2Y6Z%k}k)&|DZzKL*H%J^u|QZg`LGq_2}h^NeVDGyI9L7MrbitDJQ zAzIOq9|wenGq@-P;OkvRXqHxa(i{wi(;@w+Xb*spFvr-uo*R2||(2cULs`nAw5hevpcl7>-1P zBql(MvTxu=)c5&B3i(6oQ-FX+VyZIMmrjO3nlx9RRRy|;+UEn-3?AsuKre#QZy@Ny zgdD2Pel8+?+(bwjakVwKW1yW5a%t`A_cL1$>hYovjZgTU(U*cK{%W!42;n)*& z^tk0~qJJB&5EPTaog zHK1pR$zmz9BipO}p2sQ9Th4&1+boD`X(_O#mq+5Asa^D$%Jw#SqQ%~eLw<)vXn=#1 zo6S3njOE*Tf5$ER*L(;Ct+d{~3aq7u8=gJiz=2l1Q(n5p(cFm&5lSAO-w*z9t{D9_ z(^egXt~trhQ(YY36-n8G62ifFM!QpfRpGQq^WmeAYSRF)cT_xl6swBe$~vGt4Uh%T zpBtqt%{~h*%u*@e@2Nhs5La{yP_$}I0U z8NDK^-X&A`%mjX09J`-=T*IR3QijsLOU63xJK0qiH-)2oo5N9d#dqk}eK6kMU3FBe z1s1l4&X@DKl(5nAU(>zeg@Y-su(Z|=-O;CoF9-QfZRfZJZyNFlAI2LBP{ji~DFdt4 z?`4@9$qQRf{Bb>R7@pd~RdpWqM0!AD7&MRR)S{iOD#o`vD$}OiC>A4*2x4}?3jWJT z&9HBom7r*4TaWMJHa7($y#cY*UeqODd*Of5m+&OVC%2DcLbnZ$C@*2 zAfNlUbQ0bM}$4nuym%F-$$3@&IGB**g;4EP>+mNd2D%AnD`WHZdnV<4;l{c;zK8)99~OyBVTevSFrbbqoAJEe%mh?0`-SEZQwu)$J| z)Cb2%qnK4FXo4(RI8KF5g&TjXV5@aKif0+F2SoU4bL9yvK;?xmixYtCA*4Wcf)%wG zLma9Jr-t_=$o;*Cf5WM$CT@J*g(QgKVL|xZ2lpIR{Vj4Dz5cf1=fkqRyjAA^26Urr z&b4Cq^rAiw7GXH$#96hbJARJUZ35*td>W0UV>o4<1 zevZs7U|y%?<5yo{em);$;jZrg1NUYbXQbkG;abHc{1%Y_U`){a*>|S|v$$lu?Clb7 zRP>LMxj1lvS|rEphcE357Qnye{SIWQB%iGFsp$O_vGvW3=7AcqY3wW##tSkX`|uZ^ zX37Tox{En)v&&;3-*KMI0^spWj!!gebr@SM$Q`~$5$vZ!V!0x2S1s)#;Pt2mL=OyhiWgr?&{ z04v{@<_l*nh+cBLIrbMNK&!jyN&|Y}JdeCfj3g8XY?HPp^{EIhi&uR%hEm8m_j>L$ zijMC!wax>}_(}c#RDyE$D64^*2*|%ZPJ-V6rT7!VdBbgBp)@=nlfzoDS)ka@uKW*6 zc2>TQxy>Qrvy%)J_wsVRg`1D_ZGESuPSkgMS0lzy!=kWKnpmAK33x-YETkk7s?VGQ zJ<-q{ywEJWC70iX{5UfUVi;xF0bl^=r^p_X(*W3*X09fqY-y1s_=Zij9ms91n6J}aH#jnRzaVXX)t-B!JI@<(br5V0yAcdY2yL#uLkfK zJY+YlE8`PJ&^yd0M1xu(73z__^vT_qzo8I&L&|7NXgc|;+0iXZhGkL3qE?ptD z2S`&J7M{kjRT7RxH8*=UJw!pJ4-1ZvD~1iijX(t$fc=#LD)jgZ!CI|Brfpmx8IU8R zlk&cg)_>z}Ckm_=Ujw~i8qK+!s6o;(P)`6IaQ#Qx9W1hrD94@8|J=P};aRk>r;ijo zs!Gt8H-Hugfz>#b);So~zLkNY(i>hv(9^dVmv!@RA%PJV{+i(`W4K%Va?N)MQA~rH zVYw(4z8fM%(IvyFAcw%B7uBYqlsO0RQ1d8&jbKxe%^{{B3mOAnpHQ&d3ZJmV^?y69 z##cP`H?SOXy!16da4ydgvd%F4R`o_e6j8>Lp(Rs)(Bni;g@XSgsV#d}tTKM02BRe` z@z*XXuG9+xrzcijSV8E9BM0Q(M2_eJ|SVw*;z7{ zQ@t(Be%Am0(bb~lc@nGqvTJxJKPA_f3fu7*V5iQ#%U%K>@hfj#(gN!oW!pge>Br&D zq=BD0-^k>c{>ld`r>q)3aDJ71x}K%mBG`-Hb85#==>jHBo(@snPe4B4kzzccwL_id zV{+i4=hEuWHVk)vOP+v}kDLjLwY8m>N(3wE^yyT%_}JDlDefc&G;O9iGEy8gHkmHt zM@0@|@L4o(HDWw@dIYB~KLK$xHOIq>3?!+hH!;Hle5awK;sA5&huIM4Mb+A|kskvP zVwQu-*__V1xp$h)@9oNDG>xC)2$-*+`Y=Cn?@}LHohFSKONgDs%d^W7R?<``KM`Ut zP{Z91q$QF*-SQf@pdex?=V@bq@wyD4b)n4Bbk?$*Wxz_!6AwBsHVXCSDM(3DegYaK zyedhib|3}W0S%QdrMXf}_}CTETdNieGKR;J4`EopggJF#eB2?biJ)1~h?sw^Y~ckDBTlds2$_S9*Y;vTF4MQ%?Mw?Kbl6#ulvj4F7qmhk~z&f!E|<(4Ds^R8mxi|;9> z34Ensq^R&Rzri7Eiwn0dVxS*PalNA5fkCiypU+;<1Slb14osy(0+27d`0Sh`XO%Al6}^8)q4Ezn=M9 zQ?AY7GW$?2p=9I2>yF8Xx%FkW-g*c!?0y+VWhVk2phm06y4nIbs!i0-Zzmp`XH5 zI=@$tA_}qve4kRZBAmgYMqS7f@1}yZfmM-qZR~}QT=`j@7Ar7$mxU(&BeG26aQG%d zgYYMmlU|j|%YGs>2|c!Y$U-Zk>b>4cfDWit=UnlpDo8H{h*~qbGXSpln38%DY*7Scz##G-QjvhnzUP~?>@Rk0xIw$j8vTf`~SKIhL-sV>xi#Pub zh9(8Jlve)`k39j$+Q1cqF)7`VB-JyzBQ^KI%;j^}zSwy^+e(WOV290&N+L665=Q#V zRQ}yoEVm3{4K%Wqxaljt#4jNS8uNfRCXiQbQdCD}88)mfZ0w_gCBK_VyMH)>@rkky zH`d?&yb~vIs|dqLt^r3an{fiL-O%FmDLi8n#Ib?I*%W9Mx`CkMM)Goo z*3X8D(*N;p+-0O-+Bg7wb&z!))2y++ZG_WYXn8KQCp=!oIMo?!(=j5pqoB>ytio2% zZLHsL2Go1UtJ|W7X4{^-g&h~DV@0CJu!Z3C^jP965{pKsb=&Ca;v=-K-*}$gESXG^ ztsamGGIeISew2H6u{8Lo^O&1*@dRZgv7MMi&Z;^N8LLRFfMZmqn!QMy#Xj!Htt?7F z!}!m#HdCPy_`O(R`y912Uv#%-krw|gU z#6jrSD6aUDtR3X9YsGOzmKPK-TX1_sPK zY`9Mu1z(`_;_kH#L$EaG4UT;8-r7?4ZS$w>xp<(?uabL%eJ*Oc%zT}bfyreGk9kl& zva%95zQ=)m8xSjLm{a}Mey`~7xKTYT|62%K28xux3uh1V6h3s>8IcZss8yfL(!U|W zyf26j8NDpJnuQE{sw%vV#kI<`Ok=YX5nC8zSxxH#d~y2hBPZ{0fZk-iQuKCZf3DB> zcEbMr%rkPT?-W1r404c&@AZL-EiEdPnf0SWR+iQxoLG?#4#uyHl|D&RW&o0HTN9r& zTSJu$F1}&t$#lHdPjuYQK4b;Dx`d^ZcZw_d2ZAo-Fk?Srt;8VD*JE;8+BK7uA*n8N z7_g(;^m9lH)uTt~s6D}7dG2S|RS9g3>?;_xdN?3pP6j8n?3H9Y< zy6!Kyf;RVk+n$UYywBuZ<$7~%o=cC74&{{8EgSnY40wP8+&W8KuqwtrgCprU}L_;&<;Bpf53rGXxGAHZu&jfEn`13O5j1@?JqcGC7Adev{$6)hK(B0&?PXnu2 zqvcEs1FR}`2sB~AW*bpE2|S#V!QOZ93nNiZV;LxEOSOy>k;QqQ_0^@I>w^Z-nt8!M z5ieFG6CVHsTg9W~tQ&h1+SsWa?tx0?cGh_=igWM^H+t+69sZ?pRs!1vFd5#p$=j~b zaMEiAV}FB2DiFVT`&l6@N&lvYb=Eo+vs8K@2wFz|P<+r_rE}B~>OIo>`5bF$4l^RKqW-w1}DsGza;272xyb+4u@# zi;Z%-n@X^{rkc)=*5! z4{HQ$T@6}ty)uN`>ogw=lWcdQH#x5?O70E&td%JD$dQR|Gk#01FaX&$#EFrX4k zWNlDnQHFF*=G9uCz+pV#yy!T3)?$ay0!N}{KcMvPgB%MEY7Y-CmWn1Wrs!6hVkn>$ z0jA_OkLsB0xYB+V9661j}!H3lmR+#4lK59MJ1V|5ydak9g>g0Yi;3@nIVx}e8O-^ z*Y&x+(xs_eVAI*v!wM{0fSPd;nGzErR_0%TIGe!x!Gls2*BEgHgZZbGE6I-s!&MD* zM*h5Xw@e9+FmNS?Pac4GU%AP@rm%_azx^U*9a2yWa$C^(3q2aIlBlX)JW_mjY zb>MB7p@z?fJJQY{bRt-NEYexBp5U2VcOKGjP;I_>;nd zxTEh`-(%o1FgwQE1c)2+r}cedz@6b+*tQe!lFa zl`)wPHk{Fhdb5RC9;n&uXyeQpV*L@zkL$O2ZzMSb+NVAYMQnHtU4vVgZ`2vX*zlmx zhQOyCO0$~ag?i=M{c>fJA#Gc_m`JGu9lGPwdZ7gqKqvE5Ycr z>dbeKgrai^nW>%ff@IVinsO?oC1@KK8~8=*A6oDIiYJ+dk&>9G{71MwPnPX%%#H{H z)pz%V{{86UojKE>K%u%x0K=@l$$le=cXHopa;vFS{A&4jDWJO8<9*v+luxZsPuHfx z@UjpPHLw~dom(6Rl_!LfvidP2ERCrX%lymZDz!)fB0euTL~XwNcuU+nnR}Vzqx2pR zNJf1a&!Ieo(FqRACG#fn| z91Tg+Yj${HRj;c&Aix!aiv8W(l>j0JL3~TPnsP5{t^MCUQu{Og&u@$$T&1YnBDy`v`u^Tx*?{ zMzsXtPxgAh<%xg8;FSq<7QqhF}-ezC5dq=CSDB8|TS>nYBVTRlbqc^X^8)#m%ban}d+>vv>&u`Amy1pGlU z9NmJX@-9X?Vwj-GV-neEl2?N5kHnmmpXlVV^*M}xr;Q!=5i}}ZY7V{G(%!w#GQ}pThZm-vbRQylGq?Ip=BHARXPOkl2|j{-?x>=EkK zA+FoWMnDX;!71ab1as7*PNeb$Q4Bv!2YNC~Chz$vnr`VGpiFO#J+Y=3EqEE;H;hUB^DCI9tXJsF7kJfq3w?#mH1LOjdYo-5S_8CXy zhWOIzxC^ruBm0%7>NG=a1t?0Z8MZ7^c{|BJEx{kgRb_ zBVdP~#{Xr$J8bk18C{6rw$%|y{uds&$d-^oAy3VR&I|EIH=y-Bx6p-x+$&tNb+7=) z(6jM`I=80qWCn>P>0v9(v*GR{z@d;6^lwICRN!9l0E8`=5q`lvCB61 zLDREHHq9FU!kLTHszS#~p4i_gG+XnlZF4Hjv7*WGbRk9T!(2UN z=C}?HGhHb!5>T!r+k5J`lLO10Gt!+!2WWHyhdQbYRYa~7XK$j>f3#WA4|%%SrDpwZ zO`1G0zfVBDpyJyKuX3i=6Dqz(yYvl%8k@XnR6{aP-x*%I&T=+g5vVitIc|ZPN~%p< z9*^<^Kdiy0=jc9;03Ls;VUN9)7|Se89`ETMrgqIZb_p=HJL}xJk&h)vl*O&d&{iyH z)mROi&W$LxqhaFB14a*aRhBn(k#y%+l0^Q;v?Yjnr%EgIqTvNW$2K)SK~XpUzKrtBSSgb(xo5cpX1ay#7TI5D0F!kIbEVm8!SQ=jLSA7>gK_GjmZ zclCx?L;UpcRgsF%75+-cf$-*rr04j!sVbV|6TYPU|1=>X2nO}8nm#9=X80Fp*i6cN ztBv&TvMZz~t%IGFLB~f(s&UC^9hLm=$7@gB;i)FLz8q-(wb(2(07{Zv(-&`IKIj8) zl>E;Q5>*E5AmXjGhR?6C2#P2$MIU&Q%5g<9QwQko1bz9cBsR07zyDd~t2hM;pYjpx z8r^g}+E`vvE4#s!cTK_#HIGIb;XpU!bf&wAIIVsJ!iDK2W{btO04@WoDW)ln!q`6Y zoei-50-a8`e86Y&VwDB{wLdsQd*<+@o#CWVR~OLH04ml8pkhmbVX@??zsBRVz0JE1joWslt1@zQ_te?j011o z{rIGNCKWoFlEj^UksG4jM0wPEK5+hlftO0g?C+$|7yG$F!!je?x8y~#c=Q}eK^e`{ zXI{rw(r`witkup-eoV0QhK=f<{C%rp-S8An!e#1a6;SU$8cy;7A6krPaURLngs!VM>6Ljv^iBqElV_C(LeNHkcv5@4BugfMSKAsbClt>ZV7qd0JHu z$GzElH4>~Dt)yl@dz3{9CpY(4h@{}fDEm>HUC&yA@}RQ|{zv4~JQsNaW61(9x^nZ~ zZ!Kfwck4`=!5#a!j$jr>4Wb?98B8J^r5oq*#}rD#!v|yJC+}ysqwzMEosSNbTJhbB zukn+Hw9~pjm16hG_Z=!YOah-h>a2(LxWn9(jASSt3-S6LgobbZNristkoa<9?JCbC~l|wqgsi&EU^J-WPF?(7~&WMfi^C^O^L1g+5a5{ zu#MyBQ^Ef1{PRd(=pmzJY=rC$Z2%p!Q_(N^wmoChJi=zF-W(GUjVblevue(5wj$vIe4AsICBMZ@2w&yx+MZ z0v%L~J?8|`OCc{&?#(5b_I422?EYjN3YP8AzcdiR^MlM`d8#o9>sy&Z!kAo9+YkO?}1}D`#12DjP*Z1 z_61R4EjEV%&9C1sirvV9$Z1Yeg`-tSfnIiXA+Sotj(#^}ksmiAN8=sPQ8}?R+(w9D z2A2H!NAXO=#UuR8hkT#9R}hul-8((bM}0SstBgbkE)mfR$VWA3F z-te?-5L@q6_R*B=SbBMYeW~Qt_27Ug>`h1f_Jx>jHNlPOl0H@VRYLg%)-x=s($4RJ z=_(85i;>^Jt3@urLoR&rr~GFEQBz?pEv(zfZm!dMvkA<*@>GXUzxV&iu>TbVrWUxV z)3b4B!|B(DAbwb@-Y{ES#~GVOT(1=I>3!NE;<=xq&TJ9lDc;*-HRe}l+qQN#_ud{A%u{wNN7=fC#w{;Y z5KS>9o}BCUIQKQev+FiDg{1Y{9z(%(u57lOYGm%^iSMZf>UF+DE;{i0HLCQVd2um= zQJgBh1#jR!ljEgVccS<$Tp_ns|1j72hH6%;edc>lv{#u^6Xv{N%#`RPni#6*7>3XJ zH2fET?;A3!%ydU`z?AC|wAWyby3Cs=u||I&FIz?ahzU$Ey#X4C&*} z^I16)A?wZMHuL-L&-zSFZ(5CpOBNO5@RLeHdNvZpRB}JORl7w(kBI}8sqv6U2_2dM zmOP2Q+&ziB4#?SpA;0UV`)e~-im;TUITx7kmJ;J#{Sn|%23i|>D%6qoolSNqdPDGW zQ#dvH*UP$gW=Q(}z&dX_=7rCD#8#O^K9ZSZ3E6@)25JXJRU+D4TTLknhc{fj3Kjs|B!5wXf0v|%9 zeXpWgN1cXOMu!F6&y&Wqgv94SJAS~hd3ZdzNc;GTMT&q@i}KmpPq$m* zS2`PsPm{vB@#5j4^r;Er6dL=ndWlvg;kasoec_mt6#qV^VCR!-e>e#r5q}5kIb(|Y z0m3N*3C;;CQ17}Pu`=stzo5%KA0`Gaq{%EkRt3Z>R})A-Xm;Ei^~InD4X%{VCk9_lA$}{#rgIw62xE znX)uXcuOc?u6R*As?#%z6TPgrdskV z6+AK7$zjJDp!hm4Mfcxb716UFknBaU8VUyruVqAoES*0{ziAi*s^C&p@os6ZnM&Yy ziCU-$>sAV4;1oKQj8@L;nCKBT@4R`!zgLg%33*9auYCS`Mm?rWXsi&hr!zZ)GM&Fxp{filg$AUjo}>LA#^OasdL9FfrkeoaGlslbuZ74q;mV5 zFts22cX5M$Q`&5T6r^5k8>G(zfezum&Cp3Ce{Ts#l2M6sF2Mqe;I;7%EZQAYBPOGE zJt26eD(8+E8vYNhMEd_=aHO^U3IYo#I6st56;fQEf(0~P4o3*Zty0BYJ_K5;gC4Gb zQQwB;-vwU1bEvRe`Vq9njxeGr9--; zJABui=XKrBcHPe%&->h8-Vg5=w+)#YjyY!5T6_HW-(Q3`Wg@5LB0q+)C+oA_om10} z`lTnMMoH!EIM%yRuP^#bmXY&E-!XoCmMMrPOc1nAPQ2&u-dy3+`MlJrhrXHznDZPR z$v!duzVm7oZG68kPW2s-2h~Rte-QDDnPG}Nw7UOQY?t+%nSW5UzL+gBrE&GA7oD_7 zE!XukSOLi8-Da*=9NwgI>^EnVA;QY~73x12iy^Iin)adMO18U~ zoqdLzQn~Yxq_W@iS)`X&rAe(v?dn^tvnH`63oQziSe#HD7Kpzwgx4YieN;Ff#u_Dj z%jH;I{amjP5rlr;coYtS^&XL@SqA z#!}`!Y1@{O|18qJ<_HanNtQvl!E&bPL*5!(W*dtc=a-oYh%7=u!aw4o=>3hEN@X#k z%bHzsvmz#@L?685$o;9je$K8nd6Ffxy=Z9wH}{sjbfh<6U(|x?Wg52RSLeCG7T50U zOfMml3$LcwT5YF^bqkI4vCwPxr1|6VF?T(j!*B!jHlyou%KfBe9IeHI1| z9E!aU_%Fj5FY4c$wP>OIP0IZD+)^kx@R!MmafnbVf;6a?Y<>7wknO*J_&B>1B)O%0Zf6<#Q-a*e$VE=K%@Wrb0!%8ef5WVQ;%XYq`_Wog6IF>EdW*|A`-a! z!0@708cVQew$4&JP;)!+KYpsj3uM4gHn;)A$&8b00M4=b>UlBJ^pWx`6!?jrY11pk z{~x_EBxE>$0}x98d$_nF8 zf9jh6bKXpAz%Hr>44~A*x7)Gcw;6Cy&Z}4o(LK-(uY>!wpDLV&;FNG8<#-*3e+9-& z=Kwd<1De?O8leSPdv`+#G|zHhUVdX^r8&r&ge!mF+5RE(N7RGW0%sIYw_jl1bA43ich7 zwMwFE+TzbF=+(Uk;d9{G{@hQvlSKsm7VvPahXYpAA~OM7zkaXgo7Smkgg&H47RqXg z_K?_Uf36|+#zR_Edsqx{nYNhp(={UxlZ1rH5dlF$!t`5YP>tk~Zr}lbOM)T9hIQYg zx-d7>>v+JQ{mtd!N@SG^_4N$~R#`Tx0b$sc_T5;u0!eSCAe+HP1bHMQ< zKtKP1p3}Ij2Aeh=DQRmLpV~R#;Gt#kS?hLeZhbF~%`4jhaz6`4Mv~Oo{Id65zC2Gf~W`jw7X&#{bzCK_4{ChT6 zT9JBZ0Im(#d@zrDBpMU&O&^xSHO7bKK%FoIpT#3%J(Gs`At+^t-)*b90DTFnpFX&Q z@QAn;3GKmyRSDR4pWNpZF4J$|9;`(Px$2=7Z_~~8ezzQ)f6+QW0o8?`b3na@ zE&}LqH*|p+;;&162;h6O;BN23*?o$r`yY-r!Ml9Y^7;$p6ewdce{GND1ulTmpHAxG z%rK3^f)CySYfc!F>k$aiCF?Kx2Ux&zu2A18!@P$;;Ich*=Ak@TR`% z_gITTs*SpS$1c#^cpG=|_z9+eV`iYktmF>5+DcobXC!b%o zoh`uRjn4OGLeTobP2tIS)ygYZE(JKxp-2-=o;Y}ZWR~Z#_Rn zNj?{Ykj)R>ss1pALXgO)+x2E=va}wqUD1C_9bT+Qq;uFw{h=}21Nw`niJG(eQ}T6$w)}Le$)4M0qT`CNC)gkOp2JfGOAS(I0v>fEea?f%j70CISY_P zPr{xOVy9O4@M9qPEYPdE)tUK!s=Sdq5Ovxb%YXG&o!AkHD1nvW2C(!jSXuqInmbWR z8%sXhFqiI88iu$wrJ#%qP7tDy3Rb8H)jKV+_S4$~_PD=*| zG?E}!XI~qBi%CY|(=ln~!FN1^R8|vv0?mWWWyrLEx1G~YJ9KJyN3DjjnVac?6B=e3 zxtCGF-Xr?)gWWfbIJhBZKg%K)RbReSAr+iT_UhopRhZY6#4qXYF$5SdKP8H2NpCn&E*T)xAb&S!wNtb{J4p9pL_6B-p z+BPh>bh>ByTC7^E+V6yCGl4IN3zpcWkx5ZHJ<=2Gxi4F`LcnDSGUOZ(9~Uc2OKnMHo5TonX-!wrx$zghQtcZZ;e4OORL0 zEA_8#kOyTPW~ZK!vjj^pIqup$c~Ty2$x6Zg=FSEgxeb(|jBtnH{x^Q_FbAB$+&NYa z%vdX`+QxrDLsisF)bo5O!}=Q2r2;C@lpSOj8H4qj{8}JWf09`<(N3A7h^O+UBLAo> z>B30SmHWx$y2VDVCV85;foWUR^Y`0DseG+AVsNCTzATK2A--%{X%%@uZsx$wU9r_|COtP_d(Su8 zpZor~@bzD%+IX_3xsgenY#d2dFw7h}*20Yzv)fwwn>iS762t$60NQ$O;3ayzRlN82 zN^JWP4duo=fFQPl!`P40Mo$Qlk;0IJUi5PeE5R`RCd8@KB$0K#)`2!9vZ0>@W>Y9S z0qjA2waFZgxWp5O#fE9_ELZ)G!zv&SM$s$%vM>tVq?c_Ti++kG3Rb{|`0GF#!^yDW z{8Oy3FT{wzx65rp|9w$%fZNQ5*q(PR-(95PEp?h*zGj|n82*QJJ5n@C(eL^YeXwsJ zs;B5nzmxahZdEb_E+6HsYJ$>Fd#(;Euvl$6Eg!=|fDr_$%vXVTe7ixsSbQFG5X~ou zgdJ6l!H2;3>>FInm#OLlJU!~cbUE5jVw2TiP+Yh226#TyhWLF}IXYm0*^%ojmAe5+ z5^BI=XdItyRLy0S{X+zkZ4Z_ZrQ)=n<(&h@bb+)hI>rF%Jgi88sR9gr`<7>yfVxS` zV0)q4>Ps{`mehljLtqI4>=kLc%B2Bua0b@9tn z2_bs6EIplLy`7$d1(~-9O;kIj4&dtdb>t z$NFVLKl7^~??eDnm}2)Wq8n~&B}oDQFi;IRx=G%e{Q~y%l=?6oh+w6f(VSj=xX1a7 z`2$<) zIl=+d=5SdrF7KAp1Qun~Vx$!echv!zj_03xF29gl2w#k!|Ag!65MhDHXhh~pcc^&- zGphXI-uGhFAK$AeS5CLT2l_uPQz6y~(vGZQ4!!^%x~wNyUjfI#CBfWjt@0>sis`K& zS`0C-r{m66BkB1AxSt7V9gH0ocG1W4!0rX<1-WT+#p@Q-O^_FYt-_siApdoBua|%b z$aU*M)delp_UoCJ9{3J+$FALKk%|vY!W=&Z`PAb27p3SjL&qm#zi)CQjL0|ke#xGT zVad@JZJ0>k=M4X%W`wD~Mph=C17hIi@#lOqv~h+H(6ELQuwIk(m~ zo(XGXWQJ;}FH-Ni$5sJ~Ju`m0uevZ4QZycu2!wmOl>sI44C7!68!l!Lt zRX&?!IPMxWaGx9XXF11Cx~YvUh!J9ri*?g?Uj50rl2T1*qJ|VPWVf)^Jcs8El7@N^ z$)zg0KQPgUeVTkPV!cw-QRluU$kKSHW|6h>8dmW6^keoB`3@hjQb#(K^f`Rw;kJ_n z5UOJof8f3m)|mS5^rBwgEyL=fQfDT@?<2T2KukvzHAj*tVFjtoq-XEPj7wd(?d*+2 zOb+&oDxgxSdKbs1DBh(LQu`}7$rkVJ@Q38rc5AbicHK99t~&jk9;aI!iKVVAhxK|p zA}AtUjQ(s9cJ(YDRXE$s+w$YEkSW~Pa7~`g7sz7^18)*){OHdzScJ2~!S2lagk7R1 z??%Yo#o1TtpLiq95plPfi;Z|C@kO$Bx~*PQqDf7Nt$>&xb9O6))P}g9;aU(z?iK6K zv?Mt?R;s~pQM#;1}?3ysLYMDmt~pN?Sv()_S}G_gOprgJXwC#>ge+jeQ;td>a-{8$HCL z2Y3#A3!L?Kfu z*LJX&!-XlqYRJ}-`6XZdR5t6(mW7#fOwov}eOrLFe>I~}2nwN2?n|lk0%LKhhJ@G$ z%LW!M-Ws#cW5Ys3qQK-U${l|nAxl>C5Ity`JKgayMskYuP|mMec}4RC!6zpTwCCzh z%Q!UYj^rTDEjMC*iS^PmhW_SV88s$*QkNiODtS+lOpWaMb8R9e(T_kfGEOGN?60Uc zi4g5Mk_%bsc5hkt&@_s30F-L^g&MfU-R?^S8eR%+s%#mQhcrta0#<%WughGVZ5JXP^?_j5Csl5_^wd#lXdz=#EW44uYkRjF+_byXh57fZ zKm944aBg87-;xPcgdQ?knJm?E(1Rt3D+P!xVoXA~^|;!YTyRM_Or6lgDjMUV0Z!5z zYPrcT&04RJi3RffLQdC_&SI{KKq%$eZ3=Ck($Z_vu94pnHfV-ExIE*yk=T;4ZY>%v ziwQz5*2MVzTp|2I~t;sW=kg9KBD#F&G8G(+vb!=gvc?Ei{Dub7KEQqfIB$t z@_xh^FdxjcXZgv=DS>1r5^@Y9xoIML3_YEw2iIt$&=ExI9CG1Rd2x${7KVJv#eTUa zwDAC+{+V4vjXZ2A4&R$2H>!oi@q0ZqLpEBzVB<0414z`F_kl?q&H0k=AHU_ayTe!p zklI>vYK0*9H*mqYkqJLGv3Z=tlQL-!^6yE~4TzuwAXtkSN-$xqyr8;+NNl*A@rY2K zI)>g#$54}||E%sW((JM>xxJfui@0VR8=KgTLPIz_cMrHU)LdtMQ zN=z^-L~I4jK44$dUZ<6GOpm&Y$23=3PD%ciy2wsht$GO$=(JAqWjnDN{N^**uXe+0 zssyMb+_M`}8nTl$kRFH&Z=P#JR=5G1--qmZ46ds_e@J{6_na)ZES2fzo2x4*8-&f( z(=!ghs;3`M7dBx(4y$%b8Zti0oqHNto1$kv;uUc;i9)2moZBy$&tW7Yb(j^**&wBw zWou5kD4i2KLbbQTrs&I@<*rgaxgM)K+r%rLqfH0?36<3yQ5yFb1(^#Ua3zCUP8XA< zr}WYaIBqSq`<4Z>_1eW*Sy@{uF_X?2tEO17YH57)ZJ%s5hjotVS7vC>`cX6Q9m-SR2Q2NLhD#tc&<(s z3I}&q8D6>3CreLd7I3*Hd-Hz!p=*@G9_)xiuKaDP(FKPn^zURT$>SN@$`9ubQ(~B4 zP`aH2*S5&B6?fF&mw6q_F$0fH5fz}sZR$R_VN340&Wml0BVTZ&p=bsk+eQ9)(Yq?) z1A>Usbv*ez?tN*o=134O2$GO?8)6=eWQS}e<$?-17pIqoa8PT}UWq@+jy8B`OF7mRbzMW4(j2{~+HbFPCpo7d@ZPpaiyMPzoWSnXlnQGQsx0Cr2W}c&_C{U2s$) z>9_X-h*OqDmc)~|YrXH&KI1{Xr6y!zemx5D%XFBtl)fhubTD1MicLP~w=+c!qE>Ki z>w_Bpkp2;R3)7lsbbPfXWz_YpCv}T3AJZJ}ouJNsw)EtM}-bN-sM=?htKL##ejo!g>W@LlBoCT;`>*2J<|^Z z@K*TSucE6Z`cUMpmibX%w65dpIPd%lsM;e~>3n{t9E5N-N3xjC`O8_r=5S7hN^tL& z$;0T(;7L^VtG*%sbZF;P<5Y!y5yl&Wc8DLu}+4M!Va(PXij3Uk!P~% zgSB5lnvoSS;(ouj3)1sRwArEdMm8WkY~2t0)f1a)MU)xvP1{9E_ibh%!!x99m@>VL z`8Cc6ogU`}q^K7Z6Ca)@s?E4rlqLUC{e}wkl97{rcpHRDzcQ=h4IZc(zK<@V# z#gW>kX?za;Z0MXMlC3@KVNdt_(x5q|bM*Vn_-pjM94BsizsrbQ+N$Lr(THH9Xd9wd zStImja&%}NZQ??FZ)ER}sqP^3$QxhO)R)FRloMoM5X_Go3xr?IeyZ z3sr;VJbj(Wn7fcD>BH=ABfL=sB!QQa0fUl_&nI$}%qa*|7yg`_Nln!|zV`uj*#-VM zJUkr*w2=GW0lG}~H|@RSIF1TLamia8S@(mlM_rTtu}LJ(Ceo3fOpWXqa_|y4t2~%~ z8C8u}?{Ugk`wGcK5T>p!93i`2ICJ*={gk9e%CHELb8~1F4Ox547br3*B4V-N);4Ca z(jb-LPnEop<*y9XmSf^Qhg3k9P>j=TvVhCjgrfyUP!E~4grUKH!xGOU^S%*68-q)gZ*^X8-M@!#`K^o z2ZW+eC-qqIHd|wPk|JWb{vzY5SBUPRt@Kds_*ZT5ln$&*$7Z6D`t!et`zL=da49@U zqmdvaEi5ZRLmUs{JNYTndRcey05QW%&)t zY!?y}d}87E4PgioleZ=na!t5UWuaf_XK~lUMjd`y?r(6JdUV&&9Z=0^sL)q_$Qt|> z^LKldxzaiyNp{{qYC6ugPwaqu@@Df$?0wEMi{w%6re`Swo65)DSHy`SVx2!3E-^g^ zST3MAk|p^Rf}{8I8YS4s$HV2XcRnq^5@UK3YmW*|jvVTbEMj{T`@QSze?FP;H67`3 z%ZeL4X>6B97P6OzDoHguhY5DcxTT`}ZmG6r5?Uw}ax@=W*CT$JmH2R?Q|eWw2~HYm zW3Y_Roo(3&SvP)7oICOfUBe~+<+}|^6ON4*m4k7uF6#-v*Tpa7ai!D9>C>G7XS?k< zU9;}WHK&iI&u=xwpVe_#@V*8Xp?bj|8H(oM#M9V{O8SOd*qb1|G%_^A0T`j4hMuVj zURSxPN#^XUuja?Yvi3sDgyJj22zrs0jw|P()~KY<=f^%@f2`ffy{mQuHBhfCC?-QX zOHkk{yB+xgef@+$-n;{2xOb8heR=_1U923g%^Y=T0uFrD7AvQC*ShV;bPGaLXkFsG z3{$Pr8v=`$YzNxXD`9CxDR#;!`kQ@%GTH=DZrh!64khb1pHxy$-v`J zXN1MgtmQrY=3QLW`&+;?7m%x+C`>y}BcTr*fk` zvbodCL^R@o+^C;bs(^keW;0Q2;eP zb?!q~CPt>a+_wU7V*B(1K-`1McY)PcA{Mx7-tg@r%jc&kHIk}W_f{nJHxe7m_CfiA&zp0tR^6{f$@ZsQ+s_-X60PEvPc z-+qmTN|vBm2bMK*YppDs)RE}LwIj3nXqYaove)UGr1W+_uJ<6c77Y7H)94{-QD(O3 zuwO}#6=O*B6a?7~e+AiWqZr#Aw|sI>s_F6`bP6JP7!X=ebA$zwXIzrIrsk9!y9y}q z3DN4tT!B^SS+hi$%>6UYYKSe-;ck$h$QvYn)~l4R4Xb+nWC}s7=O3fFVhi?HG{ZYG zr?!~_F;VW5_0Wck^)t%Ny)|?}!YxJ=j1zW3DZp7lZUx$f{(-8bmar9G8uijM3~5LShrxPQb6K%q9c9d8UH& zkZ~SxwAwcLQ9TT%K}14Z`w7pn`&yzs`If42NMfzysi3)IGB_a*knpj~k>&55^t_H@ zPO9*IICdJqSBMt+M^HhcaEkx_YOtGeRIBv>HA+m9FTxJfKAji;m{8DZBZXcH^_7wTn`jg(Wi&E;t7IG1zp zPFgWpUl{9e*!l-vc>A>Y4Si&XHXK=%sfoc)%>1@4zG`_gdl?C}O`oLAPbC+(mcjIe ziaSwDF(jlCcCq+mO(TYd>+PXGnd*ZXBv|3@p@EKIB50g^ZPv~XgJG7_dM23BjA8NO zXhPMqw-Nubz8?H=JbPUoxovXaGaYr_Pw8DN<$>$>Y~&Uvwy?7O-lNJc$;Tfj zn}vHcUz|QDdJ{;B=(q82kILGGpT!*_{Q&`OOjKxQ&v$i!Dsm>hvf%YkmUC^HD$+R; z_nF+o>yN#Ans+NmS*`X#N518=2|0C~t3PG4fI@G1H#J-Ka*Uz$h{l=2SIoo-5q z>b+|&xw>j?CXjVfq%H#nIK$Ibgt4KLA!7e+U!ZBU9!9GPY9h z$r-_I)h$fO->Z&5`?GJb0NM&fsX8!d>C9KTeu!rNV`qvw_DQiOzD?mZj(7v1>ClXETFQ5!r3X2yIun}_xRu*Xr3ZHc#l75#7HR_ z(o3#n&C+?fgq<+{|f);N8Ss=J}-PO-(QhbbMCqr#o6J+20O>@brA7U+dBKYqY{ri zOKbVuvE`rceyc3%5s&E;YE1|~Li=V0f$ZwHEdI+dyGZ!~&}%PwM<%k&;+Uy_(vZVS z7`|jKdbO6=DI<8R!qvql6J}>rGc1$5OuC&PCSudt*(0))#$Zv6WzRr0-+XZ7Q;lOF zA|nJv`;z|?+pV;iBIvR0J&#aqtOS*bv?gmCV!*LIg;7EFuxt5P5U*m^(VV>|=|C!0 z@t)~zhX6I%t+g=N?4rJs1cp8^Acj)+fmdy#HPr7BeLIwvt9m+spePFdPVjfKv$9E1o^(x8e$0hf!xxP2Ki;OA z5iKy;#{p+q#Y=b&$fY^2Bl4b9RS15Nxq9oi-6K656eM)@R^qa1I{4-d;*PMXO`fd| zE+69(vymZ}X?09OZ|POg!o!JUy(4=WV7J@w`j6h#NS4aaI?^3SP%Jhddc=X}u+**b z1k>!6%SF(6!{<+mZA=$&#sVwkUSAAE!hf>AnY0z`sxEkM50T@Y`F^g?`c~I2&@TW# z&Q7N8N-h&(dKUtwy;jYKM+?Sm7A=FFjQWYmL~tYBXPbT#=_=pF#5j{bgX&pWFFg}o z`SBD(#G(2r;+$`l*%!U0gL;*b28;Qx2b7rcM>_5S#)JS-l6vQ&B$X=W>J-pQ&{f_pTTd$Dd(=xbv)?u&G~nLiyo654h3dL9 z$+XF>BqI_|mAgPlAc8PJ9GE9{M-^vFz423=fZAzirDIT@{yn3H(ot9`-=b9G8J89* z_D}XZl>mvn&Ptl>Wl`(`9Zk2*ELSAe;`x@-3FR+(ymF$u6_2Us#ei_Aelyz>HP+bF z#pJ<7g|8{5O2gN2_Le<7w^DzJz|?O7RHgCa+d&g6+nytibI7Z8sNEKterloWbk80# z%Qd24$}>BpN%YIq*GzqAAv}9tvEuw5&TDUaPC4>Px;5X(&Y2>{eGA^F=r+1ol8&_0U{o;@DAvjk zCT(wy9>onNpAVPpcl42{P%7bka?I&z8_h)<@7f8^-y}XMHt~<53cLubx864E=3TdBT-s^b2NYUgLS`7L%Oktp zX{GprMH!EV${Q9f`d#`NhDKYQw(+dq94vA;ISDOSJyiMh-7Gs>#yq#;q^Sn6jE;<-BvWzrm#hyB@h$?v~FcoQmSG zhS)r)#eH(fMshOxl1*4_2VnYhY&x5X(Y-)(du}=av)eDX|2GS{>{%l@1{ z&e==g(Vf4H^?VtzkTnldFlze<=~F$NWmz8POH>!bk1~HRj_Z&MsqC89`oFidcsAz5 zK5R}Khb^}j-zt>Fx zn6S@LyY}D}nBOIEi|xSloj#FZI@+3XhcAI4&riKAXta7r&i&Ej0ho06EW7~qZ?2=Z z*?)LtDvGKoLSIF0)Z(%qK+s})Wgv3*S+l#l{DdMUwnY9z6I%GNw$RP$E+ZY!Ty#Y> z?1`j{SB-RndqixwuZpkN09`7vBV)h;$*8Z&<{229YZ-g16DPM2fx)UGLx`VgWqR}g zQ&Sn;{wBiV0=;m2fOX?rTx^%W`_mK4jVYVz=M!RinWnA07wD(j*kYHt`z;4;i1Q=g zUJ-lVRj?slZTzUSSiQfTKI6B?QJR3=*(U!pZ)(kSFtip?8UDP$(+`(g)0Qo@0wG3p zmgF&tJZ!{Oe8)o!TVlmL3u}Nfu-QCe%PDbZXraMkedWi+y(&dlq;hA^Mb%nj%ORFD z$p(#Mme2KeXUtQvl^+MIO53WhXM$oU(nE1e_YXk5V*aubq)Qu{<%&iha(>p|T^e!} zK9Jt*XHN?PO{<9?hQ8i^ruLd>P_M5?_l89n5~A7aKi2od1GNE|$m1Hh)RSRZMJ$gD zpd92NZs$ggz=*QN0_v`1LYEMM$oq_!O9Zlw$!$!Zw5ER60qMn%7*NeY)j=~qsF-@bBscFQ{H5C)&*s3Tk3I^3KTX{XCV*3@mhs`(Zfnm3oFd)-L1i%!}tY zZ!ORpARj^dj_n=dvm~G`&6#_`-9BI67#zk>ZZN2C$MWixV8HPL_A^+F`2FQFUZFaK z%BMpjMk?BGg-i-lNm&FHCx5>3CITbJNE16~4yc7WbdJK!S%PlhdCpq*oui)9(VVI< zDwcd&@Ao}0m^07PIZlFlxq@#)j*DmOj`NT#e&B1AIpMuR=!tH>Vi%>_wNPLm(;J1my|r*#C`L3STfw;v!nI*;B74tsJN6HBX}L4WgWzfCQO=aRH?#w(4&=c7B^R~(hx!qk zLfF8J>|7-9q4eT9=1|?cIpo%jHFn+?-BKzU-^p<&BcI&&sn5 zNr_RZA!7ausL&tWmB!hG=hK@ai(hUOnDl&a)(cJsL6l(gx(t4HWf%TSE>#w-U2*r4 z`7L35m26I8cW`~D%X=fNjZDo(%lmlu6ZnMHP!<(o^}FGVh<$NVF;LoY`fY<4>q#H3 z!e2Tf63+FL(qxln;8$l3N^VuC+&Px#`EZucZa^hAon!| z*26rIgrNHVJd5FRg@U~TN&DVw?J&o31OLvEgKhft1{DR)UE}#3HJ3IrfoZ58U3GjH6O8a=!QyOyN&sppVYDR}YNYJ0Oa> z)4%Xu;3iVlzYM8W74oJwd_m(ofo=vs-nFsBTwOX_QWA23PX*e5ir63baW``(1Jw~} zdW1g1GF@0TR!x#Uh6$@V<0*QBNaUN8V7a(#M&Anx%s8kB7a?_{tkUUHoGlYSp|TO@ zTYbrnX(bZL%%S32EQ-nYX$S!ipTwtGAS?>Jp10>bEQ>$)i|Nr!}l-LM>&kxy@DH3S;#e%jz8N!A8wH~r^Bs0E@d@^&sy6574LzGtcdclp(Y?sOMUPd%SJf`VG&{f?{a7j2 zkp52+zlk>_%_i?nl9Y&>;-4K1L_>Gw3^}c;$0R2zJJ^nNB3byyY`W2dI6e3~w4FJX za-yVdTH#`ysZDWR@#4y+gd@vMPpE}^Xpz>8T(fIc85u}89(i{GrAqd`e0uRX2XwVm zoLG_sEiSf^BBuLHvYjPTBCp9gk3+jAnt>#e;r;5pa1pByi#aLUss(66fY!s26kDFy z!4;+%aVp$aI38VgY2Z>o#cuUTs%3O7vM*ZQ`)W7)dH(nH1zMpKTG+e;o{b{EhhhUM z(Y1vYQvb8oKJG>1)`I}m#lDa1wX>dsqII35L_SNR7j4!sf(cTS?*2gY*xnK4(wT1 zkZpaS?${qkmB~Cwg49cI40q(^9CI27vEv4FtXA%})xCs>M+*!mjpirhQ?N}Y$qoe| zX?Z?=_5yy4)3I*?ruMg#pQkhZ_U)q~I6Yq*{X1)Ef{w8c@X!zgAhdJ9NnPM_xV=h0 zk5cmd5_zdO$43ZCEi{whJtOS@Zl_i4dNA!p)U6^z5)f7r3m%=Pb1Xb-o5^Q-)_B%X zbx}i{`9h9W%(#n^e*PC7rgS-J+Af^@?!U~a##uE1q>Z~5n@l-A*QG1#y*c7s zKaOuS!#Wx72qydy9BbgHxD1_H49uU5CO=2Ha{|=JUAc_)`rVSZ@cZY1>oegH|7*E! zZzT5~6Nv_!g#dX_@LZ=~o$|~<&{4r&sd@yWXUQ$JTl+*$t-e`mH7lDe4(DX6RmHwv zMfHDm`5NF|KIP<_NyNG%FSfk-!s!8=WDvnFUE5&oWn$4nIp*YPa=rQ;d*3Ysf)DER=7l~;fMHqHz@Y^)%2 z!5K(#r?6ov^+^5eynVWoBK2|N%PghI2g-M9j96S)eN_x03>w9}W)f>H~yhBV|@d(LB*uEnQm~D-?A z>hB8%6b`dK^tR6Nh0U-FZP?>B{@1?WSVdYx9%Q>6&8tZ8VUY=N3YbqkZ^i;>13zR^ z{o5nT?YHyGiBX+FygVy1>&I&ik8O_n`Mw|GR_Ws37INQnA+!J6zK6$u z&Ly&b0zNg%XM#DA6>H}SCi~IeFMG14ICe4#7d+%~8!95dTGbU1UA3p|V#OTj3ex*k zq*{ROupe>6FRXG%G5S3x2)&_Idq*VL2RFEWZY59vVx;V8`k8P_zFws0&shipcPxr! z{|Clbk@M0a0>;lWPjBW#Q^AV5WEp3`;joT8$4Q}c`yH}1Izr42FU#7$gHO@TwndJT zrx#a2U^$77m2sIB7h;HXJk2;8NB4~b>yctvuip{uVEYR=?v`k3H~$rUPr%#zEaR{; zQ9_QFzssWK>jJJ@H%1>v7R6N;9kAw&os8_h$LnHSb%RAm87>e%75T&VvRGMHc`99+ z^KGWI?wD$5AkF?5hp`{Mrj&Wi?+igiWP?yN6Qm7-t$9U;PKNno;XzDxM;BA8z8LaA zcc(Of5>mX@*dCH(C(qM@FLt)+aK)1or`klRQr5x;Cri@4;f@GDZCgCIzQmL4Wxr4Y zt;0G7hU93){egt&qRAhFqNL{RLLj7+5Z`m@InfBbcLW+)j`Y#-sOyisySYz^o_3># zvJLNh?av~5xLsngwy`|bRKiLIwWDEBJG#$oAh=<4c?h#n$5c%m%(H+WpwZgjR_(9` zt%q~V2+V*a5j8bu*dT;{dk=dKR?%7h}fy66BE>(-~t z7OUl4ltlh6ih6MFTk7NmN;vC!xfaKgHL(uUpR0A5>^NK6_ z*Ka^!!OEA6xhfPB|Lq~%mkYV_I|@HB-qI@YcTTh0ofy3gvLE~v$zkw9TsbFV9RCH! z;`;^u*RAUENr?T{oU%5>D03yPTe_CW?_z6}cR&!-2+E_CYPM>ZRRxkC6by%06!;w< zYyVU)T&I~&(B{k^&97V&<-gxBs8$1C@=X%7F|@G|?;7K3+ijmas*ZERe)jvV)b#f8 zO6mEEmnE7x65@fa1(kWfQzld_f>D;rFU0)sHw$9LFs_4v7nA^TWf97pZi*$3Z;K8o zS_ZAjQSDz^6mUvetPaoX&SksqkgjSFnsNP!!8k=P+H!hL_I@(`dv-sI>8l0}%oF{F z6M67fk1^z;rre5?devGDEkKjIN&4%3Y+a3`daUx)w%^B%&7&R7QU~3W6Sqcs?}+P| z;RLpkYAPus%Q6Gq8m!+e1Orhr~ErpE9#~-+zc4mQ5UN ztR0apvQ^Se{B%L#@oWQoZ?6H29Ha8J*86;Y;lNmaKK{@1WlncjZ?Q6oT&9Mu!E5Jr z{iMbHBxlgv{I4IC7Sw9M1a7!?OApMPCsBf<_}JtVaj--=PMCCK`ODeU*HmLsa4jVt z4gKI3oOf@LCmDDhw^VpZ?`9UP5s&WQEG=Q(`a41f z9SqKS<7T!96tjQTNBsjP&zltrWpIuTMe&X|q};WG~f2rn`c_XeK~ z7c>6z5O6)uwU!5Mrf}n|J`1f~=i>BJLrGGDr5K(^`K_tp6SdVC;3CuN$uyQL^jg#_ zkdqt$=aMRN*ZJz1n#x-Y{}6d_1uKy{Bv#bOrfatOU0PZi{(c#8SfqSIVD_?Bv+z|o z0g_a%1EfT?gseW|6=d=O(v!%a(oBqxq;iEIm#}#-o!mjFXH~u9rDKSTBn9OHzh?+h z;lKb>VG4XOFt&~E9|47uXyfWUem{s4N2c`3pQ*_?*3UE&(%@{U_&u(Jgy-!v@HH~= zzB#YMA{Q#88c-?#QV zom-D&3jP4I9J@ct^;XSw1mRZgo&I;@` z4M3g-^HBw3g;Z+7$h?G=d9%0&Rg2tow;hX4C(`L{O%uIR!4e??H_|Ke6kV6C_S@B=>e|NK5lKyJf2l9)7D zL+w~h|BFBQ-+Yt)?bE|a3+LJJ-FpTC|2JNRO4{K_-@pTAQm8X~R@h^evv zW3I~odI$d*f#iSPg1ATt^)BnpK>GEzzpiXL>^xN)IoNT8EQ5b>+;#nH5h=LdNgV%n zD~-EYWj<|6M{h1s$fT59+4GOZK8!_EU>B{qPTP$H537Z$Mc#*Uv>#?GNkDknk%+SF zpUHA-D^R*z7d*Zy1iQKv)C@v)^?jE1^5;)qy$tN#GO1h{k3IYm;sy$0C+7=^ zk$rg#K@vRBsx$7X(e;*`mwz&@^KnWTkbNfV_)6pV${ziWzMh)nC~1q4JuXnUOgw)1 z2)V09K4{J&x5Ac}45^NDKHP53Zc2f~0tZ>9(K;?blkW+tzi$6KTpQAl*NileCBQ`^ zo!1cNG>#c+pb7z_p=~7%%F9kr1e=m_xaXx*AYZC%`w;3&cszVbTR?Fv*Ri^M63S4-g2f@1jVo{ASr2hEjCjMd3W zf-8_?Qe2mY6k>yq{JZvBC3|OZh4syDyOvTN@)ALMl#jA7{db`M4|`wv7ghMYO@~NH zi8Km`v`9CKNGl-W5+WVDbS@#Sba#lfNW<>JQqsM2?9#PJcgM4SzrW}CBc9Li-Fb1& z?%Z?Fx#pUg`^->q%6vqZ9qpO$Wo52QVfr1Zsqo}R|5p&ybB;1!U7Em8kM}Un(2jE3 zT#;22V~pKls^kv>f3dzNq33G{evHs#QQ^jj!p$en0U&yXg;T#7@Kpn&f)eR|MH7r3 zhe)D9803F%hPf^mY>SXR{kPlDN3m|f6;^sCTdc41jF1oeWpN|pmp_1}I!Y8%T} z{PEzQfk!$4LW3r`Fu#bj_%9JDRsKPHOa9|KX3@X$A5#CjA7^PZ1>>%1lrY!-nr$%r z6OZ8sMRMo_JEqCczvr}saLmSZ>T59Gvpx}Y%yNdNeM*>4o-dCDEpjV-sjWr6YM`k(~&=Q+C$~HC`**?acwYm z)w1;*7ysY=SmKQwcp>si|IFj(!Hc8+XTEIp|F-Ghb2?G-X(zhnzcIGSSCF~-&rFmh zcv7Q-|6{Kxam%tSUCRG4lP}oYI*LE=FnZ;~=9PJY_v@=XpG6%J^y6~_KlXZ}5{)9r zW|9+IoDZJe=si{jM(LH3{qorV?#GG&{Ue7T{+Y@1rido&f8t?3_+W_HRE)%!=MJc! z{xet}9?Z)A*G&G`O#atQ{y#&LS9r@FLtT)a`2V2_e}uw!3LK5^7|_=+-062C{^zOx6E-E$V}N+zVaZP_93cv##GEfp z+9}Eya3YC{SX0LQ|HqFMIDZvcdBKk;L8%57*bH;vKdfj(^R4BF4!`@oU0|0#(@vRV zKvg(rKs-@(>s?LdtyObquqT{Jnp>QI!ptAMeo^QU&%Ybx=5T=)Gw*5M{xt8U|v_$N#^wCfFf`2BCco$+)>Bxn9`y@}dyqr>)qqm0DeM9<=x z2Y{HWJ08-~i}Mp~wh=wNt?y3o^&{h;9p9_<^RrF{*GMa1zNI7}{OovEO}M4TQ}zMBOIJk~23Pf9-Nu{gb_08|7g9H&!PihRUcZE|yu+f_NM0 z?9brb^$@;1t2NKZ6pD!o?bz}$-;8Y+YB0k!1f)E+P0oz1U{W_@o;w?KvXRl~ab-T+ z;A^)kHI`gpYwKR~%>G{mwk3-9nGSqh_Vb+j{ewf-mK&QPU{l-p`HChtYMkg0`Ift4 zwbbFMLRU0vnXp`1@{r3p$hiD>qd2W{L#>_!s)*>cjYC4>4zpt5V zwcjc=-zYFQekA}Ya0kGYHH}U$R=asPXGjpzpl#CGImrB9{nNBJg{4761%Xc2^U%c^ zLdRyiT)&f?(@prBgXs#t$hpX%jk8u}2UodF;P$@PS5gB|d5QAY3bK`7YF5_QI->ma zm=dz~t8jaucU5`6#Vi+b*VcH>OtDn+xhJKiivMLA7iFcabLu>J)EP2I@ERD|tTlL? z#4m=6@n52^xp`uN|Ckx%$27#V_43Ldjt*-@@gQWZScbFAcq*#%NaZ$TfswE99T9h% zxM2GuwW&NE>uu=8%c*+sUBh6cmW;#syw~^BEvYttnX7`vq4~_pTLhcFcOM>jqpt_p+ntGuX>~|{9gzK3j7-Xj1$EL>LzN=)od_BZYWbF3H~&+CKIeF( z$D_0JoFoOk-ul;Cs&bUi%PO^11Bx=u(mA*+$wcoWr_YR9L!GwYk;Xj+F-r(ud+k46 zp|aMRZ-Fw^*&>$awHF5b)wwjH8y+8FI z!(tx1gO;1{9*6S0t*~KfKCJ;dA8UTR&F1obY zhfkMS<+ZUcq=x@BsnMn@uXiOmG8{_r-2=9?%WG>rY?@Mg8L$(!LNrm$8vX2=!4?lK&} z-#1S1-v9b&fy6v-ap)fzwU;p57L_@3n&Vr~Dp-j)4AXPSx*^O_?7i0~>$=*7MhVs1eKj!AU}#(>Ji&J(MFbmhEuK!ZNh>DVWSC{@dSXc^58W>zialoJ+5fTEds>G z`chq6s|LDR?8z5A>WA)}tTd;t1SDq8Bvu{*JjZuG&2sN&dX+{?*$Ds~{?hEUOPTh2 zSLXOjdn{^rjA2V5+apgP_RIoujmR!9hVciTBt*J|#%w2nuc7Dml zF(zW^lDk+X#PmLEz1?8AUYCsQRPEj)jH%8(ljWVNy=1=HNsI-ymZuKUEk{TS4*;cJofnbm!=1F#jCs{PYvDZ^SgZ2KQwF>MaRoYv%98;4`@A zi}MdQlzjN?cz)OY;)AxULash-BR2rIO_Rd5jU&95zk6QJf@)89(~CcycpzG?Voq;W zZnyG(9*_*=ya@qFPiab;+1iV>;xiwn&>#CuKx?M0?rf`;qt7BM1FB5ITQizX`c*K8 zY|goIVRfgbux1&_brRIk4)lvMcRSFbRtfWg6`5O2QP8}_ljAN zG*9)b8fvYP9_FBGh3)z|$5R)20Sqg7D@cRk93@=syP@#=&ag_6(x0OsnP`>ZBeYpS8 zCiK&}DYZ;#uiBjSE|=!r?LiO~-1H`9{?_HD%aMI9Mf>{1ff^G?mlH$l9TG94xZ~!l zOb1qI`?o7nH)b@cij--xD?%w|cxtgO<_0mH4)g;22AI8NX7^{MWW zyX*Hz{>=I~KjSI5g>**|9&q?0G z7}OyL+DG91bAPA zA1B#Yz-D6P?CQ#^&wM;~hsv)9<~`?-%uV;qQcFuucW0=yNLo#f7ysoV9_eEG!s(xp zqW0f0I2)h@v%L<*;hS}@gB|X-JbO?twn1Oi$V_G%tvufQEPp55DKT}l%Z9tvAMan} zp6)>n4vg|z(v&FgThMP&wz(a+W1#v2-e*v`+l$wz02B?5_TeFV@yj+)@76=xmT@cE z34V+atL|a;uCjqZuP)C#wqVEoZ&Q4MV*{dYwY0`Vu9d@8{3Lw3uSkL3KlCou6E=ba z;HmS@+tFvJMV6dH@w@P6A9PQ%zgT(?!^RzUh?P-x_7y;=H7$Oj#{UqGq~3W#ek-{F z2PKV}jV$O+Uf*apXKs|MpOyXQqLJuRui}XS%qgAD4%&&zfCG1x4-rm)M@By4A^$kV zW_3aUC)=F=@j9KyLX2^cBk=4x(xI^Yyzg?4oW7$2zk?Q1iH1C;zbb##8Fu@3Im`Ou zaI;GpDJ*uw{ko3H0&F7fSoj2R=qKzMEa-yD>fHyqU=x3%fBe zC0pR$O#OeEda1@ry7QixTqkFn)Swc~{oQ67HFkZUKen5hgkhPe_vE*`v&fGC2<20= zMPKWw`^^ifu4mN2rGDPQ{R82US;p zz`{Fnv3KK|QX6f&muCy;h3W-Az!ilFY_H}Rxbq?3p=)vqQnu$)V}+j}+Rhh(97nW@ z3Yd_%ZGKiG1vNWK?2~Bt=Q9&SW3{BGLG%Hi-@lv(lUFgt!g^@|W-{9o?q=63wXwVD zQUcZ209#+RK4xXqn7t#V*EhfW z=v0R>bEvgS|1DvqS?l$+usZ;b9>lPBxBba}fXO_k0dW}-4u*3WTX)V*S%FY7hA5+s53<`IpEtYR5d1-DJIUO3<2|0Q~rVY$cLl5`niti z9Kn8q$|gv*yZL(0;C*WF9#DE?eoVHL6+E_$9zfDn@()!VHN$ z1$;?oEv#%ki87YG69=Cyp5wPRwC;Zh7~c3v(Z_TBo+;}U`!cP8mh5V!=$HGHLzl-J zbyT25uxD6#wZnauL-XBU*2B@NE>MnZ{#&`9M9^pJnS(1K2=rieC|I}Wj(PabGC*oE zM%F@C-ly?6aP#hwqEn?3INY>6^1om}6OI|r+*0DUtOVE3o%3NhHOjLOknmuEqpw;~ z59~oU)+Wa`Wy*5*J5+$rf5;%8!((Q_p;s%_gu7p2=iHmCDXb8$d#n~qPgH~&hS+l& zOb4qg=IzHdU*z1A#FX}OJ#da$7&1=HI`&h3Gw(gU3~}t{@uYZpHApX9gtD)+=yrrI zS|H?(b)CHPDvWm*lyho12!_Th*WT#0$LgE-jEVvRl9!^V7cM8h!4vZS;R9FG;eyBb z=^6ZWEF?d+(gdZRpttZ{CxvDBs?CQ#L6b?#;OrUaTn!%|!0Zt}c!lbES7e_6y&NEB z)r59PJpB2Zh=IN#EYG?0p&2bXEY9jU-t_?`=zH;d);;%>O$$fA6OEKK%&=#+PPfX( z{}@8o0%rJf+`#~PIYr#@u477cHy!NIpmAPRP6lU33)e1OR2sX>R}f~$Pa_~?#-Ex# zH-=YU-e!m%pIQU!@2{JIua0;<8@7}&nQyWN*_pThLVPtnlP9%FeCcd(|MTYAA9Cts zO@m>zFyz;mvzcWzywqG@*9xGtY-(EMoQ06ue#NdsH`gNa-pZFIhW)}A1LBv8o9q^y zl`omaa=o_)mN5Btwy!6`l>f5E7_77S!3a$7vPqKvb^6_Odq+ zhVL+Qoi=&u@GHF7T9*I=CiIj#$ag#m;EO<%N{Mtw-e4vyC^nzdWW z(w()y;KOWz<09v^IA&20TJ{e*BAM$}?8clv%J!s&WTO<+bq%#`ol z33otqyMN0ubNNdrbhQ4g5Fx}!?(fck1Kg~2SQe8vr;RY+8t&LVD*J6VJ*U(9rrjXD zG(Q~UYa$6z)vcQ>akgyHd#7l)LmqQEY5TZ|@8B>?z1i0_Nz`s8+q!1&Ph?35AorW^ zg`D+BBb{gbr^j-3i|J0Xp+l1OmjL%)%sa zGzcMaqbUn+A?0#M?RtoUQw-3b>bsn(!epG=cOk>wa*p_q0cNIN{R(G@Ou&xeHIwjy ze>Hkj50UJX_t?33;vzz3zlG5DqEbv`FYUOy^?vrw<7ye3kucY%8rYyyLFfnaO=Z)~ z_21mXHj7+Lz1t?;7XD1EsZ$&6o&N~L9ZZ<(+eaV(#VM9x+YLbxqhp{{F|yBkQOYdC z52U+uJP$=69mDXAwb~Rp42ic-=WJmLcLHp`qP_CR6ahA8T^1r=!-lx7`_svk~szGS)2MfT3bi?70-zbv^rqS_kPgp2p~r_-CXI* zOyP5z8pb;>!HQ45CF1yT4V>%GKoKGZ$wiPM>#Pqj`GU34o*oT!7iF(CjOWg3nJeKD zC>L(qB;z~EHf6iK09l;eNBgeLeqY^*Z)LJ;PBrPUY893^aD&euLXkh*p#!q#lUcJK zfB5-$g75Y(P!4_W;a2d)`FS=kmtQ`&sO`w9h)5l7Mxp}ulvorq1Tl))qK?( zQ;@+pGrez4YLX^R$L&i}!d!B|<9d5XzZAm(0*eJxvq(zOR;bd@YU=$TtLDou@`@%K z#Zu^JW@EVevunx~P>^40UGy14uB+o2TxTaf@)P9q%+>)9@Q)@5{(0YVEfu2f+!Q<} zn<+Bic=qJ8A3>#g8OZYoU(H2?g!87dE8BZathpM{Qo_`*&aS}5=($ZOx|hoWc@ZbK zJJUlpS5i2{;?i;L@#iTEA>w3zVd1V$hXn;%ub5gu6;dAUxg&h-l;>~!$%r{v8umN$ zB9Y4g%sA!~S$g_y!WQShj#sEgHIIIObIrGBi*kQm;cTn;Oa0BC^xXHnFQb++@8FVj zIL;K9N+>_3dZ(88thM<5C-l~5J`|VzckX>p@o@cXN8iPq+yzAgv`LF-!=;PyPSGvl zC%8JC*<~ZM{F@8i-W?UnI~rv8XaSlodcT7*MfR3i&D8ePJ>C%T_JuGx?SlOux$$GF zygx)|Gn@crq7D0DBq&4p32A?{P`eP|ykGP|cdYgl} z?)uV08wichO@_ZQgZ@%SwQnu15?W1+We~imfwjrPva`@OKFzR z;;;9s7D-v2tQ{l4x%KOMCe0sn4uimb62;a{bG~+EzZ+VBb?YA8V5-W--Xe``2OU$e zL~Z#eeE_;RlVBgzG|k>5i*x0 zw|kq_knL}{u46QJqqOb7Qd_^JJ;2UXfYF!jTL%(`ny&ZoQ>5BXHQ|0WcV&wOorz~_ zdEJ$y!qK;LmeeeJExEI=%?Br|qR&?iJ?GgnEqkXsgqZ=dP*+Wv?#6S2PR+;X=T06D zW08nizI4Z?lN%jTKcp^zO{apVyt?AnZgF&~9A@!y4Wy zv%d(r=x10P+BHVA*peIHa&-*svVgAJkk(DN6d2~f79;Jw9eUPHLXJ97(Xu|#+y%C| z*w6l$6ob@5h9+NAPA6HjR0Ws@q__j>T6dj#8;tsiSz51)<~`1AG9B+Ofl#W7Aq?IL zqVKL9TO73Jd|R56*@zHBn*$faOYTs}M^SpK)v!t%Vd3*|Ccp3H4ZArK`%1U4?V$Xf zyfRJlBdLv;*dS3l|Gnec+MUtuZfnfRnm>A|FP_^{HicQr8@|%x%<#iX(c9!=hwil~ z>m}>~gL}*Ay3+umep+LP*(_^ojez+*>2pCqi8Twu75tEXj&o+Mc&}dU{<;KMzi0rk z8`9X#A&Dhkm|Y$@7S8biFnV9aAMA8Y-$=mfw$sX9N;dGHArsG$RASlIekn#mR0!_7 z)jyX7J$qHD%nf}D!v)U6%KL`7>dYxdr`C|=VM2V97(jDe!@;mU0zW6VSj(qhHbY3H zcf5^esy>&D0mwx6%LE*unpv@~%o-g6a5 z_pFo|+)qNQEk#kN4ae56LpgUf&4;}rqN|tS-2p9Yg7Z|=Mw^~a}}n{t5aIc3r!g^bv%YqYwd>ks+S1RIBOW&AZ6um#;2$S9%&4s{Z^ zd13k%?yFIXFv?fpp^;CzLK5QYEw2TZe`|D2%!NAvrj^0an46-BwW3? zbZCu=4t>{ur4Jlb5K`Tw#Qj^aSj*E3Ah-&cdBO_vo zFhHtdZt!Vx^nf0Aq2(;Uzo~@e%Pj1wr|}$M&_g%l&QTb`FXY}|~MSCS6Q6H_I)5zlYmEOvCI#&U=S2SP)V^eYOuek!I%PYRzXK#T%K}kOI z1Q4^+3=;oh-PZaS>=~x6E4~`uzO91%jdCwbU0$p1 zfVmwqMyV#f$@ZbGVtM(*cDzt6MfGK+70#y?pLSjHPH7(^gtxHSLY2@IaMU+@;X6^! zv*P&PbRIFQ!F(5dv-2}PapxV1lHVWgC*EH3%Y3MB+ydhpiv>HtS30iG(Nmc|b(?`6`eGe<&>;8KA8bOH2lb6%3tKKBEuj3QOPR%FXDPBz3ed8kE zKSr;~-QSS*TxPC$Drg{9cI|1GR!W1PjBk$wNULV(1=kGa5x*?Z4!G--H6oRWVOA%F za!6GQPV?t%AZ8BA(1$mDPw%7!K8+>S6Fz<4DZVE;Q9qxvGeTx+CxNR*Ek}~vYbT)dPlNt4pnj9a`L;-Ls;X9O0rMG zG!9-hdaa?h_`)KgT`98Ky1}iIoLPvOrc8I$_5(mM3|X|QOuozt?$$x+)@sV|8rD;4 zePK2~iSw6^>iN0eo1yXLSwjbOsIA4=KyIJ!t%RmxdQHMu)j`1B4twKpJ# z$CH^_j6W3Ad|eC4Zy_Quz8}aZJU3f^sg=YF465c&T)$|qaYT^q%s0@a8sx5a9a}%Q z|3q0tQ}#pa{!ed~(iQEqc5UMq0|BS~9JFFs3gP4jtd{-B%DLFD-$&Q)_E}D#a`tgR z`W}ezvt;4Jrh3yeEGdE34}HbP*}Q4?iQ#a{H&Q9w=s33eRGs{YZd^hb8amYU8X*|t z_l@c;gA=%?8P7!+U)Fso<*5F*y)69(u(w*0OT+7l)D0dB5F%VoQh~kq=ry27Y|LIEKA(iykoB3)|@ur7LCA)o;z7R=-kQ z@VKI+ey$(ei#$8?w~H;s3PXROIP<63{6uZ#H%iV0jpiijy6ozL zk_YrG-(SRvzCKB2-J5dk&?)G9JY5xnf3?)s)Y6+({Md&-cFBxrcwVNyS@lUjE>9|O zN188Lli>RP1L=)j8()33+3;IN-BE&(xeNow%i5bzatH5A#TckXp*r>to9pX|NvHZh ze%muHljXB6ldrzNC7w$dL;cAMZD?#Ra;2D2lV_#Jb>f)}Hp@JDazPKQ;~Y_2y8-X1 z;4~4Pj9KNhUNg{eD)+KBLBL}RygXJyX*p4nPGDaPO5HD8i5U+ybO#buo-_$#K{M=n zmx|O#AMf?~Hf1D5l*n!8NOvNao;b7*peyC?oW-gO)JzO&&oa~txuGKMKk&B2_!D!& zN9(*V?;P)p@+R#<@>IlL&9a7`JYmcFc;@Guzf5f!2;fxF5u{!+0fF(PyVWa}$m z+F8cqq(&@~MfW|?;U`Xd8hy8sQYwqh?1%+xqRQBDy+&x%Q3&hllIl`Qx2(;>H<{i? z8$5PHu;7wZ(>i=17?&%l4fyVccS*0*Nv&#grjNw!g%EazPEU_t)BCquW^xZYvaFqo zV_9TBHy(c`DB}M}5WibL$Y75AB4^RhuF*urocMOuHu|+wB};HH2~9ME`3NB_+MnWk z^{v#(n8eWj@khIK^IvGmwLvCAgODugpcde^@RBH9xLPa=@@Y+!g8BTY=QljV{un!2 zzd(TBQDdk1BU*%;QnXLBQ@FxF?5sApotIoZOjTrSg@fT4v!!)#Z4WuIfVY+2`}ktc!}(ZQ!u9XdC~?y- z;2=}KY-G?6fJV`AK{O*Ct^bMK$i2dY4!rdRaVAg1CuE~*+GN*DTyl`i7|A3+g~j)c zFVZn%ijWPSk{_o+Is?vLF;QTUuCibL=5>E)ea2>w4l)z39a2jVap0=T7-M~}Z%bse zAc->h`wUepM6(1+#EpYqw7SamafuqZ{R&*9fytnyX!W6pw~agaBOZrL4Zj_8Wj|v9 zl?jG(;^&iS6ZM{cs6M8il1q{7HEs26ZyeTcZE`s`6o>j0ycCBri0zTDhCztjgnH2D zm8+N2^i2dx+itqf0n{GU3a(PFUV2@tD22Wv+z*8)b+V&`@zGf(r~N@%4TTQ@gL>2@ zyngapc9*X>ZJgA#NpE7>_-GEg3u_-EDkG>$&gVQ;a-e#nXej?|COML!X zdy;J*zR&KZIW}hvn)al=ipu#je%Zz;LAq~1;#pxjmd4LLIcyT3Xh{sxz@7$c{CPn> zbUPY0B_sIdN|hO?Yb{JLN^t1Hgxn}gm>4e0m3XiC{;9BwI;D`B@%lKf#9e{P_m5}TAKf~sY8ONW6 zr%R^boxf>xCtppisT`yPmv4Zx zZ-^UfY9MSpdR_uStM7&oYS(P}OKY4m0&r9v)}IEv&!h~igR5h2bGH=@_jex)N(ZD^ zRV*E(^Dwq2Xr+8rV)9XCwW;yp;Br!<&qps-&og*4PvgnR$ILlT?@Dt?$)<;JVtegA zc)j5uAqY{%4XHu@<`nitJ{VaG%uEduD#(6y=&3xzb$MC(*HB%4`><^&BcUUNLu$q% ziIxILww~`b+fO9%-(8MixK^YwQ` z&HixrbodNx;9RZWeqh5s+-l~pzm&qsG*Mv?6#N5kbl3!@UQq#f7*?+T5qw|nDMtuH zBwab;y%YV-5gp%4>|0B5;k{&0vLkI*#bi_SmGd-uJh`^M@#Dqr#$L?${T&#i8NH%;@qZ1ht4;CMN5s8sE|BI zac1Dv`VYBW8ol~sxf&A;WAUb&9H3d>Lp#1<(=z!BPG*cVj5@Yn0V0t@;Pg5*b0~8>06tU&bpsTTa2& z+Hyw9A0qkoFD&y2cOiaR>3zA=lReE};w{#uDC<2L?m3q zpP9(L-x3|I*tM@}-(}=5#hKJePIpUwYEzOj^o8L{Zfonx@T@V>tax%zTSAf6v!vg5O~Da$2p?2+LDIVTM4L?H-K2%O1+cBNkZOxO$Z*QZnN6T)*}9;*6sb za5Sj%i{O{Ln_|q*BCjXj_{DlsY@9dJa^br^MKK94_wZF!hpKJ^N&+$du27Oro^)1Y zewBKDGi_oKm+3(~4T`@yCOdY*BXR3y#Ib)LZ)oIA`X-&}`+?_tjnlpCWk_zW8Jpni zI&3JzHLZN4%b4)@ABnbs)iA2-bO8~Wgg+Af92KN(eD{$L8D#91tm{UJv7x$netRm~ z;d4mSE$i0n6Y`>(YYyJ4r~PXh(fpGy^WAcEn>=Wl{f22c|H`9eN=f%zOL9ra0qB*# zzGi;=4eFGcU+a7y_OjUbQNONH^|O8O84KhsLNDqw@pU<8f(dpTe_rtDuGsS+C2~K% z(3ar$zRuVCvVP*46~{dj8R4ch98r3ow-h@*8+%e|8(JM7tD{|25P7xnET8wBQ^WI* zjof&<^&8j-x9l&3lYM=}9RE$l}9Xr?xuO&?}*cQr+(;v9IEed zw8OIbokP;an)?Vex_ifSRPYToc+WR7w zBkoiA`^Uv-tKo+M?Cs@vxd&?I^n2hOCnb}NI>9D04_&jvzL9?10)7X1gNvqryF)r(7Bd9$bH>c=Om3d9qG*;&FRJiLg&!5gizX5=vTfzr8o2bYm;~+E?WSti9`Gp;dj7F)Igxc7oyZ8x zcgE7{RUwAaa25H!&$hITfJ+>&y*|{o3{CBBZfPr*^`>bn?|pa8j0-~oRg0LFUbM`* zZgjs=Cj4#M5=Y3Uw73C;zx-HyA|Aj=#7wpNgZoM=xox*=DRFbQMl@F0eFS_UE^3g= zG+k-bHsOqW8StixFK{#?N%&1pg8h9NHdHY?g<5ypGqK{nAmwAhC{PtkeG8J3FTjMv zqC}G&uDTCEH1DUy6|b@tnJJL%1SD z-=Qf=*Ly!qHL;spxbelDY@;8(EBM_O7j>nXfPR|j<~O5IwNbO6joWRyw5bXT*%mNq z(ECi%tS%a$X}5G62=T#-noU7_e1vXza5$-v;g><)(3eqq-LJ5D7JjYFj4b4oF(T7j%` z`P(Tc6Y6O+#X({(ODTo6&$1cX`%-0HKdt8D)=!d29xx{p`CKP;a5F6R(L-7@kzM>B zO8z*Hrl|SZ#NyxPtyorBc&0I)oDQHjZB5e3(Au{%62qaC!EUCq;GlWlT&{D%gQ_!r z60=DWvY!;wQI8f9s4QuLZRLol(V032PIA>PXhBjI|7*^QAL{>29RfJZiNFnN1&j}vLEiD8ppg&ajDuMJBW!B`KQfpD_ zx+S{FWrY048R1U}al8%A(@93)i>#nx4edbGFfgOnmhzc#>j#~RpA5Z8OiH)$341|> z_7@Trrp-8!PqbTeu_~GUcIne}DcGzvztHGVKEwaqzaPpl$~eaHb!Ttasp2Kvw-1K` zYq!D3$0PyCtDs?labQl4 zQEVjZYgMuauk`{briXJohuw2(uB1!h#TvN^Xb%8`Qzj$OI`Ith10pB_CqoE}T+q}O zY*(o^7dZibq1>Nuy;;27e=w)*jgO_)zl1td@g2SP-2ZG?%+B8K7({JYy36`;3a}$l zXM6jE5h>72{vGlSNsS{?X+qppg*|rhOa?JteOU9#LHjLn(T%DVCc{}H$DJ)|X1BPe zWmjrKV&!b`ip||M=i8TjOfuoatK`HvIv@3pB;qmgr1>^8qij)pz>v-TLbmS;acEvs z7lX8;fIA;*M-uPO{h1P|%p(4rwrq&%0^ls~1-gX6Wok2c9C-HU`;wu1 zs0>SybSD2Pi&xi#(^YlhlVq!6KLrE9gOsSQxp&_5Jq1`$)e_dV1;VtUmVt4q%xZOs zoJjjs@j$mi0pVU`>ksM=9F`kd9Nvi zKR9;rvok76`W-ryF1|MHl@#a7glJI}D&uuc?u`0@zdq+u}@7Fv}>VU8xl=XP7yXfuj{QAku+y40M{`ScQO(0-BVRZalrmNFf zYfbKpb8*v4-k%}XJqA|F_(d*#-SdJu+`aRDSB5e94r24?onQJF4EBmi_r~$&Qu_J+ zym~fx7@_gCbTH{8>49Sb%=7a*Gec4Y)?ELjW7V^20{^!R*^iyd5Hc!Gl7aOWH$kRf zt_#InG)6i_GTPp591MBdv}`g%?crR>e&&VkyFlnlO%M>h{$b|H6EPmS*IU%EwjUDM zIrLuvCS76C%p#v*TpV6+=|WK~-dYJOy!EFRJ5#c2i6(u_B9o5|#|!0O=@|3vJ<`;y zX^_Z+JzVfKrHR&f7(x@4L#b~ZeG$UAB}E~vmT0SY+Dn+Jn(if-n<%hUwH*Jg{rsAc z?k!L>JzRZXWYmD==s}rbmdE0X4NgF^Ire~IMsQ1EI%6A9%8`I9v`fa6__s`VPUVED zgxf0LC$9yxccDgQhGA8SIkW$q*B=?Y(ALCTq9cPV=nrC{Tj}4LrhUVXK*F%F(;^py3%n1%UjIC#m{)R@lT-#O7 z!u*b3=v47h3dBtBd_Tw#2@EG`xHmMZd0E;990@db+T?6TAU;8eNi(7Awh_^fu4wG4 z){5~!D3AK!<3ZTD2c=kEGZu*W9kbk|j{S(L$Y7jM;skn3tWtH!qhHbVl|4#n-Itu* zF<*)F>0Xg82W=pKj!a-q`PRW}3?2EQM_%^Hh(7HzD%9RHm|#D&!Ta+|$YSSu~rcn{oI9QmMZmK^kp*3iUia@1}utPz`k^z0*b+D464> z_-qBe4Lx`qky1IZivgX22_N58qnz${t$^MSKVU{F0uD_MGy?5@LBt^htUPGKT!C^oecPT<%5@0+VMdQfQ8-Mqtuv#P`lGu=okID>+GqnY%%B3 z+3C1)+MJ{SIiOyNrH;N?R}Y&*dHsIcZ%b5fD&^+s)CzVz?2FJJh>Z2G1ufOnWz7oz z=ZgnDi&{-sVbQ}P2XJg?fbhpY9)LBg+bW((cgAh%515i8D3)wKHaM|xyZNvnzxU&> z6jd3<%yIho;+yzD?BC^R;|`Xc*-AW+YjOpy+H~+-HoO1j33H~y@xU)gw9y%x*6fu_ zMp7)vHsfXWP>oGNUs56pQOOiu1+0b5`z-TW^nMIM*}evjly*VBiPt>9Tm2*uA;0y| z(DL5gRkB(dq-eM;R5H_N?7v`1j#|Ec9u zTM_U&>J8gdVi+qz3{$@?ig1%TV-luX6BrzJkF2%{l8GAl*wr-j%g?H@0xdCnv<>(1 zo4N;4i;ae@#BS;m>Laq{wdFHIhLvq!1fmMTmHG1332VFzIDW>v1+w9*K^i6F2K5Lw z`HvBTuJb~eR~eJ@e^j7eRU@c6`Pl{Kwue7vopc3v+nE_i;KOfW!5nD1w0&9Ud)cT2 zGScuIs)l)5XqeSEe0M3yb-f%EIxv+CRt9))lDW`5XXjG5pU!e_mY7f%-0OcD-^B`{WTw?Qm`LUU3(WR6m z4Pw}{+9d9N5ywIwAPCbLN{*6IX@rNKL%o1I=WA91j^0toq-ZXE9Z36`6rqz1JrGB{ zZ{!iW4o_U6KmqMo()9&LS0SOD&zr&le!OH$gB6}KT%lk8iqOr*@Obi0%KORIdqj1d zy{`(;8RyefhAx&Zw*wBCf5G=Tt^$V0knf^`D=_K`;#88w(V-hkAJzh2dOS2$%)Tp| zM?nuPd$T!*;t*br_KCHrxm); zg5$V!sSYOLx$K79yJG=K4bG3@IbLf4X89yeYQXnrb7N^$MZBaQ#~TRxWzU#DIhxH3 z$FGY+Ge6Xu2+u%y5nS0L$95xc{${I%6gNY@O6cEpd{r?^LQG5C6@Q4(@SxqUB)@heXPPI%NZqABykm}jsQ<+8z&P_jOu#xIICUI~ge!^XIYm@=(K7_A3A zsa?jAR}!s^a&j1_J|>~~Mx4Qwk7y;Djh1m419zFDY+9jaOSy2EWEcfw=Bs4^cX z#Et3>&u|F|iu4cVN9PKPnB?ePdztN2VbA4ajVdY?I2$;doc6t-9s!Rs8nt-kVE0=J zIn6v~P8BWaYXZ(zMI>O>t?{@sp4$d$IhSpOVPgZ2D%C^R0iD`l+tceNO z^YH?cSZ0&ncQBnl>dijX+JT?Zo=_$ZJ}PP-k1joo``|ybMz$ylO~a|cB6|1$+Mgjb z<6in7ZuC9#ecC=YsFKAbvMt>>o=qA1#E@^EL}B3V%1z2FD?XASxcRd5R(VR{WRmJ8 zZ7%t<9bxRadY4E=;%mxBxS+{Dh7reW9?z#pf642en7EVEyV9zE0I z0pxo{bJC5@v0GOZM=TaV(}7dsdeI<%w-PscZ77ml1tE7oWe4D7JL6hI}~ z>}5Z*^#e%PK;g8rt49@GC2}KF;py2Oz4k1JuT0;Bn}1wE*Zn+S~m5sXh%bLukCF5^fBm@%vK1v>n_do#FQ$rwYq zN4#6wT;P!yrM;`cFjq_r<8X4~1~g_2W(6abU@~E-WQJDR%h7(_tv8s$t>w_;9hK6+ z+|jo@*F_me8FS~)vR8jaQtF#O^C~<04Zo>F?x|or9`@&xELPXEJ#ZT0`dK4`)YUqb@9Oi)Xk_*R;-=)TBcf5O1{szA_)ci>l{l~Ohw*4hLto7O;Z1&Rv7bv z{S%iP+@4p8=DIdxOA24rS2v%{j`2it~gRQxCp_Ljs}8B3(HJKdYPomhxHCkHNP{05y5ID1J!F}gSHh@25X8AVbnt7QC?OMbScxLh$ z-8Xpi>&7wvjv9C7h*Qy>C`Ch`&~*8Sgu#>hWf%YW~;qjwce?b6oP%VC~ALA1qxea8j&SjCgwR#(PLz@|$Q=%(a zyUv|G;V;as{N0V$Z%i$naJ&&r5 zRziZpdSk3)Uo#(4PJMryf>|Y+yIUKn!YF79e|fXSs#-9qhWR*uP+gn>3Xh_wSIG`+F=waG4snqV;~VNZlIUW0C{lfhE#CZ`f1G5y-2QG^GV2j- zzl%uLPL&(+j6Ukio99lpGjCWs>kYQMoJWCOI~XJ&TJkj%O!{d0u5X`(wEVSsE5Up` zjHs4g_L4A(+9=X&CsK@k(7Rbd(KO{#tWgM=@Z*t8^HS-~Z6_{O9X($6K78_SEPNaN? zzNl{q5inoTZu+`Gn7U?IJhG{mA>S%C_-lG9(CbRi4A`;f6R;1xxD2bhrB= zTO8C*$V*VEkTeTkYbh_un^mk_<5)AZf?=aOCSK84e@)Ns>* zv~J^Q=#d7WW!K#aG9Tkuj2}HjlDkVOCfvSg2x98I*U_O@sic@if<-ppXE#h+zp!nw zu*NV%9Imz#Mg~W40d-$1ub~N1oU8_TE za9oTqQbhLU)<7hp=aSX*oDawQGj4f;+ULx9WKhBdk29X2n6 zIRy@@cbpcuL+j40IhZ0KAO@wsM~iuMIcX9O>pLqlmQqgf97;ZhLHa5=ZeJW|uUwM$ z{$j%Bsx%W=2$q*{`+99$lH{CyW}bWmsGP$f8Z#-+67ugx-d!8pB7o2ti=7kl+7Ykb z&W!$j`?TKDt#6qSQR|Rh=ZUNXuMO-F5|cQ#UveqwnFjV9#yt=rg`5zk{=NKOh!m{!~>6G)O5WSR{~UOpD{FvZ0`aTncb7|E*}ucxFyi|OiY z7Kasks_iPN*0S#=i}Pm$fFV3a%L1&J`yYfv9jR=zh6ro-BE`-D-Q9V4S2czxHbt2v zJIJ+0G=C!;gXb(?%yDG2m;T*_{i!6D2lunqXmTm&N5*Z! z@&&ZH#G5mocHifS`s?CW%AugZohj^Q+8jBGEjA6ZvT4gd8(5hyYyYVu_x!#-zuc>X zXU5Q_6x2sx3p)33>janNJ^W=jp05ndbr@L63FSh9^)zVS+ajG?S+x4B~tG|zR8e<=X4Ii{0)SR#HbeZef3eE1vt zz3UO1m&Z9{<)F(l^`At<;=sS-9y()9FF9N$bmG~41jS~2+|4q0ElmaZVW;E3ccL;g?UOs#~F zUnM84yDW2zt-n9JeRFYFR7)C7CH>{tkw0;(FI;tk47%a8Ty9X@&|X1`VMGZ2=GgE1 zF?0xGc>?THFKm%B2gps3P*p`{eosjDQYsD+-8EEnu^VaJj+63D&R8PUSA`nYP>3z(kKlDC!yp>f3Fu$2{e; zzXBmI67ewHu#5+nUbtORG2Np4v;+W^zj~HLjDPrO_@=GwjuY6(gBbYbGyEyr(RP5cJvT zvY7XZmD1}qJbT+FsIbgG8%2nNpBL~$ZGR`Pgl@BFRJOgLE<@K-7LJA~P69OAvMW?> zi_u66Y4-usUzv5x73a^JxC)+})%MOXBf+LbIMB=UJ+hrp(KhHx1~peanGniY>vs{D z?+Jt&m0#%vCd51p9|KL~eUggug2`kHiof-`w)l5|)eRIUFS@%tLp)w>jBbHcuU`#Y z`!3q4H)30;x`6Xg1kXiX?Q& zK691UL`d5u$GqCy80r2&Tu%)66vszzkB;LSX2BQEoH|YplU{)W6l<84;)X%X$#nxR z^&74BHfP(Yw3<^>SK@eJ1;6ivmW9^~vvxuNF>Ir#+*yxkNR%f<Cjf*i`;t3zI5qjykF>=HVKL!F;!?JXi<*+9(fy5@$SPjzY6aJQOjkv}s?_bk zj>+tM=~vo)Z88pQZp0PL66G+!Ec)_X+!d#h`mv4UD7}SS*M86N%uLNgu<&PM9r}KBb z2eWj_sTUAnK=QpseQyH~6zi|=>sdU{9!bdTe1`}?xW~(V47NZm7LESiU4;2I;=6Ze zj$_T@EpR8Z&q9M7X~*O1&MKh(p0hA@sxKaef1wOFY`1{dQP5$o1ugz046!e22-=TK z0v+(%2bbFiOAk%a=ih5yHzPpynRjSj`vKrgJjV}1(h~X7QM_H%V?b6S8p)0^TNo-&E%h{dFTpF`U%MppXLF0K%Uqq1lN+_fpVyli$R( z3V^r}l=vBHDA?vsGgg_^sRb4q6&nbNs4X@dHoCeA2-?L3{rtcjf>6Bk zMd*kVAdtI;w7zrJW%eZ7-S}K~&myvr%m|SsFJYysT+s7jSkJd?o`X0Rm2_=gvj%5e zDB|b~E`?tohdsThU_X|3I=oNBTCiZ~s?Q$CHs9JAP*vtDU?bZ-$5i_0?Fy{M7CK(J;+$5V}d)N?~{%^;OLO4i$i^x=nj%H!K!jFnM#2?k+0eAp2Ti z-b-?;CY&BGl#K)ufc!wK#s61W&(q*fjVWIIw0gCUljTdfV)MDY6a&atAd)2SvY&hc zmkD{J8@-PPzfu0RExGeEf-5TwJ|JRj8xQ{xt-*t@jD_1{ zZH@}hxE-JsuA+G#DmcIjHfWN8!`LXPpiH5NiqV9YqgF}Ia!o4eW5g-?(SSpH>_`*F zUo2SvYDeE}5R=k?Lu?$EJ_sgIN5mq{w+&Z2TwTJ;vpjYflSA9a!sp2Gb4%gJnK4HhiL7K)z}r5(qzc~7Y#+~PuM!@V1P z)vbTa;`U)NmK7d{?rg^i*2_+yQXkSR>8n=gj!LlJusAb42-4J}D;(=QI*b}rpFnan zKQWK;3U(AZx- ziv$ByBpdH0?43x@+JX$avd*LWs1hy@Un&@8M|p}m%=9_GUltUq-{M61^O&H6gB4mm zn&VvW-u3C0Jq=F%T>lmImEg0|Iv;r2*~mJHNGb456N42GJVb?ZRp!Q9o$AZ#jtOz< z^y4V_Q^^N_bV0H|?9aU!w0YD7Dki2Os!3`NQTh9y9teoOyy=@knOuu`D*=R!Mae4m zpLN$qhNy8W$;AQ^Ii?js7BrM?$*K9(daDtVYDkrD8q0?wEL-J{c;eVL6{P`yUR?Kl zt;L1K+oRz-Dhz`RQUy#?`^KX;^Dl2;)##Er42DhG6Tex50`s?;-^lP9J2lQYbxR}fJc_jyG8Xm;R^}}{n1F+Q51TIB z`&=V-4v6O2ES5UepAm&{`m0obnjXmu#8QsT8rIXrX|7*S_I!z^SjwsBu~kTf1t5Vd z%6^!KV|Ut8t@N9=-0a2LxV&5caV~3H{T}wC(VLY5Q=?7WFxvUY*UxUFp?GTt7%*GA z%u9eypoGcHa;sB0+-%etXlc`Fpp*Yaghk%Z%z5NaQ;2z^9aWK@zBg{UAy2Qfm@IQ3 zJUZvVhJ8r0?s2u-+mN*NYI^?^%9XO{W!h35-3`#2O<8rCB^O>3fJlOk0dZa-V;#~#ToQ%(oshH>HH!Q)WBvG8 zQeaT`Jg8Co;d*>8G70t{~2&PVfYHkUNd%7_SCx z2pQ&YHr&Vt%8V~@6!8+n(6T2!G1&Uq=s@r5{Xz=#Ts@~52HzS!Gg!|Y67sL-E3QY( zn|uWs2hwO|+w}C>=!UoXDjO^bWg%p0hIWo(ONTY{W9Z8u+cl6o1$KGE8-CGwJj8oRR4wb zGp57hMGKz>14HO}<=&tD)!i*jL{}E(ed7f?z++P0$)+^~kSi0DwKO^{RcbY_Tjx#^ z?U;e$GwEv0ngy(QrTf9eM5sN3@dPQp$dS2ZmAd6|ga&1yS<^bmb2w z(XnV`d!jIeAHz<7(sayb>x``3VmkJds_M?qzj@ju4xvW5#RstONMp;!!u&mz5e2~6_jWr8`YG{_~Uh`6M6AII`_kb)0*2eCXPLsV;} zH7+xlVvyg5PNsO3lQoN=pP&}l7g!GWYGM4CJh>sn;-4l^z@F)pgj7j@_L8+EPLB}lKG zrH;+EKY?R>m;=gr_FPdwO!0l!Zm+!Vkd~sarFmKO(dtc)7sosx` zW(*!l^^~*^@s_dX6uqk-dS<_1&i__B(-0d}YsHw_WlTEkJW7o{S)W(B$C;n7;W*Eb zr{b6$?{J7fHxg<6CU02MQ)o$koA_THni;nfQ1-@ttnPGphiLr3|9%6RlFN^P^s~a# zI3@$GiSM{HEGtRZj?Wf55$YDtrND=RVHLDy=JCok16b-M9oVzQSO!7>)~Qr;`OTv9 zj?{g0y3Gg=k>_Ma#LW&HtLt#9;4taWmY5)HtVcf?&K3_ z5`&|-kC7aIJ@qgtk1Jz;nh~r{U~4kgFTg3Q7brrOV%A>wU-_zK?jl3bzppLINAAo= z0#%XD^a7SsV!r-#L~*G18}|~m5D5%_!kCP1k2+U}eN0%GAx@u6@t3NhLg1OISViw} zt4J{|45<=O1b5hO;_%o`eZ(n1602tmqVzvN8DUoN+oHAZF)=8Q#+cb8di4+5+vZ6o z)F^tTXyS0EYV?lfsEe_TKTrwl4`ZnvaG!rSNbJ=X z4|cB}ytf<+ZWtZ$ngAZT|E*-vUHRZ3j~v~VlPgZ(1Jb=f2S1#zw8n2~?{sbMW&@Xb zFARTy@-B~m(5k>!LydkHGI3i#BQMiyO%!!pvY&w86QH?l0|yFnA3X>;)_KT72h>6n z{Sq_uYM$jh1(jDLvO5bKh<_L4_d6yF!|6x$L&T?8_3F-cCtK5xg`WU1n8$yy*~#$P zzR*Rp)F4@8zDl)JRt?3_Y8#_D@ESM?YK#zMmk1W@fL>^;m*|x$E1?=>r=VD z_*g$QT65L^&hB@4|0$h0q7+jl3IiIEUT;`R(gZc63zf4-e`_ioY8>sW{@ahWfZ^c3 z$HWP$aBVSZA@YB(Oq|u<9^o9$le%tfwc}!jkj1!UT7he_MPCp8fTVE~Ll}s_3g6Ik zwKCO@GD{{;_vp)xm;e<rRb2J!a#*ROc!uFMfIT}MwEn6qn|e! zVCR$|8dn%pDHB<&Lj)P!#%RK? z93mD=s+{KvB1WlsvBiFb0{cyRq|CUtodqgva;9^ZyLcl@FPhH^Xjn~sOH$m>q6{fG zI@baY@N$_g{jF}=*vk!CxP)$Ed5prGz-H~>?tH) z8FIR_xdvs-6_`=UI}5AB+TwjdIcL_X;&SVVIc3Pv{KNDF;G+&3UR2?rRxQDth7h%w zT5~f@8}v0H6|o+R1Q142K!=4n9hEVyR5kZf!ragk;00OFN#lHs=c0O+<=B=?jc{%q z2|bnhTqahg&}z&S{ckaf0OGII{d#(!BW_}MpxjokJ=^=*@Ac0y)V}Cpli^8DL4%K- zN7vXa8{EH%rmP1eHu;U|??n~9NsC2%swfy z+$0k0US%)T#Ya2e)q&+Qt=NlPzO&tJ30D#mb+5V2vlI7#!F@-*3TdW1^MJv_bUTd@ zrUwUcr9RJ9QoGTz=PA|&WKLkP4hVRP%)$)cJlIt!{j!KGrO3-6DZiV&)IhD%q?IDM zHQ+t-M$?fg2mzn(t;<9AYfs$j@eoB!Gi*Nude0KvaQhf$eNI(xT-fKWb2Pmsf&WF8$Z6CA2RG)a^vj)5EaQXpAcNdzH^YOqC2nGJjcs4 zMX$AyGPdWKNkwJUpDQ1`$hhJQZnX#AH>1L%+ONyVOxgc^WBl8$B$|GROz!aCvUA+gJGiMLpVPC?8sdW6=^;wCHhDn49qX<5VubIo#iQTISCs@EjE2zz}CcF-ioquby`tJO>N0Elm74bIGqM-HnhN z3FO;cmF}{>OO(&pB&jv7xFjID-?BfdAVM@%f3dz_B;$7s?KE5-EYAlE*^6`7>$bc> zFB{e4=i0Pw0uHvw5)0s5@Uo!bN02XS#ippbr({W>c9TK~tEzMm&n@GWKTX6ZK|faG z_i;zcRY~Q8>4^`@hw3vxNbJ$i)b=Melbq%qmvQUv-+ao(Uw7}#Z9mmNLi|q;bu(^t zi9=+&Qlht%-&>YQo*44QdHh6*#wTxPu$>6Fl`u!?tkrF)v<-K``2zg~O zZ;SV9I^G>8zyQVZ=}FsMwu7=&lw-}myXk|xg3YIwVEV2J3u10)!yN<#RL1$-fIQJ^ zk5UV@5)AP{DPv17eFS&xUn*do`Y?twfN%26xk$bOJcAbV7SmfKCz>KCWfO3ctGy3v ztL8m@FABp>?k9gULL-rz?VyR8F6YJT^LAEZOUT;Y?BNrOARB_K4|}W+c$jh|;Ya7u zceyITOL~2KtOAYr88EI%JErdUz&7i%WV3E6D_z|$l-2Vac-T0B|F^)W+~EHn*>=ZCnDB6o>g za1eD7;s&{zf4mPcyzhIfsF$56F$IzDy=)QWuIf-M3!oZg$l=W-`5Dsb$|Np*aV8@v zf)>14)lwGM=-5RA3-LCW!Z`ThAg#>UfGw{RtRnyOV7!?j*}?N;++RxuTHWv7q{oC%C=j$#qD$~VpMCSzJ;}I^EC*tEw>fIdO;(Eb$sXvEmR@$p{>&{>-tJ%Zx zY1^G~-PF9s+->up%>4#gaFC`iqM~okh=})JB9{BY=np4)DY)fdUSrqwj50HLcvvQW zvtp*lQ+xiXmtO0uajk^2t}W=b;NZbpjM9JZG97j=S3T-d3r~OTwAZO&-$V?7;@(AR zp-^@_L-Wj>6$T$Kwh=`uzeIG%H;BvE-6DR*zo9}g^cC%E}569U9q zBVwPk;>t(mAN8o)-%RelazxoOLVQ*X)r=__ws{49aFRqV98@PR1E!ZTi}AJI^Y__e zn!I`CsXq<$De+{?>gVlo`i=z%#=7JeFET^%K@P0Y4T&uWp4!?j#gj(dkmrgvPOlL- z%9n+!U1ll+kWt&$Yi#I+rYw3rKqE8D1z14wGUr%Lsdhy3K09DmgMIEENnGvN{S1I6 zJrc@0qWNbeQ<#v2P=3Dm1`dLNU)+oM-B5D!P5H@%4m(PLoyMM@|9@CC%RdqI@dn5~ zxX2&|lU;CPq$FdU-aAas5-Lx(#nDJ%_$y{^hF_bgrdmA;=zlj5aJ}P#OowY;a4()+ zV{7mptx|oTCUWuEwo(bCq7?J(OcIIg$xpAJItX6~;9b97IoM5Gt>z5pjY_JC%AR(o zRtg(AgFf$gVae8C>s>m$+OiS4$t9QWELtf>>MX2Aa{95_OssFMu&LVPSMyfKboSu- zx!#1eHnDmcXRMvvwg~COKsbyJ=gM=*oNrZPu2rhh&>m?}VF1u#t{UeWy?x2JEk;9s zWiEK?G0&dW8b(Red}-q`Dh3G9z40SG%2*oqv-9h0f(S7JD)GS_#lt84v{}6jlWFg- z47R^1J6GnLe-CW;JP)c(5cg;sn>rQ67Qhl6j=9~I28S6I8;zJ}8se#UfXU*rL&-KJ zhCycgEN2O`i5O1kN6^oGX*@6)o)-nBp~6M(DC(&63QqZ^(|G=gi8QKBwB*eEJVy>! znU}kNm8Rn?)g0~SnhKI)N3>VqA#!9v>KhSCRg;XqX8Q5mVkS*pl zAJH@g@*}i?=LUkPAVy$B5*LN}3ba$cYs%y7%iVD4tLC>#I|f75K);Uph0pLBA=mfu zPKP-jxxJ&=g?+4wvhQdP(~(B9x{<3N;H7ELlf-oPc*%B3-l*i9m%TF)n5aMj{7Y-^ z7Y~6&7L{1*z<$%%Lal-Anm3k<%mDm%=SAd*3Ut^%Gn>1Tyi?Itv1^&kzqIIHJ`c-3ZOI_2;8sbF%9Y zT=3<@5NUVTE&=&;jfE&gY;Mjv2El^t6B&Ko7 z6C<Qzm?BnAIc!?@kl#KE&ktF-B6Zh1=^uuAUGm82*+WN+?Nq>+!3!)j< z)t&Y0?YWHEe;f{ctj=rvwO=o1>pQxyFu&7X)c$2!0zjW$6=2V-{7+q${{Ev0%=Gc* zL$PmM6W;6ZONv_Y(aqj$9*+%b z(zP9UvEN7@xR-DKEQ~&AF+)fFc#x(C4qc9=5;NOeN;b&-l^seK;D4bQuv~d+gftKz zavOgxxY%KhYQI*?wTkoxqZAWdj#X!}NBa9{;%b?sC@au#PZk~aVZnV9&$TqB5lovA zBV(=lZ5IeD^KIQ3up7s_=U@u@zljFPcAxZe>WJ7SOOE|C$F7c#^fenM7V-XH769ki za7`Awhy#~Pd#^Lo@bxkx#DUr3t7FY0Gcv?Em2C(WLm95rzh&l|SxIHxhR#H~=_f%$DSu26RCMWY)h- z(=Ov7CSI64n~eWK+FH8IWFDOM&yKe1Iw+t$6@i|> zWoN8bg0Ptdv_>_44qhIcTGV->#v-J-tFhR*?f2)u zWsw8;5Y<=x?#aB;yN}oJ7d?g8lnZfQ&^>xqRT00<{==W#kOBM&kPT2tlC&?#lB6RO zfeq(6I%0h(m0eE?GttLGfG}g0fYk)l6&dOU+$pn?1)6R>yo$2twpX|VG%!s}lmZnX zmPu|UXnCuh0sTV^n5FC3W__cA!@gUoajqi{Usvv1@<>wKFYp@Pu$G0dkNn9k(rm)# zX8>68<;~izM@a&DV0}k1tB=8VV(N~Z*h>R(c zSA3rkv;OOa#RegDj348(Y6xTds#vHBeA~9C4XSbCk;UuhG9l12sK_w+>q}8cZ?>4@ zYOCe2YhN4c&Cx2lbYJAUzb21xYV}mcaBnA~17Pg0W0tC5DPdAR9S>y}x2N3pd8MK^bt*1??3#;C$kF&mNXWVm6_a$-qo zpo|WiI@{r01(U7BRuc2fQHY>K|Di^B3Lw+*GTY!`I4=2`+|+}+^e>i-;DQ)Y&Eq|F zG8TOP5rqy{(K6KcFibn6*~y#VosGO}eJWE}@nkWGv)XFt=r=7+)Y^eF|R^p>TFjg!l+lkWUp()Z87vs z#Xk5E{iO-*(miRs0ts|tED|O4RLDh#5RCo?ScSjRkKbccw$A_>4!A<+kDpm(d`nDE z5}aVEN!}HZ!|?8H+hJ%sNbm^YfW&1=rOwpCa;qn^lYx{ye;oxYfJ1om7hgmYCs!rPKb5US-69 zaRGTjxQ#=WDK+{^mP6BaDkK(FdQEtI){mA1Ur}1G`u%d7SNhP()EtFXmbBBCG`RI? z`0NFUW^+!`E8bAvG~~7g;6sbZs&IP@7FMqVFMqW0ve?HBZFJ;aUWW+4I!6s89^69v z|ImJ~>LPLU$zDrPI#jE=5e5-u#%a-l9a3jvZU6X_3(9M5KH;3tm-x~c_87g8-f9Ic z!?Ry!p8^Ottc4(~?RofL&Z)<^{!e1UljeMcPWBu@lxGEN@C&+vd#?Nn zeQO(CpIEF@TcbCVS2-dCu>W^D% zd50o~ZKIFP&w*;bj->MYuW(?hg8e6vxT%93%$lz*!4Dqx2)dBwJHahQc=S?R`)MLz z3A1sA7EJHyJ&a*fYn2YIm*}k0l~X6%A{eR;dLC8uBu%#E?|y|cz5^Y&7q2wJ0U5^J zjj4<2J_XRznW?{{mxMxiNo7w&fo#>&gOF-G?tN;~rx#6sZd&WgFugh)@=q;3o80uc zza(ZT$~tae;9#OY*Z4bH!(c6Kqqp`2NTB55FT2CWa0=QF1!k6eOTsSPXh?8p z%8+Ex-CC%yVUd^Ua8t#>GTUC)JcO1}J6lqj|LsZ=+Ao;9RL&1qOT_w{6-|e;thb$h z3}8ug_PYtMPVr_=v?e1#nDZ#lD?bBLw1VYppKoJd~ek+AwizAma^OUq;r z@BtaFHfn9GfXUuDV#sbArJY=;twO!+=3wX^4NF_2yEA5#dGoyQLb&y1OtRMdEfbN@ zg4^Z>6V-lamHLp!H4W8on>8sZEmb^l#R(8E>Om(feMfV_bBzuq816eldPBs^Ja&Zc za4w%iiidG7`RJNzxj0S2$UZWh{$dy>nve5P? zR3$v_1hPiMZh8fK%S8G?PkZ4|_3et`@zdTV@<`gGzP&p^hpV?h_=L!EnL(YjTjDaV z8;~jGo;d~Z?$4zS({QkUc*xw5ka^{W#XY7#?8RSGd>!Kzh>sBJSrh7VDNAv4OLWk# zLD`FRBF#R(efKgd0(1D{&7X1R$O;^ox{sM{QYORl^jvn(GwA#idJ%$MPyZ-aNLLCF zFo+0WIZQa-W8toB3Sg=G`pO^H0#~zsI!t?u+L#92km~X!-qWbz9{1QJg;Y|i*wz<* zen_tRq&X=-#6Xh`%qJo_Y~<6<2A>QbmA3(b;)|tVLO9MKW`Gg;A8A z|M3?I(mBr|8+^3KhFp0s|5+D@4B^@>7&sT8%_0XqC4cZ77-PFiiny}tbdK}I^SbdB z8P;`^{Koze{GBLbh`kXZ1MG6wN6WV%qaP+dIA`Gp0uRj}=(Ex{g~X59gSWq4OR0vk ziIojaOeNZ=%Tq12qc+mPd3xRWatjywvm^M`7AIPL2H>%OD-8y1#BY9$1-F}Ntqq)i zdRB&YYPd!vFTzzZGADrMFlhNgUpP(u5Y2xdqbfW73?TKP!{^{Kw_naj2V6 zBp0%-61`xMzWmGoxQE<5%|V?8_IA!&KKjR2z%&$eVrW8zKu%^8E%Uu>%IXsfq-{{A zSi6;zENuQ?EN4?o@-QEM#iTmUMG$s5$6lP0XoEgg)bI4#;Q^|(*3SO;`m@7qo?A&u z!N?5mS^d4xtnU>-64mH2$bvWRrHAx(HfR~J4c6gCOm!kWiTp3Hl6h6E$Y9@SB`%Jdq0k7?e5*avbgAZLxl||ZJ5ds62$r(ZVrGl+S0d@1>%|` zlX*=>eC~>Tzm+kO zq_=~Uk-EPSshZe)BV{XQkgH5|tsX@pQ-F0PL2SVD+gC5jeq&E$LVC`F zYpT*GR2^!TL1dI|n5qevWoa0785ZlgHE&AKC#J)*^+j$`MV&e8lXH#lVD#a`9Ts^3 zf7w+k)$|sN8rQSgR4IdFhGsvXW9;VKIlnwCdWlyY9JW1SA05KH((cz5-!9$_NH2}^ zFyiW=sAQkMeAJ`gS4fbE^}JT-sVe|mJ&g-8!W-`Ds<>^ZJbR%azC3eA)%&|AzlxRk zjcz+OmAQWtE_3SfCAe{s`Ol340}?9iUXVxf$5skwO^Fw-^wsV1{6LOzP(?&mGJ~9 zSB9T9;6Y_@)+HK$SD>d)!u4*8bLNZ&G=Ke{mx}5FC>pWt^kd*b0k`)i=cm~M%`)Cz z3T{K+bJuq$yv;G9=7GTk{x%Tj>TSqEl1y99mlpXW>9jhl)boVQZkpkA8n8l&0^kJ- zchTn=Pq$!8$uYoIIR*2k&8hF4XLlCIE^-K8#IyM z)5$J8JlTQvv~V1G-QP#f*m5|YuT7H`uWvP<$rA?+SUhRDBk|uD_(})4N&=j*yJ+N9 z&jGZLi}RX|MIksjS$u~J3HAooYNg8C>VfHPR5B*>Y(+bt|LF-N&uLTZWZ@_56rUZg z{?)zXJk{~5yM{Z{tNH{z&wPWRzi6;~f9HYY)x{?F6e-(+j3WstnH&9q4FN-h7sj~C zg?lf%>^fUz;TWttmUH2Fc$j+E&Gl&iXq5yNV%jh3!yvKXY6>*8YQZ!7H}tsP4YGGe z#v*}rE*bGUPFm7OGCTQGjW`Z3Nguy5j9{cOgUQsx_v`m!*n6yKRMtiMB?#UFEdhP$8_Nse37#XwFyXNjs2Q z-i*M`oDOuDx)8|dL+E4{wy}$9KuM)g*rQZPwcy9#92(NbB6m@9&I8xX9rBD~2j~4K zn$W}Or$o@q6-$CJTgTl_bW0ILeQRhbAr9zA>`OmfKkXrVxp~b3O!lIsM)|_PY2t7 z&SnA$DJ!9%{na3|P_2IpXqeK{@(u6IOs*UzIjkj-VRlSLb@myLC|)!KsX!xt0*Iko z-987@HtY?t!g|e;(q}(3I+poO!oHzefu;hLOLNOz9LIqXfINGf zC4;!&B)fY-epk6M@Llr$uQXXBHfXi@{t_O7Pf6lZ0tX5S)SnU%kfEYrHTWfg`rX6t z8Gkzp$*^NmkQ=y}iWV*LF*GWrGt}k#hfcOxDMEAfkz|V5UoXAL?Q&oSy@eEtpaLGE zIE|cP;LU(;lic&psK~$U%qsl;qMDpzY?FB}qwIG~DdxcLy^OWJap{=(}JMxs1V>6ELh{E14%)uup@4}Fl1Q%8g!85LGuRWQ5_?I?n3cOIm2G-lhb zr~En6X75^fjks0#!G$iUC!D;7S_+yZPkN37;lPH6ATjgT=;%!*Lf?wacq`{Xu#hZ< z$I_lOS|)Vi;7qG0$93;G_-aVY;`Gu<+f1Zw z8&O}E#iFje6&JPH;SpOIJls$QGh;)3#hO|15mR%&9!K`l_vc!(z6&Qu z8_;FNGuzZUdpxT=5A-^J7QJ=#f%rAcWgdf7o)pxZ)$P$r>v!|AwJx8eTH8Fb^-9@d zv@ba9dMCqbZcq(YL@6NGY%>uGN!%jx^&~aAZL<;hWWS{0HBdp4b}QA!MKh6F&7H6zMR{CQBfYYw!n&6MK$2#GNk^}3(O8x>UYTbX5Y1qGs9-u zC!*y(fAn*Hx`bl9LUI?eCj2sVZ!w_Gq?WE1sfh>)>$i|;Xnl}x7!hj1xPUdzO1TLU zHT+ypaT%fkE}IxiP3pKmN4@{~OJ$DsqEIDJk3rOIY6ExQzMBJ|Qy!j+-fefNgO`3b zW&0||?}*~>plD>C&ldzOHW?AM&I!sx${g*2p#-Sn9a>=L3m$HV`PS-<=k;6h7RDq? z!sgvN0Iwt&CHR~CX2o(I0}sc)^B3xx+qot*i`XT@N?a7v1q7dSyteoGYvmx$(neXG zHx7aLuI7i1S!j-?SA+N~&aV2Fw4!Y6Ls|o8TTBQ?@s4zu#Tga?q{X|IfH#eIRl%N) z5?bPJvF-k8^fzOVYd$UwaPGl3O_LSv&WqQE8bcL6$Iq^Q3tzPh9NKrDea^wXraqk^ zeplK;eCE8@zHoo>!0_nN(3j)kVY=G)`uU)O6bbZl>ub_!FO{a18GMVJQBfhWez$n* zi-3!oPV_p#U5LmT2INAY%w$SL>!)uTr{U0hY!Zr|UDiV@pVjV@YiY;EH^P zeGAd$vt!K`M)QtP+}J{EKN9lgw&gQRNx5Ww@xMDnuhi#8oM+D}+WI@=A%GH_Ir?;Y zvaI7clEZ_~fO9wj=YWaN9z+?^?_2?qH`{s3B6yHG)(iDYOfo?bC4=lmR`WG5=ExvW z&2%0mZM6Md_UB!?A&)jq++n%h9YN?@GPayed+KGC&K8lYrE^6`tU@|~36F(o<8+vZ*@ozwsbRNcZ=XSRZ z*3q0IYGcvIL5%*Lr^wZ{ zPwv^{R~h|6NQ`3l=b=@q!0D6d|?&}UFL%2fnmRwt?VR-6tB+paBL3s1i?aVV|#9quZH z`QxM6rmRHiE9+X)#w@1qy8R!XzA`MXu7?&V?(SA7#ogTc=16|A{c|XYWoE9m@?x=l_oMLJmWXe#aG_RhUU!=ZTw<*jpXDo$EzpKCLv(4Q_@V4pZi(W*TC+P{aB_5?Uh2DR z@w5{C(!V19L?gkJ?vJ2M!P8WF>dSG+rbSY`NeyrPu=CnHn6|3H9~?L$=d_HRwLt7q z!)GkPZ@o4TCp^-9+FfR=+-C0KmZ+Ckt8eT4dtM6(`u9RSzS`tUi;4EScch)3nsfpWq)kV%V5H$S_i>x>#HxHDTIQ7559$U3Z zgKCU|>@^2e*#__!3?MrOnR-W7kDZOKFiC(hoao?2D?2olDg+DLIY(kRdpLITbdi&Z zFEz9+D%I`|g-McD6!Aah$#Puq#8)BmUFw9vl15W`6m^D%oznZAbf}NEP{Vf&fV{Au$5dCAfvz7H zJT{zSawu|`&5bgTDA6@f#eDR53|+cro>thCXvpH(LJf8{s@In8c0r|F(cClk8)TH~L*-y*lVdA4K#Kg5uw>fA9Sas7*4T zZuSC1u|<50ITb_5=kdA=HFQ1D)w9{oC({Pg#KrcTX_!JjkNDC1zz72SSx#6#77^S( zBZ+RO=13MMYcW6f(_K3qR`coY!WJnUEe;>dJ%d)JualQ==2vvHq;JorA;gjJ=!1g# zh6-@&y(>=R*emL;EWfB$zKmYFPLi_O1e+A=p_Z=SRHU=syVbJoC){ihHXaiJ=^jDR z@j?Deio2@e2-Ice_loJCI@ShFTu$;2!>y0^Dj}}RD;00(i@#gg+>SU>6#8I5%p*F? z`aWMPbv~@z=1dPuUtBgIP9S+-! zGG;(dU$4Dbw*%ccmvof4JB;WyDshRvw6L2v@2^sAO-DXxws;p^7Ap%ShoqCWja2VT zmes<~aQEyQi!N+HylYBo`nAa0|MeBCTwpN8mIkG#ldO}SLMy(|Pg>)tL#thgTw4j3 zisoWV@43Abb0=$M|0UK#~jaf`@+2qpcr@$Y$ zb^lxgV#&rSEWD!?#wkQx+}ufowN-!!7&&%U#cm!8#zTaT@4Pa)yHfaY#6E9be&*OT z?|%a|p2HHVTO;VddJ(&4eqidy%gN!OfkPIhc^E@}`Q1vX$2egEnyMx8 z>J^)K>N7HOw`Dxueg7-Gf?}o+lC7G?0AE$UuM1C5RUSC6e&48!!0d-;UtLo6=kkCq z?~VbqrYQAMyc&|s;CPUvo5vxFi^T>4K6DT@bNFaGy+XvWV88QN3oA>Y1240L?+Fx60- zql9TIVZ)JL$TM?JuTGt_WIM~Eq+9-SdTo|)@dGb@sfC`Dfo)#|7WOlhj1g(|-n8JP z&t1Aqk^mLl&sbUoAt8qPT`{O{+f#YMA3hYD1_pI3@dc-7h!Y7W;S@1;T>#PQ5;Gu#Eqg1?o^x5S+-^hJ#7P z_4+umzMiKob!$xTK{e02KXWBt#~^PyfX^aaX^&tM|-7;Crtbp4>=mpBdj%zL&<9k>#q zp_4+5&Ef}RLg8flSRRdw2!l+Ij`Pjc3`nnh=uJYQN@@b}lS{hdC6E;5A>YJbE>~_i zFmGGpcr3EeC<6kn5*U^(7^0vj4sG9fdZ0j%L*d&12P(5DG)#dAN@(lAdG!P~H^&X3 zQ#&sk1+5s4|Fehq;4(qCOyR#7S3;!$U&RV!6(4mYW-uVZVOo(g=!Mw#J*3Ut)d^@p zkdRh?JEe(7AO z31EH!Rdm(jFA)V;2h;6WY`?e%M5`%5sOH#*C%tPHOl+3xtuGLuMDivYRT`r$MEH%r z{T>Nc29;{$bbD5i;K9~D1y>$y#0XXb#99f}dUe?%eOEILDzK38)3VU^(m#E z_EpG!#pEBlKUmB*)4FxK=8G}bTS>-8VHx!wubKp*rW8Z88)+j9fATH}@F0P@y4pkE zN|qyrMrD<~>>8G(0b+RbG!(+2ufphLT)13`h(S}_qnbvi918REm*6qW`0f56 zlJUprhR-LDe)}p#U%irXWFbJG+iWHJLZMgc7l|1;Xgik}E0hW%i+&T;8{1;p z$F&PtzBnG>g(g0Uy&v$QgJ5L*U=H8>vg?cm$-hD&I;R+s-U7{hFm-o#QC|_-jQc&| z=YU2Nwx1p;DY4Vjz9z(T8jcv4SlwvN$V)k-AZY46kSOAH+k4`~c(mSEBZ>Z&ba6_AJpEtUe$Y`QLlCy1H@1=Wm_V?fcUOiqCV zoQOm@L5n%U2A9jt%a3APaixF?2VmAdW3j39yJe6(Xzq}e{`*h+# z%j?H{Y>+x7{D{W`u0%#RNL6y(5U>q-~8x~P}` zI3=LcnE80c_wz1pMIk_&>MXZ=)H1K54|B~O+e{BDfj;NKe zc{u}b@vlvWLzxEM^!-?3RvQaUF^Yg=qm+?RiBTp;2JQnFa)G2u8d+zjC*XdCMB+m1 zcq?NZU{=REd^bnubhRwRdP5OnC+RVz;{LmKe+qQVAspN|F+Lh=ia>yj7ryLZBT9US zTK=Y#5vaQ^`6eN`LfJ9d|A9=(o1`E(BmezqRUpAkl~~jk5rpF2tOo~q__J6uD5f|p zI2#({6N6{0iA*K$-mBr`2G{2}dFKw|IceqoJEfSBh=s2y_%Ar{XL?6nZCL(oZREyp zJ`q^lq~|AO>+#6mC|;2d_q*YJl~$U$LsR(#TP4F$&~A7%!4FH^-FZq=DfWK3KuxE& zeTI%IN<{CCqza=e1!Y|BM!mN%xj@z!c^2{JN_$o?g=)1G-2}_W~~(M!yE? zvIc}&GDo$~$Oa|sr6oKTyxXQmv6d5a$JdciO&SOQr9wN=qoM*npwkpM_QbZS0WfjP z<6!@6;eWSPK_E#YkK&yiqm+|X`J$jo-hBK6VhG{h%@J6f7^fZxnEKb*1oZh$m=RgI$yX-zTbY+UrG}cuBjT# zV|HM8aqX8)BE76jO)k8+8o_`jB^s^Vnv{C>MM=3h*m#czjw>)uL;u$>)o&D z_~=1^N*aYJ>NtT1!si4IjFm4+H56(Y5&wfO!iI(}XDuT(d>7P5Q57K0-P>|hLqmcI zOVt!)&Buw+b2||?xCD+O+r@&W>CtDwn5vQgyL#fOW^x#0Fbor3*Aol=_ZKhe`9&0Z zH0V`0Kn!GJGtL$DMkbWB#gN?o4#g?~30QbYa=q$VKTA9roZ*Xq-@`!sMp6_{zDR@S zdu$Z%uKLJ2kik(D10NrWC=t#|faQkg7uAXQeCrMMRuzlhH7=5odO%_)4d5}zaSF!N zUq>H-k?;91W|K;PC=TMh4t4rI1XRNisaF}Kk$DG8}x7K>B zTSwh^WCHfW^p$9dVZT6_IYIqFh6pU`FTYoLTKzal*Vqh`fGP2%PJUiBAbvlxxR zFfH8E4(7VP2KCRtfnha4c{OMTfdNn z3SK#xkA12(JxxR%R;kNX$s)~L!KhBZyKErQ5Eh%|m`y5{GRKV!g%X3T4lMfsdSLt1 z9Xq4ZUL_pxfpjc+~3`4svK5{t6^T5=MDUqQZCnAcMkE6Q^KiODVtUm*} z&0QsP?$40fR~yPBTts|T@{M~ZAiAMk#SMx35|rx?0@d^jT{YOts+GRV6Y|poW&5|+ zJ;=8kbz=>C#4S84((?9_gvEDUV2^}~TvX>s_$8Ffoqx(X?7@IH8c7ZLcBBt?@4l`@)M=_tZZ9=f7Wiu1cF4dLvG! z+(t1W0m}-srZFn-KE1nhXl}EF&E;J_gg4jz^%)VA8O)&}>9(anwQ-i4+1#ke7q3Bl z5@=^$u+EuRW<@Z6$|4Cgmk@FDRAxkN^Di6@t5u3Ix{|Vyv>;}j-A`M)av(Ol?4dU? z<-|~X)YvreIVYLXXcbU+#~B1FEPb=>A0fJuavv<~Aet!}GrDfbVTKF8=dYI5*W;(w zMqS>x4-T4N5+BD>!^|LbYI7M87|-KHFdx$#3_FE0i5fRP8d}DQX7MTKn6kz*%A`el zW&DbblGP+J!H3dNIN;8L2&ly&L!MkkbA2D2|5DlHQdx;B^>A>D6~+K!ftSbctH*m= z{SN%iU7iIh0izs;D%BQht^`6z076@cz#^(udPk_8eoWrP9XQjuJ`~8!iZ-NpH6^=J zV(f=wJj{89!+ej{*BZynjkydTgmbc^7r3^Y@k)ph>Yy*vv&hQc!U|hGvKbL zp(Q$1wavpWBwJ(Ya`}ZZt!C+0sI5=1k27BO_Z50nwT*T!0cIxMS{*Ba-3<2`zLoV3 zaBa1z1y%dpa;c0pElIfC&x?L|m@kv(!IpR)g;rOaH1kq#vF0%cR@iR6e}Y!DW9Rxx zNL42;~yLFLslybM%%klS-6O zG;;PTnDg)_HdU7?@cDW{%Aa<(vx9S&yh+QKtzzGX&SJ}h)IX*!9_?MzcipzGM6iK5}`uRQyGA&^?oIBTOz7Nj5 za4K*UUx4kg0|cyI+obG1&f(vSJBV0GCqbb$VI`>7GXB$hI(+4LpSud98yUgj^&Xx7 zhnIimixfeE{OC%0+bsw<=xlBGf|vL8abP595wJ(glMvJ;IeJ;IyDDM132)=A@+_$ok$oi4>@6^RJXVSMb1o{HY|k8@B+llfluzf6Kdgxu=-jg&Mo!isGmyKF%Dt zf=-2r(16VXOz{a^=E4HeR^7ZjVvvDJw+3>qntd!vG1nYMzdY+|FL-a?O`RulsC!f8 zT)@Ks1Vrh(iE?<5;eSOp6#P_SKEO8_RP5#kG#Ww(3w3=T(wEk2B>L42n$YN!*!q)J zLd{^S5?I5%HNY+14vnB#=U1RINDCArP^S1R5~_Uw3V=h%`_E*l*3B`i4JojwB+{-0 zX=D2d)a-W1p`mbA(+#@aUrqchK7G&A;0BYXcrr#_gsIiAGQa~VL08>9i{R(9XiRly zIgv^RkolVscC$OQmpxY~XFPd5|72gVPlp&+LIBx})h|2^VBy-szrznnr3xX<&f7LA z4aY`X z&`)O&Rmu=T>v%*{nUyFh)htcpY4)JD3tR4W7rXXxqz}}6kshka6P~FsfHZ%t&;n8E zT;n6~kqt#VhJhTEoNs@B0EsXGou-GJv)a%EGRb`djwi|hvaU51jy4!1hM_=d7UciL zFK02={!!TVj$fzR&osq*pzgCol*Hx5;vCu8nlL4!Qnf2Wf?zB`t{;5h%8*Fm5rPs$ z-Lo#64~4G@Zh&LQ<(w{d`i{JrIL$Yj_Jn1B*LdKP zK+3Ug+>(B96nEhe)-LAkt56E^yk?%T|3r^KFUL5NK8F%xN{Y|- z?yU+Gp_s!k)BejD*I~E#Y`xAF-?U*~Hy=I*{hgoS!fi%5&nT)@rTHf2d;9YJxaQhW z(=_Um%~<(|=}_DO*v?JPzGuH-|J!S9 z9OF^n<&Fx|+LcGAOp1)R2X9cPI)@Go!1hm#$*0T@y=;}dun1+2)O-;>yV?&}> z)<68F5KzIk4)L`nSg^m-wHq2`aLLRoF?-(j$;=2|{*VugZ5%J(rV-1;);unrVuirN z3+Nx*%a&>zkBCnnZ>8Z{S>+%{VnHj~Krfz{7&hOm?v<%1%~6aPt@C1`Q5t1*8#k)y z7Ln8)lW63=jTaK($%QfMvpJI-G5CF7Qe-C=4l&(+SqJ6C>}zjcBT(MSB~UgVzuspP z7pSK*KOHj%pbQNO`PRR7$+EVHdhd*(yUvMYK#M2}T$93`Sv9FJi9Z9phRWp@6Gyi_ zRFkWEeAPMny55^&&(+wIvz44FiZh_aB8|^>J|CuQ5Agp06n+vJ>@A8W9AYUH!|T?A z2_L%J{lczn!#_HgBmY`3hk=!YoyYzix@jmpHDK$rY-Q5?a20Ii}Xj zLEG3oRJ^}_{P^tGNv^)v{`c^BX=TOl-&2Cz#XK};(f7p zAkzx=P^w{zb)-l&cc@Nwd+BU{bK!eLiS7hxE&cftFP$#x| z=e>XPdxyY)5(W0FY%GUta9VnSH&e@F!P6dyk1SOnCj}`}b#Q3*TOO-Pyu%Zj()f3V zvMtl82}i50o}9aQp#xrF4*t74=L-=e*y*%d6OEyX;A*%y;S13zM#sxd{)+6DSmcIc z*T?LuXtH0e7gX^DUcOS>*9XdUFqr*Fbn(>z?s{)g`3k1uEH#~Vl3M*V?*tUdy6`Mf^@zfhxtZs*vqpsci5*g_;n)p!z0gK%% z)Jd&j?AZR7jgm1KKp!l9T>X-d0?rkxgTwnm)-xY%nZO_^hfQaI%gA>tHQ5fsF{RHvATm$~^ZXvc8s2Vohm~P&1enn>u_M~8kJn4L!DwSW} zwkR0wYrie^8D1yE@jL@OL$D9oD6fR6Q~-I3*>HYu>HEWfExM8(Q`o@X(lvjqJbmOhE{njp`z|L}^M# zdat5u+AdiR#j0KI&2XkT@h1 z4qX)bXS2h4?VVCt>n8*^$;lO$XF*u)xh>rS);2{=bYUmvy4`gNu9HdZ)9k=Z*{XYs z!(4hml!Lqm=0S|-r%wDBAejPM3PqCV+q#>A*r}K!!-c6B)=o8iJI{0Sl0@s&{~gIV zyGMsgRec*MjWp~Pa^XbX(ahvld^edw_LLuI%a*}ZSZcO2d#^zE8(fxA|mUZTC z53yI(OvACV*;L_!fx_g@%LtOs!qiZoZo1dX6&_=FuX%YstnHQh-x_u}PH9iZIltjk?uN3A$CXepkl^|D$!_A!2EBaJC zoLGa-hn!J_Ax$(z3hoC)KbJda>Yi+i>5rLHt=NPfq@kZiIL^&?#v9h*joN%}h;!FE z21DxE&3Q)_ySvLHYLV)~SJ!{c+rLn_=FfBK|U>)X?{kBrbPqy0 zq!ZF`FeA!mIj-GKh&Rc*b$!{#v+oIIKC0PU9xJ*ZqeRwW1hPQ@rTFasbu$}JA^21J z7@Ku$WeRdZn9SpkJ!VSZyxA12+x;!p`8?~h0x2$SdmX;~d&vQ(TF<5T^v42v-o(sb z$>>76hf%B5{0f)1O8BR){i{-?O2KI7t1P5nf`{x{E0Cbc*DmKZCR~da5UA3jc!} z_hMof&Y}KWDW^eQi{rNMp?}R=KaNa}!JYs4Ya`O4J$L#(5vxb^U^q^GrV>-$a(uGS z-};9VSUHWdsh5Q*vZ0F7J66AK+MPyJf4h+v^sY@c0FiCZDed4QKHCG3EEgWqp_D@= zJb!-fqO-x^F06;eB4a@z*c(3LBa76E`os_Dl|^~)V0Gk{*vU0=9w~PKfN6BVH;iO0 zD=u;iltK+cEJ%dBB zud>fwrLWC?h{~0#HI4?3PG;Uno@^OfdGvpMp+Tq&0nWGdED-WUnO8+PKI7qYgtri? zV;JO5jyVR4yp;k_{=RcjFgEdvQSGTKR-tX{UELyU7Q~_R5%&R<6xUSB85>4^)tjLq z!z$&SoirG@axe-6%{N)e>EiVs;1?C|Tclz6B_ID6gbHWO=aMs~iA=LvA-ErT$SrN- z6n3;0A2r|q057zg38<_El$IL*t{K;PTiEs24cPlyUoIhCfgBA?zMlVW{-*yX=mS)zSWO=^ipG9EY+2tn2Q9X` z*GgsngSGy>*)3@{fpM)T8i&=DuSO2+5BM{NLV2`3v)d<=D8z2((WSx16uxl4MKI47 zuhx5>y%brsU3^&vT`oXkc_RJ#4@LcBcj`;UZx08@Se6^93g=rIRkbVa)#6ooXQO=R z)rvV_Oi+_MjR6R09r=DUenEiBHvdKf?$Z}s4g*af85P~3;9S|>LzuYaJ5?YL@wVK)KVoH3%0}Ks3osLj z-uo6>W8lczA^X`NU|%~tp~g+he3_NQQMVpu*jWdAdO@OL?P8={c6beU=!L)d0Z`P`3p?ZvO>B(H&KDZI zIuCAcbwdNivkyhZt3I&zC0pdDGc)F%S?;=i7@C}Ec>qmFZ+mU%qa5bKMP#g=U!^MK zwI|{hu#v40&Kf$K}1%@WPddC4tHHb2uew@?S#IfhQSMZ3#8Xv{ZZv zK|v@;a_3$)T<4=7Re6(su4NJ_T`3N|+-9(YFML>`zR~|d@Mf0E{MCi!Js%FZ*A|)G z^wH11T%XDbrkhM;$SSHb*aF1|ee69;6-?gXazjAz?IDp-X>$PFALGK$y9yLr9{JtYOSR%S8;L6>(fC>-DH9*!cUkF1XTd>M?lDye%W$)*e;)9%e z?e4ohcif5a!yY6Zb6R|SBk!A9fKx=2zw_Zr)+}&1HaKDccNw{I z3x)5}>k%Tk%iQ@GXDT%@L)*)U z1QXgl91ng^x@yN>@Z7b{_B;?b2&Ia*(~kbv^>m9=ALrvtzDZ``<^Hv*K_*oT%6~!c zIXH-4fR=y)s=3&OiCxBOCNus5j19~D*ePk#b!z9YF^x*x%Htc! zSy$~0swMg6Z=SqDtn$^+z3%k^WB$cR!UWB!$8^J$ov&&gSoL*3@M|2hy9aIxJ-^;= zxlLRB!{8+#%?1Z1BNf5db?RJT|iGF zL~vF#CmCv<5~-(CFRH^ruz`*$5&WoP8WTOZnrvV~@XG56ixsI$Fmu3o>4Dvr+&!o6 zA5R^hZs(Jp!%W(;pYf`bXGe2ivis_FmM%_7?C*o8fo)zW-*#sUFJV;t{hBp`?}T#9 z&c6(L?AtTg!VkKM$pEtB5F8v$WAyVIkgOlZ3 zf|;gJ4$Z{Ihs={g%sK^aAx#s9OZ6rRdEA4MS;m&%J1U@9hGiz67YyjS665Z35sS;F zpT)e)x+r&2*iKJ-?DZB-Cm(>aY=Pcn|8vO4rRA#Sa>0qI=nOaCV1&cIv}O5EPH7?= zJ}0f;_Y7MH$)yP=%ogy>c9WOC;2t7Kd|q%Guyy#J;usMSAQ|*4qY!B2ogeC`HBG9% z(P&B~&6;s;-WjLXbH4iSRuXD8S;?|5%d9Wo)_yI%`{1Cr{{Dayi>$J#l7OIO@YA|I z>tkM7+z38n>p`}%2u(Lo$h|^Sw_|Yn!J=YvZDo)OYLp7WC8nU-_?p+|c7w^s%`j95 zZ+6PpjZ3Rm+*9bo&Dz&Q=Gz&t{ky6!k|-+mhi&?&4GpIFfAfxOkYyRg3$D0n!>Kht zp}?co@D`_kEb&9M887c&8PWUY%#$gR8f=E=9Yz!wavjFD-@AnP6j$od2DW<-|9q^> zU=IohoeDuvmOw+wusO*m0<}i*^jFG6kcjcK8Ez8Yfov`*SO6-+lVD`2Ln&aWfmV8 zmOTUa@!oo?MSx-Qj=77$r)ovT71VjxqQRk&E$Bc4XxI5#hL*Iqh1iD8e4MFq;vC_* z0k|)c({%H72Nq6oh~zo&9--)IA>D)7SkllsJL&s!)@rF!baORma`Py^@xuEhbb;Gy zTVG2HXXh1fyzYz+wkc^WrIeVXAef~s6^FTNB{+F_f?>Bj=c*HD zk-Mg*Xzn9(g1YTyDAcCPJ7r-wE_dA-^wymoRKHV6*Cc&*WcNCvhUmO4Hx(Lue12$s zb8&l%kXvN7Fd*}$#QS{x*3&&l<70EB$)7tfs6VKAvQ_+M`*A-G#H;IvjSX656@G$oB;kn zpqdM9M&n;s!bW>S#@rql0*tg?gvsJejYt4awd4Q9P zf%f7$XN4kQ+Yco8F;R-(l9Ag>J!eVa|Db zYcx}wIJiK-tO|6u`12vN_nH^Yg0;!EFPlGP3Y}-%OyK+WexSm6N1az0pKYA7eB9Bc0B!5i0fA z(se7V^g3{x&Jx$=&(<8!evo2jzaHG+k&HF`x1a{rrN*EoREo36G-$Mrz$E%>+1$oj z&JTRS2C|xv$}v)5GFOJ-?yB~4KDYC}s?{tinLshgC`$cDWS5jR01WBYHS1Q0spP&T z6arhIZQFpRW(s)NGkz!NI*YL&=)FDg=xO>?o=Tk&*O~)V67_^$MDSn9i;?3GTuW8` zGa<8JPWv-e*Tbdw^z*$(;`L7NtJfs+RgF`=ke_-k+V#30CFKrDC1A5?eHRa8!KzFo z`)1}IBLat=T2+k2SFitIs1VK6m)ZS~^qzHp(U5|>LSEWHJtLQ&sQTKAZD&eMxz9=i zjLYPO3_`!_N=jv~fe5}yyY4{3ojuflvlzY;{_rDpN26<=tdxOxj%3KA+EinP-t@1< z#8U@^d)GqAS3du>PqwFSItt+G8G#c*i{5S`OlR!Xz(!0DOY`*GjSJi|yL~Hm^H`v{z z!xdkJ9VLF<=>h4{;Y#9tN1l&u3=Rlcp2ca?dMb6dpv? z0eTcMZER%KiObrcaLH8dADSC!X%2w>;9f#}x#jE~jj{yB5uP z7v)!4RNG);2*@8Um>W1EO*SkSSNG{&nyk?%Bg8SjUw>{0GO>m}%G{$N_zPg@TLJNItZ10$ya@dtWt$;={PmQl-C#!&+^EGFEM@JafLd7`f_x#}BcV1~&sC2z(XX0rkWJ8xs7 z&vJDxGs5Fn1xbVHMht64@cMsZeIQQ(cnsB(k$%15Y&k-D67J4{Y9d3Nj|gG`-IaW$ zikN72sd8py^!h_#R7zTdpEy6Yzw6OP&thgs)ku4DpXQv0op}tSe;vSC z`x+lWW`Z8zZ1r+gs`H>zA{PIIYq2a~7s%mH6R&X9_x|R`;$plzpoG(VF@oedsAO=i za$|U?h0s39n_dQ> zZq#0>RFWB_J0{OB^^d4+KkeUTEGrY%H2O@4?A~T=&wH)Q!4Ar8yY;(k7B!^|RuDFm zwC-Zen$Hv0d>uK0RNwHvVyJIeAyN#JovPUx9DYE!sB&aCM8)lTS40BcRg7-^+mqJW zSvtCfN*3cXFpvcVNb@2k6mAJDEoL)HIR~ew$vlFJgcXgS^TZ#0&F5#Fbf$5cna_8o zZMG%RiY@=pA%UQ~|K>Pn616H@e&TV{r9R}XC;VH?@wzT-D!p(m;HAD2QfaT+b^{4= z{ld@J${-}v1zTP*c^!T7A~MZ8ahJ@Giu{@$()jj=EOd)x|H8$QFQ%`fgI!d^nuw`+ zEJhGo@alCW*Xx{2FX6+em(8_A8R?j3E`M9e=51Ug`KnH(SG4DeU+4+gkz^?P3iUZh zBy+7I)$*T9`~CdacWh#_G$CKg(pnF#HpZx!{fR(M-9E5j*EV0GxK$=m$HP}yXNizb zn?=82MRIa7U>+CprstPgagAoqvw(eRkJ?P@6#kj!2atBAx(1Zw;Rl|^Z@fPEcuFV6 zEc#-uL_)ejZnP6sV{yMvKXu^g{+`pW%{}%sLfS)47COirX6Q^a8FQ(~Aq-ai05TNn zl>Wgs`>c@QFlLZ-b!8l$s>LUom4`swG)yrubyPR+-?&CZY{-(p)5fP$^LB8{3CIqp z!U&tGjzg9@y^HxdS1@+3S?%Hir+d(L)|H zpdi=PrXPaRisM56o`{$}LxAYh$NQ3{(Tq~rxgXJH1W5NMGD5xBKfBNx`Xy<6et3=b zyUwKLMbmZI4;-8*_LGJ@YQ8~zQm!zd^gmts?XB%ln`)%{q@Oj^8{*@k+)?RjSiz)( z0%p=TjW4NMzT}I2u|#&_|7j_GvfPx3_t2ly5p8l&3B2d8>w~2VnG~(7Y*x2t83se1 zANy@CcQAEkW7QndWKVu=CO~epw*~5ciqWLxdTv8fE2GByb^x7D&~J!W`^qV=;4`0CE3{(+D*i63lBW z6b33d$^0)DRS{D8DNgkxuE1C1I+?dqbXsTv>vT@h>CeYSQ^!MheK+f=R6Q>O4U_ZL?l!1p_Cjdyd zS2Y%pz_6t!WKDm@M{#Mr2;A&F$UVN}3bYWytBY5=Xp`wVn%chg`qm#0YK|k?;qs1d zoDZen8LyX;$DcPXk;u+z^{({c5Vh{^7{`{9N;eg7y8T<{ZOGPjD~5N|ovi-da~dL_ zSork=N4Ap)bzUb|d62GK!0ve5*yGmOCJwmQVF87ilk~Z4W!-<*uV^GI&vIoraFh8= zshJZ@p$I!BN!tZNW9nPNdEvcZSvuoILyPZxR|Uml$J0WAIBEoPQ=$W$#K=6RrAg~3 zMYt^a*kALdnpl$>-J;Z{GNUtKbXVRO7e^lsK>2Q}MM}72=Up%TLHz4|Dbn_3X$(D@ zy4ZiXTB=LFC--#9f9|9ON#?}w^*IU?d)!OJJk#A4{LJF#H`a(B1@}lj{YGmJ? zn^@@?NHCW2A++bM9uKFJr}wsg7xhn8@o)qI7|&9}HgkA1q?|A{f%j=xj#Z`%sx%M% z%UIu&x<6k3cMmJT0Xl=9&5ZS*oocV7TmPE7qFDF)@zq?Bym@a?8<#=Li0sd+R6B3v z&UBaEbOYb;M9L44V`do3DtXrv4iT3k#dsB073_S?NbTp~pBBe<=Y@Q347_zYNfS%e zuA}|9O`Tm&isWTzZT9+m+J1aYr=!;cu*5C-q zPk%hBVNNOe9YPw(yj`_mm?7JKaVC87;X1vhEcIZX5!oqsHX~Y9@GU{Avl-#G8h>f? z^$jxz!!%L@lU6MXXKdc3rm9tXMSjJvyTjJUd>o9wI>RCXzS0^W(u8ZA;A=B+z=8*5 zZ-z+D(dtPe*(f$%=QjG^wvmkRnvXQA2wGP?&j+9JSWQ+10H$>dP(Gm{l!ZXwyjhbA zP?B5l2C1-Ehq}uRDjVyn4O6(PCgT;GH~iJZqI-CTp;+76@Ycr}f$}4FT^jk^$b>l< zC+FOVO!c5%8=Ded6ekTdn*zo0j+<61_60ONq-AFH#yi6>^W2)ivClfOv(Ui3p!?o) zlNm3m5_6&NEmoE#q)Ru`cY@tL0ezdx7!&OPMDosHGg!c5tKLZ4sA=$zJgrAypcA6e zDUxe4cr0Z^_+@Kr2;Az%09nZML?U`)tScrc_{;d;P|)(0aAJ9?Cz5JdJ-0y8n73>{ z>Pe&ckz16(*tNHY_}&xzf@L+Pv%*TgfDX;xh$3Fph6hm}xLD6yt=QS3d*|+N;16lI zSA{_(1>%u{GXb1H#egbwD#xCDCfgnHG-9wwuoFQkwjFF(GKkBL>Fs^|&$u7-9Thq^!sYLr|ceJ@xzIpyz?TF{TYV!yEjh0b7QekgDyNdAb6e3evye_*J?9kxpgn4 z3@b~C(!A$uWH!%|&=25ZaEj;qPi(L@{0xG?!J{t3#73c~6zu6<_f>zKer5B=tHuY? zuI<0Z(AE6%8q^!vQfTyZM*DkS&6@<&{Az?m2%oLMnDG4mum#j&r0uHex>_W|Cn~Xw z{GkfR-ojdwVr>YgfNIor@&vm-L3Jvmij6x)y+`faqNcuP`O~nYbd||z1klCl5$b6) z)>~s;Isv}_%l}P%jafe~ukCshrApUZEa;*CY{;Y9u;H8GcFAQ>xU9tl4XPgWcN|}E zmf3;kF2$qC+-yHK(H{!gAq=Y&&=SA?Ck09XdTtSwLm78xj-CwYLq`Mij5@JwcHq3$>S5S|D@H zpdPaM_W$xNb*@vroE!fZ^ymppcz}Q8imQ&cFHzS!o{<8kja#`@ZZQ9lm=r*%)Za`t zL%fGUs;xnW4FJVOwzP9dzhL2Lud^MDxrp%xi7hQkrVv9uK9FmxffWJTpb285?Nsfw z-~Tj_1S1n{89@X%;+Ft#avDqg*1)X0xi3wo_12jsMJPC~M2yDLe>EEX=tMP{_=j1x zb*wVn#wwkz`;yWwH-*i|xLQ>V;%oCW2&$q&=kCgX7JLubupC=b{f4sHdP>T-YEfUm zJja@h+u?7sFJa8rGt}yslHQmcvJ%P4^0%oIfkAWMR0)J!@U|*>PItf#ep6^7hf47% z1kj`r`9BbE-p~EfTon5H@^o5P0ObtR+?No^xSx?hCmk z2AwK+AwC2Rfw1c?cUO4}q>%t~_}&2**EZO9w40`E(Lr4%t9=!23T;IzUu&*9YbCd3-1QaZQe`(O1*xl|2SnLM zrf?Y=M_78XeIFhiD82BhUnb#yK_8x7)#S{>iSl=P**?eAc5TbaM!q)@HcA?X{phQ) zoJ2F^2}D=woODnFAXg&UH2P0*Upx-4&G~jcdn7RaK?viW*F!O)-GWE53dqH{D`FCJ z{OZy~YWSoxz6_-iBjBK&OCh5!c1}q3rrBZhJ|p^VB*Ysn+|tE{pNB-GNk8DkZTTnst?3FF^n*m{j)|KqB> z=cx!TG-GrwrYuBWs>AYP-iuPsZ_?q2{H5eX6Knf7k=#n9S8kDOj5{=BJ_73lOBs|v z(WMlG2i0ZYEm@0{*b0X8u7=8}*pJx(d(Tu`wGR3x=U3ZVD$=NcHn=r&AD3#zsaJaT zk~w1bn;1YH1PzUK2r&slyOA`EG>6puk#l}lj?K$QVgX=t9mS)^_T`!LBg|Ac_cera z)(wqZ`#b#L4Hq@|PTMov?L{U-tRWqTs^CtO<*o?B{+cCArb=(<u^-HIT4++_;EN@AppVfBKAT$4x4;qMVs}f(U?qNyN?$ z^A$Jif*;h2IC{YCzu#4ofbd{#9s)Qfl}Qt{n$m^H`nvUny0oqx4~W9Z^?LfpzQW&( z%j@+he0Hp$lgk9L%0DSBT zehssQ)b5;B*;4jg@VVGD+@NE*q_4+Sgs%K_{=L(87q=?Os$V&GFiOl4+V8Nb(;BF# z=6FN?bZ`Jg$X(TRohx)rA91~3`%&Z14B}*61R-cgUu-zjv{1`v$5Gd*d@h4R+zUTL zQI)m~mc?TaM;nZxg1Z~_awYAFRfe_TLwEqiDmVg)ItOI8zAkme7jPC?Snf4Dzm zUft;Ie>0xxFyL_w*vg|e;4L4H^S^yUPbo`Yml@}ha&hA)ZT4jQsrT zmIA#j+j`+dH($M5L;IAUflT*{t6|Gmvc(Hgi}EF;0c%zax(Bf$ttGU@-#-?mV~X39 zFjvXlJ-<$GmvG1aNK$Gl%~-z!EC#{woXB0af2C?we<@@!8b7+p`00_@D|h~JC_$iJ1&}JKg&rdn zalco(Wf~iqSyquMI_$Uj`B@5oAMkYin+m52yP7tV@yK|3ksY%p)FC79J%=o(DU65> zW;H*3P|&FzQN%h4q*_q#)F4wbpC5^gBStJj1J6Yv{VIhN>HHMG)d(^3I&1jEw%Pg` ze43AFgr`U{OmXzVP)%J4T^Sc5T z2T+$i{^l1pHvPLfpUh5p7arGgT6it9AjxDb?yVXDce;)O(BL$kMn+ck?3t-K{W4m{ zku=h2WebOc4oNCCWLn_x`9<~gYC66#j;IJ87P3Hna{BAOTNI^Qrd?DSi(=y7F?keM z#mM-oLd0-K8_BP6g!Qs4FN3KRge?cZ6o3|;oytMzhj65F&`&WnPXbS`?!x&cW0OitiU1y zCnS}8D*Q?jYN$TMTWcae=ThQP+Ac$V{98eZ{HQ3y?fF&w@~0rgOWmB1Bn-Zqhv1n8 z-Bl>%PkI&mVDE@UR}3tGk-Z{r(#|2l0FiaD2-ooaha3_ls2`^kpQXdp5!QHO+6@*I zLzFtxP=u7ITt_)qwQmN@}lE_d%td6rh60}N{?aXkXU#0AlnLz{EGrSd9 zg;fgk62ua={Kr zfQ$Tf)CGGo-znQXl(3jKT1XW%@^ZWCT`143Ao2uRYwE7OtL&G?Nnd^a@6mCvj{~w% z8TyXry3Cxdg|K?H*wvWShqK~k8{snCB23>KQglJQ-K|g9fg##-B*Gm*7`d`MTI#uL zAhRFKqJs`t8#R9eVGI&+%&0zsorUc_R<`Jp)mgmdH??m~x)GF*uN(%Wt91>?aaMGu zvnJD^A3`_a4v%7(lPzJiAXS9Orj)bNBI#Ut;ic}r$SlEXpHmhGhpb0M$g$-4imqrD>rf@)+GL^0SxxIWaxEWn_#!DBRrFC*I z+e>ol^}CEGfxB_;IJ16&<=el&>-I>Y+Eo4s7G=x6ZN-+t;n_f;vCW!U4&s+5jMZVl zwFgpDZ7vrnHc^CP?RfIh;e?sev^_jPSBdN!b*-aXUjt)ljR1p<`to|0KhjPI`iCF6 zBevdu@?kYLby8=TO5F4Xi2x@pJp`$6AmgfoZKjCVVRp&!g5!hnIj-oCO?^gJ=6k7% zEn@FtrbgnF-h~51|Am%=Y4lc8>FLIPNlN7-Mx#%pba0?Q9hiL~@``i#4L<*AOu=+ zD1dU|KQ|P&$6cq3$5&^pqcK&&@7(KLlJeN*e+G3i|Gfx44%Wq=%ukH;D09Oz3aczR z6Y#%BQb=c{=ao3&<@8by{o-2XprZkzO*eF(k-?~Bw3LhjRSgo5LY3zq!b@v3q&uNX zZ{RU1Bw!_b#&?*7_Y&-ik^0Q7rT$g*G>{4ow7jn=6KYVdqPgZO%o9&5C?M-V~p_Z3EF`#u0FZ_Lc&DajK5hDeBe?C38`K;&LW~W(C zdaYv@d&}$RXZ(2s-p#_CuY|V;=xU-K{GK1m@qDp|q;W30m&P8wsOD5Tbn^O=4z%UyA82Ykat%C z6&Aqy&tU7?<8GmP=Bdsfv2V2>hxtHt_=&bj{Kxs`l}E9%+SS2mb~NK7nwpwXuQP}) z9jxKfvz5BV{neN5V@K~}YE;OqM@1oXD_H^=CY+0li6H#(dkNQh?1Nx}p=DpxS}brW zl^?y>X488lei9tuE;M7)Y!img2}#WfF`Skx+~^5A`11)`2qIiyBsz#^#h9q&67AwQ zI0rEG%^Qx|3Tr>P-Pz#3W!hh82A;d2kwh=-O>?Qdg`fu9e_8>)-@-N-S{?MMIM($| ze*UWO$fG%XXa2jrX1H4Fu@u-~8$_`x-1%{iaC12;w6;j7!Tbwyw7hd`kl5J{kLA7a zsJ!I|#bgEJA0IRy9niCBxmUlmu$M zbGxL;X0vG~6wg0ZQEfhY?bgmly}DG*vFM|vMOx$E#|u(ntO%i^BSQNtwHCXK|G5Q2 zSdc2crRP2yZUW6o*y;}ZBn;sIB`RdD&u@K1c{z+m0iLc{5e;oHD)Ki&_p%)3*b9KL z2j!U7)bF2l8y4l$?wu9+)XFbnKO(FL`TF8hkQYW@xvy-CHO5qZdO< zsr^6niynxU%h=a?KkGuPn7bY$iY%8y3^PkK>w$YpxNO=V<9v*@cfb3yk!^%8g|A%x z7*M6+mnNXtoVQ-max(pF6h1@WTE*iO*BPn6Va7+zLewnOs;F#IiVG%NX~91?6^m|F zDrsFfe4Mdic;R|qK+{z@hbAY{DFVA=zpnZ;Lea;?g0$g6#Ytt zc^FYBT`ckO7+BT{IS9`+qWwOLBSQ}dYRU2L&x%|bG%KlD3_5aCLta%#_ZeaJw*Eao ztgt8NqqNkbCQ#Zer=o=g*a#N(kDmol*b_mcAoZjoly=ZpXCD6+1@T}-X`muF&O86b z_4d1_0!GC@Tnl`VdP2Q`p0%tcueSHNYCz1~*1=)t05{)v!0pLA{v$f>V5Fhyce;ej z+TE9Y{I1(yc=Wd>SXs=>%zi9p`ftMl zf{~D^gL%zO*4;K~Di?6h5sR&pdzMWjH}CpCrP{uRhe~~AEP^h1Wk=m@g`R;CmEpsf z^{1$`x_-OkP!sW9b-fQI0JqQwA%3fUL2jpwOy-o-FMd$|YRMuZ>sjOq!vFIo24j_p z3@iT(y7x^gvFoxJQug7?>1^^k8c6w0HAjE$!15atC!=40IFK}V>8jNJCdMU3JmD-5 z{-aSUyaEy1TVl)IFuz#4VDgg}SqL!>ZxcgE_xLcQ4WijcSM3nJ3I%%?OyrjUH} z;e8G{c7``Ph9+{Fc|`tXwapB(IcT80hhvMeE2`=gU?7~jib!|`D`6NNyS(_a3|DDw zk(D3}Zk@_DCdW?XqB>>h=tgZk7mZI+9ud$3yzSdB@bi7d>zEXeOiWEbetKAi7m7lw zx|EjF%PBibgCEsZziT1{LD&X|F#8kYnoa2m?gn=>--{?UYn?}NopyHQ&U|D%%=2iX z`&sAOYEvrDf5pf}#D#uNa~5s7O@r4;XNIn9J4x2$pC$7+kLeT)zi zHCAfu!r<*sr4;HqKBiCtCaMjnHn#9hqC|i3<^2%I0O-O}*N8}RA!pG?|Oh5POnBykUe44nhMO2ZySjkttw8&pZf;mT@#pQ%timdP8XBg}^(?Bl_@# z!Ji$47d$}4gP5Hhf`{W(Rrg#Zb{)N!K z0Sc3%F^#;4+TwIGYWgU%`*qxIC9(x8F^$AIeD6Y?Q5F#ur z=Ha-r!)rW(OwZvJ!)W!|0~}nygILM&EG$SOh`qr@O`@RoZ34ZXjpijtfh#42ZBh50 zuww8HH8unQbe8ztj`vg}*(V4r8T)jKjdi<+)+egF=DV&_)k)+_3L#bTetNlPn=v>D z)%Sr9!C6`5-8;CSsqEV{D791j zYsz&DizJmNeAI*3zup*sLf-1i!UY=(R!}6K86!!sBhq(dm5U`wib*EKQ=tWY|*scUPj%drwZ-1qZQI$~Z8zRj&CWDUU3 zq`?a{3)%`@LRaMA0Ka={%zj3|fm}?Ve*`uN3v1q1vl0c1hTaUPN-+ zh24)~oKnwQo9o6|P(zEZ7v8wv(H)$&0y?DS03a;c*MB8Mkb(|QU=L(zSfncNJM5oDx$R~o<7X;eg#yh~v6>w;@0^!@2-cdmjpDh=qh=Z{ zQMGM8pR>{_<;F=+4>KO)h#=_5)^B_X`!RHY8B^nUz)J+iJ7WTbcLOCL#NIEEZYx^Z z2@g@$uN7+m0}d>}$^H%4IzU7VU+3?OTu-Fd{KVb)q1tD3_JGH?6^6|Z9zB_hkJ5R} z){%xS(Fd7`(E9@`E34TUK4S9C4Ypb{Jy4K2D<`LM{E`775KSv$4(2m19 z$j`Jj#0gd#y_`g7eSKYSfNs%lZddXfU5J@e*F@H`p6@6qM50KOTfE3o$Xa#*?a0p@ zzO`p0&E85azmwU26qH^@6+(Q%e7_Gk4-bHUS!$r4pxxZwv~Q(eKnc$2j_o@eQ~&J);Pm{*i25&BAfmOpOLd$=k*WJ;R(u(>>582fZ6SZD$Vb*1Rl+$C)QsKEkLQ*oe01~TiWvQdG8^=4Pn0(x#c%HtP$FiJ zHh&Ye0Hw7q*LszpeiEYl)e|f}x^KWy%Y*lINJuVDNju0mUY-c7tX=kPRc{H7(I#{j zVKwDr##DYt!uY;>z%2zQBD}2X!JF$nRa+@EjV5HJbp=K#uO}y3@g02OF$4{)$c9sg z<>z%6`z2gUg8@F{HKX~eWK7A5Z~pVAo!UHBD6CVT-9Uz3vpstfBruTT%pr3(NMp_U zucTiA8YXHV06KNpqU(+8y2XR~&)5#;vbZK=GCMB%Kkc@#SI-ti`?wS-4qOX6O~%&P z&9-wv3WYmK3dJ4=x?SDUYSpwErKc%6`Tm2aWh9uYq-yF_l zIrhc~51}ry(nC>IBElpyOLHFhpbfwEuh~&+)873(!c+0X*}eiLCtecIW0g}nL#^L) z*eZq;j4vTmS<`ZdvMX1)0$PswBe2v)1ul82eL^B~AAa-wiLvt{Pb#`%MZHo*)?T~Ov{gKX<-gH@HIvgf(2i3#*ty}f z!T_9#3&2ibO8AkqZuF=1$yFB+ZacEDIXv9Ax?%CirN_yyc^rh$Ib6jIXP49SRoBE@ z651xIs5M=~ZAJziDxm3BP3H+{!j)KHT076FkX6!xKl-Jp4hd`Y&g8l)BD@X6aHi{D zyNTD-_JT?LULuFcwmiJ}W~|x2m7-ttQ)Z-;Z2V)sgmnJyS5_6#^4pS7RffPk)qLyw!l)Ta|y;K2I_lD|M72tPT6(Kl5S^3(K80Vh(2 zA6Cy5a)rN=m#JPw>UI{3E6auUXd3aV#{T`i3as~GTi*~H8vpz)M=O>r2V>^|mX>Oz zO|=}Z%IQ%Z_~2b|q5C>bzv=zjslM1@{~1|~ufRVPBU^jRRs-ziph0@E;p;)GAEqbc zGw6kR_-P3t@%;Ls`ZgPqsd_O`kw{nl)bmc5}iS1dNk}oBXxqLVDSO3J< z*Ql4Zi@;G!&X>JZ<+Bc2xkBg)Gd;v||2^X5V)`B2+u%n~axWLk1cg@5kQsaC?WzMs z$cFb1ehEc9wpq!@;(bu8NO|`bzStQ2%iG`bWlpB@n+Bow#LoL0<}jpuU@lUA%x3^q zH7h4OZW_bxJXG^J@9}Mx2U&f(p@J$=SagcQTztnu*l9Cu&u-rO!+%&hYOJ%VD3=&{ zf)G~kkE2S+mjkR0s?7nz-BDv0!a#Vr|IY$QKS687mEdCXJvt|0(35;5e!Gt8%Hk>K zsq@(xI}m0+>%0#97JAxA1v=go!IHem$9?-JzA2{(#^2lC80pkdPc#dFo=+|TMzWtq zVmtG?&JWZZVy`=vmo!Jr_qHE}MWMYRp$QJ@BWs3yoWWzn@npOqWgSD{!a`uq;nAtW-A}R zC3p3|luTg1+6x2O#C@bJlE4}nIC2A^V=QQa{8xp$k&OL zc$pplN*1-B!ZG=(R-3%7LtagFs9@){&X2z{@N0dBxxSfr0^7Z$-va$E?^b*!44Wk} zbe5o#Vyyfw%o3b@t9T|I(WhQoqNIQL8^g>SUDeIWkyoe$t zq}_t}oAhy?ssH{?Bh6BDH>RKcPMS-P-bz`YP@8BdglsR@K*I@Tx6Crtg|VH$ikBNT=4d7mD(-q1l9kVd3lBO`3V+Wb(poHp{RhTy_y>rKcu zZvc#K!o0^6rN?;@E=FAyva5xJF5*Ov)+TR67pdNg30RMY0ervdC6_CJ956}|+ku?1 zeO=nnY4Su32inb)?3pcVJR9!It08=U>LXcbRnlorno-#L_w8??>$zca6~v~|LwvwZ zD47--^he2pQy56TJzA~P8GpNU{d48XR>^IUK_+A+L>If^k39GYR5y>`lBd%r48*_B zZYcBx9?)R@u~Si&KP^|3W{8|CfHV z^^fUMeM!d;g_fkyg8Y_{g0kp+sMn-Fyjf5Y=o!s+wG_P@|eR17J7ArDc$ zPm8iDPkzsXyWiP5KbI(Ir1ac>$qEk-cd(HRt?mzxS#gn6^Xg+Zp@04SE!|AVy|}*P z=r=(YafyWWJoa(NA@ov_KR{{Hu0!bqaYivkkpA#xDHb0~U2Ih3m2lYU8g+{3n^DwK zC7B7MA#E1`=sn2|_8^y`5GO=Gt0% zg}Xs-bKB+fXI74vCp2jz)3I=j>$xcVPkSVdYJ9x(hE`#W;TW1#|6vuVVCCa1C+!@d z*UxBHFfYreZZJk+APzzH&R>d}%vkCoCnFhkvHLT&<^)~x25&eg zlFn2)I75YPQ^&wmAyK~3^6=yRH9P-@QfJU~ZEW0$fo{%cM$43>rDq|t`5mh;+^Ukh zljXYqAsFqV$L_Cf@I*zZ2uZbW*e-olTd7BB4%4~(zxIR>A%8fSF zb9mW-tgeaY`#mmifx7-!zf|8mT**6d3I{Ze@<*c(gbc|8U9mIxnOHL#GMJ!f>$|j) zPn~$S(Py%)Z$9r%Fk8J5zhN8X3qiV}#~fa=ME30-Sm;dV0>R+K95)v$ zDWbJBkcGDYsa)Kl4j6NQ(y(v(2T>L!<4r>{(_oKRs^MFgsjZDbr9Gd8qX0DRf~)rv z3`p0CpW8b*I3i__>82Io0ch5m{q40j7c6-ZI$lt(KyNfKQfs)LREP-0J;TF-%kMGqyRCXdtcu zn`%{*V3@>L zo<+&0y7q7zKg+W*XlN7GLER61eYD|M4=EfbvKP0K`=tH833dIf+Lu>*)GX&ZN)_uw z^kHTefC^l?i&1>JSj1aQFs<+HLmF|XB0?6viwG>QjAQQ?4;AwJyERSU7a^Q(h|1+F z@vl`g-EKsPYy?!l{Syo2?KXpXLx-d_9k%S0h(|Nw_4?`aB)ikdXJZX{=kDF_m+?8Q zKi1df2{jY;O)P)6Tl?zgy!jRwB%Pe(@uLt=MljBXHl^v3xhih06SQt!$CB?x0`o-~ z*6gvAmZ%UkrhxudM8c|QA1o8TcbMr)!0eWvArPige`pE3*fZKoe^N|7ZtIEM5M`>f z=$R8_5&d~awsm!|0df}v!)ITk-T!FUSU&pX`g}NV z9e=Es?vt&hAta#u^$LyWdwO5~?z*qY(6YdQ>&doTx0v6a38I}mER>C~{7~iEjgi~* zu_eb#N2Br8)>Ai6pg#S8cC^Jn>Ru_`m?SmlxZh3WGHXute50w(%#s-<7>etq1-XuY z@x40aMUFUd76@OxmtiE-RVC|%)3Lowx(GByTb=Pbu7?&vJZ{n@IWBqd$EM-0cbRx@ zM8=&1g!A6yLJgM-`8ug5DVF;BwxMn)JV*2!F4%@DTde&%jdta-u4Iu+4zYjTyb#Ff zB!7S$n2k-Rl^99IWD=GY&LtQDI1o;9aD}Z%eQ$kQbXLA3?H3x43#L8HUe@Whv83Cy z3V~*om`x_Pk|xt8``_5RWHkgJyFW=PRsoBH%X3~na)OaAy zU>MS7ey1@}@I^;G3VIK+{%3$_r-)iL?>bm3Re1+k>r7O(EQSgd{6&HBIeU>CF~^Bs4X%$!i~EgID6HaMYek2SQ*YrM&lGzQR?QL2 zktgl`fEB5-y6w6~&I@P8VC_;QC5IM-o7%PQs2S^sXA6xMT0Oqrjif4s!gd@FQx@%y zY?`%H88sdf>o16#7m$y#*yq~fon6QneG@&I*Oobp?NF~QCrz4gvtE&paljji{72=b zum~Ly*Frq_4@K532kdNs1P{V2e z_BH581~_A1U^Arrj4#K#sZ$B_91=>8HygOEvs_QWg+__2IT>fArrbRi_M|h^xxcu^ zPX9$8yVzuNMi`k*y1|*Y2nDc4ev5hFT+#u5`%F;UfcVirG7Zs;F!Jtb;&lM z!pPkt3E6Ca8s?l{+eG7lwhT+MR(BBRIa`pj&4jIcaqBAK`6x+?M;C*p#89I%Jt$T$ zJ{2%lo1oLJ^StD0FL)hI?k+hS{mgL!ELbD0ST3Mk{#&E`fs81TJ462i*(F9!$jYcL z!3XbpF(sk%a0#8gIqf2iLW%R^Z`WR{g)E>q7iEnH^9&6RbEGDuz=kogStru}bOi zz$LtS`bQDSvJuEm&4s**Dp-RlV!?YEm+g&7oeI6IXB*2+FqyoGbag3QoFGZ5(rtgU z*h>oyG-%PhF8K(qTeB+g8QOCJO|86Xr;;LZe{L$-M?+DZ2CzoA}Yb?gi8L zS}qv195?)wFs&~&{#uZk<|N~q4OiPSImnaAD4h5v_pJPkfRjqh2|K!*0=J680Q4=r z6wf3We&f#dCiElPW$7q36fcD0x63pYl_~9&bbLPyzOpz_3kSNJ-#7>JZltuI>X&Y- z6qYaST1-91j7eEv9H)L#jxC$h!W8AiTfui+cdge^qS2nf9T;R~UHfO6uruFKO_(Okiz>Sb>GMHD92#vUj!1B1s@UTLa}h(}#TAc&zQCYF zGV%bi?L@AA_Q`Pjg+QFg$57y?)gOb=bqiPEAu+{8HG|Ji%{&0(J zU%8#5m$6h}trw%E#)#EyrY_3b%!jXY!~I}S>=x%~i1`0NqB%&DB%shK)YS4nsy#&; zh1*$sAhc=;XY|;6U(|i~_kh?lKQuAlNPu1(H7z4VOM$)J05fN&@U8>zgM(zqN|Dmt z-0Um{h-g+J@%Zf{t_Qn>D~m*<#=-ME^6N7Hc1;o=cB$}g@uM7PW}1f#0fDRHQLQn5 zB<$HqtiD#O*3|E_5w%!}mLh7r6%*D<#^X|MeW%8Ok#S9>u({e1^$Hu2q3%=pJVb6- zP-!V$y#<=WMtIm_+#`p~)-92=2NzdOpT#K&=W8efi%@N{F0u-YZ)K3u{HCpMO#uZFa1l9+Y zQ|msKa5xYM*sl=3y1-WYd?TuZ$~-En_qxVi5lyc%9cM^tMgWv`r&j1Rx&O^8C5a+} zU=--RQCtr9YqFEH+y~w05}-RGX~55!ke2?*;9z+-Xki^)EJxGryn-J?(R%YgrI;2$ z)l{{}mA^m4PmgJZA-~{?%~;qkd&Hocj;G(NLnZlb7ByMxSt364y;`1+l|B-C@6H-8 zrRopRae$~?P+18M9f|Uj9*baD>WPZT*u4M2rbMwtfQ19AOq*7;U)1Tty{HXVoyZk~ zd)jQEGiAo>!==XR@)xu}8Nyl&3pf!c%i1trhIQs>2iZ=Kk_FMv`#a}}W22@`LQFyx zZzg0!hOim>XKJaTGrQ+)e|mwSY|?7BxgbGoYVoJr>L}9A8c_>+cU`9vl#PEIi4xP+ zTm0uR*w1*ux6s7OxAP@149PxoPtRw&TYAGzNwwlbxt|$n4kc`xJ3^i{8Jffq_pc+r zMn(mM<3nZ}j2+y)j5t4r{-lytFn`Z&Pl3<02n-Baxsmn$g2KDsMHpIO{#neg%?~|O zd^CyDqzo5aaxGtysRfX?=4ho(H@5twNxIxFi3omum_**`5MX+e08-MQ$riey|83Wu zcp>e0S$r1j4j%e#uYz`{6HiZTsPR2rP@~Lw`7v0*GHY9AvsLGx3fN;WZQFOK^(w*| zP(J@7p-4`-m(}<}>1;z9R!=i(@vK6tOn{DU)1uVh^Z!D%4Ve@Al4EHjs2towyEskLxWftd-C3kA=PYJn}U5XRH z8c}%A>^ffDzWHSH)$U&6thM}*t|ub8klEC<$7r6+rtIM5jw}|`WxEGyHC)9C53zM8 zm@JTt-p@G@t+ZWPw`9=$*{Dae0WfGHO&uQm);4Z!+^{)-gvc`wB+5?q84g0X$&yTyf3rJ1)U zf(PPIC9_e3Hp?!&<|vhR*PhZHZ>ypbIg_Q#vy+|r?^yWm4ap*KBWq|=v58PDEdMcS zh23{Sf{KIh)OSk(7m}Ruz!}KzLt$a1N>}EVIKjk&AI<$q$3Bd(rj@2=-#S;C{^p(|JZ6m;bxy}E>v zT3YqdZ7NbiL>GDrm><|u&-^2^0kSczCC3!@C=ZB}?J)iN*b2%u*yNo#q3KV=2zAR} z;&A^!{VxUnikjXwmM?YSnSb1T=2|HkfWSZ+hlP1vM7F$^-tP%>FF z@Rh@XK7mj?8{js;fY2ROomS^LzQwTOP0Er*CY`DG9Q$}dW)RbXoVhhFv}JDHR1uvF zlAMq-=FIO@1|vdu1)#tIC11Txu$`vPe>D*ncxW0zklo=po@xz$~(srv&NMX61 z;$!$gQN!L7fs(*(U9-3hix8(D(%k4MKFG?(A?qupjIl=kd*5-}}8aonLV1bhUePJrBYh^)9)n7$CfZ`taz~e_h{`e~B_X{l)m{Pp_nH4A_yV8ZO z!o{S%v7+NzXbLw~&Vv0CskAl6?hZvZ6k@> z&;Joi-ixSTgYS@1@5BewWr#ypMhWOYczc$kb&`KY?`g&$4w#7{X^q!c`>8Q zbC@h#5FN%i<_liK-lcW{O$so3$oh|@lleP5yai>Xl798H<0XIdg#gO1Qk#M&sMc8g zBBNjAX$?{dIZQhrJ+H~)2QxD*R3{;lc<)?{Nx5Ao=fWA$mV-7f8SU0e>h!8-?w>(* zdfY%771Gs`Q7KfE%`+h<9Nn&To5O$Y_`oDC6i_-L$*s9Bd4N(fySA_CV94iZjrj~YP z>9*mnv>8Po6tnD=-}n-RuWDco%iD+NdTxU;3Y=R!S)IheSFVmU@s&K8-+c`$H2fTM zh82c<#rXe`NIMd7YBj)kxK!?h*k@$JS_?3u?O;g~I&0zLL^u(uY)@J-fbYUXPUMlPhCmNJ8siD@ zeJpybNp#zsJJt!J=xk!IrKjjG4EY6XsW#3!MF^3;axUQ9=H9=|A|c_kt1`VrU*;|>|bZ#|YAjd?=|C!Y3)gX}qwb;g2P zmC|`dCu{0hHT(YbYB^FcrXY8MQ6Z@5>h*6hT4u2wMd*+F*dS4XEVwgMrI`D6!U<4c z;YN6fepoSTMk2~%=-R7CAGfhiv))rgRbVVp*bDITYFZ$uy4azWe3JSqf)UnH<1gL~ z{ejL#h~e={3s-c#^%xE9gZe2~9|)TBC7$s0ES*x3^KHK5(_)J^8&q65625#(l(263 zhX3m-wXZH0KYl3tl}$n1rf+-iZ}2t_|4RwR&mm-RN&gh-YSi7S$EF5DrNKZep)e4$ z^wu%H%%|@2f2He^K}b8ZqPD(Y5EmhJU1p}8EV1b|liH5*W0$=d)=a&ud(`4kX6rlH z*E3T=Oi)mH`;pODaxF$AcdOAe7R^d=FF65e%IW|lW#2Ny2G!V%tnn5dl>3z%l_Abg zl3^v?a4zg2P+%7{;L9kW_K;b8hE9L6WdYe;x%k)b8Y?)i^R*lNwQ%xGoelYg7mn3A zoG1%RZ8Tm8hu##N$ZhESa^Y?7H4v^-JuZ^6r8bGgrBIT%WTUb4b844luv`cEykeRl!t28ODzL^Hl}dJ^$`!Bsh^d0YQR!7SnGn zr(zY&v5CjT+!mz%_nO^x#@7&*7ZJxV$2?B4!9L`;sUra$zHdq|TmfjYnNR2=?5nXp z-SzbxyJJ)+|Gj6cx8|e2c)#fXLev=2*4kuW9Q!|_-YP7Pw&@xT?iSo7 z!8HWe03o=$LxAA!4#9%EySvNa?(XjH?z)@j{r+p8aLvIC-P2Qd)v8sp%HJ>~E|Vj8 zBbwpmo5*j^^d&bnn*Irnh+PLy$6{*AX(1|r@}656X3ZZ{e~NEU&zrQZOB}dwHJM_i zCP4h|F) zC}7QwNuifqOnSGuMn67#v^}YCm~M|>7}rH21Nv6xBOOqi*K=?tGCRZ9u-q)4`dAB? zW}Cxl)Pz|XyZ?siPU(^g-rvu`uLPJEL;3Q|>TTiJT}t@}5E1!Noli5J))G%{cEaj= zM{xNs7s`yIHI?Cp4&D6GJ)?@dJFxR+=l}zzD#RCqiHcug-6JZAb&|GOL)SpC*^H%B`bEdcM@2Q9y#b{W_DelkTYm4d|_rw}l=;iKZMT!)s1IEr(<5qO-ws<4uJB~w{@Eo-*8}d+K-@>&hTE|VdER+d|Z5a2^dX+ zoapT*r$Fg!XDRS{#0^q8;UeK1i>LoF*t=&ZUlf5dgO|ZvmzTwsj9)P693~hH!c8>w z5;PaS4LV8)fWqs@o%|g~@iUNFDV82-;XL-6uW>|WFVk`@fVv7ONRL*L5*_%n6qS2c z>0#TMu=~u%*yxt9NQVh$z(KKx`^nX!F?{SJTxW7LU+PW{euvLNu26tR4|u*#JWE*T zMrW7RyM9ig%+i-H1^)cdSgz~Mn@P;&64KQ8@>GH{0^?k0A?RM=Ky7CmDkitNRJzWZ zt2g0cYWKg`xit2v7HHu^gW_&z&s5J_q(B-I%L|6>p|P)?J)KU zlnIx?m??V27S%Y=A8~QLkD_W+v+J@Q_bvSA4f7o!$wd;^dctYf?d{RW#(;fwP5Hvt zqF>yxIS~H^`}wEUQbYB?C0wO<8yE=A*fl$5N@6Ut0|oXC>z}=vg$e)ogr3j-Ck4P1 zNDO|#-x{2l45j{Dbz$BoM0rn7;q zjON|Dn7k9FaoBV<3!UrNT;Wp1!Bc5_OuEi2Z8iH3K8)ubsYSbgh7_U^e5jNL9C>8Q z`)_Zh3wtpv?cQdo9PNWoj=xw-5a#)lzab{S931tX|Wv@8{st(ZV0 z+vwH`N9Y~!3*0_3?&ficH6}boEe2>=ph{bs4iTFW-D}eI808xC)byyIbCudFWY+`DVtJJC4)thU=+waYt_DICtWB$u*{@ zmt`I`iIS+68>aH)xAZev8;E%(%b$-ZF_%CU9uKVvTIns9V{6p{4#=+c$1{Wyb1(Q6 z?zy4Qm#vJY7S*H*dk<*{mo%y(L9ptc&wVh5(?&m(j~~`0yx#A^-l0X6jPkTHuitqU z@blNFQynjx8S`JVva+0aU%{0Rr@m<15nMK90JZn2yEmHl4~&REL2!HYD8!erSS1Y3 z#(8a;I-dLZ`B@OgBZ^BrY;xJOPFA+XDdEbE`TSCnF# z2II~h>-VjF)Ij>8-7_sfZ>gM*HtgyWBt=+4CzF?!uv(OML89rYE>0XVEKtuxeS8c5 z1+=EGM9vzrfb$0n-cIBoSpUH8C?iTvXFt3sRle|W$DMnW$T^JlWeUwhwsjX^=i%M% zinD!gco;%?yuJPLMsfO-=Ci!MgL>$|{(r@BoH%`i-!w={CT0)*F8>;i5o56M^^8?; zH;Il}!9kOga*}EFT!;v)0b;i}hWUl(=TO4SCtjVoNM$E7IhYMdtFvHo#Alu67uyE@ z?223of?xoO_rkPJ5u}I-iBt6^615@W)euXpUnUJgYk_N;lgj^w>uG^YW?4E{XkIoY z%8M}3n;7e(!OIP|vp0Y>5e4OGw4p3Q5mypN@6C_a5QpNng7tv45yD9iWn7Ky@r{i58)!u;grM$;a8#6~Z)h390#N zG%i|GeGbW|;w)>COaN_qe~Cy_b;gHw?X&3fAnhL;hN4$x{3fKu;8{f)KuutpgS7-~ z=uXv-EDV|!aEak<;2`Q*9S`dJsDAPhyp?2jqlXnK5-7nUx5pE()a3XLfiL^qInu+H zQwQsPG6=DK_GLl+Ack(B+a~l)L^k2of(u7P#FKJ^Exf!qjL+qSsR?8@v>l$_>LYIm zDe$!}X!pk=_@IH$4EPF#g46DAPX&a5j#DdF-CfJqc&td^hr6omYgf?Q|3iB9#+JyO zIY;7Ky=BzXS_aF{j}LI7U4_Q@+J!)2K+jXwH_4rFz5R?Ll*PEqp zPu)kO_-pyNaeup0J6j$QAAzA^&OVft`OT55Hy#odF_E2;nZHE~d!263n|$pDeKWsX zT{L%z?BvQ<8xljSW$J&xtA5N2b`*NaMn#QBd>Qe;2|XV1i4u~?OAlcx*US3DRK%ar z4@`mf-cXFrSNXHfVi@{Y`!mUz3xt~N`!WrfkE=+SDKsE)bAm<5+;x`TL*-VD6jM>w zIRgywaEFB{C-;`6(G7~1pSi(?Yg9Z_5w{4nkYI&FjG5#wp0&UW1$5mhYdFNyW7;}u zRv@TJ4gnwH_`bt7geB?%JT;4kYDBbJX7o;%h*Jf2Q$$OTCIU=W?AVlnn~aA5n0VdEc&@Lk72F<^u4Gh)?i5(Jemx=8 zafDY?OA#f}%(M{c4Eyv_~^9?y?R1mQYp+=}M4ifPuoD{eUM*L&HV zPPt6PYmRc=R(YI%J4<*6&WFjzqY&3nWq4Ql_{qHd<94|Kel`LMXajONNi>y!`EpeD&}dU`niaR9^V_fny$H}e>|;DB~KE@?nj-v102JQ zGaRhxJLYB-n%=_N;AhTZ7J;&=XN*ni!ziES*xK^DY8@B8o`;g3JcUbeT@-+WX5VNaE3ng7KKDwz`qMWf zcT;FM1{oSunES+j9HRVGi`{6iw2!Yozo=dgw1mljJQ1-vU7B%Xpi)PcLFA{FAt9o2mIHoZ*Zt{ zEzD*CWoPasGtOQ`$w6bGv59K-_fT*^D71jNqsY5c-2@uXF zpgH`%`o%%*D-2>7s%0)~CwSvugcnpa2vI% zp%m#q^2&=Tvf{j9Qdd2&kgVjm-`!TFzk2EnnJhrQC5ypGdlP0G2sSFGb0kgynqG@TI?+`W*U&g%D2$W9lTkq0N@k4b#rdk3zNpV z3=Xfw2GhMUuZ7x?X?)u!(A7$5`+it`Bj?qrRKDh-lnENb?bnko&7W(lpN$HB`ac{* zGQz5+=Rlauf&3r0dDSqJ zgZ@QXfhBC%IA0LGy7+7Ed|NDQ)_l_-Cq=iFm0(Yvmtt(CzJr*R(|>C;l&xf78uhB7 zJc~Z4V)`VhHmmnM7##`2d%l7DPW2IVqgdc(^-G5IX~ul>jNtZkqWja+38NL~2|U0p zLA9*X4tLLlcq^myn)>W~d~M$7)27=M4A*kCi?DI_KUOkZ;S6|t(0=W}ZIzL`1+AVXfa zIg=P%mvrdAmO%ofarkcshF_(_K5Tr(dFJ!NAE}E^nCO=$uw4-me{Ei&m}q8H<(R=B zC$j{CJtomNtB`>)!_I~=f;(z6Gn~EhuAHv1QNf*SeM##3Y{5nnV9xVr)%a?k;|=x6 zKMj0c)k-wPlj1HW83+F+%bELo*wqu*?raM^dADCDrLL_X#sF=3`xGl07Y5wT4yQR_ z<2;TpX%drc>>?ibhIV=uI9O&d=>3QA-+#8Y4`Z@og1x(t>7)x_C^WMaGr^ja+I9?N zkw*l%dlKlKb?YvT5<=r%T~r?YL;dO6^q!zl9TdJ*+>|?GqFBtW0CJM0%gj_4QlCir~kl6Sz88XQGo|zVy46UTSv-8ec^ZeFOqbn@-o}E zm3hF`17U>6lXERBl?z*!;{#31_Bk|&JniVo${Bo20(l8yF~9qzCHoaRvFpyg`r+i- zloWo~u}EZ7%ZinbX)2H><6WQZC7=i9PCexdP15Ual2GG}q<{m>N>Ox}<<^9-?KUBl z`;AF)8vhk}>Lb-zj^(7}K^f~u;kQ~)Iu01|_v=kOGIg!h2k-jJmt`Et$t0GdruCUq zvfeuwicHY=()bzYXO%F&@Y0yKnk#-B3mnoznzx2ieSqm_bP=;D$V8%=U$j{in}_pd z5arrXzz8Lmle8jQ5myZ23dQNgV28!j$vx$MJaEb$4=82U4gW)b$r6*$E5E8Ls4b6m zp;NM1Wvz~=h1rGLy}CBP8KS)$(nk#Isz{=V5J5ObXf;g};NYcnJ$ET-rt0qdIG znOS*Er}o~|$C#ldRIS1DP#l?X4dmS`Yt5+hAgMqLVBVYUHdA|1+%oh{ZDVhYvtf%T zioJC5L94Q2PWc@#DOf$1vBQFfIca4^6${pmxHEQpRgdigYYIoBCs=6>$>``BO$Cb< z3`CHrrQ%bxTJK|XYcqs9a{?qwU)Ehn%w<$?YJ^#VIj6$GvUh?11&t>w`bPgFI@Hb? zgYKl_QZX}ZoTYfBgr8{nXX@;n{RZ~VOoGY@K3N_@i7cAAh3u>@_TMOg?EvE_jGtb| zH5>3~5bdT-#nA%K$~~!!khd|;p_U6e+o zVyuSB26XrGrmXFFMkeN(9XMd_r!%T*R|#E0aLMW}Fvt+PT=aQyA1s-^i83hc^2trR zAD9N>XrT?*qf$e`d@BE`e$4Y5bv->*4n=2;M{qcfQMV`7!OMRdxTMOBQaJ$m+thyO zcx!mngscz&-qpnCglj6A>yGEGwaMNc1uNos@Vlgr7i8~{@^s?k&YD-%zq~ry4evS; zViU=G%3m+APXTORdHY)9>9oXbX?IT+BbnzNr^_I#&5ezYQ{EtIuu$CZd!Q;0)1!fO zUbl&wf(s4XodGn(lKe-|SJqqFx;iBwZCOT>@VWcNvoy;0g%=kno_2K5xcxQz*RUOW z5pu0N_YOUkNbx34!NrA_rE%0v0uU`T@06XV6AsY8oF(gD)B@KmV6Sv-!^Nc`k%0ZG$w({0H zqk$V^97T0>gwEDZ_csA;1N#@q!o*oUf&F1X2r!k7aAu8-O@DMSU3>7DBz4RJ@Xr^X z2(p(2(L_hS9;{K!e_Be#3-i5+K-(7IDmQvM%s#39+f^akW2rKJTVo5M)7-rwqgmO6 z@hHrHw*2r3RKaM`yNdK0)nCOZZm$6@PtUu=Ps=XTD+i;eCHd?D4we9^jdk9H<6?II zj6PDF;L*|@zUdYLF|clp1J4@a_D#mteoN+)WywN;L}d}rnqT+80BlP9cy~4Dwp^_u zX9GcF-^>EyXU+J;O%*WEvljbi26eY=i==SrVwC%R({KKrGD|ujF=?u5)+{jxTLcGE zry(N&O{|BfJ2>QUDj!oJ5SdKeoejB4a6~X{fB704)y#$$KqlnNYo4T$)c;`G85YT{ z8$_tF?`jQa8IAB}UpS6M!F;ap@i<+ZD#W-2*pc956$Z_EZ{-h|tb9EX1>`tA;6-2! zX)7Q!p0OGktZypq7FLKUtpYjp0IvwSrTyo^@|Z6tsq5Gv%rJNF-*z**-s*`Sm1Z&7 zA1h^#0G1*rh?OR10zke{xI*q)-cBWMsT{D@zfcHFt~bVOd#RG1i~aqSV&h-qxZYFF zQAs2+=@zZ7c5=g(e}&<7rtx|8X`ZjOR_Xcftw*n~lyaS>Bd#3HygbRd*nfq9#hKBM z1Yt=QN61*`h~8q!$z941%qlzQ&Qtpl;v!C$i|9ql$yQCqYp-tsAsbkA*4*U4<@fp$ zzW044s=yq=gWJG$IsI8gdHY11ash)b5Lv?Vs|NQr7f}{sc)pAwZc-w-Mw*wY0JHUT z0ny{msnfzB+`lWYkytaQ8ks(P@Hl@&y2N`~Ypmp(Q7U?%AE=RX zz10%DnU+%K&qtEPjIYQb4fsSKXAJ zu}M+kZECWuS%9eqRq;XJNgdys+sK$()80ww`E7er-{8nY2DN#7>a}}WMSqut5`#_~ zS>nFXE8u1~hM3u)KK_ry?OTKQa%LuRVykXacE zv*X|4@f8UUE!oYu3v!xL}l=rn-eh6sW&7=d^Y^JmKq4z-79wSrKZ$X2N4 zj+aRvt~vi1N*ZAIe4@OzX#l9r&evc&4^Rh<0G?JJM~O^lIe!+h;#v3(1K{;9Lgm?) zmb1&tBA0i2q_M}XEMk%7&Z4M1Z-j8o@br2bPxHaifJL;RfKp|F$-fU1i&@RJ^{Iy1 zs`YMz06nuY_BAzr(N*aHTjzuE)}6Eo(UQxtfvNKV@}>r0`)h#2t`AVKS5QD#&65f_ zM=V7|LQ=SynwkRN`|}6(0izIBVP6b+W3Ia!Vs|KRyLY}+4Sjzst=k(6qSE!&)In)T zuZj*>j&!=!8}jXU4=e`<2MGzuCr?jLYX=A6K;$DYiQlY3Yf``dI}3OU3`gVjK%Mtv zCQn-h&{-cGt)$h$_BVCx0@f2;+`Xx}yW1e(+F=QnM~72QyCQ~;(kUVv58RJ8I2m(l zuk-o?-CmtD%n-m1x$xge&zDy}vQOgZ;si;S*MG;vm@ajArULdh{Au&c)@1XYT=v zwp7_k>JHmM%}P%){W0OMBI7A9npH#5=yOm*nLlRP2B(~=%G!sO0lQ52LVdsOROS62 z9rmg~wM^*3%RN3YZ(J$$ zc2KNLidvu}=Gxie4@6s=i#O~Xr9{fh%fhbB34+2PrLIt$XOG7|Y0HRwt8({O3yQOZ zx5m1BY_e|8OxafZ%5&~@k2HN&MIFlw#)z>LMimDq}yu#xlM9^U%XXX?LhciZKT z%HbT^CHzcJZjEGf6UeKrIu&(%bUx>(V6@9Brh4YbcFxcoU4DJ+Me-z|tKJiCdjA3S zOp&wrsGwXVd9)wMEwbR^5_0C-MFk# zO18h8K})q+4-|2-BI`JZfX846Xs1yY+2<3|i{tZ^ceUuCkE?N7c1>?ndrmK$&1@t) zpN4U=*4_W3-LFA>{$AsRr7LIdf#Y>vCtzNsQB|dJa&~ss@#Cc2479LHKi?sJVu{Ga zgbIcLS=IKO_Ks_mXy_ERwvoE8w?C2;bDm^qH2$)ug;7cGBiK8f=`r3}DUNl;FI?Vz zoy48aYvXGuPa9iKvP ze~Ap85^`6bv$aR&o<(G42+fCU6$dsMF?^J^F@?wr0`Q*<)H2UJT z_;FO(bLcPaC@ovpXVoYuXS@JV~8m4Ew)@qjnTr4I_Q@&I$W5`#_H;XuyccoyTX)+>6 z&|*+imXXGlt>M%qPm5Hn{J&iQ5@w=qb7Q@}$NLHohcfkzU%|Oz3%3v&dco7kiov}2HvHYr5w|fRgyW=@} z9?zFVh@#$LOd$Xn3yig7LDZce9tP=k2OQcTrg7R)09dC-KpFSX?ZrjMM3zt#gBBMu z(45jvL@AT*S5iV-T2>~P{Sz*fkQ+;_=8sacMvL>eaUlmZ0ttO;O;y+Ra3Ws3Jc+;- zt2jZupYT|8uqNs&#r!;|YMXXYxEo^PgG@lEA`h&Gr?ycVGHvWstZIQ@dl+vji z*T4254~6zsN0V7G-ta6!+2m+s-fg-u!L^+hQit*oCRn}rJ&6#TW7YdTHU7qx5L zd`z;esM}= z_>B=}x7|c8`Rqp~#S^{|%2!zA9_jw8%*$hVmbQ311`^M%o)>H9J>MTor@nb8cF(Wt ziwe(hvBif3oGdwYV{Z!iKtn-CdB0{DGa6y@RASOk;AB&vQwQj=!Q*UwSN{b1WB2sW zr^g#Sz*(k`#roNK-JZuWJ$MAs@8xL|X^r1@RzAFAnI?vjRJ$wE>_lJ49ChR>;RF-} zQJRHtXoq>*)Py~s;E0%}waCb8OgV*JQgNcN(_5s}&}>urE4f7o)ezXhkD;q5?d5j; zshoc5)xdr&e|y8hkR7~*DBCy!b71Jx)WqiI8Jsmg2MpBm*pKohh=)yMFiWMeM#!zT zCJDcj$ux&V$JWd|r>i@MZ%BAI^F)n#NauTLYyUwX6P0-t`8&?X|E z%!P4WhX+y?w|oU;vuMBcvX>CRl8%Bu6^m;v){qj7)brz3D(TUFwf8<59_$< zd=U-ZQjF3-F6;QCAG(Feb|sC;sjix-$*!9jP-v7f!cVH%?P;kStEAQ)jyP8ZK~9St zzm+dHt}}6j#5sK_Cv{h}RqDR-DHg4YuIoivl6?4hl1Xdf(cf5U-2%&x2fy&?mw|ujq6XKi5Z{i(& zU>jcFi5{t0v~5!hdFFh%r9_*X?)7K7v{E;uqL02XK23F@yE44rg^He z(o&8I@r?qmQq`)z-227TGnb<&>^UB8gP}swPPVpP-e6O&Fq~4YTFs91O^!$|8yVq- zgV9ic0}g0=JGRXwS6MGsDj~Dm8zE3kW3xzZ!X=mPsN^ZfqF2`)Ct5vUhJZoN6o5GN zD8WGfBFJQOxi$43oxrHGwc6|ye9RO^u0V16PHwf>nXt##l7|$NW$I394=vo5oM=odY7YX-bpAeRz<2MeKo)~@wyzIL0NFi&S zrHi9df`M!Yl(X3ay<@)046hh{XNFl2lmpgxTmE&Ry-n@k)QdoHv%b&V8+G7{uaYH4 zo?3HI8%i@Q(kxJtiDXtF3ck8HZ{WIUv5D<3xp5H87j%5+TxlHexgT6SYasIu13Z;WLKL44Zlu|%(ca6k<8R)x6P=M~ZKobKZQ?je z6*c(&J%`P+dW?z{Bebb~dfyFi6la@Jf8W+v=?kmD_%Bp=<&P6EE72vFO$>`1wUTx^ zMfc#jqe`KiH~92_$2fEM)W_l4t9yz$c3V62gC&qkiN3$?+!T%Ym{sV=IWj z5k;iZ{daF*4hE{$gi@ChP6k)HY}Z-8yc*$xGN7AyB0l>=yB~sREx}L|_-weNlslq? z#}@XBL~T#-!fQJ~#Es&ck;2`E=5N{=?USNUNjuVRZ^VOQ@g4mrYNv?6X za_Sr*mK*V0qGug!VIrh9SN58LFd8D(?8-+@Wshh7#>@4oBYls1lWv_;GiS}?n#s^; zuP+x_SG4#ek0Z;Cd1G-~LiU4btcPj!7?p9azgX2&ja0G1v^n$Zoq_Z@jHUX;>})gh zGNE-%GM;4iC4&jbADq((b->r%C=XEKof3yvLZ2@BhnfE(!|lX8T7 z;_2OPRp7*tdh9Zd=r~@vCD4sx<9-Xzh-}7%dE(I@>w6ERSFO>LU^$-%X~xjx@POo=XB6H@ z_=Jku{Coq9+eG{APeTF901h~Jr+N1h#tV0Mbs+~+h2V@DZQ>U8_#E)m^7(x^&mblb zMXxpJ&idu>)gAA%gil^AzsKsHoyz;`Swo`e6OjJU#kC#hi+2-s88Xy^y=CYnsBmSN zOT-F~cj`w`w$t+vt@lSK>0e%)Ng*R-w4I0e1?8svAT|A$NQ#NtQARq8ZGix_RsW%y zy?o91>)i;50MABYKal}%{~?i?D6c$2i!o90;q6NRc^mD$0rkRM!ar6HyC_*s6;b$B zNin7oQFarljV%GlP2L(62{LFH7q}7>xBE;Mqkps#Q%WFl^Nn2ly7Yr1%^@3wnO>H0fJf?yM z5E|{ZHfFxI&r>mKw-h#vVo}L{QplIww5H{(Dc5erlSvnCe{nxw<2{R&2utU73g_OF zPt~2V+3q712`3<7U%K4xw_{i3a=hM?irg+E$Oc~-a=1BJL{H;(+Cy&d4<}UU(*Rj& z5pdc6Gje;nq2}{?3w?Wi-oDx$KA6f20f(7>xNUqHvM2=Ylyf_sX)Y`-+NfwT*OK(F z8;z&yjiqv~fT^ZsY&jgwbWY|>y+hcp=e0dPJ=tQbgGW)@A54Iyu!)UepNiy<0Hq`* z(-|t7F@a;p)1^(TJBeL;OUXngp91vAX6sEsq5^DNuKdTG>!7iqU`*Ps;o*=B6cgC zfnBraWJLFQa9+8tRCe6Y|s8~%Xx0OxX|PHL1CAnq}oOu3!;XL~SE&BGzqKDf|F zLo2*Gma-Tb1o_WV`xyfZaVxI7EePpis~BOO9A>5ZG|%fSc4OBOtvNs(TM?;`^NUI& z1y9EQsQ!bKxdo9G=ROZJR^-(M=HqI_f`l6(t`vFWnvLRUX|$&ap2kAT_2@ZU;$6w+fNB&{ z5CYycB{6~--whaOe?Gh;Y;`K;x7Iwbk^TUKO8>LG4aR8KHICWS z(*eb(KW^7h{6;H6(op^C!2`OCk9)6YJ4;UlT&QBi3V9u-;K4?#!(!rDg<~@jWd~2g zZ1ekW0!cPL08neDdJtZ+_||amuHG(Ppfkkh&oTSce$hZvC^)xRK|3kNdGBB&ib{`6 zANKCA*|fCP`a<*zH`8z93Bv&5>t%$;zKE~#8td)u9fy;jf2Nd+62{sr2o0)tSj--> z>&1~W^7lo&KLweEEN`uz3K8^`)m>1#RZc{YR~`2R6Vy|1fVv8E@T7WJu z7aZJfKd!wvxU&debXH+T^?Iu$zbGw3x@X|2DcU?Bc_3d6kzH0-)SO)kXBWd_Hf|HX zopdL5AKUERh({jpKpo#;%|NX@Jv!(7ib8CWoOWFO<~c^Q+bR-d+OJ-xVQ#z;zp?Um zdUWNQTzeW|Q=>vNR)3RLYuA0%;I_>STko)B`;RgGYUE@$Xj!Yam_cCYd%T5E8imD< zP^6X(0v5eLeIRT5v39#X7H_iBri)X0OHRYK{NMQ!Y{aIx6>(Q?=^t|hOp94hT^8w7R7or{l!@6HWG}$d<^d z)t?1HRS7N@K%tk%tMHwd}I7+rjj z?r;AXl&UXnq7mpDC*>Pl`=GGHPYqFID1Y7S)v%B(ERTdaV%X*7Wd_)r=s2d;QELX@ zir66qg%4kpE^V^?<26`oac1U1WR;bCo@rOklb6GYQ6Us88gh6{K8l>%<)o6Vq|ZYq zp$goOILp@gViIPy^I}n`$!`!QF^0bS;nod7Du1a!=25zae|1X~i@L~3M45%4O{Ahf zx3sp#y`HT$+s#k6zrjDonPX#P_bxiDw|Nlk<*|y`a+7yN>n_u(lp8me?~P|<_%;az zAZ~6@$C2X1=&IYA=J5?)Fx+krCoodUWkbR^lqi)1#88rh{%~O_ZNw8eVAHGrRHD{9 znkgc9$n(qK_o6v2s%112l`ZBo(i|#ae9?WEkS~xP?Qgf;6-Pah@X0g)53w*ezj&zH zdyno8M9I-^b>&&_3&WqR%E_N*0h_G$EscmkaiR~G#HC3A$ey*ao5N|$i$uywY+Fu> zA1UCSosd6c%xtsQ^Wj6V83S59V10k}6A%(!9!^u1Yjg)7eM!w=$LeN`0=G0ukJ!`> zI`RjnDD0r!pZqpuR?wJ?Eq3$^h(gi&rWIx9GqaZuX%G_Df0B3uMVgsZm{gy{`u9hc;z+!t{DERr)-jH-PHgE3!Jza0J9JuG%*-H-2C(Am4qgG$e|M@Lm7`*F(FTkAoIDQi>#Ruz4@JO4&d-ul;L&lNIcS<0`#^ zlEjS$73wwo$^yZ2#v~e;*>7#I$-lB44H#6>e0R_28XfeVd3D&l^LQKAF|-Xabe#X@ z5yfoW}#zHF^5o}wnw|0gWoVa z%f?#Y9m2g0Gm{Og%++%8HE3_Hk zHK!u?N`Rwp9IY(G6lQ!Jllbtd~1`Fi}-jUi%tN$~g@(efRUMEzPfrgb73h}b- zi%WPzApKNbP2jh-0>~DN_LGpEqNxk;igZ4~il#>w_sO;60fj=pU&2vPmI=~C-ViBi zvia&llA7hCtUPYcFt7L$n%#Xhj8XB8qkteM+I4-lxNkk4N0bvFubk=-I5P2vIRC~f zAf!J{uHAxoK?Yt8C3-k;?JeRP6}?36M&#LnKewKWiu!c6dlax4XQd@dtC5?bvkG!> zNWih3+-Plde~pC5PW^S`8tar++)NV^cNt?&dpr0bap#V#nf2Gk-RtwcXv{AztHHy1 z0SFVqdu)9(=079A4vYQqj0gbB(sr-4y0H(;#&@N#TRHRXZk)sVq(Sxon@MpVuXekE z?xHw%xBD~U>3k_6?9MQJc8*FhYs$v7&j%^g3KZ!PsfvRZ?Dh-w7Wl9j`KYL9 zBfq-3+Spv$)Cz#mOk=sj*W0UI3FOATim> zm>6`J#6e6|q*#S?fHI*u>w)}=K7pUaeB~aaK%d44_t|)jnB;*&saR3dD>;JAV##~$ z{c=kT5igC_Y_4=u8f3dJWc4MP-~KUi0lULOvXJH|GzLBq&pM?}Rf^?xKXFdeC3PJl z!GsW3(}2!6Ft;cV0S$NnqN?5ncnyU12kjHWkDiJ?8qGiv zwndG~DeqXM(#l;c@{8Fz@00jw+2?zO03sN*QSMEYR09)Q!HJ;XV6*5nrD8wvp1X0@ zddHqmTe1VGutwqoZficmisO4Zq7!Xiz~_P?Kf2vz(l{v>Xq|ZBzh9>mUTi7(8g%*| zy}lLzyM|n!op?rjk%#Wj#?a2ZX`3_N&i7FWPNM#*$hl5P=Q8HE$_mRw5FaGR?oUFs zYU^)%4EJfdURdTbsweE{Bpg6n8XhQ`Y&h+FwG$y1Q2_$1vm4XA;$WP2b)LZ(2v?kC zuPN%gxv?w@m-jN4G-DK#$v^7?|md-3N_qbX_hD*UPXU3ZHT>r4)88m8xv<3}U z0T+`$Wh%pqwTP>>n!eibT{1#meRs#N5@>5pXmoBc*AzVW33DWVF7RcntFj{_ZXaTPf`2@nVy&?qY&Sc@~D(5HTGh_*ds!b$jYcqw8 zc0;*SGj34kKAN@+k`v-FT~w|&Fw z+bO=fGRS{_nv%z>DKu#^QkqE>f*O?&6~0Fe@IS48 zd$2kzQh9eJEjI$dErCjlrLB4pG6Gb#0@zkE-kXNMB*!L)H@u{Ei~Fu4xBo?drBpyYq}5a z&Ubc#UGMq7FcvA5V1*O&BQK(U?NYvxfWKDCpF$(OBZ~A=~ zJRfDgvwmAJuJHlZ#j!DIpNd`m+Aw2JhsDHy$4z%+Fzf9Lqu*B{36A}(8^VH$P#uz+ z!1JM30A*nh*FznG)G0-ThF3HKKVX;7#!)@>3Yapl&d!E<^{sL4NUTU2q7Vcq&UH+v zDnFUsUB?f*p-yKk)yVDovh+M2A)__JBvfi$It^_(5>&mDNh?&)^dzvWrGnH+zyF8^ zG(zw-g`y)gZFftsd#wJ$+FrKGmf&6Pw>>yv@Nk^t9M})4`{S9 ze>tAG!WjI90Zj2XIz^M&9gsB4ofN1dPV`_f^@Lr1I4Vu$FX5d1~+hb;?(Ho9uOqMz8PD3V@thqhX!k|x>*~{=Yo+; zxd2DxTe0ypjbW}ggySyON1Jw$@&*o}zoGbLC^IxdaO*D~*7ljT6DoQ)Ho1Q~YVo{h z*%@ePBj|MiaWZW}=v#tgGZ|jWY6MH?5`vVpq#)hhjes;rcO%{1 z-6`GO-OYLM`}@E1UY(0`<2W+I_^JJ@z1G@mTX7v2PxP!w!B!#cegBjcz`Q2svjg)IZ(D?vN9Gs~2I2 zRpEC%)OOZ&mMvc%hvi&Q%ufg_jn~4iCB#EuY5VjD?_ZpjSLRX%#h+w`Bwq`AdDN$& zoPSjc7Nt(pdM(^^{6`ERrPrwf8HzMUAyG++MQr+iu{(deOy4yB%*LqJIu-Wzg^OMX zIHo~ybc{bba0Y(~Nwu2|#X(+GTkj92pqffSR9zq6 zaeaS;O=hW9Z)>F9K$%>SEn$Sq5#B&s*ZsBD?VckLJz|jY?&>gTb0F5HN7Xt7NoJ0RrpW=PrmhVvde7M zO;_OTJ$B#&1ErDOFHhOjd#cl?F{j1`w*a5is9!5%`OoUx<~6ntXGx-sroWo^Ph*k& z)#}z9;TXb)t1%0<5guJ1%8vh_ANg1nNeTQR0 zx}nRtSSSX5Tt?t0EP8ahf}0tt}bNTg_(E@4st^TT?2}E= zj34;%sx@IW7xD#-ilq4|>wTC%*`ZcO$F#gRJpO^~sg^U+G5q(JHCnP-(EHhNQWqBY zrT*>gW`0;lJ{?OdIL)wE=2e@3@?lJ6LmSwZ7HZ4LE(J+mheFO@CtA(sk049UhICRY zOg9rO=Ul}*idM(tb$8~gIRyB1XE~CQYpmIR{Z>iSsY3PN7XWe?SBWx{;GuepD`s&I zGVw`JrKJq&NeUZ^?|cz`RD>yzjmY1T)RUkG02{=b3v?g7=RBuldHhZ|_({e)s(Q0C zcx?EGztC=Rjd41!guEM@6aC6n@9?AwXSG4CD2r9s>!`dr!9G0Im8o<^uA^RK z_oFD8i) z&@Es|$DbjyKKUd;&WrrV4SAl9TIf_A8Ad=`P~g3}mZ} z6*c)eyyhnhlrs%RP9B-KELUFPz7Kzj4cBF^d-eOikk?PZ2sfT}y*p%mxQc^=!^70y z9mxmZX>#>%t_-L11+}_{h838UK!zLWu~?|}TI&+VelHRB^3Cro{rAn=7SQhny@T(> zSW)7Oe||jnaI`u^y^@JEKf)}YhMhc!rBTh;v%J3<Sz zDz%$RC%L7ItEO^ovI+{`mbzLj*NoqXPng_I|Hmi899OHRIlVsHxxmCvUi5NEza3=j zRj(}S>^wE(J@iQkLDH9X7qK^%`t}s{}UMc}T2`(uaL7 zGx=Dng}L+_L^58mjcBp8lw(S7s7Ar-cTzwg`X!yTQ#}iGf3=F_Z!FC36kAb0bb~`} zd6CPT?mW?k-DKFsn;cPT604Ze80k0>HUhA-;gWyw0gjrp*YrJ5Y#5lNnXh<9yHc@j z*3?=Q86nckbv0W?;aF)vDnnVzAs-*}#`PMVN=#hfH@Q#pp7q@t>x63QA>u|ppCFyu zNly*uR(N8rzu&h-`w)Ns0d;ia4+vZ)m($?Pm9*!X>_6dI{TnoInN0my7`y1GoHa

S%ZXdMR?dZOQF)?=GIueqBE58 zb>a?w(fZmVul%oYL}yL6n>|Cb+nG7%#oQNnHm9e%h$atZqaS%YE!wPPyY{p3`yr7% zCtH;>iyZ*W%nQz0=U0`#x@OKmHNzC={r};&UdT}0TFa(& zw`f4`#of6-q$+J5Ucaui0b&4^4ANu%T1Y{WZ&EW;4Jiyg)}&|CZp28^t`GQCyh)pm z*&K!W{k57nCZwDVTi@;B@XF4LIHWq%B7(0XHB8C!-Cr8ER)osNbj|_L80xR(UB+LK z(YURs_}*56;a`5Aeui?B&B>R1zw?ITenX-IxpbDBGMubo1JU1^B zutNNJp>+<=Z|t0E%Ebr>e=#pPZEd64nFLfRep`%i_loQ@P00_zd9`#NmyjpbJ;A7q z*SNqE6Q2`8RM7T?85Z0u#oWdiTy}H#6mRN)RHJrPCNAMVka~H)>AJsWa*=@4b<2J0 zvIYzQe_EcDBV7vrl9@hx{r*NC0A~^^?$17>h}EhEs~!G0|NVZ5X1OqV1ApW_6x(+f z?x_8P!?K2$yZ8GO{+;5gF*b%^EXe#w=go{+UV!5Z=na>5lL}_yS5!b|c$?aIg8%Qz zc5?6aa9SApHl5G2XRGZzrwfySS$S%htu@u&`L$=86_q1;nF=w7@6s!Yo-63u40yyd zC(_2G?NV~LAjPyhGy>?fpHb&pB2LrsjPeXnQxt5butNp3|0QeD9ryj-YtP{{m8Sit zk!ji;$wb&6f~e-|T}Mu&V8&!h*7o^WXP2h3taZtob8fGm3An5V_ML7%;zD#o8rGdZ=@e*3pIXl z^>3a(Y>yX-IkbR%^!$0mp7%Hh-yQBYgCl>GHSE_jVE1-JsQGSB`c<}fhDM-T1Ee4u z&4;Arsjh4C9igWhn7ffb`5Sx(?6H*>7nqwbgYG-O*&`piQE8x{tUr0;skK{yBVY#!MyDd&=VEx1$B|N z(4o3L+57csI+8l!OR$tg1v!0r9EU3xmeJ&Dv9uwd$+{WI>mDBpMSQd)vK`kEmj9$ zKt&QGnh(g(AB{U)B2A+y$X{G7|#THgs{nmTEbDt8sEJ`cGKprXvvfTi?zL)2sdp{=9~ zXSa55p=_a{OX1;1nv0&+ahh_Gf)ti#LIo0(i$4f@z@$Z16yL%qwV?fzS!$&yxwk4t zFFYl0=NA@aG@yE*n=FzS9?}Onuec2mkF`O`@W*M>P3x`fPc3PI)Qm=`HdEsBsWTA=@T@`ZSMPf6 z!XtPX)oOQNaYFrPkzSquBEw*Zca5@fzrWf*!KPgI55s;V&X3_KJx@;4#uy_IE8Gui zT{-tbJ;MwnzOnt;cx#hH z*0jQO3;0_=i%!W^AS{R4+}DPc=iRgMvY4{@r2uwFCt0L7CektY-#BLmML^%DkA*re zByJsPw+PNN|FJGFF=uGyCJxoC!Us7THUMtSaTnPf)v-s#yYh=lv0p`LCdBVeNqzg+ zO>=517~y+G{u>ogMbRRGtaqKViv)e78@^3X;;zw`>du8Q2{|^O<)wRRG7bXh8@z*H zWs|gSFbTLr03^N<)Kudsm~GaNpiHe} z5Yf3&tp4^rFrSIL(6l0N6>WzgfDaI37|toWH}|w|4h!<}$JWgmm>Mz(7JJ-bL5@Ca zf$6}SS^Ponxl3C9<1I?@pY^`K5}QWEGb9a*P?uLIRHhwgn<5OIFU0`Fo_AB;w4i(i zG*epmNh+Y=8#IobgB4(e0hw%mNYi$mzA8+#+TUcjL*&Pyt)%*e=4D=7Z8^?o$2;L8 z0Sh3}YFc;I@MTV97n_;$D5-~Fu{nBS=MF~E|Ip6bA4)m*b=a~=CL8doyhG$%4kEA2 zX1A2*$7B5oePlh59Gd%lMrg&2s2|nyRC>hO4=XjHx=)k1+%wQ}y<%iwlnQq|!OIB+ z{llpkF!cS?7S6dW3k@kJ_#M!XmvN*-#t_v zIIx~0?UZBGe=c!V0cLFX4mzu3VQD?R9$Mv#uRv3M(S$Qqb2BsF!8zzm19iWWu# z7IA&&oMx>;U`Orf`<_`;!^*|#3Yd~X>GMVe`ig=uN}auN=gY&Tks1p%CXq+7-`I)G z@M%1t11h{*3yx8@Vr9n$E(c#Itp~ky&2`*zPF=e^)xPbsk1P0V^88&!W{9q^2X~|iqPFPbXy&+_tk1t z2E3=0aS=86#x5bWfZ{$Un@z!7ZO3ty5b>Q;8;ftl-O`&v{sEC8Uk<)rH=nRK9J)on z)fs1L?#j-`qEfaQ z&=H4{EA<)SUD5wbU8Z7%pO+q~Wrez3kLt&O?G@hmW}bP@W#xNeM95r_ZRGqLe%&@k z4N5L2Y6wG{71@y34^^zk`$v_Q*^(%@wo~T77Arymh^ymh%e|8ntj`2tYcdow8=Dnx zxPL9xP0)r79nx82LG(P1M9iiub6$j~eF_SY1?x7!jrZ3(8a(5gZ6(+Rzj-16aD9W^ zcswY}{-J;PAIX?xSN_Ef;u*p48KJ=*K$`|=`iA@T0||3WJ6Dz_EYTSZ!0bIVYs46B zW5N9Z6hJh}BlgRHJ(cSI@8;QN+dtf06lE@B1a+c|XV&sorQ2aaTENghNCxSKN)}04 zznfMZ76clGo~ach@_*>GQI`2=zcW(Dw!b2>sO%%$eDJ~*dbb_A7xJh6I)-@-7Mb^k zkr2|LyFQRao6{c~Ls`Tgq&jnY_wk@45?!?{wp}=8-Rj_F%ws3x*QM6qVOF;JcRK-x zT5Y^Rpl4PhavVV=#-_ox-L1g6b((JfPhNTqF0?jS5?!uxBbJ`(Mkvi3(%h8F!(yO4 zb|-k}))z$jbajHwxo2V^off?@t6MJ4;s-S7MZyaZ>yAPbY}~u|*lD7-;$)KhrzG?% z&BlbgY%}}4+6SQhhb-7x20})q>c=htu2uM&eLbesV)GlT6YDaoB_d`0w4HJ|jmYHx zip)KWvc}>@Ts4lO$`to|5jym{gHgGO-nG|hS+X0533j>nz3sf!7mUQi%6{<2(b)?sQoRn%y7sd!NdxJ#Tj zyEcoLfSE+A7=Y*Oop0Uo1xX_pOmJ8s+A!P?2CekPA-$@<%j_vpTHAo%*vT2b-d1In23Y$dm$kIH)Y3NMj zz2}zQJRlw3MAF)Asjvr%AA0v_kw)(?dOt9ZGZixDrKoCx5y44rSoHASzG62D+XHsp z#dWpm>ehm@m6+(0|I-3^WGoqXA@YkkIR_yG+5TKc;;g5Ay{70XU-k!1wdNf-qKNj(zs7&uhj8R7cDe2sRfh^o|b(RIIW>0k)Z z-&a8|qzbivx}++{Q76N|A`z0HaY_h|mff191{9Kd`~}Xe_f<1A(kb}8!>0U4pI6o{ zscBRtm5wyn$PC|vtcNqHJ0D5LBBiVq)Y6X`o3-LM!h2SyUGx{qxZ=m#w69HqR&QrxhlA&!-oo>F&0jV@a` z31cjtXp4utUCW>s!6s}_Dpz;%`;;cfTYQ)B?h%1nLhuxQNvD_IS=Gt_Z}z`|Kgi-V zZC06{;Z)u=fO83&@=Ry)r5_-**#zjkZPi87P@64=Js*xbqFyGT)&NZ)<;p|nV=jNE z>uQ>ZuNV$quTIpn3I&qg)vVVq+6(@iy<#3{aywJhKjp7l*sjC(jNtMDWPedcw26yv zFY(9#eMc>ifsF~QFEr1S4!S|uGLVTQmJp=Qv`*opQ&)cJJozTpUBbeEs zv0Yk_RfNmqic4QyJGYJDMtfBiu2Z6cDYd^&iOq-4l8@V+#x?$0*m&+Kmj6}BmdaLc zS7<)!sq%EKhr+OcLk`oWV{w*8>g4q8m8eF8NgU6^?q-jpcw8jC%$4QJ^SaYU8?ooX z_J7NV?L4BeV~?ShTgfBaT}3K3jf=~jI4sD}6k&(Gqn;<6Y}GZba{T*IfyA3+_9oJ6 z@jTpD#%3Ol?;U^hv$ru$9sn5Xx0~6Ez>qmt1f;5zawsG^ZXg@SA znr+Uzv<|Yl=&tJ5T~g47nZi{rr!6L(`itl`F=ECRe{mzfYhDWGFmKU$ze}n4;pm=* zQ?fay7g3##I&N#EXB62a;71MM7~4 ztUSjgHi^?lNFXFJ)N-n6M(R)ed|r|NT#yXd2%HNwV#gDE1Nv*Cqr(@0#hNve=Hu7U z2oQHTD|#mWyb+#;kFhd2JkM>yO!UV)9(n301$*|rk+fnan`&-<7OF>t&q{Xu%gWk{ zG-rrIr+MM3B+Sc6akc)0L^W9()`@q$cv6sc-M^Yg6vb+)5))-Vaqr%~_T~T9BU1lc zk9bkI!vAm?QC-(qyo-z}CC35K{VyHToK<~wzWS%5=<)r(O4)mu`MsF);tFW8HcDfJ zg|za8?W|mfX}8^u6xWRYW_K!nc=h_qZPt|avN_p!Cy%(V&JkZ~(YCB$=T_@#onUK` zwo#~Y=j)N3L{Ovq<&xN^eRslJ>QAv&j%KuG4u*(zIZ`d+<-Ch~v7{G^bUUhy3X_^n z`}FLKXX2~Pe3zaNe08LGCy1To3&*k&J``ABV zf8_(P?sd;GM_kuA;DAGnaMEI;jJ16*C7{n-K%$%nhl1IZ;_m$ahPZQq@&mYV0a7a+ zSt3Yb@BZb<7%s7_b$nI@H{gQozq!8x*#gbn_KF7#%&+>Cbryry~7jXo%>;@7F z9ZcIaP!Z)sS1!GgjH+*CO@|%7QZED=Y{^5q=*sJmLf)A4Lvi%V%&X?331wl8bE>MB zu!3mKBUEi4V}||?06}ZPEn!E6HMC30%dW6^2l@F?5~-dT(lT7bef{9mjpBh0yGS0f zvBnLD;_VE^RZY>fDL+V{3ju+SW?{*BLh)?IB&IO?gHv#?++qg5Tj?2U>3|HedFDHL ziWTWnhi4-AwZAf?+;$7^d5MjITix%0Tv_lkAvPaZzHU-xX8Hde z{A>M}S_PAK*t*_|_Y!k?X8*0v&9oj}jk!*yCAoL&$T(R(dZ59?J+9?2G<-vghvX## zf*eYj%^Rexp?5|xuWT*C@N}5mTZy074to0;OT94c+FXz82x!i87pGXjqd^%0oPXKYOkCOJLOTJG3;;v}?SJ&HjF;^Xf)42vg-S4I! z(oLo7%veYH67URcs(F_CCZ`wa+_AW1Tf>_M4(DrnB{c>LZG>i@nz4C*6!3LN*iJBf zl-|R+&2m;{o2_}PphP)Z#T&7)Hn3N8vio3xSi37Rzh#CI76qafA^+#+#`0dD*s&DWH8$hJJ)S+~y%PWeB6u3c8V0qej>k5)W}3iS*q@&#@1*M=a!(TmWTEf}rpdcKwzsdXZw@HwSqSA)VVK0q6ToJ4v3E<9dhq>_Me+Mn9M3wgFO8(qtNl5>ATlrcLsqtAr%qWr6vL<| zVT&~feC`ti53YozLW}f5yHdmR=!-*#pF}gyX?m_hOcghYeV}#a^PKVWOr}waeQz>m zGxC)Y%lx8_9u?tqsY>vNuy%ybHLlD40#2~11E2nWn59-`{%$i@Kjz0L+kG#M_xGTb z`j-*mA}@RHGZ~3SB#&-0>(!|+*R3ocE8CGR*v(c*#>HGXof0Vs{9te#ymCU^ZUkc~jn?J}P{j$GTI5sR zH}77gp0rJb7UJ!BJp|&Jnt}m6e)qAX%A==iL(THpyaQy4d?ZQMd+e{ZL{lghlbnH& zMsh{KWmAAVzsGtpsW-7^PWk~f745Gjs3;)m z#}?E-ZMbVg7a`&aoU6b=Vo!r^=Rp{L!8_CCxUoVLiG`2Ue7lvV4H|H-dODJUHP$>_ zr$p!NrcdVmzW`w#z(C0Y(KbH50A0xjBUg`#d#JFlwFxB!eng}??VAuz+d1{PS%`%uxy2A-N5kyw*TS-^WPqvR**fn} zpvS`D#F)=i^3M<&@{}VvZn-aQKtY^dVCyVF#Ttb)KCZZN5Jp{rzz(N(j`JMn-@FYv zj&8N)jCV3utgB!3hbm6}?o>@bhgI<>W)G8qi+z_Yn8=QAHQu0t+4Ua%@ISC+{*Z8q^0`yw^BHlRcPuS z%ERMs1EKw^z(}Ei+8wH=st5O^nZuJ35x1P@65dku^(H#+P2ikMhG>Gc|AaD+n7-kE zjd_B1MsQa?GE!iCrwEocNeNyX{}t@lyh`ZUn;V}b+!%cITspUEEO66YYn-Y#e`1`N zM7WBJR)Hf=Qg+l@>)V*_>ghgU>q34JW07$(7>2OxJRa%s=@w@d$B8d83u3SmKmES? zY-exY-33Ew@Ksv))*TzM(X^05?6@|+s&3QpEDWDz$?X;>B0shB8g1IFYYEfa_whAH z5l#(^2KZ2P+WBO7IxYwKY>wYO6BJ%HJ3jzt5uZwp$9vcZ@|C=UyNFbug7+Ijtqo8` z;ivxQm=-R>K=Bm|^j{J+Qe)GXEZx|eAJ#ybX&G33btSV@xJ z7X;WP3`!}9rtDR#=)_Uq@yT$JFYWtLyfWP~ogZz&z_NDRHH9=T#rM3{f(svEou2Jg zY}s*w=e4*WXd^6UA!B(^M14gQ+fY|yu4^h>xb2nUUCmwFGIM!YTB|=>oA62G);%{r z{5&L{Y3?Q8S25N=ZFEw_Z*m}_-Fjz>^D?H=Ju`}$X;@hH6|qmTK<&=C46DFBa|Rgp z-TXzqrOlmpsXx+F?l^>WNoOCDP51g2KZ;J~#Vp5rl?fXX)Ygd~?Gcu+_}19D^vWO8 z6uKHcfZsZ3m_?TbZ+3DRAVY#lZ7#xxWRoJ7<4zWWYQjKG;p z=YB~GiM>1Vam4_$TCgF_uNkN|Y#OJSS4l8COJ7 zQzJiA@X=zbw;pLt5BF8h)m%_z?1VD8!t04Lt9CD@_@2lN#ddLC zB&op?^-97BAmudK!!wMmu`p5gPYC8|R&iun0;&LXmPXN=Qo7?N-z?>x^44(RZ&t>V zAMz{yes*anMmSCp>j@k95&m?;8q*FRip7{}^i46!m>PkvH$4kv#rg-G8 ztE&rC-^G7-nFngU!*$W^U@G{j1xAm*6%>+%=|37v2i(*A~KXUXU zEIDdSFk&d|y}pKl-xy%22|JU>ozoB-a#?Ro~UPga(n&<5~qXm zJ{k6TPT$2wt(Ipyt=cc;8h)jjfFPC&N&266c zUHZixu0X@7mksLOYq&o^8j>g{ZjZDc_p>>@2i#qXpi`d*ZCvBKSb0w1xY0lyVqd5x_R(NLhVL3pIdjn4^|yli8WcXCPe{7e%*O# z6PJn?e7MH?wX(~&J@BQEASQq1!BVrX@7*q~Bo8xS7!10fevV0fpU$mzxsFP$j35m*stOL zUflTb0!0Qxir7-6UPQYF#MF%unaRTt8%n z0&DLz!G|p2cy!PTjMr!}#k7mpph=6CB%1(MSjD_Fhcv5WBS<;As8}Q)5#78oRr;tO zffwP>NV!o`BmUi5vFa6(|rMtt&-yVl z*4SVCzD6CF#Z%uPQ%L*j;iUPj;qED)e|+n7veEQP$yWr-6wm+Y){La+{`bsWfp`J; zD_6!tun4$NTe0ktS-iF3ob8yeQNPh88+tWbCq_utWdQwtCs2$!OmOw2*iDv0uC zc~E3Ase=Mt3NmU_Z>isGu3Wsm*qzXDoc+`Ug1l;h3b}TbW!zv2o4D^iQ&X%rusMAi zlf>Ih>Z#a#AcYp4dL}!s!6CCJ|L++#U0xkbY)Jpt7$aS7^4ZD-PnQEFN{E-L|^UpxY^)=|WY!!9H&64Bs?+x?H_7L1TYtNR|5 z>M}SS>mmu=%LIfx3e^iWrZ0WEC>E|hI)yweXZaP}@SQ;#DiyaJxt@n`0Sny0Gjh|3D$;bGqf5 zeJeWnbACNO*I+`Ia+)`V+bkjS$W05^_^_YbFzzYio7^2dIJ_1sQD%ikR_`W=wVvYn@bn15I%DhRMd7Va-i@-c{+hG_k$$;XCuFF~3r3b{`Z z*pHDtU)Ip!M~kRjau#@VJh;rPZF2n2tubOy=CgndYEa0FgMY_oQ;sR|-;0CTVVa{2 z%MSP7i!-?Y`(P@EqAI{XF zS1p1m^ncN181}#x|7)m-iVJ;#cYJ8NVjl%MGIUjjo^&0M{uMdzjEa82rl(l%iAe@0 z4?ZX}M(?xD3wzcA$8 zh!xL1n*Dd4dYwBC!GM<;l6iRpyXGe_l#nk}{n=?}l^Xrc=v)Rn02sr+A2@`sVKXdM zm<^Z$79E7lBKQ3CNGXcP_?`@mLcRjCxy*8l59Kt+CfUS5vRrzm`x+v^O@0x8Se!vN zu5SKw-1lNk+6<&J;|(s>gDE!vXl!?+#7v)?x$;k(iBDPH98$`8(*w@i}>@ydCcEm8uAcW41`+N1WVRC0A)bS1Py`HE>YV6n%QMlK)+Y8ZHI;@~7*dG*uh-+W0P6oL5sAzT7{ z7>==m%(QOAK5v$K`jYQ+xp=Ew+(yY06{rWEL5yj_;#=NL%F&GP>Eu7@a{E%b8LBDT z9nKl*I3N5x@~d{qSs2@4^f0|(_~hGMRN1-O(SbkGr`9|txoADNM^axc|6JhxL>zVBMA|^k47QkFaelFYJM^&1tD(8#ka05}0V0LAQBv`rP8~ z<{CueWX%#CSs;Gd1V4=um;gUv0eHJizGblek*vWlmz5blRj&ntO(<MF&xvKY%x5=;9v2qM<{e!stQA;y&9s!&G=90CWq`VJ4~BjKti-m%!^z$I zNyV$b)d=B2@dD1=CV(c$f7sV$Xn3u%O{L zAWR%&Q$0R`BK3!RIMo8^r%N^{deR7CE>xIBBrs?xg#>fIud;kcT8@eI6}-^zcbzO4 z=aj|~YM-zDo@pTz3>K;nj_2=w8g(-O8e5_~OS8I1jT!Z#RelDpJ*E|sJ)K>sWfZHKr-1MCt!7z)c3~^eQEbjY=d&5M zdRkSmZXEGEmu%=~oS!`>R-YW#34JCbc}Ill*Wnf@S;`(IU*Vv}%P&wo;plkZ58-7E zJU=dHsWzEv)2r+hFt#swJW}I3k3^jfJ}Cb*O)c(BX2dvn86olty;q`xNusoJM2LUS zYPK)D4_|F-B#Q+Yg*aKlClzy6e$zsMbhVWvhM0Mxr_})KA_xve)j;LrRB>TgEg-8n z%q=^FV^W)fWhvpndc zR!Vbay2ko^d=l^MpRSVbk;B-wvTwfBltUCPKO2dMy*qtSf4P8M7H zv2e!KLv@;qy!@s%e#!Cgc!@6eg=-C@nNIAx-m)-v?bC~esLWiycR<;4MsDkwM;ok4$q zamIX12M{$XV`n%vQ`G`Y^73ToWf51efd5wA;N0CoV7cNDqv&GxbJCaKm5d;btx#gu z6uy{k((V?@Xdba>aJ#r?{}e3NNEk=;Aj9tlIvZ^=kWy1OaM?zPtRa~4t=0elE&Hd9 z-d>osdNF$o^mxnZlWT#_aHfZ3#?mbTWX@6eL(vh-Qn9iEx%877La=${}J~vB}p4EcO+|H3;3CE-Pz7 z^0_~(t#CgzuHP?hq}b5SPnIuA+sfsdsq2Fjp@Jm*dU-K^CW@o$C~zIyqVU8Ck<&PC z1hJZ_bf1x5_Wh+7O&-xEIoDHu^>5a;7QynZ_U|cR#WI34BudXBZ9*(0+wDc$ym35@ zqI!yb%Pmd6IL4{?iKhchUn8NesX1 z0Xi<_P&%)gzTH%Dsz_4B8i2~&dAriTCy{kUxNRjZdb(GpE{`?vSm!~9E}@4^-_LOS zqlrB6B+j3Bx6`p^ZblfTm7>8NUF7P}aMFRa32=`?vZ}Ytr9f2t7QOsz(!{#oUyZE8 zd^=<|5(|4Z>1_OIlqH7$h(`$~&J@e8to6xr((uo||MF^rg1fmz>e(6ZAvtxhZcV=H zJP97&ntp>bhGq!mpHMWd%(b&Oy_)a(i|o1X>Wy8*#>nHn%n@t*x+e0>F=TL|Qx)nS zNBo|0XhKpr|3v)rfY=0ub>RJ_GN^D+mge(Vlu1KHp2!FVqJm;}pj%GMu%LpIK{mb2 ze%o&kevxMcSB5i?V}p=3f0DLzdFh(U^{W*WLs(Bv|_2qPh(fqq=c+oZ4DUMZ-e85lde=7I7KBDu29~M0+4c3=H zBC*y!`S9vg7T&lYq(yd1a{E9^+3@G^ntz3a-$JYTY}l$bvr=_-1~bNX_V?Cv8_+_qfZ+QQG~V;hD+IAl!2 zqf@2&``=CkuNNqJ)Wspl8{Wr@iOKRuJi>tVo%1AVOu~8hqwZhNr@8SmGwx?oro2RH z3h61_8JIg3gLX>{7{%wF>F#@~?B!s>ESpKKTuWRxSYfkJ_l_5HbUKh~VUHd5c0iAr z>m?OFiJi;+8N~wJZSgIe{hX2xVy*w6-11zt^#D)`V{a9kGHMp5@O7`aEV@h=nl!C4 zYgb6TR~)WU!ZY+PhqNCcgH*{mGw4_x%{mQ>Nt}4};=AiP*I=gH_iSN(EPQ z<{4x;{Xv-%qtY#}VP?<1Z1)iJzt=&;{U_;>2d`eC#B`o5h73`F0?k4Tu(FOi=cb=wKSEap%>hVMVZ74 zZO7yCEE=n2K-Oi11kaEPDQDA)ztTiF$ot$KH6G`R1VEQcnl#3Pq?TqclW>*mT?SWX z%}39=u61TlZaz+1h)qPjfupEu(e=j-z=kC<54y>Cotd1aOfD3AnqR+S3a?UIYly-c zwL~TD|bGur~J1Y@skv=HaqS~FNJ9me}~@d(+xI$upkI74=qgNa0MPO zr^)69m;GOdY~{9KdzFO##502U`m^TZEOCdR8mh-zImN$z4m`6yEM)<5$V4&(3D2CKf{Wu0&9oyJ@gwRq zepo|`-?J}-91Th{>YsNNm4|F)kv%G|`E8{OAX~DUF3p%*Og!ecjoZ#9cF4NgG2f;E z;Faw+$~j;Xr}_w0Q-j1@C*l*Ts6VT0Si&Zk`}hOP2Oq}$G5=5{X_4qp|d!58-knLTFbPN@v ziQon5Ui?&{TX_8{zE`m*^4<08 zjSy0qmaG&y&9JZ;aZ4-5Hd=)n6}ojz`x+)B=Y2MDg|OFLIO4c$&!2}fZoW7-EsiFL zUG7*X$Z<<1Ksut(*kj(|O><>*fEJ0Ekr{#2C77=JbfY{k%fE_iIr|x(8kw!xU4(No z{;)|MPFcs2PMuc=%qm)@fc*Z< zcF-yB2M)E+8%}6!m3%;ARl&EfUUQ!{OD=>%A^*~Sh>b15XCh(0xQT2sG6Be*z#>Qu zh?(ly))O@dRM8?dSaximMVZa~N4~%6cn$Z8rj9(Z9SD8WN)VYD#@28XY#iaa3)p&pe2=;d@o5H5zc=UW=yk+#FPn z{QaPwtoFP{AF$2$aPsGp`t5G}3!I>cH1yCe_iq>9WcaD|YaOAdwSRY;eoh`9;R)j_$_hy>~2ev)B5ZalEt4e|t|?z-5J4d)v4)n_r7y3CT&U zJv+pwJMA{4ANKNM;bf<)N>XeUcjjsu3L z6K-|XYc?@jyi0lC9ca%$?!7$0zV~4MG5t8Vx<>r`jgQVi_jT4c1C`4N5n3shX)c@6 z=|VN>-R@Ww@+nJcEI!oMohAi^R9#Dsu|8-egu*P}J1Z)lJ6fze1#i|kQ@JKS0oYu3 zXGcM!k6VQ?eHkYX*8oX@DlQUemEs91s55viR8px;GDfoB%d`6b1rrz}G>SsUxmW&N!@NhCjT zwVnE|S5NbG|Jbnl(w$`ujJ+nvp%8qIGb{>iD+7$1AER9Q*h>lt-F?b;$ zd&a>YwjIzSihpB75OF>RAjY$bH=pty9k)M)0SAl?nb+y-J!FCC9t@8@I1;V&V^2U ze+#^RV!y=w#L`_7>Z$gs)4o%(Zo`smAn_@H+ILcnv{ydnFIG# z>eZ&Z3+bL8#RA5`g~63U|1Qz~w>tr(b26cN#B{Ve(mYEN#2cWea(98|7<%v|DtgK% zhzHr8Q&J@TB0{aNE&J(|S_bp7qqA^r$xeG;U!^e=0vBbiBirh#YPk&2m}fqp;{!*J z>FJeX!@=xqA(8f0{{$p0BxTiX`Q{J-TqV;62BYPIE0*zh+1nh87a{J>B$;a0^xkRO zL^2r;uO7R5Nd1Vad$srFgL~>}JIXWf#ba_58xUO)nHKm0IioX#e2(>SYW!dTUeC{sZrKG{& zFn`ZI{gHQO+?h*WhjMdz)&GkY8$CfvraCXhkyT}N=+zi3T(lJ@odG;5Q7okAh+kQ! z)YT=D7G^0a+hdkU1IH-D{u-~a3Lyxq`OA{cd-r>X(pMA2<#^;;+h%?fq5lHVPcRqx zzX2!@(@r}#z&L`{DD7yU~TYaa%G zkmmd4GQQS1@fA-^?d@Fg=fTk{k>`mbdgHK@b;JQiw!!PS?>)jX`#yZdnN>J?hZZ{8mSD0G4|?v8BnPRIWUUmjR-pE4>=}TnVTAp|hIPL4QmG7ji~qbR zZ4F0lz9;1-$3BoQ6b}YB>W5d(Km|{e$`7$ONEW1F`E30m@Nm5-I}bCz-v3qdK5(6> zJfUlMiY+zx5QL$(-xn!dWg&P0jeES(^;K3gGqtMX{Hu}ihZqhR&_Z_+cCC}>ZdD@2 z_QBI-rXuSVnTa4bq)_siregd=N*s@f*5t}oUs}8EGUqggw@$vWr5<{n6CqBJyWn}y zUitBu8J+$l5NIB|_>td}#TJs~8c$mY4AtrGk13Tc(fE2N%Vag3c=o!>D!)3lX2w*( z_jvd-6)+TJAI+Oua=wN zQFDLU{1?hTfl%h=Te+|`K3Gp+;`!ogLW_3%sW*$)jZb1=sa_@KK~WJSfBuW*bHPc%6GzJ^P|UAzD9G# z)zLx33&j(6x8!C&%0%0wm&a`B@*9*vB-;wD!js6v`O4;`^1=U*P(Nwg=-S-XM`ZA7 zfcMO%Y9Z@Db(&m=F_d}?jV&v;i@xX2L%a! z34cKFv*$NIWr)aLn8P!h9u{28O#PG+d;`%dNp{Wnq~s9uIFO0{%|@Rfx6H09>OAWc z-jn$%%Z2oQHFGK!1fZ@x&Zi`=awgfCenfdTOtR=d$5&}wcVj7)3vH^OpfG3j8@Q_!r zgaw%ewL2{6(-bm-N#p;JUL7H8Mdba&TZ29gY@o!OzMjXYBOjKeuai9vT(nl)e@$Rvh;#>11AhdyQ+6vM+c%&97z8BL&A*Yt z6j-1bzG{Dq%>3GPmH?TZLCoN_!%c{cN$J#fOSB0AC<{ad4*y!Ge~*Gz3WT}kuo`T` zhmNCp_!eZ>TcvPj&E~eZLLf!q6hO38HX}4+tB^g>JJR~E${iZ19u{hpTrq^?Uh;i| zvWohu&IWf1G#F&kZ1k%%<<4sHogq+!+285i>3@`oDU4K`lZN#m3e57pWT|CrFwzs{ zn?u4}JuwH1&OFT4jn@*`Ddx<3D$DB>y{flK47S+ja^lxz*)Z-2ci+njLxX)gz6TDc z(SD*Me?@uoebut6SKi{}BfF#hV4fJ})Yey)z?_mrT_G^Vr?Er7kUi{ER_5Y$k>(b& zrr`6YXsCN*x|21b`@LnjOzSqqQnGgImTXG|cRcVB3X=uN?NZ70E;F3;IQeD0&fv?2 z85GXwyO!y)?y2+@4#DZY>w(viA<$c1K}3UY1KLVw-gDGAq+Nt?hCZxf= zJ;nlxo)pN?^w9Iz(7t)Z{F;UtGWUO$%J8zk59BCYt-;+^F0u!sbRHN^zPx7%6mdNy z!({D)2VG9v$PmH7P@b2~2+c5S{4Oty(U#0^pTwI&1bS`~p2Viz#zjKMuWaHcK74gf zKlHyVMSSPLv0`ZnxGV+;o|t^JU&D^X1s)fa^wYfT7BIr3W20V|WxIXU&pI)GRA0M&Foe{UmTP_dBpoGcEYl-#GJdjhhg5H^*)dJq_2dBzQ5#8rcO~bbS6PDNJcQxGT#Y*V4z>h)2VByzoQ_ zDH$uf`?W?&MC-bqdhX2*5bEa^EEk?RdYx5pBQ;`ul^3ndb$&@WSxns|$Wd!V{;F;$oY2Nf=QTIPJGk zKN8z_dN3G2*B5?yUchI=Z4H_6VH14K4i#u!M+B*jOmS zEQlH((y#kk`9&_;`yWIwHPpY-L{SqFi~4%^p*nkDBY~#&Q%s`2dy~VJhB@hG%_52; z+wce0@2w_*jBz}JM(Jcks{T=Wz& z7_?1^TYS4{r*1E6rSvPsB+z}XaGGcJS5c{Iw^DysXKSXw=%(uv2sku^RnzpusFd`} zLbbNGm*=c9Jvm?g%b@mMrIY_;Y6H{eEmlCKGU^ssq|kNd5Dfp4X1N@u9?_MNhW;X( zgP11C?$@DoaMw9DoL#r330JRyHtS>h?qrEjMP zjz{8$Qce;pqtBG3!t4WCl=19SkwMvopn z>lD>PwLp$D(NI(vvH!hXM!+suSAclewyn80HM0CPH=K2NY@INQbRFfwFJHv@bJz#W z+YF=hZSOyAM51mMpOB$pO<=lV+&_qM#`RsC6ym+)6Wl--;_t8(SjQ7AWksak_|c_z zV3C)$!)?HV%ISt?OeE(AUHHZ1E&>=l85+ZQmpf*<)5HFnA@5C(xRGg?4KN=|++9j^ zUv6;^STmy_U+7^)>stotR9)*X)f=RY2-Z5fWG|BzaadMOJg4akDr$sR3}|`H)A)rE zcpA-GWclFErY0=D-s!21HK%}uU&|K*MO@~5sr6l>oT0d(=^pH${=WX&poh(4v0bY< zQGV2$e<5U|arGT)KCO~I*CHApBIjMp zI`~@+`B1{bcSg2er+R&pHvShEoP}<0xf`Eo6K6W(YiR~NqP!kvOpOIWo%(jdh53R~ zklO&;%BpN~D2-bSDfclF{(=K^qp)_<1}nT~3yqDwrX6*uC4aru0|Cxd6QTC6E-n&p zYfwTLk@%?FXjvVGok`-n{Pvj7m*k^W^H3^M!D(gUPm~LMcvO28yB9pu5gBcC7(NMC zQifqE5hZ_L#`qZ=rmU3D;ax9gYF{(Ne&5Y^e%(O{c({=>iZh4ti_WnUj#_c&AV&#_ z$8)yNuX!F>^6>9_N95CrDCN&eF$WtT-%g|BFUi_Y1qGK%^pd8REEt7?QpDdDR?NSb z?30wK(I+Wbqj(7=ID@Y*;!$3o+~3WY`T6`Us425>b#=WqKQ7((I5Kz5Ybh$^o|1zH|<;P#du>DV+I>yiBIm%g|`b^*n=_-TKd5 zv3u?nI}>nBOBVE2E)VX@LYS64T)QxK)$l}u$LCRo5T37b>=f8e>oiAUn^@K#NPt#r z_1W&7?`PZ=Mog%wbw$J#w56YPEKV-bKgM3oWFKC^}1mDC^DbU+NXmbvyC+D7O6q3 z8iOC`gv%ygTg%4V(@MR$qq(D#*~oA2 z#SCS5VR^An?_9SbM*gZ0Tdr@>dNvFtb9Q+Zu5siRrtb9*nBiDE%Qpb-0Fij zCW}hL(Z(c)rLLTgj|mfn2vbQG-CU1T1H6m+yop3vV6B<}G&!2c`iqWS-%o3=mZs*y zKVHI=3|bp3T}JLpPF*%E{hS?-{R6;=S?)8PSk3OJ2~maV7aiTCKSmoGWS+6MktxPL zm3r)3RXS-!l)c#X?m^oS=Ni}%`nH`*ZxV{evniOsWnOLEQan#W+wp^Pypt&1SLeF= zj6^WSCVOH<*hBetG=5d&%kK+Ho?vJMq}xqp2Dh=R(2Tn<%IID_@m}-$*dyisvH7y< zInknx_%5xBG3}<*Q+O;3$)YOh!h0NUY)x^EdlQ>_vt5 zLP+{e9#pO5w$MqehdIds!YcV3>9F~WgHJ4;Hh0)E^Esw1o#(M6soOKn8-I`(O^ zs0bW%O_fA+nlmc){EE!f(Co{#jV+9PkJXqmB2f*M1t)j+_~>?x2s43VWl`DIt0U*Y zV>^SkJzd}OuzK2+gw=puAcfW;RI1NJj(o=#)7s@e6fU8R+UZBgnc^_*~ zaN|#Qi}2%RYm>=`wHd3D+=MQa(w~lTj8qSsZc`cp3%eP5KTe)H-_gif?YNJlQ)j?2 z`%_rNW{)A-`y8lQV&L^Fdr!T^>?H`+Ne!yFsi{z4JERLZVh$K>n=5923tg9J!q*#N zBNpdvr0|t^aBd)cX)MzXLyZd6!0bcvp{42YJ@Ko zKXl~M5$bScC;ga;6s6j1AD7>Bhhgr7V_Lekm9RJ=dq>v$JCHZA8gF3te@m+%5B88m z7$iHrG`IKHbl)$03%6I_m>cgx-Q=DGFW?`o6fK?X-elohwI0n6hf;^hY%s43Z5FkE zG6cPVtNl!|C}1tw(I=qJuZ%7(B%(fN8|EHeYk?w#4%0kkhQ$qQ$;200=EltIp$v1% z`BnG=jc5$XDwMc-16~IEw`H@xZaA%UO#hs0R(jBCat<4m-^x2&Vu9tbA%u&lwaGrS zxhE`rA?q;o6|Unu$?JS8#})eTM*og>#A^zRBUMyg0nhx(}3@Dojh z`rC#SQJqI zxLd+2$-i{mCE|-HD|Oq6!qu_-@e8)V3*86%1%l&=#5c(osJWA0Za(m~GPMZ{w9K%XygA=|5E7ZDl!(a4Nt3z^mf}3VW=|4|#S(Q`@pC1xA6k8+c_=-{~ zc1PT@@f#hC2}uo;qN)_BgRZm9uSB<@#>VAowd8NwQ;aP_E1FqUlur0urNcl(!Ysem z%Z>u#!EpTBytV`^F~?Uc^VH%i69Sirk(oTS;`5dDnn za!D<6N>A5(~X4}#xF^P zA9t0B!$J{rj^8SaATxT-XrxN|$G?CnUk}PSwCXHx^^Bv#qIUK5e}xveAr2FR7>W_n z9x)6hiSWVbtUowvT_d+Vcsz2XK@(a#NQJ>k6?a)Pi9U~*dUTN*o#1_%MqakRZlpBP zelKh}t`*w*>m@JyPfaRIIWQ5OM(tCz_J+xCBaiQ7C^HP%*mo(3t)c8Tc_^EI4{%JQ z!~Ej1j7w&uE*Z9NvL{8XGD*XJnXgH(R)T0RZ*1vzx0{a@ z#ROev=Eixh^{#j2Z8&k_LCO)Bs=_S(9-WZu0~fb-hRD+{+9};2Me37OByZD%+@?;% z5kj4$aaTbx7d}*NSBq984)y2+)#&1j+TN`Cvo8##J6w@BnM4&^dD&_m{9^!+7MP_P zxe2U!uA8CJ9C5Y)A=zX z;gU!lhW(L+?9M>IA8I2QmbD*_W$T_?>^Ul5qv-bSM5G zmk0!gkJ|*=4d}P1I>PU&Vk|h`ULjqGyO($6+=2b&>B)pmiyz*v7g$C=HG!alS!OLn zre^wX>unLKrArIJY6e#+p7!*_bu8SnBKNK8HKO#aZ%B zOYK=v@(!;-*n4R}A;Y0{_Ck5ro_xIcr31Pby_38WC+5d4?|RMoB0LBACb<9la=o#UA#8Qg9skj26|ml1ek>Q~dm$F;)qq&33FF&7%;WpJJW*^aX8> zy+yGEjg1OUC<=KS)7hVBTnZ-XEq`OQc$W~k1>97uVE3yU3+>C+$%=x|TK~=Weypw6 zg-J@EPbBxON}MNN)P5D7!`P>9ODM*2AffCe5X}&1RpaY zC)#yAid!jRk0=!C1Kh7_6>1RtzNDqy+!TU zOu&pncL}2OzC5+}7&lQP|Kj+LY9m~YNxA6!F!6oTV#VW8mgjW&rScW>&MJPSHr0~)MZX|@v%#m zib-q9CLPG;?+l4j!3@jT+!s>SjvXqUGzZ$4rFt8coQi<&|VpRPy4E7`6>&MuI!t!iawZ4g7(N(^-kB$w`yDAA! z%pq4`nJc(l{TUn-l-sDMwx~_TlhX5^P1EDnP=A`1$-#gp5>PiU z#_;gAn56JL(e=ybQH{QMtBM9U)T(JU@*_tBzR=$eMtb_-i+w$ETdd|NNoe(`!}37B zXcgzj!%txkhc?a*8m~~HkcqB(#dNl=s(%tRs1&Og9i`(>`s;#Gpk#?xk@NMF&r0}% z&b;+B_)f7F1kkJL^XK2uH}<98z+UcrMAQfOVSQD$Z8QrLFZiw?T93gp@o1q^RKq#sx!Lz{V=@Lj~? zpq&_+*3un4t-)^S)TH^}ul*bN+R2}PMOqwp3mkvZ5;o+QGJu$f{pnOKc<_28yjxl0 zYN;U~VaX5BtUW!?D*{aX)X>TsqBwV%;LW?U%5SM5kY4Jy1?Z?mj-7BYnaI zGhE)aY2Wu#&qt$^>tsR~Zm7a(G>XgH-2+m5exQ5C3Fpa0PPZ=3$-|7g>FU^RpLt=fn2^zr$(&2B#S#(}dz$w^<;i9VY2 zmC6$m54btYrA^6cG8`5 zr+8Pn3X#hozMa-^wCkQ|Bbav#u^D0epetI6o%M(ASLeSvMZT#vy_%|rn{=TVX$*rq zU#Q{wCQ3Tx1@hkbNjfn!+ph;#qi)}Jxn(OI_G?QJTohw#pUt5`V>IF8=ov6lZ3Zm~ zCI6aZh;07j!q-TLC$#gn+%817*Eu}4$ej}udAlC zp{V4Yd4!|AcfR7IWNF}M^Jg;b+h1x8&a`~n{Hmfq9OFY3DKN z_}XrwW^+7euN$et+yv;=otAj2^4D6G720*yDujXbF+s4>ZP+%<--Hz~%v&xW^~G=aBB<-agy zKSu1!Nr1BDMT`JUEt#tQ=6eOMmA4|TIQF}th#2>AsxCRFr`;js{Ly>|7gAJvF`~61 z7hd=Sr2noz?N-J5I;Tb!3ZHC{@XdQTcE(?J)V4E_Fm%O?D?i^^mP@})I37B(^RMDf zV#qhu``i#-cjgucJeNWv)m%X%bP;IZA#bn3xF9vb7Z7&8yLz7(&p$rk~OviA~HEV@Fl5LslZ(~a--0nm5EY1D( z%ARGRa?6={tyf4qLySt4XZ3h}*QAg1ET&$2zqmIK;|0TD{`$e6>!SyH4P66YF8<8* zR+EwDg_Mi0akMb==yRP#ooSzG#{E9eiXO++W=&#g%#7$rBcR)s%$MA0K>(K<1>=h0n;QPShT~TNC@q3<98#kB(@%iLKtG zvov$SZBeVbtr7#K4}H5C=vpq3MLn_YG#AKjrReg+u+hu`FfKxX9Hp=x+a3 z=x4DdGAL=aY9KkaFUX5+9Q|S&V=dQ|w~j5nE&?%r{A5$A+i$Jiu{$0k{ctp@P&vQT zGc&BaR&Lw!__`?V;#b;((SaYCI|^?^c#Qe<_36oy!7E=F=BHfRzhtYFa2f-y z-&uYVQ|zhenj*pO^3r{buID|zUrMMUAT|Cf!$I6lg=ri+R{@QK z`7x0kS!60GgFel4tnMG77*c}AVDUk~IHA6ba@jwuE_gWX?ESBTPCfnsF1eOwri0@a zwn1H~HRkCb7*etCqF+4>j(n5PsgCmG z1O2F^C zv1JxZ?ncRtO%1TdNvGFPQaAoW*2Db?9G@7Y=;UjQaqhD5QDAJ)iC-k&!Ut&LGRkqu zoTnc7I1QtW)w74%9kSlb3Q;AaZj8>$=_tMsZ;n^ouUh>2*|=bbIuEkyJ|pw#Be>?{ zc?)wZe!rV&a>JDu%}IUqi|oNN2+E4Sv}veQ57PG&`rZ4&DZ#s>vO|Df=<|4z+fmMo z4S3;ebc73DmT>C1sMKB^y7pl?VngXDW>vb@O({u&Yf& zW4X9H9{nN`%wUgp(OpgTkcm>T$Y&e5mDTJJJckrzLUI1iP}FdX$$KU2y?v}eT|n_w zihs|NXdd9ZwfaMw0^;L8@4L_cx{u437XI8l)LB}^*nEyU6P=OiNVPO#pkm&gcT7Tq z4BQC9V*cT}q_YBAH|AT-Z!?s#^b$rrek*+Avu(D zXacN{tFu`^yTz)f{K(Eq8RPv{;R$}~q_c(csY&8b#bTxL|8!h%1Cx8!^LPtH zbNRE`w#!?HJ*oSHPnjr_Q(zE`2JPl|dwht&`E=}3VZ0;BWKMn1g9qThe%hS`SI`0( z(7J4A@DCRq;zrwMzUkNy!XWOBbKS@rQXFnHVafC;x6R0Oh(FH&riVQ#n#lA%&2qNy zilQ`!HW?=yj&cztN%cJP)^o zE8*Rd^SU;s?`K%I*WtVEtU@x@T6m=)Mhp(STCakhD%V+Yx_U5o{vF_*(8d3!mHp0v z&K69gW7&Mm`G&VbXhXT>T(C5fb@uvOLHvM3txUu z4R@+d1r<+y^1}&Lt9%lD-ZT8}U$?=%+0qU(JAJV`B6 zC^Ay})sl{B)?$M4$m)hHBPdPbm*qY9t;1}R(E0>;T+VMSwqE_v`n4)u>pVyKKC`pU_ z6CPKFO))_vnDa3Zb_|rtwdpX1@)GQ&KZ5SVu%t?*AFSJ1wL1Yq#)RqJ_35`QP&y89 zpQQH^9C?TL_)7NDUMLZ580Y&=`^R{XJLWGYKt{?Ro4`}tRwqfrCk*>bZ%z>mivrUz z#)?D`lc=9mxwdN-(&M_dO|i1%sTN^bX7_!0I9aTV#-_oyA96zb+3$ zNucKXAi~>8rdy-IdL$yBZ;CM_pYNg%Gc1R4Sq2NthS0HC#FYiJWs~z_$gC1JoU9wf zm7axX>9IzJA-;a@S4?EqX|FD!42~AKB}b&&{v&-rPm?&|M!GSp zxQpL%_$)l z10cF{d;BSobN(p_7*tv|*9=XSLq+W86&Jp&R>1(?sLx zChr$^^VD$Otry{{0gPlfj)4i=M_~mtjDn{+6BOtE)})qh55tv->wE_X(V}LbeJ4Lb zZZiZQA4K1Rwf33XFY~ahuT$1#{VQ=getn#sx4eJU6J6a7VKMOw$+zp=R5_4duGv;mDw()K&L1AWaPpmq6 zAA|Alg}e60xLxI@h_jBb({D7p=tGMBVPNlbjzi=)glokzyzhZdq;-j-qG#*P zG@i8!vO{6q--!OWC{Z7{9r51t;cO@S-xNGnfsJBxrLw?lQoX9%M@_J-=RH}q7)K47T2QTe-em^b7d(lltMYkV7|uL6cyv8QiS16YbhqaabR_oVsrC$4|F>xQR)gnY?KG$VBxGhOq= z=qB6V?`y!m$+`{|%`2$XKCJyU6N6r#%%j6NA92YIPJUg@4ls!|N4}%ZpcSV&>hyHnT+;&^=Nh9+RkT?MTDgKZgF=~?c{hE5cqGN9YshbDjf+I& zhY6X7hvX64t{(9RAPtloDsexQD zLw7?krEOWLX}sAeb7?wYX>ng`PRf7t;paDD>QCxi z9E84k+5VLnAfuXBCphsxo~)1)?`=?jxJ|uFX^T^@fZ&~eE$NF1u_+xs;9?dYuCqLb zlHSA8osC6}OV;qxkzDSs7j1EZ0?XN_9MlKZ<4MWdt)JSN$_NHuM)Mhy)H0=i4)YZf z(HFjf3v6;L52byg#}(o$SRR4X6x4tHhLLw%@L1moNtX&XyEx^r+4Wu3_tzhid-lEP z4$@DmHA4Qop5AH9x2I^N`RsJFJ@^K)$7LQ@+e2u}a4V8pU;J=YRA1jh#sNK}t=*l8 z@{5Pjob-$7=vUZI&Vz!e9l4-xo(#16Q&Hv$j>N+YVx>fyOje&Nzb+>n4pGp(sC zipnpEG6-CGOIde8eJpfDa+4eT_sfqDtqx16E4+EiEqS<$$ecMk)}~!L_J3jd(vofu zo!GSXSBUrKj~6FDE)WN6+ETGk4bN?~VVBe|Go2*5%@oFtKXsD!vO0j8=oXplrRUCF z97evB{cY@u`dD?mws!7TW`x~pfcn~fxk5wKChonYM+N^L%T@6T)?m~KmCnmb5!jqY zw)nc}*@n}LWRv<+(HZ=jsrwrERFvn!cwm9xrZQG>kl!+bC?%o(<&#<$Y!RoqC3;-r z+MN6n?UpgbZJ;@SH^XuSkorm7z3O~(RV%(oTofn&i^9oYxAeSpcTtCnO77*j-C@Ix zAfx{NKDtapEQjtz|8;+-m6k**Hu2%RU!pSs;gw<_;YC-sgC#w9z*Cli9rpF4%0TIo zbUcNtbAl3@m_>uFluP5?x9DUbtwRE=7Y&}D>8yEAw-%u1n=4V<|3AenhfURB{|`xK zy-=dtHkb{NC}i8{sKBFn$3J{3xaNDKHE!Xsq>BG{ZUHC$EY!;KW1+T|m+ ztqnDMt2dLP(F}nv?6= z*h#W`$NP>3ybS(-o*o4kzfP&yFQ3a*&B0g>kR7=uy9$sY$YZ%Fr^HnXnB*|KtU%$$ z=ftavj~{ovgbsyGuvb%4`Zf^_C5D+H4ZuU3E@)*7A-O%aZWKXpbNKJkFwCRw)hgr4 z;<#5RR1rB;>hB`Vv6k-bRfYYV5Tj+3unrIG6Caqk*bz}pEgG0$dTZ1k=pE5TR%~a% zb%k<4`#T^Qq@0PKiT)NXBbDW_aMiXWe^R>gF=*H5Uzf4)F z#IXgH)AB&tt&T1b;oGRmQ7<`Uuo#A>+^z9@s9TB(O9U)ZJuD(P-n&AUDXUNSU*5N_ zt5Lj4@19nL$@6za;BS!NTgW`EqJ>}scM5DeMrgZ2A{~Y!Ht^dS>x&v0M4<^VJ zo_vrvBP5XX3d`Hu?@TW51;4BR3LRcX;R|7ZO=10B(uu`7U>m@%M`ua7y?@$zCKI1r zc}j3oa5^N9DDH9blbK00OZvTeLI2lnZC`qQDW9FiwfTh1^Xjx9k9=hh$Y%IArVD8P z6jnEIa?H6V6gl?zyXJH=f73WQfM2*cS8JR+fcHdwbIDqE8+P_gyXI$pFM1QPkL(fj z+ea2mh@6xYmRj-}SmC)WKVBZeS71?HbJ?_Kq|vH8-tZY;Rb7F0cp6 z45~d3*Ta6R`NPr3`B_6HYB=lBwEBto$Bt50er;tbQ#tpC?Bnelc>$ol0j!f<_vp+DgaC-e{vh4m9P>Yh@H04JecZ>AS8 zXMrwfkmoXQ@@yyl?~!e`$r=ee$U=7uK%XYDLvYj0Tz=4cYPlQ8O)~M-_?{w>wR@+s z%~=*BNs-M>_EAOOn6dp4dRKhb{8ahNe}u-l`~M+$g*@u;?UH3q!R$HBmGgb9M63iS zR{0;Qu9##l_Sdp6P z3R>Hc36yKGtzTJ>Z7DN%-Zrz2SaX-|Muj;?K&vHBU!a+**oiMSRmMmFnE}KDvHPIy zi8NMu6uRUCtFqE~47%W(H)TJ`M>j3+NwH^kh|xya8S@~*w#kOAc7t|(=f3-pLq$hf z@iWKz6miA_j3@FCa?pr6xg}kPZu)@BaC7YgiSTt>n4P3+LwlYU(ZY8-z;Qy`>fj)@cJBl6E zdhtpg1uIrvxp#@I$t_kwSnfwYOoeD37VX)muoowhc+&KKuHh`?tS>rVJ-%m2r$aN; z2f_6dI`bP!qw~wh9B6Z4>nqKJdR^EyT|`U=Tf^%Pl7#xf-e-05i5SGXD$&2TXH$46Nw8~0xinwxiClyjW}-(*Ku*e88V~Yh zu*zf5dp=_VAkHw=Sr10Xv5>pom09;D*FhFI#Q8T%qp3&xqiR;Et&X2llJg!%ijE*0 z2<9OFmhC{}Dp&lb`+5OWoMU>Iq|{&jH+WNN?z=T>AQy>)%(~c@gyWMBo$5qfB>`%c zb5On&T8KHqc|xy>BdONPfwYGDzwfD|h>{+UKJs24mqc0H$PbaooTU24(EFnHOcsT`mG&&)*dPwWR%e={N-YtE{KI24vosL$;~<(V1t z6#07Ctx~{oe3wlIh>hbXSZ|wc&h9`oy>lGm$F93?kqff^YPYUGD?;q^xQ?x888~|r z&->JrMNMD$dD62#(-DP@_vr?q_K;5KRNR{49(R!03Iq*+56P^9#JrDn_O)8hy(>`1 zeK!w<#tR!gc>(_SDzaz=TbPF?Iq&D-hs3RKvB0z0vV?dnYewK(Fkr=w;r1*clu9Gu zn+^DkWw-I&b!T1&X^=y3qd+`*&x5V=y+LBy?CXdSwpt4k$VQwI) zP$jGlNj)uy#+kRAskXo8q&P9j?R?ycOZ_#Z54}t_9R(?X8?rdBj&+GY1U6;bkZ|EO z0;65vOV2m@#pwGHD1jcuwezdv9Y}-v>VpOD34DeB*F6DVl=9W|Y>|i$*SiSHSxZi= zp=Dr@&duG&;U|bJZvFH4VexnA>{Fx*2p~^lNONtmuHDR8BW^nP#})^M?%eRhl|R)P zRHPQi^LMus*C4tX_e+qZeTYc!=NRdcQTx)4?nl*Q(ZOe`XbqZZpizy6HWzHG(8qyt}9nD`a zmuuTQvA%8*{Ad7tNcZ0eNoHV?TLLZRE&%pMMGm-hd;{>c#Lh0P3>qCq%YS); z^tciRC{4i0tT@p!C(-pI|1fyImC%y*N2+LJ_>5L~Od+<;o6ALvzKp1>;9K}J&+m}_ zpWESObeO$+Df)l3*rzM(^PW8&M)-%KJv~OYfVJaeE~+oZZhbaQo-NwXGnxRB0AAEj zNZ#{d7eHsx2QGolxdY^wrU5T`{@MKTTP#qJ*sB-NjsRVnBuxZq zdqOEPNq8fEcM(AXEXOY9?`{m%pBpBcezzZ#s#MXxe+5d~Uas-+7Q)Z$k~OtCbz>!h z(R)b0_ADjS2Am7XQ_DBY-|P1kIQ~yreIt(+zN3t+*XDXy+&x-6fKUf34H#|RUdfDne zVh|MhqS(0r>HZ&={{z1NA6N(+iYxC<7U1yIIS_B)H5E!FK6i~Y7w6WosZfto*{$7X z@jz{^_j~56c#CQV-^kmnEzhQvqtGd+3Lp5O5MazN#%L-URdm8Xfm>mtUw zAlmXi@Wn`bX~ij)7wWt;TQ$9JA(9oJQmd4a6^2VzxtPx&21}GsL9tN5daO zQ1LJ;7bvZ_5hy#&5glAtuYT95Ow#*&>FRcUeKgn)d_Ijq?r%D2Aqo3*c3(fEg78n! zL;)~B(Wuh*fYLM(^Lk6Oi3@xSN^uh4FXlS};}A{J(K-=0C;ZT)b(o2{pgj7b-_}cw zkni|GG3yVVHD9p>7^thbAKwc7oOs;xIVS9|mz2T%@xp1EP7y!BUSm7Uyf<&zs*<}< z)J>7z1chTWrCE>goiQ$%a}LC4bIX}x&$fOG?Wk`#A}K;F#YjU7?#z9>fIHX|)>B{C z(R7|q&~Gzg01bE|-jiP?2R{ngWop_@*?UyIGhkr*c`lLt4nP+end0TiHvfr#LoYXM ziH2CYW}^+|-=!0n6x1CMN*BHIZpGfaCwJf$Rad1QCmKcG%SrjOpSAmxVp?I2reWoyLV1Ijx19h87c$fyL;AvC#ofNC~I(op8 z5a!tSOy-4>z5p-*oo2G-G^nkFKE&STGMbiFc)y1BP1(lmJqn+ zvKw{1Kk99s`b+>j)m0I}0dOG>BpZ`LAE#o-{2Bx-H*Vl*E7fgrXeO_}xu#Kc?UlBe zt={LJZ>mAD?V6@EbEjxnCR3940i}*WR7OUQi#5E5Lm~99PhdH8SCv)ALiBP5xFpUO zztgfVY41}K-l1dJZv02GVHDKSk?W)MyN@Md5P++3QYiv- z!==JLhNDZsZL1dp!UYKlhirZt;dhO`3eHZUU}m5HM(GCBx?wNzJVA0$f=+R7X1h0) zca=Vx>zE&Yf{ui!2-d%hdM*KLi8pjoIrVS_2D;X-?Jd%$YVS`zU11Ecx2%|9h-=M~Ep_pGL6$H(w^VPKam z9ApK^bFN_5w`_NqAH`OAUJRf`htbd+{bO@8pO!&$U1q4L<$G z^Yt2bYI{}PWMJ{%z=q3;34QJm_Qq;v4{Pj;EeTuPxO-_!ymmc2;)qp5;1XS9y?Qx( zd*%9zd1hJlT9VaF)Rxx_msb|^GqSdVs=1`zC@oFHXtx&aMh(5sWBlwPws}1Sqc+M| z|4RL%twa!+A$o3`*}{Sj{l?h+S%dzAKu?9^*#S%~O@@ex=%?hhc9W~MJ-#5SnIYX{i74T{{y}iXlv#2`fGWFeMgE&#L^j`XcxKPpj~B!)zI?ccWc1UkLMe?Lm*;!hEPOGBnhj!0Z>V){A`!HL`h;53W+x! z&JzHXd_buJvWtp~-h|O;+Fedp_p-@M>|~d@WTOG0z37!1Z?$s8%gwfVRW#s(S|RN3 zlNyWsmH+Ks80qSltD^?D5o(q?@q5prs;Hbe1_Lk&a63YN8~hvt@j=+sa>8Ty#V?Z}c2T%5ebS4}ZgEke;&;acW$oI%3CiNPxg_of z=w+t?Y7@?b%3d=_9y`K#e_tKsr-!)Hb1XG|hh}LP#1>|iy4uR`-G-1Q?bE!YJHowB z`x7#5 zWiR{yYTrf+tGRDlAZ8$&YiW_dbFhcG2YtN|^ZMJ7ri^pjEi}`;m?H*iBt0oDrDQ$3zZfwtrgJD}$%X+W zx4hrn5Hc#0cbk_L^}XKD)P2QE zVCN2I#dR<7RAO&$_Pn1G60S% zf}i(8`T2alM6jtqdFW$4NOooJxQ3+L1n*$GV&I$2-N&Fmj zc#k}>&mp-ZFJF`EPWF1=_%_@6WVv=D#58E{PytXHN4JoY4Lyo$oi*si;*c7GKvrAF=C9ZhBmT4ab=v?1MHf1FoGb;XI0Rt_g@o zT}W71E!c@g zfi}6Mz3yvJqU~~LFLHOvYegWN#6Ufy55S0|)rAObD&N6ntggKF-{;%^8D;J;_`-_) z^??=T8rW&D*TR{SQ2F?wJT(UmiaNLiBR0yF==#)KVk3+!mdc#D4*^h%KxNi0e!(vP zgPC4soI18WzIzG))xGBOdz@JVbQ^v?6#z^B%Wu5gQql$7MJ|~3=xPSD9hTw)8ZS*9 z=blKEPr#t-*?Q_>D$i5hMg)|n)n&fr;HGyoK2fo9`uA`6##S3>Tk`1V1e(AXq8q^Jf8WFY_XRr{3V1zw zCSw2v4Uv+0$C}c3UD?2Ni7MT5F|iQ*Kzs{vEEBLrJ7AMoucKF);58TpU?)$AE#!20 z7q@yxu%h%VmJYnh50C%zCK<8q5b{&)<#kQy_xq*_@f}x*=4qVF`Ndz12RE5gpzEWA znz~UUO)Jp~eLysHLv3?X$GA|5lmuwulvp;eb*f|uao=Qv`wyiGY~BIWd)%R-@u)Gk zmNsbkV(T|ePaKIF*Wd&Idf`h!41ItZu?0PY?YO?XO&Ks2Pu$E&E@Zm?ibar8r6lrk zA_Wyw{Z=yQ-_257nVzRq#p!lIw$piL_XP#Z{W9o%-NH ztBFtjvLN;a?mfx{OB1wz{%nWw&uxTfwHwca?%T@iAjBX6&>n-x#;aYqnmpR$NGekt zNr=b2OEb4o+arcWU^dy7U#Wc=Rp7G+c$yv9;D{NRP^q1m-U0$L=^l2DZ3C0me--r8 z%T%}f-~Pa)=(b{9AEMS@RW;r87c2PaX_F@wA9RqB`81GU1e%k)igu09P+kzVEUi;e zD??QMya5@sHH}NZbJMu)2T%`QlqSCzMBGD9`h>dMWvV+4OiI@u2#8#rgq&33Mi$3_ z%0z^~QsBRr6pYLVC<3Et8@&SKpFo$vhF&c_KyCmBtfSCV)}KKL$42gpGsLg&G-Q;3 zRr8P{>pXue5}qw^zTnpn=vZBKsMiqHNba2Dpy(Q~N$0;uSlj$Sv#3ez9l}~^$92Bn z`c$}mC+z9{XR|WI(#$HndZEwV&!fg+^)LR7-$V5V?E9TzDd}x$M|2T9o2pq@kj~w^ zjt%kKgNQW%yd0AKOv-%OHh|vr6EG+I*dB2P;6uGb^RJLxdlR|zW|tp3Z(Pe`73DLy z>LgAL8XUj9yJA~Jq!xjl-MTUnVMkvJeA@$?h%0BQ4sXqHsw(= zNcreoBDdLvCqynL-ySV-D<^CslVFLfSIM^z#`*jz_v&*9r*5~82K!c*l{jOlyxXpq zSJ(R=GZ#TMAjW!R<}QwxzgqhV*TZ;|ZR+v_VMuBGcJk^@4cNe`x7o&DZ!QIvhWtd= zGuE{Z=0SejhJz&d@)&Wdxz32sLep~OP2UtlI8RaIc__qwjJJQG0atcpgx~lbF8^M` zO#n&pX@FU>-syOe(Cj+u48G;8sW-B@hvpME^;#aAz-&Foh5gatk#aHyv0e*H*$g|& zUWVCXd;C^g3}zSnTG~8`fwEy<QwjQX z#gisN1s1JunC6HhCD3Px@U%nm=_6@C)pI@vk+m&&xO@&pFoTK~d*CgYq+f+5ILr^hoZn5KtN2UQ~nQLTF# zj;C>wT>!TZfIrn{R^xqXV!f3P+YUBs3DBJWDZ2rKZ+0#B;`CJ5v?VmnXU8-RzGgp% zb2e?oZmt$3E08%2h-jQS>=JdU$3O|T%x^DL$y(2A|<(&9L z*_`sIMeN(I$WQJGk!4RCu%+WS%}ItG)vmeL)sg|>qiuFsPjL*tkBCVXbqyC>vvUmx zUt?uVfu^ftyWGF?gXL7#hkL1?u!`e9+(}VF%cjv@;1*L&mbAw(+B_uhq;y9Pcdr#3 zJ==2+|L<*)*g=-OkdqAEn)H)?lse!?tc#5Pw+zxf>2fC*J)^`D33dzXc7^!GhUS`I z0dCnPQTodunBe5KJh#bH51OQsMy;ZGA6;qS@R?f+okKmeDaGt<3YahSnfi+P@C~?k z$afekS;nc2)2H8Rixug8KbIcAY^j1w0F;n_JUa3^#8%sD=?M4%(1HsH$cC-g)8t_^ zcpm1&7=$`@XXXqVe>pBQF!Iz3LF*b!@#%Ouxc}oScyOlC-+#W=#QvD4weVRz#W-BB z!@tV!Jx5`xfJQ!ADVIrC6sbo`Ub z(k64vv~Nj4crn?&K$^&UYdTZ(L(v~G#7i$GqJ^|ey#ma>V2mVn`XWTQ`eXEE?IBn@ zT8$ba4x>sldkT4~xCCQ>aM*qr+)U;qxnZ$8$He-fRmb>kJE`J~ zdtUwKbN-z-8tz$5hlpQYLr^h0XUU%5MaO;~j*1%3G)jWgKHWz7r&iax9Aifb(MitDa^bcrI&F{%S8gT+JVTROdRzw1=ql!56I8nbO(4mS<25$fn(9;g=Kz5Z+keo^OX znvjxqvyJ*Wg7PlC$Dv8qVD!|$W~XO1Cii1IjW_>$kCMX}f1(1?mnQXE#n@*2-Sf=fFm8I&7)yG%6KzO;6!TA-bFNXTQyJzg?M$NH%4EZ1Lhdk;(R)eGwdD zm+wAMH8HrDF}lCksW0-^ziDmG{6nj%n4IIDpV0C1CS9wWV2oXj_L}{UAi^FNk;2C9 z-*jnh>$O8h3bh<{yN-7I4Y*``qllWWoDAH2-!6#b$;0R{)hu-RcnQEiYa~aX6k*Ja z$42BgXfb?_UU#GDaUYKwvHeyE%lfUTUin=OwPIohth4GYs$i>myyyzPESTfYSvl_L+68#z^| z(l+SLhMZYC|AuVlW~&j+mtVK70}Z7#S~&$3@$uz$ zk!DT?N+kg{J}^8dMxCOUrGxPo*Zp{O1MnT+eeg%fXH+35=JPq^q%X(ke~f3>0M`}N zEC!H8uk5_#oce7T=XNi5wimvg+-c^dMf`SRhP>bZ#D71Zf-%0l zc*!0~G1I4QRj|5y;P#sGEE020cFI2}_d`7+wF1n4QBQ3HuSOJr9L74p@6KQ88 zfnK=EjX<%nO7iuaYQ4H+A8nmFoMFYA8$L%?^j|sb%FwTG2%tdd2n$16mk01wxlaxz z>!rNFZiGcl`40|w2Cgr`b7jexv@xe{y3dt8V9b(U;%b906m>eWqx3{-C`Q@doIE9& z>c=dc|9SU3S}acQZt12FJ zT-lvQi_i*Z^rZy@P{lQnQ2EykA@DTE)vMwY#Bq}~Mu_lPL`ibd9H)}L^LmWg6^?L+ z+)(88J(YsZ-ksZ^I4 zO#So8>rVkBf99^l4_&L<-S>*Vr?pDoEC(**=tDEuo6cvf|9QVTI?*&B#TMXejUY89 zDy6i!vlQ)1JIwXVXP7hBs}@f8=!B;@izAzsWsp{djr&i|2#WqDTi3)STCO#&z20s( zT`|rXuw-2rpE;ZPH~Qjq7Or+QBwD2%(cGCtbLG;hg0Mliulsal$_PTR-x_~+H+c+KiFez0r2z8b<-Qtl4h?d}v(ZrS~I z^DX{U{Vc6QJ;k8d`i$8^54NCk?TX*Eh1>t~GL&IW=B1D=^WN==gGL|p%x?%Z$q>~{ zbS^rTd;Lx%G$}v$tWcX0ij^0!cMS?hjGDKk6_?0R_ohXD?r^-lJpQ)i?txa@^v87a z_SZ5%==!u`CCr&hh){_V|Ecbv=$Wp=2)-MwQ!k$BCyM$m+K}ps6;&CERVR)5QOfB3 z8Gn9VYzezuk^}uNsFrgsb%yOS9n&#H<(VFoHI;uJqsV0Fo}oKd+U-2M+iwoR#TE1f z0-IeEfg3U4W$^E%FIe4Aa|-^-8sidm-67DR_Fs%ToijXkYP{I5bq)L==m^oS81y+y zEQ4hr`dbHN!q}%3V0<(RpFsdEQ3_6oAc}EGip3w%bFKlycr)_O5SH8@Tx^n|cavJh z@S|{ocdP%nmDJh>0t(ClUp^kYf*o;w`(pkHg2M6n8j)+KxmfG(f|R#%wJM`g~z*dJre*P-gvhC0I@5fDa3zlDruE0Q;ef7Rr`r8`iIs=-22_lu*>S!f2Q+ zmTl#VTSCq%vWTA}(_hMsmlpI$i{f3AI&$8oQLi<8;-x*Y#xen`W$_|m{JC$IeF>B4 z+Ja_2*=Q;EoJW1BYc$1$biWWN^59`!&Ymbd;SM zTyIvYafv8=urTa?#YM0K$-x+>L7QznS9JW)!mAi4@W=d~MgA3KKO^+v`!HH!6;{I) zS4@;)G?7?=C$0`}Uo^juZ4(Ux6Z?_#(jQTm77gu5V1m^MjZ(|SU?fFT7=5LpB0>I| zAMhM5MF`xTm~Q+N^vniTO>~sKD)jKniJv74G5;S}4Fo9#4DBMEO(8Fhd^)8=S`376a% zf-FSsRZ66Wt|dvprABjGtm=aR)jy9=BEug0L}d?Bd$Q&Miym5v=cHPzdRY@@DA3>H zK1wuobt4pn*+dRPbLTICLS#cVe(1R>DmFYrZ11?rD3`|HJq}57Z(yLB^#-9Hw3ZSR&bb~cI4zooQ5_eEmUJ`qm^qmlx+k)RELjy=3zDJY z7}qHxv2U3I3py@j$IO_zvzA@AYt6<=g>J-`s@Qf{?dIu8#<-KMGcH$QY?omK23#R5 z2Wl?fm%pA71$v~QzUV#jDs%C1fM4`CHSzh4U;loPz2(t(HBM$WYQVO(w8wQ!U3M3h zHQR8Ve0?UEAH{0lug!yKn*G2)I?8NA?VW8r15*(#!!&9J=0L`LhxJ<=D@u4hHG4|Ie0v{i| zi)X2LWV%!N!8CZO_yHe|%>}q3Pk0Z8YEW|C$e1-;2;A`60~&GfNoYRtBG$&cF1LM$ zWFyqA%&T`r4>#*G23zgF;E~Pn&$$|(9RZmRC;5@i$9NrubsU0W_6!-LojkcED~ftA zDloIziULzf6=fmmmKNa;;B$?Xm|lz3SQ9O<`EDsrRObMQCF6s8XB%rN9~=8Z+Edn* zhqAyFMVL==NfwoX9`A=PQYX@uxI_PIK`0#a2ovY~|Har_MpgMm|GspHw9?&3DJifi zkuC)RX(^? z0FtFwe~YtRrSjv5(gSo>iWK1YE7KjwKdQD7nC9d0IaoelCa^#>H>I}7@f%qtCe;FZ z2*%>HcFE)C57QKy{rJrN?D@s*w(J(K-H<^~HPy#?3#EASF zifvZNs0BAOZ5yC`7Q&dGi{KoMCCGP-hH4Y5gSEfvkJQs%udeIbDHQ8X!o7L4O%*18 z^N}bdhaYnj-4`*T0Afb6e1IUsE)H6)2Se&BSz6;Ft_+J2~%U5IbkC_ z!X3@f)-1fi>0}eM;4V#in;eRu!6E9Hbm*nGxlE{>@{w;Mgi)5k4uPsrYRJXKXa(8x zY9(lBuYfW`=c7ya-yg3QoZe8-ofx%dqEKzY=F(;rd_r9Vlk@Dm1Kr`zcPwJ#0UcL=KBG`_n!`3x*) zc7ma%ksj{UEjL7)xsQAc4zZ__v?#6b8WUY^QYHhxjf;)O3rKpr`n2nny$B0&S~^yb z!U|Xc{hHG!!XGw&*$4gdB)r~c{s00TGiTTa=nzza4aj(kU?r6yxCkp_Zo*_W|5OFS zX1lMi!^s(^%1wkCO498{6ozOm&}>+A)f08C=AA;Hkn}Qq*Odsuf z7B^?*hHXWaTAIq#@UIaeI@Z^&tsX(?L8Wt`qQvIV_AtH1VYI6&UyeZ_oyGOqc zy~jg7cMDzSa|+9*+@uiN+^$`F85|Fh{;FQO3!1U0q@T~vKXU84bC`J^`-vveKZ3t= z|Fu!`x@!Y7J7~PKvDXuE$xdbKSR>)>FU5v-qz&tE)nga-!ezk) zetnIO#$iK}xvHD%P4cuo+gj25G=zJ^ww#~bld~@Idh3YDd#nNZr`CqitKdpObEnCS zI7CF2IunP{H>>vq3Pqkz`HQSSr;Yd!x>0P_C4=9-N9(~C zC8HCim{0f}H68$sru|DTT4op55P)m#1;`fwUzG%ki1L2wI>skIeH(sxoJD?43_ehn zgwkG5`Dihe$P0h9F&{>V5+nJPg`NAnIPepw)SG-5s=l;RMx<^S7@J6V7@KVhH1XfK@XzVnK#8`6;|r>O>Qd2*Z1_6D;e9 zr^|hr7_x}-X2Yd1lR&5%1*dF`o6DGHdXFZ^VI1U;5+m+%rOuE+#QZWh%9VAyT%0PZBB%xAyd6Ect8kyQzCrZeU4=kV>;1OLWxTDTUj`myvh zz0kYyJK_T#Vbp%M7A7xCQC*;h{>H>0tH}Oe=3_;$uARaiQB$~zY7~As)~$vRMmC6F zh>SiJy83vjo1@@)I|4a%{6^*W-pNrJD>)m6W z+z{Hw(zWLaDh=t`C(rBO5nrr<_B4=Si(&Kllkj9S^A1B(^`D_6;WdMdLH~ zdHS#dpE->K9&5@xe-x;-pj{yq7u|f({ACtxX5*4{7f&|3r`bX(0D03_Prohcjfvcq0gq-giEh=_=Yj^6o8F6c;}(ZN zL*T@3;0DC#Z1A%Ykr)Uzp||%R+<-{H|A-wZo!#DCei5Ael%$D$@M(2*E=0xb-JbIN z*V1oebYbN3^IY|@FJKU|W4oiCRMqspwRN{1>Y$oSr25Fy#uWPS6`j`0L=k)IQ1~;-Oj?!Ltn6>1T@FyF?|7+HXX>8%Iq6!HzEDP8G4{P+$Bq-rRTH6I zd1J`EMzk?k^Bll^DX$>-W)3 z`7gMHmZd;#jDl+NV*rzH8>}{_=+&$&b6XB4HN|0FGQ-P0pmKCy4T}2$lUY(>!i*u+ z^BkZ#pda)wBb0h}Gj0prl+u%HlbJ`1*%sA^M**x za$;Bb%>CI4qFj2l`SG3Egne3uLiOxS=aSp8u1r$A+QG*$%@!M|d^h?+yB5@T+V;x_ zR;uZHa!)97uRTWYLEIv_l6)GM++9Kb`Ln&zX}cV1_JvB`D}@|xdT+y_qon+yS5uLH z+CE}8u(L1ew%IlA?= zdw#LA2w-!wy)4P0+;dK-h$A^$m8$f~-}qEvw;okr&12fo;(=(uO2%{lI=)oEa`0sI zfTi$ivfp8pp+eyW7?x`|nkggGsL+qdJ1s4whXCWVW&vunUmHuA;;)CY>}Lj$Xn{go zerP(&o*25J@4=0#onB@kLo_1ax`fN_xe1lY1Z~LgS2C6RiPP^wf)pkgnFY;t6im&p zHJxVMCT~*o%8x=Pvm{U76D&!dk^_@c+<(EMEGI-go7%7n5kr}zZNcfAl@w+4^g{LS zpL~?HFG6I%i51#kI^qN+eA;(1;v!G}+U7^?K@}Fqs{nF-yUbFIr}iMusCSMn3RhMm zpwm%U8LJZx&oGbXC{Yr=rDSHXUGIz5bFrG}cI>tCcG9v9YfyrvC(maUex3Foa%c~i zw|BfSja3KjnJhuCFjNl~$W)oQyi-0sd?P8Ou4jn*NVWPQd6Gd>CzrKJ8QW1Xk5OcQ z(YTwIBI3Z0o=COf7Zh*!!ymu)!?w#1y^_V%t30?n;Sw% zOcbG${;G~M%>SU~x^k86T7&5rN$GhOeTpUbcE-^(oF_0%HR@t_g(BD6MeJurne5YY zFzx*hUz+ubCF9bN$`k9E5Q*j>XMCu2xZqIxlcP5jR^py?`ut5_*Dy~k`mo-abOhrT zDSVmm1#-$^a@E|m+MdQM%7f9R-ceRt?*4YRYke|fNTn>dztm1nhS%&eJX%cMDKHK) z)-z}6o;FF7_L+5O694gsU>`_Y7=?i^q85Qv4)*gag)a993{q|r91Rva)K%ky%yrM) z0f{ZFuqEI*!0Iha?$bGMez%mhbQy5#WDzSQR#f`*J%R+-QK<#p?QF*NyMAMX=u&sB ztp8Ok^j>m^Tvp6j`A66)H-vkg9u@mjSfN@Av_Njx4OJIqJzb-DAr)I=#TgLHwj<2xKcH&d;vJ{lL#RMd*>7s^lhjKJpK-nG2Zv+qr<++9}y3(MG_LJMc zze~;MA9`>;8`t(+A>O>gz1@V`90$F=rtRP=%VIq!_b&ju!XQvwX=GtgH~-{G zW=Fl_7eX6;>kWkUX^KIY+eshwes7hgj^iH{xp3m$M=5qUPo;N#j2yP;7R)$9muq?; zkF0a)B?qj98E~l&|BknnL8ty9k)^JSJFR+MwNEVhWW2x5{^441lYopq>^qGFI`<1$ z0ehsvypto=xv-%VSl4L&pC;wGOO3I|5^yx85wX2~Iq{nco+ziZ`5rhqc!4M0(YE9_ zOdEYDJlsq}VWnkUPuo1bt_ygr+Esrb8+(QNqd<4N@lP#5f-w>tF1`PJS{;a$<_3Q0 zcWVPh$-B>)rJ@v`8J^D=K{449TKjb?}rgtjt#()(%>>2mrV__P-CBBqT) zq>|Kid!5~4<(MA!67YIp8PGf024ZnFZCi=01GNlgjIK9|xLpjp?ll`{x|0p#k1C4% zooSM!FTQ{xw5(M6`CII2W!@r>eob>v@}`-~@bN53DB!9~Ldn)7(JTCsOaz75b4!A> z@~}2N9^nU*#IMFCPC@_QcMBa z;#v;#DJcTI`fbIgcp<3Jsa8pTR8>!g%b!Ld57hQ(Vp-&RLwBHf^t5QhwTv7x|1C(a z{^i~W)*FVrwOPc^g*s}~*wu6q@-iHSB0qG{n<4dqmN{twQ=U1`kd*3TC`>VWt7Z4J zfcC_Air=w?;*my1RVN6Obo1){kTf|S+JVuDbJer^H2SrI2cNn(jZq8znZLU&+yg#z zQgn|n%clg*(OBk6lhbAVTnMhq$a4-$XfPjcI>t4y@+$y~7VrRe_M6J%%~7a91#gcR&p;2CjYS$-L_TK}Q|p3H{}%%mG6tYtJMJ~~ z`~Dn?I&+#nCdR2c0$nmEesW3N*wro>#;mSd3&}Y|@=-lFOIcr&l@8lM+W00PGebUT>`We?8-o6(Q*6{Ft>fu*Z0gh zx=kS+!XMIJ?E}PO$?M5rhBrjr$IY-iq7d$ztO~*2@xqC4zCuMAM8ku>OYzy>crPFi zK$4!fDB698d*Vucuk(KTw!=tqv|5)dW{L!jQ1fLxW{vSE^ZDZ8wmg)LZ_?Ze+C&Uo z08+=lDbe8*4#WD;xDj%tgs)cV z6t6!+o&0>C-j{W%qvlOzSgw{G<;S|(k<@dE^n>{sm{DRWuCc~__vVLny4)g@f7IcZ zUGm@X-O7r6hp}o`WMUwG@-jWpV^v3CjN911T(TGO{A5 z(4argkqgA7AoK(%5 zO6PDpes|Fm*{&*h;59GORZFK?V)Feg{iC2R4UmSK!G~(8`h{VrgMucl0vaqP362`l zm%z^Zz&8?I8tBWt&0TSw>{w`Vg>+17`*x}d7*T4!Jc#s?woqjJMgEq~fT{hKtnd^g zo>2kTJt;h;b+eCXOmM6@XDIN8S-SpDH-=92E|ac5MHQ4e;UQq?f+!7fC~^Cn4wt|t zXdtPTv@VyG3j3<2wSTXDt-d|>k*DCdbDPw#g|K1aucCo&WS5TF9UNx$v{p#-G+(=z z^U1l>-Q0j^J?oyQUGgo~5U^Zl9wM-w?7$?%fK%>APSPg%;(!Hd+*pzA)Nodgt>qwu zF+FJ=UdxYRbM@j(@lqJUs?x~q&{OT++A(j;1p~#$jpLwY7=wsTBULkUq}Mz=#K2;d z&JfGf$z)(eKeR%Xe5v`U$Y+kV-lEamQ;%WrE=?^lrI$8NO~XSRlna6LIu^Fov2wu| zTvkhFeMOAmaPn|F>2@Xr4@WBO;lc^8>3Kep@1*nNZ)}>6_In@BR)i?KW@PwMB5EBJ zoJRbY7(HW5%LHEQ_#B8hh)XaiE$4pyQPWal(VDW{^)#p_RL6yjVAd??2Vo5hK)Uz7 z?|)knJcRKWAWLHYhDk*D>DJbf$V#ir$m(!G4cH2G`2kZ3-T*N$v6{cfjPYbPR=&?f z{bE|Mx;)aleF-=zG|rKY+Pdn2gL=TVn+h(JY&M{yeeX{cN?RrEa)L*nU-&h)CF4D4c@<%BJX z*>}Gkqd3uayaGL@xFpxe^>*3L)0?6=5$EH`e>M~&*RZ`nT?P1ONJ;qw>RKqgYGUp7 zyl-vnG2Zo#d5W_Yc~^5z@ip+9YM&=@!j&K+$u+&tv>nzuZ&tVT-*cgw+ZXL%uhpQdLonRGwX7lOZ7TD;4Kf{wxJ zjb2gWB4;l=Z-&R^BiSeQhFW%TUwGcoFY6Zhu-1<>p0|d(85e3LyBMAL8PN*Op8(u>bYc3$zWSGven(!nqM{$JRX(yOk_}V2&qR`pt~@YArIx5r7~9SFT>zx^nY2= z|5o+?;&e?^-R!Bp{Z~uqtY*D^Whi7AeL>bkhzW1y8gYtCT>n?(S7;zn=r!9>g$mOF zF=12&9P&Z*Wv}U%j?>0n#Fm(|q~BMmK5u-qprcRb$af@L*pyAam(7Z;<>ll=!Boz| z%T>AIXg>MN{JDHC=7BBt%MEgH0opw2;&X+qp*`A(Rb{}x&T!!CM12tKAZ`hNlrriC zxY)_xe@WGkTGAm{MSmL3fh7Z@IVUJzXdUC+dTx%vevv8jKNVAikACS!D+P`Vps{pb zY2~uPGh%x&t2Q<|;iEO#8Ygt1G$))DMiTp>->Vi_@9WFTP9_*lAA7`9OxT8RK@5qm zY}%X|a5vIG0chT^GRbuCUgBWNkb4-E*q%&<9-ny!va^rG$}*hfa~+DhYCj$qfUYCc zFY=A$Uz|u-po_tF=@(M(%Y*M+7m0+HlJ`mLX0f{27}6B<_co$T;&!8cMyMHI`ui^ z_lWl)FDv#HgcDXWcxwFM5xu5yf0Xs6Uha&Fmg-kK1f0mDKW9eo$qfAWW@UivZ1ly^wO%8gMDPC+J z5?v*A^nkl-;T8hZX8d@1)Fe1To3So&DyM}*kSxeO>KxK=eh#!Yn0_YLUOtBKv)`t4 zpBZ>Kr+b5jwE(emAg|9S& z!eNvX8PMPWEZeU|rr@N0u=tAANpa8fLylYo(?%}IzUvEUUnG2!Qca_{Wc;ooq!e%K z$MRz&9L3SX!GaecrsX)Ql{qC>7p8`_3YRM3syjqB+DP#!ZYdoNo?~BQDSw7%>$h&H za~8VSRV8a`ZDGr{B8o53W{&hRIfb*Lbh|EpLS>TH71QrPHq0=5F@F^N;vudVyS(j1 zKBN9FaKa^^JW=t2>`lhFd+1SK!4C8xjJ_C;^*J+;9an?o_D22Yu!5!T+2lv+C!m!u zhK43FI-bhw>I8TJALzSLlo~(NhZP&n0OW5zZxezv&O=*wB;rRk>x2pU^InCHshqMM z8wrP6SBJ%vpzZn|sqHvoa$cA+j0KjFFIMbg0(zI*DM|Y!U>B(>nV+z=dueklCzO6f z{6W-Rff=~;nq-vfjTyiKrKwe>pLJXB7f_SuiDb0Y2E0Qv>Zw!IaQEs)7ttyUVydn< zK@jt@PAS*8Ij-p!@xMbGY`D05klurKfUZDe+0`xtmarTGvsy&tD-$A{P^x3EZ*A`c zlsvQ6x@n0;r@3kH5mB-BpJnvolK)b28T~4?9n21Lx^AO14`{D&{+}h|#OQ$@XZ@gXh6eS%w;$SUj6aFnlF~Hs$HIH#%8)%y@4UM^ zyelXWV*+T7Yqa1G-b#n>$(FBq!;i;Xhi3meWBPu-t6Iy!$bH&WL7A~ke?68CgqTe$ z{fCC$oT0b@3UGDz?mhpc;|7d<(}>dZf63>K$~a(CyuiRKXN2a<3_-#YJ(c0 zQ>LY2)EQq!2Cf=be7TS*@HmLuRGj=uiOxfW)uBwLV@3R<;>3X)E&tu-&J&!8d_evyWojxHDbNkNT!UMt~c0+#U&m54#$MFEqs@v~> zr}U4v@NQP1Cy>?>?k!-s`x>1}CFeJMbv5L|Z9=f^#3I~Lu-Fu!py&E@lp5!l8!|ml z0)hm6U(0M|2k91p2JHMXd?{x-uKMVT+gUGR%`pkmpQSzbhB{e+Ej@2g2Ut-7STawra|y(Bp7lg!^G)kJ!4H$HBSU>1Mq}-Nc6lR5)$d z=3#1bw{H*%s}Qb-^j>rjJYp0ZCQ<(k#;9xDTmAnW-dWgF>To|?$`KoA7AxM^No&QH z&bT$-3q;~?8&yncr7^U8ba>OG8}YipSYzo1=^f#)L>X2*XB0|KrV;Kk<%sijpqhwo zW1Y4}JLn-|P#V#=b|;ZA%l=5l>)Az3>1B*lOKuPcm)KuOZ(z;C&6PPI4COuGqWFnD z8F1;Ej(B{E9)vJmYAhdr61EiPzs(`eZM)jh(fX}pibe>G?JNQhqA2h+T(maeB1Doti%=9 zN=joG?t`-{Dk1u1`(?mdlww_eXg-nk`Q&7bIkY$<5_Wm4m+`4uTk~p>l@}MYV0=zj zkGRMRGo(2`hzq{rB=GpG>$>rr3kF7mVUzC9cgDK0N$wOpFfKUN_)WpcN@}iyiZPUS zp4*?~tYPaT2v!P@5BKDupc~us@l%=xC_(DDrnFWUaBlY2r=5`qYVbHk@nNu*_yE|F zhMDB=-H$k7rS;=MzHD~4D}ovQk+KDhR8pPH);HM6~f~w=6rlLa?$K8CD*3~?<%dF)3RLPqQRMV0tu{_#2Q;-LRsq^}p*QJ0sQvnYAxf%1xZ6qW zfW*&?`w7B~-gRq+-VB0mR{KFN>zRt?ySwtctM*Gy^Pm|!k>afkkGCinGc7%Jw|SRY zdo-c(@q4r%0$ZNU1U1JSYco`ZHn}C!T+dPXzQM7XsM6_G{reZcwW_*HGVH*9(Y1dM zebm7F31pNwRl7TaoTq-A*0e;2nlVXUK0Ni3!LUwq+K!l!)9Gn&dmC52(Lic7yRgnF z)iP9YS=s3nqOUh*hHEpS$P(TEu@-kT5|NRuZJx;9bo+?)RG`(51f2|>DAgoKF^zN3 zGB(gvbyJ@u&D-4C-g%MOao;_)U4y6{+P=>oI@y=Nh@^7^5$sJD3VKbyUFL*e*-c}|WrG-~T zoj%%IH$E@biR;F&yJoC7tOn!b{RM7b*JVt)^r=e=Q72= zL(SgDZ?x~u0cUHUi)tC8oPXg@x@i*0O`tr*gBEO3Y<<0`-Aa!IeqANEvu)}|xAW0l zJ21QzWAPk7Sj{y|v*O>%G|2>LHLRn|<;XO9-DjFl73m9Kgm^Pra)a01A_O+3j8aXw z_l3&`^800*+RLiPp3D$E>7bdK=Xq^*6WW04Utw?|D9O&QR%TIY$h-^N)K=2O7;MX(k7NJ`s|ct`2JOd(#iu{+@`!pu@s z^;svOdIVzwy*m5>$@6*-6aLI?Qs?hC)_Rs&iOHXho98{Wkv+#N?ex>%X7@|Js_S;e zuvVS5(!Qhn@4*v>{2b2rq+R}#Ru?nZl#yMm^P75kSICCGdL%uP!}|6uSo_Y*^`63m zn}zZDRqL`=r^2Rsrx$*3M-hzkT@Z!;%g25SuB80{HfUX?1bU(GlCHoszc^4Zu6mA} zh~`oTE72H%!ypR$HALPXOmpl9Zr|`k+64kf(3*vUlcgWnt{4FaJ2FHo!bZ?x`(63{ z5JRd3jgb4r)6;6DJ3-UmE5kwvhqyN9if(O|cjY1nJ@*@cCdbFOwR6SDe-M*uR9QJ0 z8L1tl-hAs+wqHF*0PV9^>Po;uI9bWjrqeo`;kob<()O^qIsCln{r8LokyImE~V^{)OMpe6OXRBy~!HJo%Y2uELsU(N%c?0dk;;YtQ$tBt`-x~Hf5 zG|oWzPzIWhy>|UI^TaHx!h6X)qjiX+qgYbgHJk)RPU1YWHf+Xehm} zd`~zVu15QNW%G;KxR3;fgJ!A0o2YD`+?oet%gf|yW9Ggq)s|_ltz5wPW*9W;+NG~< z3F0TFyPdxJ^dI@i%@iG9K>XhP`rj-7J5p?T^@H*F`7ZZ2O&tfs|3#XEYmJ*a9xMd* zxn{YU@Y4VfnR2S-KWw!zsmS=0-L&t9(T)$_x{CQb{$Ux;NFZuYl!Q8cQ`4dy0-0C204h+&Zq=%5>PG%ZDXul0Al!^Ul+r zA{W{JPb@y|UJ2d8HF<%g?S-n{XZ0s&pGE6A2&;K4wW_`w`0hwgBwHrjmu0P5kFWP3 z2(>siGY>j_L&ynAAF9!6%;bvJClCCOkx$W#-ugI$NYCZB@!J(C2FE5VK)Y9=tyS+5 z%>}6;NNWjYmJb2P93Aj%9AqS@``@JK7)48DS_6#aBJcyzd`Wlxyli^hTm~?j(wBz| zgXj9~fxRFsFnHdaMT6wBOFNa*_}e_-^U%9O{m=CPiZlHruzuPgv=>zP*z*g@WQjQP zAo>BzbVcRnOU0Y>vCH{l!#S2}NZO6D={9o(Y(<_EbNE*I-s$N!T0()ssF6P5J}mWd z;DBDZ2N9cgnE*a<2|lrG;n!gnAKrftA^gn3Lt{<^1am~N86WY_c`T5Sw5z-m%Scyd zt~ftSwWw-=Lq?EOI9uw6FgW5*0_JW!c$+?8!nS6dDtiDu`=XCG_ zmei*H@&Hia9)Lvt608Y;-=2fU-T-#MY4VpU8Fb~tw>kiwyK$4V5iSz$NaI84ix=bq z124!wr%l}5t@ekwX>5KsbZRx<1_VY1{N|Krx{>KFc6!fnAL|QorJ+oMAYnaClUN!6 z3Cd=@pws@xYamw16c56(1HUCmLI^}pWIxNe3R1}uMKG6Fogdspj5m|NBzQlZW=xVt zb4S)YbyPTyMkH>{H^;iZGr!{oQZRViFM2rt-&gr*1Zn9AM%OEQ zxY0TfJH%~uZ)9GiyaTL0a#>FQ*)!70|}Lh1JZ7|O}`=>E6yO^#{we`gT9#T z;MWqnjexwV$GhO5qQZI;9A%{wm@eer$2ANw{MLd{rkEyB%c@wg4^Ab`1Whw$Sb4tf zb{}dp{$A>9vrhVtDWR3g4gBLWA%wwDpZp{2V8-66^Ba)27=!Di=_2X}u|bWR@N`3| z%*94`^{7!P1#zmpwCpVA)pU^P#4T*C;4(e=FN{m9Y@VK=een0`zc^BM;z_!$I1lp4 zuZm;1EcU+74ewp>=TU8iOu~nd2!J6U__RaT`j!U$78f{IN#Tue+(ciYSG8tk`i#m zWiBikfbp>o{@1WV6buO9)^cfp6WaK&c8fg(@h7}cNf(KEfKg}++Vi{D00Z~6lMDt> z8~}Fp5azMP-j27#*3TqrfF1q|Cc_JYr-T|txc57e#yCDUa;XK}FNssS=e(mke#`dH zQ>@mzF$%3z2~|+&p+<_Hqm9$9IKgP;A6_-w6Y@k1(H&n(gEv~-bR%2md}Jlf18_=- z7LDhV`tM<5UdNgykAKef+hxRw<(wS&Uy>_6&RJ# zD5%vRHMJ8bKC^Od)tJz_9?(QH_rY+xi$b+6(<7t&p69wu-)!n1A8z}Bf`wAHTU>A* zo3f0yrHzDv@4$z!1spFQ!PCy4w)_PWg@38lK3(!qC>@0{-t-Vn?Z20t#zUt^9x1Ab zw3}?xZ$RUOEBz$wH_Q2UdYn4_ROqDp_8x#eR%j+U0=#Kz8ZK3{Fj!pi&tAPc1pGdB z7$~)N_zfGunq)iReln8_It@%P25+i{E+L{kjbbUPc{8bL&IZG#nNk1x0~y&{Y`0X! zx#^&Qhy6}%Pj4oxn0-wgtI{LGt!_!5!XH8?N;QRpDhg&fmC+YcMMdim?-9H=acv_1 zy-MxN;9EQp^KZXc`i6U7&LV7VMy=V{YvXb*Q(UEjMN0#T@lxH>fA4qt^w6cv5?A^Ll0xFkP5(je)9AVtNUtPY*-AU` zptI)1mC#SO;9C+EGr@8T>K3nu>#a&wvq31kR83*>r;Ji5DtOqtd@uChUX_HqZ+#&F zDJe53jq%wk1B?s>B05!kK)Z7S1WKi+%;JsRbQ_5miVRu3ZjESd2SD{~boMe-iWm4i z*Bre7@hKi#`09sM2&Kk}Ex8hE0M6GUaFVrsQ{g_zE%D=#mi%{xw2VSo4c)=beT8r? zU&GdiuRDTM6~AaNQNu=3{Ofe=L0*eJt|$}B)G1FEn#WzlQX8Kz)(uO$%z{A93vf0{ zHG`K8LMyzKRvXInm1A~0e;SWuttvMzc7zZl{=0uvOYeK=QusFfcTR3~_UGg)feT0$ zcdcxV5E!+$0al|q^8Dk&r3kEsA8?CAwmc6gNrkH$weOC2OCgSCaopcL-F2@tI?Deg zK{QckuG~Bbrn0#SEt$PK#__7_K#dp!C{AjJ0B$>NP%>*YU829a2q0FAX6_OVohve5 zU0}2hQMfizvN>Y*s%ZmyR~Tdj3Y`8)Y*f@DEAY{l?ahFpw>D@41_;E0d4O^NWM|oc z`$wt`H0LHYkY}gh4Ai8-E}QHK!T)N>gl>T!VjJNz zC0_L{Ak47^9+k*$3VbdCD^kluM_*)uDA+)aE<_3z+vyZs2WbUW&m?fH zK+RL}cfQ7TZ&kNWox`inH{II=J+>R)xlLnWLd-72c>t_q+AhyZ(3HIZP_6O_oA;*2 z@{yN1HwXptI-vCWRk#ZVF^4?u?)7C28|oG$uR8~R&vFQtWq^uB0n9GX^TZ)C32`l~Jx9!n$#1AMO!}NoE@RV@)p8+_Mv!{;VbRhmtfUg8S2pCkUQ@!g*(z2C`%9VtT4V=w__j2KvAMm}(4~ z%hN)WmfaBR-+e{#x{#iCWaIv^Q-=<>03gS+K2v=IDZpEUiMY^Y7QD{T9l(8aWP zN&g&mC`HTWP@5_N$`J_dpQ|DJD`CkaN84r$6JOFC)dbD$AHYXQw%s?36k-56IG*%% z8F7uj-6J4(e*gB{b=tUMXs-}Ip}JkH-1?CV(k#V)xr}9GN#ZuHN%()cj5*z1yrd+! zddS9t5=g#_VRzf46wxb#0N7{%Hx|fe@^YifkXJ(nPaVMYm_FD;Y{W`bra(9q{D&vtCw(BDWfP^bVCC+W3H<;z1;% zipnI?h2CHmciWtWCwel00qf-uGTid3|-Fm$8ou_224xj&hzh& zp@f+7P#r*G*PpLo`|&;oXs)ZNQS(l4`I*@K65{P(5@*R*5*zw(4Z!3m#~#ZOn{1&( zj%jh^+Q*zj)K0w>zWeI6CdXsF9jK+|Z-RQrw*V10q**NA3g@y}IU3bNc}FLQ6B+V|o|wm$~w%(Fg&v zT<)gqe!GD;HD3e7muS)Z!H*3`1yy4E&eN^pdXn7;kOX-JC|am}qu*$Y5_>EJ_uLSz zpt9F5B04Odyw7?3cO})z!E7V!r~TW7R)N~a7WK3KZ#xn}wZq~3%=c4kKv>}p6(LG2 ztJDHDar&d0)Vr87ic2D;-z>2R^`z4Q8ml`WDRipAREQK|45ZN-8({hB0k=FWtJ0R| z{`~8sH6=jVfpMP(AgMDQt)k?F33^_xu7I>P$QE49%A{-Ecs}q;Q_w5RvHVpwWfedX z&(3_^l1C`{RIU9<-}?K3uLI5x7xn{%`fEGdTT1ilC71MC`=qow3)TCL_wRAy@ z8(T#pN1AB@`>cyA?71~ibkTYq?K%&LpS|GRC+`n$6I%fsa_yKRwoT&l2ywY5lN}HxnmyE$Io&j?DUmsNrtf^3134Wlpf)WC){9e%y`RKv1z;;HF5sCQML z#PtiQeb|0WhHvDuqhHyyXb25&K_WrYYdFcmwF<%DWfB;bPkPx(gqPvENo(6*#WlKpPFRttD-;S{0qE6*D#fWZvn7BK7gnph%~y`YbN)eZG}MT zaQi7jx&f8@GIhGxv%0uW(uM8^|I9q_D`V5UBN=f<_Tt9FIx6M&11I)&j z-(&I@JpDS3crDS(e({Tk>(XLi`0-;L)L=3h54ejfU|tKE0yW;lNcS(LHL44Xc0wpp}0fAj?4|Qs12> zUFhb`2=K=e=yCZCgKjE_hzhNW_jGm@fkWn9TVb~T?MKMwuOq67glB6r9B zBi94u@4CQX_92%qIZ7>9_F<{$@^<;;8B6Il7*9HbGMzLVGDpdDdfC{%K5pRJfJ-*G zIB8d#xbIN-=KZ&+Znu`2K%*{Ubp12^Jd`dDuHOaKE;mrNn^nWYU>bK~v)d&|r={fj zm3Nm1gMBWmaEE;XihB|J@SWM@bz^QgPSLZ|KQ_@sQad%lcKVkA`2mHId*4+qn3j6j z-6!qVlfMiIV5!Qd-uKkUhT6>Sw_M-2BmF`fpF=_{>Z6{XrL^dK8vWc3uUj@x|p8Pkw&kLD7=Lw-8?tJZiwNA9NsSW6NKj!P7!K zZwaMjxqR=zM8nX_4V$=?%{pGLUaadjLspJsb&d9>YUER_^>L;@l(ytvwc2W7p!UGH zTN~{`pUDXM3H2YiL5as=Q=DLx0?lhpd@I!maC|^O(0MCZpXGe|_$R@}9pvxCc*t&u ztH_}e+49MFcrTAX`(srg;+sBIM1SuYI;0Iw{HM(A7mEpugSb*;`VD`Sc^yuH7#N=b z5!-&-tfzW6IWd)Wz?WOzXZZ~=_p#-NqYL?)(mxfWS1Ia~hWu@8q5k9M6k1Aip8PlB ztVQ~N6(9ZCUY(>Xy=%jcO@8V{T(WoZI#Yin)~$-(i-PsQ*XBDa6@fByI>cFvf^&~Q zbEns=KkWk61*zP=Iiv8s@D&xpw<6AW-W_MgH95m@(?CQq>N-cdd1@gQsID%}Ugfpv zHU3wtw?^>KWe>JcEpQQ%aI$Sk=FEi#Y!8>bPADtc;MU4E1zYG`ApPOwP}IvJ$P#tE z^eSLYP0P|aZ2Q8qYc;I*H^%#qbOrag!HwGvf{IN|8H(?n zG8%ptU$%!~g);q^h7CG@utnazOU6H|TL^lA-&iu&bKVLHO~+_8R}VgJqtzT3D^<$m z(V3`Bs2Kd?wJ3tcJ8klZxF4nKKmbU!x0quMqc$2rYp&okcfez;@YZ)Y5b=jflc=9=?Y^9uhxV94g!t$C%(&Tp_l0-yno?g#zWNOzt+ z+nE(q_a3Hvd1CY*%7zByy3Tp46!>?fo_m$X2I+`J-esj5GSkQAaot z{$v})`K8p;p9mT;i(hfzI9WT@w$OFIinKxLvmiWc9r$B`S|>+R^~{L#ZQaF&Q1RjH z_?J&Slxc3pEXeooj^IPgc)H}`K%t=;&0hdRGFk*mr4;>|2#F$h`HZE% zlh+%4gh-AZktywn+hR^18u!_(qU89~mfvy449lKncyW0Wk#X>F_1>B=Nv3nLb7C^72L9*xNI7uW6au5_M`HcmlJ>#GUWI=pXltVPdOCOpB- z#fWN`?jh5SC(8Hs#qOA+Xn#+c~ZCo-kk^JlFnpE&|m0c96cWkes@4 z`?}JLQIkNpS^2f=zSXd`V&g`~!Tq6%>=#tRSZ7MG85nk;Nk=x?786lv58n=G&@Axp zpmz^Huo=sCMo9yO`-KPpdEL2bF8G!8w^H~w@>T|hEOfQ7l)@lgu`(<$WPFmOP^g1E zdMUjmq*V^Rt|WpV@0ubef>yhkOdcX=bXtVT5cck*Pa2*WnRdlePd()<3c6&>Gt#EVO4*MzQt=)VyzX!F9h#l;D!mt> zFt<66CcGN1n(;bb-&1u*`ar!b<4e<58fa$;MbM0h#%pOd!jF+AMz59Fk7fk(!pC}9 zp5ds3n|w!S_YDokFH6-uz7f8J)w2&n5P8YkgTt%IX;*Q3Sok-2rD)7%8DB_pokX}- z@&sAu`kuDrHqzs*aBl}$Qtf%E2_jG;utXAQE{b2C$knenBeU|tGuq#~D9j*Rw10ZI zkqZ0n{JS%Z0}RYbo$}W?!Hrvwo%wx0HC*ptwACIBdl3rGT%#r7SE3H)MT3-@&&YHX z?AMjfuQFk%jkt8f(5Nu%+iJmQRT%YHLt!H6;PhI^*AE>Fj#gdfNoH$e7iy4NW2GMU zmc3QWMAxFudxe(eeXhAx*`3)eJMo2X<>3A}-#|ryerM)es&#JO!x1;0dAooHz@7>Z z0QnFD$2#iz3-If+P&BSZiy(M16CtK=)wf-yAT1<{~uvKyAl7h5N6dXoshN zyalAG#n>6ZXkdtb9(41DdpbaMfa~{>GBQq`3s-k@tc59bk`2fc>@J?Qd?famxW=|$ zwVCwXnavQeZW0~$f7g1^XxDY_Rn9T$3|!D<_+x~r@dEP}`2eaKI(-G#f*A}7g4JfL z><56H!rswATH&@`u!_h-530SjAW@`Rvkj&1|WFhiz77{d>u?v zDGhWRN-WyIFlqv#QgRaD>;}LuSn|AF7Trx91-r(aQxp_`DJ9nw`Ma&7)+u+yZVcH2 z%^Z9FO1#4BJ_gDb4U84;?9Ea5h#++QpJanyz zhUj6TPkL*Skjv%PDxFO@E8HF_dNoEGXI_p8O!(}6VvDk~T#cK$A7w6@MMnAgKr~De zVzq;HMc=5@2f}L=Uu(cS3~k>%fRa9`dv*~B6&{s)<>S!-Bj>$(6)o}#Fynz*X(_6G zuNuL7U<|kw9_dkU@WMG3uR(Hn#vQE=zRGJ^ zKC`P+ItR7Gda=>u$NM8@f4j80bp7NmpZGxgQ;!BATTUP4Hqf~i-3pPz=>m^`bOAKJ z9c();ftow74yjK>~;NKp)XKzl>s#n zafr;(bljZzQJjpU6K!41)4OEJb|A-sv%L$su&5`xqT@0@chC)OL_E3Qe->0T z((@O1L0eH5tShVRCOQU+mNb-9*Fmx0HI>->!tC8ZJLIWC9EEEGYiJZWDgG|z)As$u zbG_SF6RnO(zca}!xh2lw-K&w5VDBUjPFa%0jKY05nBsojni)h12UGBHVZ@!aAtTYBH+qWe#EoFBs~}6z-<2l7|HBMu%CYjb z>TIqjNUY!3euWo2(C~pZn@>;49_kRlQ0x}YyD>E(lF?+^Ndkdd$NqA~f6%VU0Qebp zbS?zI>&K1hk7@xRdonfD%^UVhn+9Ip+>tf+csd7g$FG|;$2TKaWo#CYubtok;1O#5 zEhbH$jb#T6$UaT*n{)4H!0=STIQ6o)#4r~$obIS~5F0~<9M^-zs^QnWy`aN4BJr-^ zO|ArTi*JJ8fA0g-{Wri5fKtcH{8lac6Y+nQOmtTE3^f6qFjoV|Z%;uH^Txl^@c9S4 zgQK$NP}Z~dMfU_$?M---g5bP&tODWREVh)Y*sMb@0i*Oj_!%>R z9E--jr@4a&=uFs*pH3UQRzX;K1WrT^oG1$`r&rBl*~*3-U~X15lv{|gy{C0|@7`dtw=t5z(xcZ$24Xm#8#hg``D-amV!Sg%HN zJ4QX~f=aX9{~?(|zDy7;NFxQX!nH3k83}H{uAQ<~n7VX193n@Y0x1LHcW33kwK6>- zcw(%^NdVtkoF9p&GtZG_^n1?276VdU9e=_Y0i!B03ydDPs_I0-FQ`ee=K?(W%cgM3 z&#hKTF;u_Fp%IXo3y1N_2oQnzlOvyzvWMw-TRmpvgJ9(Qp1ze!*+TAG@{xihSx-<$ zb|U_-+QNt4*7s<=vtq_^n7wI`b3*RhJ>OBW^vc;*82!8i&QY5nz`qy}V3Bs7J*2L^ zfS9)}>Z2mPenOZ|4xn?pl3{u1sMdD9)>)=}Jt^2s%LFJ52^J{igMNH_FCYuCgCkt&DhF3P`HYn+LV`8 zKV#N#C}yc20kRbwh9^L{;zu)UEnlx@N))3-ub4@~V(|jS0bejC#4bEO0`8uS$eZm> zTsYl>??z60)R1XsnWxfp0^k7tFjYqv+PbN;<10_3m!kjVKD0BJ^<;h@DE}3|xWtc+ z62ZO~pT*`jSK%bwkW77-`A|*>nFSeDlb9{w(KZAQQi3{P_Yly|`<#wRcKC}Stl~?x zxU{Q(=MQ|jl5}IurSV}{;{A)2q^i0z0VCY=gs6anorUz;m7Gv^O&rDs(<$ z^l02#Tj^1cAnnPF?!|9NgqY~*-mL0nJq$dDVq}3#!LMoa=RS|9^J1$}-b%Er&OmJ> z`^segZX0~WbLOHSX9-{>p5&NUKcBoxIdL#C$;CX5)Dcdov`NPJ9$Z>QNn%-1cXS%4 zCH|E!+Wxaz>>>Ea4st;R>kyH+vJz*s@wJ!sUFW*Q%vj-C6u&vxE;ohmU%;0!hgE^q zQGIZ&4_(D**iM-G1i4-NLkIX07dNeucnK6$Yz>P0B1|r{YF`yx zBV;=zaNOxg%cH32O$2|(x&M{evPUZ};36deZIHOji~)*c%~)qj~w8C+1 z;NyU%Q6yIcs>`ggmk~<(GdKXZ5hq`7UEDD4z}*2Jmag2=jpq~HIownBn}Y_gHa`!| zECyMFz!G>nFaX>oW^U?-%|IvB7Ss$e({(%VqKk0s1DNv{C|r^WdUk3A_3x!R9Vy(s2E7WuzEh6|*7^2Zh%=FOK638neHTxcZ35*sX z{{oiRq}(htx$;2y)5w1a3;8pUATUl)UWsJ7gG`9Xkk@n_sOLKg;OJ-A$x_Y7ZGyE6 zv|uw(`jh9+BPbTABon!h z1Xl2$rt);YP#1p__EzyDvdG^c&)LNqaJih z0OaMtKweHQy$=^hS$WGT{Wixn#wIde=%bHma#s`(H7VuorJ+N z&os#`nFUa&3brbZ6`v%l8+@F(xj>GJqZh}fB z^riGetV+_?PN=rk@+WZNCVUOMzS*}dyACw^UO2({8%`ThKAZ-CbakA)Yx*K}G|)#- z)x6MmM$o1?--uq?CRJ7lunO45&Rx?F@^f240O;8 zR~lgF25RlEKJ*tMNAse1Y#B;D@4%`E#x&^P{y2ZYu#HkTDdyMaP#h$cw`@&a^<&l) z{8fO<8NsViOEF(H8c%A3DyMM1HAemGt2PvvF4ut&g~I~}%ByQUR?Flv3zUR%dVX$l zZaZZznx`UU9i?+@F|Gi-mnzq7k-HC+KKJ=^{TzjCK0K;&QY*ft`pJ=3A*LUAKXl60 zRh#0pT8)K*C9`3GE+wmvgSzy3NR#;)BbnW2f~17#wh2Pi`s=6yxO#)7X^#pnGJc4g zOYN96Sh)bmfNq-t)K}!+PHa4wM^b`n{yrmyp6_lJ@wKcBTyi`8a88^C!#P;S^nsbc zqO2x8k_~GGQo8wkAo9(#rLEXUNxc5;QISTEFa{Y{1H(R1Kk6Rl#Y+JfYfzixWO=OJ zrjpm!aNilQp-G@OA7(nFA=@Urh(j@$HA%*B^;_j}G2iR>g-GmBDwYm!#Xsc0POR(x z3W3yL%d>Q*scGm;TJc*aKXhR3S41Qy6teLO$84y_q9%_5NPiKRdRqgjbTEZB=Sq^=Q|vIC`W0lYbUxEKM-V>u z_!+|G&1gC*{FWJl&BO__rfKr6=)I;u!WpiMNjGc?q`sM&vbLAoSP*@%}BazCz`^z%I@}09oi!{IUq$k?Wy@sfFl~Go)gMJIl$6ZGHI!~cJ1({fkQX@4!!ib0P_M~6DP}oB5gDcGQp;4pEtJk@ba870vdN1ai?SpXr33YdmsXqxZ=Q#hS%3$p`%n#Xtp zNPCanVmrdI9_q+dz;@gojW1}`CyQgPQO;Lc(>K0HG%?^vWarql+PwzQfM-W3!n;)? z75>u7_xAtywh2tfA98k2tby9!yJuqUoaaqA?tHXiD13KmwE9lel{6sR8z`(Elhgp+ zLhm4TJiZE3`pb=!SpxwgI|X+8-)~oE9&Rdt1L?<2!l?St9Eo)Unj3XAV|D0K&O9E{iN zk_A|gRy7qdT;@%kACj3IMp@dnl=S0kVk`YdVBFJO817N(V^$9O*^i{2$tGIp_w1FI zlJ)PH#WVr;s&t3`7u_eBM7W6{?>d~7Xq??XHVA?TNZ>sLTWqpEie;yll{~|jc5psI(<0B49Y<(PVI~+0 zd%`_BKs4jA3W&=mf}LB=__=KF!G37>GZnYN_zlnnzRKLN#$|qlPc3bcj36`^zS2NTs==V89K+20q5DHt*g94mKTP5~bjjR9Mev8J+rbLN zhCGKgMKU`F$IQ5cdG#Is=Zf|`$IamlzU+&m6k8OCiV>qJ0)OZ7LRqRk582XoKS8J^G-vLraZeov66eJpAG|sOin7O|?dz@-(h&K2 z6Q+8w8vIM6dNFlHc;3XMZj`ro&=8{WVV&HcsR>ATq4nx~)T7cl|nkC!V+>YPw9 zK&)GwE7~&hsxp#C2V>^^NPplr9>$g@9YmAlCn5jN3Pd)Uqdg%oZ|{2l;ULn@$9g+)V@vZ7Hgk$6_78BBF&Ym%ElxnMql`X z_cNSXS2AAgs}cUObamK@(*yo(;DI6dY^;l=MI%77V9qI1PwP;+DKijxpJ0cMvI7Wv ztbq|U{@@*|eqP%j)_f!HZAd<-94`4**x^B0jifOKfB5r_1iD*e2)wcC@7(+{>)6vd zcBSd^<{q@g80N_fJI|nf7d7Gdr4E+$6@U1>1+c*thirH;I7JbVE|1Nug@=+JgC)jCXcijZO^YC(1BIGpM z>1I3k7;^IcsVu*>C$HiJ+&e**Sy3J!nca$02uz7&HEa}OTa@~t5fgv5JP@u^kDQcO zZQ{*4g!hm^=oOoX9>z~Jhs?Q zEmDH5*k%jDVW;*HT8bB*}9 znPP-#iWMrJD`!)UYC5H9>Z~615q~c?!@rKPVd%ERdtn!tdf<-1vkN4zuvDCfb8X=b znib~2K4(}~!_6$74?6nlh&Q!SdshA@)ZM6PUPHF;e~|GbzujtcGNd^bwAsSOILqXmxs&{`Hj5MH*Mh+^%}-Qx zn@_ewwAL%;kZif!h(fg@bB}H-|4?HWybmv`z4%}GYfmf#NadHz(sD~9pu2+0x7oA4 zv(`#x$6}jdfd|lyr@x+GalwlS7<6_{8sm2Htyvd9KUne4J^}4+2R@;3!0#*Q^vVD1 zSUN$i;rh?tLZrt!LX92r046Ns@i{zs^TXUc)76zLD^`(^Jjp+^r9I)LWn_3eSd`94 zEg8kBfJ@O}p1~VopM(oA3bzEwL*#F zSy0ZCNVJ*_l0B`R)@_nX@zTWz1mq5L(WQAnfQMr=Oo%#XB)MMy+8*0yO3z{s{1WTHJV4v~mxF&#>uCJN}Iq3@@fdDOv>S;hb;6>C-SEPX?dp%e5;jPmPcP(nAgFzQlQ{ zvp*xqlKMd13YQi4#mTa~04jLZ_i4ZcF|pTyE13zhhAr2D!SSipq?T2sc*+Kl*Wxu3 zklT0StkiDxsVWN6!q-Own;s_z+z_MHM2ezIkm*2qC3apa4t&HrWI#LpXk2K-1z4Ei z4!~Hf>R8k|tC8N2yFU7?h@el_uUH$ms8){!xc%E^o`SY=D)(h3ccCTLQb4ZVF#uJq z00v21wl?Q{u}S9V@s>hf5zsDzLhO2U(IPiu?RYleV0qV?UDVqD{X&AjTan;YCA@=L zR)I_{0pw%--v?q2328gPF_ZlVYC>osx=E50Xn(&@!qd9(U316kwe_VI8Jx4DcV7*B9*a|YSmA*~o z2`|mUBLeNwJpr4Z=@Yn#h4-zMxp^#ng@U@Cw{y!gG7wov30I-R4Y}jxdTobb@5z4` zP@HP-#NsiM_6tf4hj6b#FC?I>v#i>iZ>SywkcRk2JvZHi|)}y_5_vl|Jm_8dZ#luq@r=Z-{AHeruyx# z`S!-^^N?0Cv2C+5pgROLK{$yCur{Fi)t`>bnsfxB{k3UU~R1JXZpDYFlDh7fGK|gzs{)BH}oVTdJD%cP$V@IKxL9xUEyb_ zoHz&oFSO2;+$)~z{#TQr-G?6baCH6gKl5>c$ZuPBB$@xt)A#246&$;Wf6AmDJI^Ds zhXH?U(#yxGH4U1^m#*au`QAc*&EI!nb*xBaK9>g11wCr))o0p#?<*Vtt~urZyLhU?R(kHyBG2Kb{Vz0MYzr`U zZZ9ZaMF<(j1H;q;FoX7ym6zKf{#U9Wk{7a8NoN1RJ`98+d+N8=I|I9eP&s3R^Sy}I zLqP=jz<)kf`O{Euwc@w!YW&W$bu#r{4$&ex{~T@1PX)5RNK()v)Z8;{zc5uVjr%$@ zgge{jSxRw2;6U}y+=fS&Ric0c=StQL5b zdbTeAN)PwV$vFV`|0~h=CnvP0sGP46K)WgjIFnYxRN^nHIxK?wh0yR~u<2 zfU%7g^1hzY>;+r{9h|+U+#d$i9PPzrB~VKb{B=MJ0~PUl+x?$%52QIS ze>IyKcje`=2hi8Aga2@x@cq?DccQ~H&8vJaiGR;tx83!gAOc3@--k^MJZutoWTW3f zo@lf&u)1&n=oPG5WTJvsB;|@{nIqswNC!7t^RdX!kKcsSk|U zZ#ocq#XAfBWb43oAsec8Gf)zB3oJ9nz>0~1VptpJ@t+fw9(Z$WtbmQM7I%X4>f3go z2h}{Jrlz+(8gb#YPjcM8Rk)980iUP)Qw_@5V0`qz(6kOMy31WPiN_k6xw6s0pW^{m zht*n*Ui1+m+AQDm?kNqTo_!GFV;Etcv z$=j0l^66G~iC^qS-KfyOQgCc*J*?E$wTzd(GT)G^sWoEYHNhJoXz-|qvh^nsPcmrT zW~2E85G?n;Y#Q6s`CJ-qw8*WMkU7FnppkI+JKs6(Z%?K_7*DL}ZF?#`Wh-05SMvdlM>Y`vyOhUOxvpl-CpJEY zX(%3$K`W|BZ$O282^c7LXx%}@PfY(!I0oDY3?qziPxrEN+^E@WteY#~m3^}DYl3e2 z%VVxf;lF(ZvafdQB|9oxR+0B0kW^LEbdTn|3A$@W7Fa9;pwlr}4KB|59IL^r+--#4 zb)Q6cGk-q)6zqPZgA4hk^K_k$50o->AsPe&*m?Cj)0cP+%Fy&+y(E3W2vXhqD3BL|knh z#x?@U(}~((!7&&OU&7t3>gm#A{xzaHNe80Z5CAr0F*U5kRlx^EziA*X*2aZ>FUXA3 zZSm-1sve{Qr6&=S^fh7fpD_gm>D&}@ry_>D7XQ#Cx$#%^;lXg>_yy6r8d<37UEha=Tz;#1-NOOi1lRv%0l3`h&CvP^%07BtdBd=W1N2a`W9cs61Bs$p z*JZ4sYIW(3WmDTr?c0+Z*t}Mzmw-=%wdsSf^Ft%W*aQEA?l|8}3%L(wvEu978a;ty zNeA3*a<|9m4adO-XO72<1H_0^Gq0c?jpM{+88A% ztbHCdb%>!e8`Ftn@h(3wDk#$yvwtynGSezJEw3dq=PI)LYv;WJ_XV_LQLXs8q4xqr zdk|dn2g+Dki*H{EINB%FGF+{xIWbHtgeMhTnZ%~mEv5ZZ`0Rt}4h=9IWsqFtqMh}J z8HO{fL$-Lccy|i(K6Jh5DgV!tOZ2A|r2I-dW#*{mx_D6zcq)bO6!e{ql;MZo2<*a} z%($V3IfrjULvgO-P08E|7%*$ml?iwFid_M^p`wK)*D)td^kX}fbSP5YsQ)3 z3eXeulO80<*}`a2HP7K!FTD{v)zMw&Tq;rySu`k={Y z5o_GI0klGwz77GY6Wih4pDuHw7>LapD%@@5F9cp@2QXR4lLNwu+5|Kn|XO~|KO-Hw`^0%dF=M}yj zx1>95xErXUoGxfKGB;LuaonjkY*kry?2g5A3i9Q=Yk3==y2Nw0Df7JQfUNRjFZ_nY zE|dh*%~zqB+E{9yI2HNs-a019=O2ap90=m?*nh zf)V&@(EcfbI~1#~cT`~{;`-xKjt=XK0aS;f1Jv?mzApBmSC+7UP#75>bTPMSgRa}EN8 z@_D9QJ>b$Z0R+-uItx*(Eo-MvGZd3dfY+mGbO}CKsG_c%&pVDV+y5bEKFhj0El_9q zlxIKg1DqqfD=*yy6u(1HYB(cZSml4vPKu+|x#24Z$;`tuY3e`sQ1=6ur*RzofANuc zF~6Azb`2f_EA=Xo2kyWpKUZ@Jzd72Z0?(xDgY;3JM=^U)WN|tkzUMrdP%QUMHua-APBIF>%k&of zSa!@3vw{Rb04%gHmNs%j?=%*6_u6G|#$w%I%whbPG43$#D^}RUkfU&{Ngyhu2NrUP zFM{u-u5{Qcz?-KhW&oF@R3nki(ED(`XvTL1)Z_pTFqOjSW()3z>7cXzk0=VV_}@*v z_teqU|DkX!zf8JZtD&1f9lXbAB$QIrguL&VP2#%4N842xZ0C71G~MTe==$oah38Hy z=Lt-ZY0MpSRs8ZAdLVmBq|J#uiEVSUSCjT+{vx}R3Z%aE;QDiBTJaBSTrYsx+M@B;Lza*q4gdV<(C)iWsJJ55h#@9qBV zeU8hT+GLiI&=xXxs4dShy(Oj}&?|oO&{O5P7&E^uP6gufcHof^S)x;A>43dFuKmE% z`XBeTn~mFf(l?l9=^serjq7S#iq+2?V{N&tA*k?MqhSA1taU?ejs1HD{tIfBa?Xay zbI*x6>DZB+)N||*=@#AMU^`jiU4Yj;E=GR11LA>_#_}WwKp;Dj?q;)Mme9(9g#wYe z0t-yA5IMlXd}3|R+xUL3pK|+vhwAUB^}Wy|e>Ocf_H=*NDDQ(~0Rswz#^tGwWohji z$ZlU&k#7G^gh^wCwPyZ0T71c?$G+V^WFGQ(eZ#W-nPDbOps2K8-I7n*`g=?N-*?6a zTR%jdr09o^Hjwp#D^u{8w{XsFHF9WJ>ISTi>j=qR63&#E}Yl)l(*TgA->k21qpn zq}{hDdQ8{#J4I{Osb7p$FaDG`Edgq-RQp?|E=WUOIRmn0iR*J1^rgZSI-q)=eLsKB z3R@_ICn)dme?J~5)$RTy(k36qoA1cSUb^n$&J=g}y9#R?_l-uC&UPPX2Mj)N?UpnL zdcF2Zcha&#Yha=H#8T6nTS}3N%OntxaI;*vvayKA+D0Glq9qUkgtF(U1FT6ukq@W` zO6#j4JepG$UUc|RZcFFk*j(@(D)Aj(P85kvfT$n;@|eyusd{kn>aY=X1r8~2F|5AU z0yR`%{4}}GWez+XbIi>8u1OiSPW+*&@qJz)N5e3E>4?@q)z`ksR+l(IChJ?R0S+G7 z#q)fJ@mo0VNxZKe0((I0A08ty@1UGXWdhl3e4${z^e|Gj*eGrf0&$%z@?kmd>VD`K z{Rw8&dbMFWVYv1s+;Re813T%Lf}^pTa@^ko3N6a0={d)~z%Hhor#q{T`APBSgL) z>9^Z~Q$jrA4M&WQu&erC785EK!jmgVC*3}E@slH;fO}T%_yt776WydB{WM{+zb_K|zQJQf5EhXy?;22PoN z;L));Hbp;%6aH@ETT5-eedl4lO&}j;FdJive=*8FOmXI8n)L^Hbu|^?COPxXzfD^H z54`;|_K(#ZpV0UPG^-*X=sKE3>!TPD6F`aFqTD)Ym<=Mirq~Y9Hi5t|V-VksYC@@x zpTIloFrx2dtwjqwt&u(Gi{8C%*pzOYhh{_gshtLs9QlHw{`P@_P2N=*q{ZB`xT&sK ztf_OE+lRWq9^D;JFX0PO&u)Q%(Y|~4+f-zpEYqID<;gW%;ES&|2b#gm13w*>R&*~t zG^SxCf_oqaInJ~NhGq$TbdlfcJnU$nn|v3qKtxaK#XL>#Q8~#91UDn#a;x*%Om%{I9Kb+UPgg>|M zSL7Az@W*Sm^aRw#)D_`o{stl)`L-)?{5alHtLsW4F8RS%u0S~(Cu4f+2C_}yBJ79@yX(#foy%`y(KEjHf3(i3PkxtG&HapZ zrGEW@xk%UCg9E5H`>ss;jwDH}J}VDHcTDkw5)+g6tbW_n!Z0~bQ?)vNOQO|L@3+1o zYxE5i;JU{7Vl>=fJV|CLvvlVP(EafYvE&etn zMFKr~>CyG|6meN>?9YRQ$~Mo3x>SXm-7Szf9T#%_W_q(V%6meJ_|{a0ykJFAt&*xa zqVXfelQbxSwo8UnMK``%Sc}8f)i)B`=4%HEPkT+DE;VC-!Sou2Cr52^`3m6bxs350 z-@a0OeDbz7GIIj?R8Z$=jdFiwL+${vM6j{;kY^MS$V)wVL4+4U4!QIDazPNJdfxL~< zb)8i`m#3B6(-W-T0JMlK?O*KXiWWrTNB2m~U}s=md^vlBe4|6O0*SNdc82sEzypsf z*szEn{#ggf0K;-51_OpYPZ07~na+RIw}$soTqf6!WFJjjlM@xpMwxprelU!s)3}*4 ze;bp3RKB1gTZLiSQh^4%&iwRHBct7X^3c)=2;UOWGdh5rbfTNd${w=fz9Afk%(*V} zlXFa)h_Fhi0T%!5;m@DUU#{*9!+&;nc`CdIeq?#!#7jsWmE)^RjlP?dF7<+|ZqnEw zj3^-5T+eJ(6kzQp9aEAfhbm}EgZ|Y6ZQBL0Z}%nKJ=yp1BuI2HPy}wp^@WGwny8KB8!8(9g~R zISJmE@D5qwC7IK!*SjS~8*#bk(PnAuH@!C!dLo;J@3TAigI%O1P6oZ%!2)K|CG$nW z{`T|y!AP?#|J%I=-t<48(5u{iD`WL{SG6Vq%CFVzexJu3x8+(B$M=@Qlq}f#ePz%n z*6OTn{Yvo1%y91Dc!Z6Il?C}h`7WtR-$Fg59m2ORB%onFb@6kei|1x_C{D}=RJx5R zl6j;@Wcz?(40F+*6Pdb_Cq8L*X>stzcPYsi7E2RLW?z!k%j9!DWv3h-HcOTtsXna^ z9q{b&lnABvQ9J(g-B_Uv_lf+9#VPByU}0=M8YLc?U8jhYAb#;S7{GVA(`j2zA}lXkCpIbB4tia)+*PhI0UDb&4`>@oVfvyIsWAQw}2IQdbw(Db+aAr7_Z zD?xE%c0c(0xe#iYY_n55O~}WHz-7*#xEV95@K%$))vtKkKW9}vBs2a9@fF?$P*q}< z>w$!v6?e{q_86r&9^o36G2ondQpEh@(>EG<{adap6l7@JuDP&(7*;$Tg&ds(`jcpb z21FxWLRPlrZ%OPax8`V4NCsXC2#8^QjBJEyuix(C6V_?@m$qy1N*o;Vv)Lr9^+abY zLy!W8XD;(|q8@5;$hiW~6HPZp1RF44o}uF<^GSQq_tO+#yQI#8r+jf4;oJok;?6UT zh*O`v7tg&=j; zRSc$^-8|{7r*+2@-dano7e#qh+j7M6C}V_8uhezE5-b7^I;3}wd~mSd8h};Yr}v@j z#0zWh_A+Xs%>5pQO_=oaqQ_>{g+vhRi8CF`fzbyypeN`M2>7A<;g{IHHy{FXn)U5P zr85(ENO1GY&xo;^9-xk#rIH1N)x;g3m~VS-{i!!%`y#?g{`f5gY=J>ZuDE1;ttbi; zA34Z-Qh&S|g!%gk5yEKMHbP+ZbGA?DwtjlrTQh!NB6b_LMvI^cGhcFB#b6HRLq;OU zOTJ49ws7J)eqmeVm0IVc;g+?R?R~2+Hr6_iDnx6VB-zF!VLWqX1`bC3FD!$GF_#= z#|Jrz=^Gv*Dpq`ZDe*sfU7D6}Kkpu(PTcNp#pAC2aZX6QU@S!f{O8o3RzsEXWi zUG4F#Rm9zNM)%kG>N!v7&>r=j)Ht$A%j3lu%8q-n8OX?9m?SI8;km)ApWk#v8xU#v zoZgm3(*+&vlW;YDUG?f)z2ape^SmofYUj7N(&V0Tt4`9nftl|=3WO>Fap?S2>aHBA z5lSF*(42eDX~%UnhB}H>I`0gQqtZ_6x!uGkeR3nwvSAa0EKD)bJ7<6eQE%CQEhQ!- z-ztFh;GNCACwt*#OfOFEYuG9{nN`>!nDK_`=Sa=6 zdaF7e0JyCan#bHIX5@x6q3;%`hgW z%hE^SI9kYFKvqBzvwtYv)7f=i3}I;be!yy;3pv$CZ&gAz`XDBvAYE&4MCJ{!&(sz^ z^=qLy?;A5c4Qppw1S;XGK`bPwZ?JQC6yot|bFnI-3Mjke$!xF{lYA50z|5}!eo2R;N zapA9QgG$3FY&~nBZnDrq*rxP>=$J$9)mMNyvj8FZ!XkF|pXszA`hgjS zeZF@c8B~Jaf%OMu)4z1_cpp4oRbs(_3{P0XBV7r3QdtG4{m*qKPO*<(UU8ddl#g+Y z)m6M9BP}@-(NN=1{5ZgTECA!z%}+PeEnAZqSn>5lBEsKCPi_MNxBS%%?Hs z03Rhax;5lptb8=}+ElZ1{V#5W81>{OD%O5ZdEKtaON63aGwT@5I<-i}Mq2)Al+1+N zPRr2({AQ`SXmvoZ_b#;9dP{IULA7JoFF7U&6!^vEqTshXva_&kMD=|GwlzNXhczQY zH-YXiGJh0l8)d)M+{u4(;XgUyl0=(q=krzn6!gePTG7vC38pXMNzJ?bz@c3GWe zn|Yo1lxaN#1mx23m>(JoD;_=;=y_h!KFgh-W#9eWAd>y`6aCSZk)bI26nDaAMtG}Y zbFp6!>WP9m{R^Uyiy+=!kmN~2!>sXsYq`@VD?fl&k=VpRPP)d$V~#G~MIXnl0)5vL z6tj@o#!f1xK;iF}e^d1Xnrl99UXjI+dn9s~9qbNE=Ls+Z=FkX-%6;Trbu!A_DT>i+J! zh(6@w-&)Uf1h79YD>_idoZGDRvl-=bHWcNtrx)selka?VEq(1X*Equ+IH5SnyTug> zt&waR5r;l*-VCD3{iBN?d_)$v4^n3^P6EvIL+Yg?ESze6(BmQ&uXXyw>P-yO?-<^X z7A&{CwVjZxL&H-Py2}5qG9{F+fPDzcbeovHX$Sk^oY8gTscL(grx$sO)MyNWtNapK zRN1L9QG=p%jIx8VN@_d0&E=k+hpU$q)4PsR2zqGh^rDCDK;anc^Qv6=D6gv)Mfum` z(H^&5Np}I?qD&f@A%RyzwWhkn#2XnQb~nTHzFVZd=?UvsbwV}``w$%F82uOYCfA1p zSz>&yf``WMc|t)zq^sw^VMvxW-*MoC7DL(;Y{gU;YeMA7)GmFdPi7dF#2@58)XhGf z_65O5zN^$HVxjLd6Z-7CR4;KE-jJYSW2?J=ri0!2LcpZEc#pJvxK{81kg(v zd&n#mbZ+}!3EWrR*9hEPhcFAY3Gu`5fBP)ujU?w+PCz$*N(hmC%dr+g-Qd$X&w_q1 zL-|Z>tvLbQ%KInj6qY9u?b@r8(8@v|cg`$_rOkXFzd7%ArJkwvr{U1XMcAs#b1&6t? zVsEyx0~PZu(cN#{!oVTu!T`)ZEPE<27@JTl`Xh+L8khIecfSIGxBA#%pc&i>tE31=MEaeTh7jH_kD9d2KsIHj|qsx`BTwXtQam?5daG0#=W`0Wp+)!-E!sJ zC86>b)rvmUz6#b)`|4Y;zVUweT&5*%?)y}OdJjzlcencucn-!6xX(g8F}0^%vS&=J zqg^zm2XY;+rTjE!@Q0d0TrP2oy>d#V>YT`O@PSTO5q? z^1T>W6k<_MA_hsn!vcN$k9qCPqzVJ=1`zV{ZbGg@$Gs=?%=P-r64@I zKi*n46RaAJ|2~)-4WME(zOh^FzR0AX_vfgbL1gUs z@(8@w22u7ei3rUsz0ziij+`DLARfXqds)+{;}>5y*lt?;Dy<5X$IXy2y%Gt-d}1BP z*3FFpQlr07zT%LILOv@J@!q?2QZgl0&oj?!8*r~TQ7Wt#eKOj9GP-MT@ill}P`a#F>aA2{{Y2^$A89$vt}c^a_$9Ua`v_Yx zQC>j(HbZnbSd0B86b?q>ailzX;#Adq>EWo>=@Y!+YchS2s9=34mm@ir>=tjNWgXre zNBGD0hsL|2$A**%-<16yPs4o5fvwUrP@g}OEkiyyI<2!%Lc=nv8MT8s5oKZ`j1~Jm(BeJ_DaWFC_UT-6rQ+m(E082=#%4vIl#rB9V}Eej9t1 zH#r1DDqQ+#Z`Tcf@*L@hGCV>7HG$mwOx7)$SF!CiogB~q;p?q~stWtQUpl0e?hxtj zE>VycP&x(a?hZkaM!G?|yK~cBn}$tpy1U~n?)!OW-goAl^QR-j=(^VRUBCQ(>@wly zj?*2kr>jOnOG?!obT7sv8-HIGZUush-0cI?nw}zCQab4LeO4je0gUG|@Pp@1N*zox z7aKy*kJyJw=BHbn$P=Ao40`htCJlnh)r`ZFN^xBm+K+L2b1{jDr~HVx8Le? zTvuK`$%t;&UAg%3+)&kiWZX_saOveLV@dUlPIqsQn` zuz0OwndpDr)qiNqn$Tbr|2A6 zPVqV)4s#6O&K;NZE(B?|mKlkh*SH2}k1^Y+dh*746HgE4h-~*o$`aLCOLxG_zA+Nc zlCXAB?jpFMTI9^AMRjmrk#4cgG%lGs?;$&q`FUu5j}DTo`nPgfm2={;BI>f@IXia=>pU4%j%kWhwrWm3pxGHfSBH%Is~(WG^!lLp ztm2Oo1`V2<#Wm<{wor?Lu&Ik{SM+`=mo@U-AMJ_P@7+CD7#8O!y(_;vYS`3W*texU z%5J~4cF6XKk_MD`$=90e!`~MYF6a0jRY^!3H8wuR_Wj$d}f~Q#9s>@oB%xW$t#+`FtJuG@U!Gdad45#UN+-Pk{yq)*$4AJkmHdm5~ zPT|DUZvULGn1kSX4vnnBi3$E_k7bo3weA-CfU()_RCv*Si4U>%fhoA$M7hXo1CcQU zapN*Brl=YOB;phkU<}z1n{0ZE3ZlXmUU47%F36HG*gr(X@72y{RHR%QISLm=B?r^w z&|}Y!$42fHpujN1nZ`N|Vr>L%^8s`5tjSr{ew|v=g&z^X<|34Ci&P4C+hv*QzKa4B z6a-WXHsCcGjP6!bd#dB*3Ag)^4WwH46@drut_K~RN@&kJtuIElH0C&_b>6hjm$hvY z^ATuoGcVKqD@~CJH0IBr+@IcqJc$4R%#&h?bHa&#{Z3=f{z@T%cIpS>HUgF?%=T(R zZ<#Rrj7Iydb>greLxbT7RL8E^>uMdaK>cB<(G!@9?Fr!~m#Wj-w@$aFzaqv#zkZ)O zFaOy4@hzZ;Z{9^m%e+omy|qDY{)`od?ik17 z{sS2yUx;!T^&mXnp8U<= zSU~Oy^zJCV68Ki13~0O7v?-p}i)?mz8UoF&x{e0=^-wC7s;P>>tdvTNbCwc~dFYFZ zQG#dT6P~3kbE5qR<$b}e7OPW^=ec99kQZ^pVlFO|#w$TiTR=i%CU3PJd4Zj66aWAb-8SWA@9UH0-0g#g5i94oY5hPn8b! zNOH_kt?bv8)i3|sYCBu)%byVjN4jawwx0eXCAi6EvO$5;zgwb(IEb<8is&&F>ywWb zKyCzz^s~Iz={ZVte6GF8pwfdL#B>!RpRCzYY z?fyVL9Z-9oy;Csia%7562U1WQ=_2(z?vm#@rQw;`>i<9W=8J<(Om(_>sSnt!sWw)Mz8U`{uOZyE1Yxh{;)tXPkhhbU-ZPn}vtSz7FYLb{NAScv$_5P2IV-bU+bc(ffl!xAH~x&LX9_qlh{3hcsLU z7nvs-ZK);~i+&)hma%#Fq}P)E?PFtEt;pgLtf!3*p|IQjJb8Ml#Fb56y@>*a>&TD) zM10qFR-yKtdi2<)B;j&7Po>O(+CzEPWE&a@(U(tDWs7`(a7~>ncCoW4)ZN4Y-PjA3 zMA6qlo2`k98xk^L1Z`SPb^63%{zIFmX1|mdQ^}U1vQ&Cb#4-Lrn-;bW^ztp|)W^k! zCdg}?mui=)j=bc3%CDQmt(2hFU;&uJUM1yus?_F z>#+|c0`#Rx9jx%*)nHksy3iZ~pfDhmY+b)_Ss;Lv3x}$>rM{1NtU^levz=)^22#mZDHNG=~iO7en>5GK_Dnc}A=(9s{Q z%iTu~RR-Wpv^aE>*D~x3*_uK9G>JMYzx*>10yt5T{;oSK!gZG-z;mM_ZDCunSPzk- zdwpQXPI7~sOc%upbO0ciJpB$IY;>e8z}bX*Zs;lJahjS1K}rNwZBG^$U+XgSzkx@M ztLQufW@a!dmgqVy3{a7(u-*1zs3ZBiAos)i&+mnE3=C)`gV3vTh6nyq)3AR_5q6iF ztOWYZUkqB~{Op+g|Mo#vjAIo(Xp~uz>SO93fVjBFgB@Gt(8R zF2Inm7ZLxTov+Fq%Bfz4`*R)-0~FCz!8*!5+4PPa0ZAM+{KD|uK-_4>@lwTLgmW$+ z!~>PK?3D+?+W|j*gzYxTu>*U@(`v)|=@}760-NwY;#d;d1Y;M)3ANg7eDWVLy`y-s z?TqQfgJxvsr(CC_#hFiAo`p|vPe@rEjFSSLE{xTH(NOB+gpvJII_TohtE)=SWIOs3 zMmwLDSmp6jL&e_CMCMw{hUD3Q8oqK5)cvo;4R=!;z#I^jb}~YbmglJ(m{OiH#&zTS z3#y5q9K3vIF1hH7iS$wpP@0~oPH$>!?HB3q5VTK|sJ%bHJ<-m%x^yIpJ_3Fjwi~-0 zAjg_lH{I<57AB1mlY4V70yv|wDakIc6n(cfQaI+fU zQCc0>zfuyY~OIXWKQC^4wdn3^_ridMcEHeKoH4WX~M|N0N zBX|MZ*6UDUCfMZtxY?|D`d=ZAkM(*om*r46(1{^ zwo|(4zMD@?S$+JLnwdxjz%gj}InTnE^a!_6Ks5g1T!OI`(ode?H_hCi=A{|(I#{hV zsnzF4`i;Zpy<-Q(BpKiT!X^x;N8vx|7ftk1$b{7DQx z4Co0tXfa!qeLy#V!Wykvh?KEzndQ%Y9U97b?eT`yU?2;*{C2VE^SbEq;$m2OA141~ z0#@48H5iF#i}9g)a#~3Twd5i!sgRJ6-2Jf4(C2A z{gz1{NTGwko@qYb;s2%@mNWy+2EJmy$i|HU-y*CNBs3I6p4w13_WVKB{oL#KCrNpP2(e}@n-b|0M_J3m$=IrGL_v|Z zDw)lA+tkh2w0lPK@sjSDQ?IJN_ix=i-4>T~S$zQHQxJqnR$MuXOxg0wwYOGUW-HFG zX0wb^;`=FeIT^j{`Ba~7c-!z}c_&AgMK9h#WG{pI(Ne?Qf)PeUJ*}J=+r1%rR0Jao zw%J40NV<7VCQGbRi3!X|;7i!SHO%ZH zY-LhE(5!98nNVMFCR&_n+P0UUiXRzou3cqhunG+Bb9rfog%QUhT4fb~4#QtWGq;|~ zk7#%8wXM(TEv2f)l=T(YmT1|=uKHVfoMh~&pslETHoc?ytu>GECS@zIZYW+&ONMUd zip=eAov^GsCHkD3-%e-#J3Mx5hmxLh+9#W;dK0oQr%@aq@mn&OBBl+`qdwI!T)LJ{ zz0U{0Fn@08pv;E{+s!${0#C)^@P|HC^Vh+rIkTH1jbW4j_9~`tl&`X;&*s;Adk;F& z%UE7os?7b)Gy4~rJ;IAUw;_d)c?K{Q6v30_x2s9&h{os2Z{VG#(=Ybx$wunxVxQ99 z_tuZf9Ps=?rNRK36K#>SmK0XolJ|}>d~=1)oKp%6CpkkZ3{bn@@#?MRwYR2v@H4rv z`;p5xY3}Ft9@y_{BWz$74r8+HO};C?d_FpNz2nM641+f$l%Te0XKchm+WFT4vQs`C zgEZ0Yg|xh(_G=3GM=1`Kt~4X+BXN@NOa0w&nDC+9po>H_5LP0xElLjU_|s{Wb{F8} zHYxtFo`mx_oJlGv<#yOpi5L{!=#+dS&--qnid5e0h|+TY=N~Z_vgSat=vLGI>@Nlr z6XQDTA*mpZlI6A4xW;8x%?r~Y3RjBnbQ_Ox8@f8J{;=~!bcR3v{7CgL`hC)6W3GLh z&|2dfZBpiFzOPEmm#ezJ40O7?jr-%3NM+oqm1KOkZ5$uB|DkPMsoW7~=`9Lr%3cYv z-e@kua|zez^F)=R(~=lIefg0ZzZ~m7Ifvf7`v9t>;QaBG&%9xu+Jpp;5Ux8b7lXcj z+%PexmZ;O134Of%9iPbqESl7}%uk}RPFDTvzI2w9h0zHEFHGdV~E;r zL{Y;TQm(u$$HDHklhY@%N_sP#7bo)Y<|6hBxRD_L?U_Wq4KpR};a z;s@4pa5;k1`wRPl{U2N-9M|!pT3}m!1s8g_2olNjm0mlhD}D>%-(rzT@r@lX&z|Hn z#xpI~kT1_$GfI6N)<_02Pi6PI{OovgJIh$23O4H}uHd2i|=j%F!7Yy@>&AHfXG2*ZAdAh2;j1tCLTo3gOFJ9Ge)Q5DlGCLXFB=;+9y#9&Ant`vDR7`S#2hyY4+*vZ?Gb{O z=v$0+TvkWdsYC2&eA!x`?03~38_UhxA52%D@qKU%J9&s~=tLeoiW_y#_%3TyB8HFb zVp4Vs?IkLc`KPT7=9S*`-HDnoJsk#0LWrloQF z2AdOfz^hcGT}%}VREa?aKt1(~FbI2euj z#`amnX)<)1xNUpGq@geW@rDTRg*7VhQYhA;h;uAPg|oo3CqIw!PviHEs@!~F(J7M5 zU5#VD;wU2<3-51Lsu6`z&0`mcaWQ0wyOzB)2x7V^=WtQ;-G;180}}yy43jfWeRWN> z64;ol3;09CCqK#QPr|IDVul#jO$JkQ3$)7ZkHniUqIr(_J=IfAhV~d$`po#=GQ6A% zA2U7)KlAVFZtp7lWE0vz56xtr1nh_R64-Ual76Z!BDmA3n?IOQf6l&lU!3)G>NBSR z*$}}*(4ctdk!J@N*6|0a~J^>iEiYX8Rr;I*f(5DUBQcai!IA+xO?hm1Y>Ku%ABZ&<5>9(_v$?N^g(la6a zVtH-^1h&(g3}fu_Db+AGHM33JSA$MCu7}~wUWnm?|16+GbdkBO90u}?H`n$kDw&6a z-U80=Oh#6})gl!p=B4y3toQsBmh&_S?%&|?j(2y`B=^$>e_mw{a#HX3Ss-%UfJ(>? z+Wurb=I_8^SqwslS59PXUL-e@aLeBo(fS z2r4cow?A5f4s#DO33=fXLIk0bH9E;br+$;7PI5$W(ZBu$QbR`st$u06_O&SoAXYK$3m7>UKDb40#7CIt!9c(^^GA8fHpfKTUp!zm zDK)RkMfhTTr!iW5nPyJ-@p}F51+BGP%>P=Z3AwutB|ml93OxkB1ofVF}&>q zsDPMYH%IrT&pw?aTGvw1g$++4dQspTlYjhDAMs$}J@G4(j-~o~gZMQ}L3bZVItY!>dAd;9WMW+e z#`{niR@(r>#l&2?(P6XoOTxWbUa{n%T4pyEJn_O9lc<8@don`NBm)xm7Y1&u@E}T2T3=u z&4Q&v>u|Q@W4zq{l+rYvg8kXOtvbc1N5@PS?2vDf)rbqf%w1Hmr}>VQ{rYgD%zYaD zA+BK$tnmd51W*|$yV$0xlOdc<&2{HCVOphih!$PVa{RvQH%-Rxx613Ac(&g>9vv(E zEhYhs%OHjw2`M!WZ!}?(8FTX6LAbi2X?_sPaSw{kuM_!~@`qd`JTdd|$m`>2KPmnZ z0(dQLc0JktudE;z`)VQm4MVX3We3s86r_kez{lJZlh!o*oqM$(|d=SfX_4I!vrMuiIF{$OD_e+!z15^3=peKWE zzJ1h=`3D;ZeOBEMc?Ur7S7yi&+?#xlVx53ms)U2@0~73Cq-$48XOwqORA$ zkRn)#|yrZdKD#dFDqGQ@w0R#0#1^n<|REu8$>%f z4O?&Sg0=J>*U7ARf~*?OTSRlUeoOz<_4L=2y388R@&zIEpt45jn?mqNO=W)j`SHkC zENG_JB+)p*>Wltp>B+NhcYI}e)85#`_*0aqc0ZO?&2A1Mh-LlF0XwB3*OC3rGNyn^ z|4(0nGcME47bn3lN;I%GGHB+D1xr*#7mV)J6)+&%4%d&j3I=@j%kv%jDfi~P&s94s zcFi3pe}899m~(YZ+7OehU8kY3mNgllqCA<_v+U>ze-UdjTdSO}XDWYM2Ua#fhc5xt z=0*YklnV5X+szjfayvqZr%dXC2U>Y8L;+%7^)Q9~ALIX1i_+adWnM?S)ol}>-H)^P zajOP3gi!4cQeJ2yW;7si4irE6IAA~1njMY_Sw6`3-E`U?3X)nSzn{-XA$j4HLefc; zs_g$GvY0k*S`@WC-=5~D?PydwT~umxSo%EDB;r!GRybt`WrKRD3xruZ)&Sqd|D=VS zu{5^kLs~RV_THI6vijd3S5>abt9aMaiNb(+hat%am}cgu)>`RW0otz;8@VSty52Ai zyqckbqu&>qaN^7oG;5Byp9cFLxzQW)#hQY3y}AN_8~uzuQ@=DDTkWNo3xa{jdV&@U zEh8c^l&fj~8hg@=DsRQPZp9V4$#EP_iNSyzQ%wx1U^!F-4hiI!wW0O8lNmE zgt1%Un+Uz+H$;g(Abr#IFMf=YDuf;CFdyeQxv0LICa}{+cL`Nuw5+|>dUGMHc zKewMYL3a>(b7&EegvIV5L4OnCjGn;e1jnrcYebx0cZ%EF>XZ%4hSe)Y%&JE zS&CG1AOF`209}Re$ffJhbktSzfpn^I_&qCo#tk?~H43#2;A^d7Ppmge9ZU>or){Or zVx)d<6DB}W8Sx3MH@G3}qbV*yP>%SfZyxNrOA&fH)DUy4 z!Hpx6Vr$H?R=L}Ei989U>3z&^s_OG(Knwr^`civfJ#<&efedkV~7 zz}{Wsfs5$Z2l)rtWk5y=cjh98AFTt>M^`JG-hgn{7_+o4+92b%_jAM=U-HI8E{1C1 zTxr*?dsN36-J}UKy&tp*vBGPyS?4~0SPolyJk4&5&>q)ahf>j!%jH2VS(;sV;$=h> zAo(OWRGhc$C!(1zne5)I6O1r&u-D{H^U90ki0~G$l7Rs}Bm5{z^V&c-6Cf4Ncq&bp zZTbj%%G15|{EtqrP~ZhTZ1K!{Idn>Pb8b!BAt>U->SNoovwrFgDB@s8?!%U=$+Qe# zY5it=hpVYq*=h&x6UF@!X48fsMplCG(09Tp*S%`#^wXXQojXMpd`$jZlmgE#stES? zVI6%)jo#Z$J69&~AQcm#i|c9Es|z-haRxV==5}qam{p0qOvNP z7vY>_ZrcPFVq*T9DejHL@I8Ky?Wu#`8k7D80rRPhht&bfIa7xk+|%m{tM%QRULaKSws+r*-o7XoLu#2ir{j@#=20$2ZWfI*3IA&A!)M zqIi_^Ipk?76^!GKhZ4^y#Zj|zjlAZGTs&JRBsoa*FZE?oK07}zWQ6z}yrX^qSt6AN z#%tY+wy&>8Q6_VT7{1EqGsU`A4o`o1psk$u;&$#8@m`BO$T~qZiJNYVde|ePEbNC* ze;u?pP_=Zab%TXBeWh(qJnvOJ;}GnI{SrYr&zpZRl>ZQ(6Xl|5$Rqi3r|{ll2mI#F zCq*{GoJXDFZk$3j`0|;ZGMqw8^wJZU13db)~h`&c6NX$}DyHY11nlL2Y;i6pUtLAJbx9AYDnL?>ZFauUZG zy!i0VUm0e>1c&z??5=LzDSvzv24lpgd?6xR!dM|;>ibb5XAyv?B6A#OS!(B689CL^ zt!eJ-q}&@f|9i9s813s_a7Z;kHzfG#0GKOf`Qo5+*F$yW?>8}+>i3z!R<%G8BLa>P z`S3g;nDq^(=~Hx0ze13H+JFJ!vf<;q9E32WdI`K62PgV0;&XWcyC)g`eER@fBjO~K z3WhgVDzx@_?R|S(3ZCMcCNZ?WmjZ;_{ozD7#AOUjwFU3DU?A0dzuj)TH6q{L0X9+5 z^v;=Br`nLDJybGHK4!*0p6LGwyUfMRrgBfRAgM8R;~Wt!Ju*$w1p~hj(Q2vGz&~sb z*UdcL0oa7RMUm_FM>7Tu#!)ZctB1yBWyR&5UMBBaj7AT3FPJ%tRbNvZNq|3!Rf=2 ze720=5>!c)`qFb)7i$(K>37xD8H4R?X~%k3^A9+iQDF>H9|aVhr_JF^3;F0B>hV_W z?VplE4VkTpd&%+ zxw#YAt@hh%Iz!@9tR&4xxc2ntg@${PtQGBk*0k}|Revv3J6wa^zykeQ54f)$2g_K$ zPf!|wOnEcpGKSUZ{BrnYzqRZA<7SwurJBBx!c!!ZyM)+yTl?v*Qj+)Qlh%%%^@6Te zJ$^ekf4#GVdlLK6-LI={9ydjIX4h~>kteo3HzYP4e3vJ%4Nqu`)s5G|uJ%wk7%dau zQ6yp_?Tti^7SbbmfqzjP{m8ZB!cj)xp&wZOO=)&_OF+zJF&`buPR^lZy7p8C`{nb8 z17RWaXI7)2oJc|0Z1CKNhb%O|zs@6T#J;#6@=>4v0Al^^KUKal&KCvZlD~9*St@)$ z%Qt7oPq_b?skEt;uYaXgdgP2{kLxo`6L!6bNv|5s&uI5wBEbn~<*1ayDijJrI^M7i zyRwH^I#mox$()}lj#%#?z#1RgADrs&s!1b!pu(pI(-8QR)4+k$Ws#Q;ZH-sXGcG^P zWRS$Yf;Pkwc_=-qu<^j?gtLR`D&YDP3XaB7OwNKkpADq(7c>6SxY+qX7sn&8b&Z>0 z_c7CAmS&MyHRj#|5=sJ=N&T(+*Io3&kr!b&33;hmCI$Pu$>^;N);cY$&8n~Ox<;~5 zQc)_3xf=kL=;E#{r|i-Qs+38Td%YOilBr(=Z;cKe0UNMAG1!TL77IkktSf}%yP^(M zq}^!toPJB(hq-F*yo|J^%Z& ztuHUEc6?*;tk%%jK2aS&_Uu2oVSI~0((zW3foT9weAXQeT1ji2kHty;#5EcB*-<&m zJof`RKAHUA&YWBcKj-t*N(Dbll>pg!ASLJA<)g!PV6N=3&PU9O6y}?v_6SMYOm&Zc z0Ad~~^huIFjAVm#3U-)2JsGrO z*;Mn~wEx|eP=z8rs~*D(x{17uR(KdZWC#u@pY)tclVTUN@(l}&9||VsizeF`XMNFd zS%~|M%T-~&r3yjCsmayEXWQgccLdQspHKYmIclzMlwDMiqzPZl&2*7)xq$yfuok@_ zC6m+@h_c47h%gWatGbz>Z8LesVP-qDv9ED7s5`rA@1Zb7p0p*npMfZ;It1HDHYRfX+SI%^zI*k8 zkV|;1`}A5cqzUaJlGkYk>o59g!*LE*H5K{0D*G)}8TI3b`xi>9kTV!@wsR3Y{hx)x z3wq5WWCt3obRpMScdmY?-H(fJaO}{y5^lFbeeL@Jh~50!?_7@D%TzBu)h{i(Y8!ZM z!?q73CNnKW74AwcaDQgWbH>vIRK@5<;TE$+uAO+91Wj0IiXqAxzJX1@;!@C-vUnCY(wgQJ z#SNgXbE_}H=t^CGnbvI^RIPP6U>hjBp4*V@LWRm{`4d+QG97&+v?c;7heO4Lo?wJw zA7X4k*)Bp2Wz8@Rw0|@IH!Zv;+k5#4#adqoV}uO`!eUFy498hX;NJ0N~( zQ)*a*HZ!5x$?3iLyyX6BeFLpdetw|vuBWW1L{B|AIuR$r^<%Z~d0JQ0u%eNFXvq<} zI}Y4}ZODU%fTgPa!7~M4#AsK4SLL>?3!6tO-D)0DSy{w49x+{5YYJEGBxr6g$XvJ* z0ojB0xoK39!b6tjVT|(#zRaW2V)iYLNM(+-1ypUcnmH`732GrRDGK zw3(T4XvWzuqJngNuz5KjZCNi5!dik;4Zmf<_w&v@fqAZ5-7?^Rt&#Z}dWJ9}YYykc zAzL|NBY89&P(xL{gv#oRxT&N;+&`^-Pc8G+ zH{!1bnFT+LILPRTDVOu3^0BVe8g1r39}V4kd(CeF9SSjvqdIIrUTgq)xx(5De$Cot z?Ql&rvagu^v;~%D<+(`c-Z~yK+Rx9GT04S0B69onpaWoJAm+449~rYOdW|{rLc8%4 z_0F2X8=3AH-(p`iD*(nu;2EJ4g+3yCc)|?M`_M>5U?YUAcq22Ukj1ax$`0+AC~1lL zE1V+KJ1&<)Fw}lp`1<$f{jgulT`_9qgm|y*b%_dKnmn}HZ1h3}&So&t-3lx0IN#2T zd5zX{V;~pZ#6TNiEfvv@NgBtVG=&BCqkxK>Q#YOwR=QPOG@lI4v30k5)m>O#Y$ke?)f9HWQ9x>qCevGUsn>tCoz zCCGn%GFgAC<}!7gj!WxZ=+`;=sGOfnC?!+njfwUPThtkm_X`fC1j*o-QmT3SZE{+2 z%SReguvztrRNjmj+y7mMBv?!MP0c{ylFkL&5T~tL$QDO^HXJXAN-y1~W8xdleVpf; zSUK|9PGF3fvh)kk`snhTSs<^d$?AL`4&x03lgvnqegyNkhrI~me1SAD$Ru`h#2bCl z;mH%fMQr*g&}S-LlZ>b#F-Qcb+$Ad^!!&RXbxZt;)iCsyTonH(GE%c(Q3-U<6$xM5 z$25MKnj<9eKo-~Zm)M+h=AYThJcU>UJhbErbnC8tlPI{$8H(}Lew-2X>|PDaWvF$F38GhN=FZ zpvpOjlj-RESzRiFuHORL5^yc46$=@9&~+`b=DXMDE(AsS1sO8nH#pFE)1p=H zlEGZ6vbCx9i%>3vAw^7x|FCD8(<{itsfLrgl~D)H!Usj5FSyV!4~c9|T?4^l9wG#+ z$I;Jit#gji2p$K$XGOO*c}U>yCujgw7b{FJ>| z&u!*u*S_#-0SIQpJV*U4+ia#lL&H(3m(fKJAJI~OT@&rvtY}#jcXcPe$ovK9$5IaW z7Ps8Wr>Gf+h}Re~IJdE8zGbA>XP@dq%`tLZs1hv4>nq6VEfS7ItJ@0S!Vz}arvrg#fe{A!G|G!>AbqiIp$0Q5Hy$?3PmKN}`lD?EU5=L8b1|N&G8f=cd)DOF13bTI= zR$N~fh&{I{{byBVa9C!Iwkz>Es0oK|jub#cmD;JdWJO#hPi(bu( z%39BdLMzXsL6q6QsHL4m=QNBWgkz!^6-9k3&B`Y%!|++AIft2JhxCic5OGBDV65=A zUT3yk6R_0NyiQ2&TwJQCDf2ALkQ#rqjPYS`I zD+UOOs)#}Sc$MbCV})Y5Q7&g#zPFOM!Ums|JKyKML6>HP(F_`IGGD09TLc^rzr#!e zMX~2sx18?=o2s1~{uWF1Wp}a-cmQmx{!QdtMz@tXpRa7eQLRAD4XA)dp1X)&<0q9&?J13SDqD>hQo}6neoPY zYSG-;Y;(`EiP2x=SWE@_hm&4MCvt`Ut@~2sXPoV*^YYFM1uSD)!J*%Mi|+Sf3`*g0 zTFM*D@7EfgWHmb9|Iz|nkf3S!t#ZVY`26)g6G-eX`50j-u^M{&Ph9hVa<@lQ3*f$1 zzQO11It@Z6%1)BJI$qXhX@EGaJKDg(w>*2V|0ci}#=`&f9cEu``@#TLYLYht@WQrO ztTk_5&K|W`ZEtgY#Pj=fc>yE;^=sn7Jy)Mh5) zXrMgw_2QLeX?T326=lBIp#SS!m~TS0WM;*ofK{HFAWp4|a+gZ~XH+kjwad9{8(N)Vc0T$*m z>D<%T8I#dji_R#qBC14v9MJ~bjlR7`784!u7801e>DN`6rEh%+kAtoAkuCG9fZBE< z$t{oP5gnwMXUh`^jq^ScI4Z3s8dKDE4-1-9cAFP>gfT4TO)CTO&pD_ymV@6Y7iMI` zK_$VoXLvrj-v7=q<;+xawqNC^-~pjfNry_FkQ{%z2&1B(L%%)|QM~jFCKbUFR9@LAI9E(jzQra^cmW!+s^< zZ(LQZP*lD_YsucFqz>Jf$ft*)|Adg%^)XhWGQ`Y?E{qJ3KUSyeky6nNnM-SCqiIX; zYe#GO?2|GJZ^MoPa=OfScQ9rmm+pp`^n}Qs8|K98UJI1319`=rFby;L?3sEMu!%_L z`+?`7b9n&{B4Kc6aZK$N=r@47I9RIQpdoP)FzYj_0c{u+D5ie{=@mrqm6TS??vle; zgV+n8WdZxjUKnidmvyY<|Z&4{e}w+J~MJe*puL|IoIMg5OfE*Zoa| zHoSWs)V+79u_J$6S9Jnt{h#?Q<)3bOlgkzRw+j9P%E?9N*l-t=83>4o6#>-#-|TV& z?l)tVxS0&%ut3~?Mz5aih~jkoq9q`6JJM`8WB8n)(I7fZL-229KK{tBWdPp(oWGSE z*htt1c05$sLqLQRxIl26Ad6)$o}E8I9w!?mnwFpUDwKL>+h@++`su;5mQY;r(m~l_ zk|Yz@K|R14)fw9rz}qp*Ya8|k_oBE1@Vn_;nb>at_2N5V?kg!47ywE`DiL9R&;G~p zBWl(XK={LBH}Cp^FpL8AS1Z%{y`IGPpR?Fw9ro4{+kd3@= zTGh~PD5o?4KX)U%?~x9~B4#|&#jX11P`ruQt_UK#~16xPghT3MRGWpGJ)6t0pg z95AI2qW;~4kEHzwU+j$9|E)X!2B0Na(&{9p_C1dPkDGD)|MzhtyhS^`f;gf@eJK!= zvZ7=ifBnQfJOCst(xP;#%_lojfve)wi-m;PnfmGjC_q|iy1<;0{C}T^(cb^L{R>R> zZUX&$Ii_b#Ni)g{k7)H)jDM;W!E@p z{Sjz9lmM)R-JC*luTu$(F^*-BRKp18aG_y$P!V9Gx#Wen0zdF-fy7g@3~+MDMEPuC z_H_V|$zSxw{G~pRlYI@jcy+8smUvokegzqL_p5mK-qikvD{p6Vt%?X7gCmOP(_lgQ z`T%4sHJE?nVlQ5=p&IUoiQZ5lfSPj@IVxbj37B+$13+uvfqqxJATT~4$yT{Fo++k( z1PsI$1GDMtju*85dFrDTYbR|;DdkAQYxR3Ro|zZtz+-wcsqcMO( zaY=>|M+f{j&9bf{)3m~BfKmH_vr^5Hd^p|a5-8pBUjZnDl7$*mOECHnf>i@Dg;%AP z)8uDWnt!BQ+zLIf@n|Yr6l>Y7DaJqG5=-cv@dhe-lj_0C098>>kabMLX^ABVz~Q}^T*RYrEM4dz zryxP&2kKHt3P3qo1dtIkzz{$V;E$Ojcmh~;A=Uvb#bUr*QR|&v+#vwSyZ^Gk>hqvL zAx5@U&LQUNT$(pjfecBIjRmA8*T40CsCC0yc6D~=dlArdW=Jx#HaG%CSBvnOHL_lD zy>-9_e{k{ZZjQ5!luMO+G>ZN?(7 zzJ)9Q@V*N`atiFw&$+?729o@IjI*oOgWeC)gRCz)9;qyyRx$x)5f4Y&e*T7Y!P}t@ zyseqX-XjsJ@a_@r7oiRIKA$t0D*X4SUvEW*z534FdC{08ynFmq>&B>Lzo=q`KmC6t zolh3)xoJ*Z(!%eY;-{miLFV%JU!H&zjMtD3;&&>Uh~DfKu97z~V`;it)3UZr35PEeHWd(MAvM_CHi)F*5Yz&X4G za8;FG20p+0z>*uw0FPCD7#P$djpuPmhaD& zr7i*l@-CE)hhrhzE|LSS>s0NJ=sVTjHMy3=x$cPw8udi!M(pdfg$zRxXl?Q z50LdV!P$5l(oha8a66|*e4C+`x+j*8_1bv(JG|!_sE}iSc1?vcq-* z_zgI~QPDm(F|j_dFWJ=1sJ)3E2FOuw^OZ6#VEUQ?-$quiehlk#V5jn5W~Ux<_t7hH zbS;Pi#>HjD-E=fYE|rkx<$kVX8gSh&2Q2vbt^kuhDFMsNaa}UYB2M4~mj}+pDqsLk zp`EkBEfw5w<^Da?Cz+adL8At!ci|Np13VoM9CW}cw!x+>iY{Huw;j$)?uE@UZJ4b? z=LxtdiqVIF&1@cUWXRruKQFdNuQWCQ)4JKxX27GkRPgC?s+&LgLDyyBXUcjzuu}Q@ zLRR>2Vu6k>_q?d{MDGjL(7J<}>YnfGrBYT-44TPC8oslymd`|G+VG8WuE93^UY&_T zdvmq!%R>&_fcjywlS;$x>2%kXqJC*)Qaf?zox$s2MSOwZvO(VX7H|(o zc(PY~U%amX9*ue#06L?Z{G4<9R*iPx;1cu&GYIA*+bm%qX^(@}4&5i}xBm7q6dqdE zbu%gtWjGq~!obP1nYO-dBz1+@hw}3aQ~?s5+<|nURjQuubv{@u8H}0S&Cnpd+7YMS z9gicrwRr5gkI_go0l=_#5ebhp_JaC?h@ zgs>p;qV}-9a?ct_DTr%50l?TSYC(~(-K$Er{J*Otz-W~#M!X#I3tnF7=05aW#A&ppGKR`!a_4DfDzija0Mw)gP-B!UmtU!H z`4_()T3;2BC8Wh?6UF&1TJBqcwaeFr#dIIbbOCX*N-&-2$3@-0H9;rin@}` zUM4KF;JBmblK5Elc+rzn|9)1GW3CE(&4cUHt!gKw_M;^+CsTvA+H^Fhjf~z^Z>Lxm z6LFagF!^2)pAr{RV!Y0uD4Jy0Ckok$KK22+IAjid-ZB6c026XY|38#{WmMH$yYHf< zQ6!`l1(cRV|E?B%qh+JNEQF|dB;Du`Xz5vtgQGPh6zOe})F>e+H ziaB%8-#jA0P^LNG7Ts?4%l^^hKm0Iv?F!IJw?_KdB~oO*wXSN+Iko;G#TCt3DB}Kd z_EX*@RDIO>+e-R&AGP3i18xHOtVCLhVvXv8PNNH6J%jcxHMiKVcX! zv+WLCfm?&jvbyUIsqEz4$D!}K&M0aLq9NDtdo93Z+q=x<y|`pxp4h zK2{}Uv)d->fwalluJE2vq8YY>JEx>(#=d`eZE=JZrg`CHl%VQLu0j1Kpa0-xoAf5B{bVnI)C(}V9v87WQ@wjYnjmPwT>zuy%6T60UE`W!Q; z)OeCufI`dO_$wAi3<<7N^6f8Pj?3g8;~sduc)_oe^jw{`ZdJ~FU9Uy#{QG*r8;}Rf z@hR$7UWHHzV*v`DP}LYF*%4RN&`jna22SdCuwQjI+3o9q+*`R7PtCwEvz@wSqH0jo zg)CJ9E6p)wzRi4#`Om0_j&qkdIv6?_=fG|S%!L~VVU05`hl>KJTM*o9wfpWusWIJY zsM$-a$*kw+8vP0UqKHgoO5h8S-)7Pus!qig=(@7pe#fgz<}r=f0QE@X^86gJkaxR4 zb{Ar@6ZT$WSB)MfL#5Cms4sp4O!_R6i8*BvZ6bHotYWq7d(jtmK%-uoT{;+=6Bxu zVGxM+a~Ish3Ot-C_I*zup8fdMRbu-+!tk2lk91o zbKP8jfhW=(a(BuMIuXBB*LBvz-slcFC=>anogu5P1zx_R#sBW*D;|eenT?KtYc`F4 z&e@Pz(IY7Zq%1RueG~!l-}p%L<*T~6wyW;){>_p`>x^>NQqPKXv|8E;i~N=(9?j(O z+ogrwN3l~>$CacJ!f$1r_rx7H)UTCqL$SwuHzV8JFNZ?U&!MzkXE??P$$JYYAdgTU zBT$z%XSr@Cuz=s9Mn!kvTtVAybQ|?ZS|>$JS1qGknzCzDvD~=<|FH_H4ycXiw!Zz5eT-P$`%=X=zV*ay#Y0Se&Uk~Ab^I4r4i%)l|1$6fJ$J_)-VtRZze%6}`t zeI37VcvEnd_3O3bO$?;g1?hgXdwcWIFxzjPtmYFx6kYOaH1#Gc_&Fr1{o+}Bf{5g( z`TdoNq!~Ym0*#<;nmM8*xm#;L93E-+lCuIN%@l%e@8^$q&%pDV8~g%vFgPaPg7tz6 zlius-w{!y58R%a^c!J#EX_B=(dfsR+yKQHoN=k}Sh;^js!CTn{DPcI)uM{y&0Cu@0 zSpBdGkoGBb$QX?Rx` zw3CG_7bI5H2~Q}jGg?2K|L=z1tWgNH4wpt9bgA1Pepe+7D*|kyf~LW{lwNvw{I08MP&cbP+-4HV<)iNc)rMkkev~vJvHmWvP>}|#l+_XliO&hS9pAVNA~;M zqK1FJFICj{r8g=opls8!Zc<_@{|Af`<5?sybN%0Up)m@%Df3gb5dHR#OGm#@lsuhzrxuOe4cWmFBxju=X9+OHVRA4;cV+GojG6;o(p~e8a)cf z)^k%!Dsh5w;8K_hk<}9#@8=~hw<^s+Y$oFLU>A7F6=_AFV-ldFN?tiXH~+nBC1CUS z*%q^pNx}D|I3%=6!w1xLZN(!$KMF!9>96@1?2F|z#mnexLs_l4Iw zYp2XvwHH4~v)vy(L!Zfz&tY&{8-79SzSri6$902EK$$iNvW;h1D(mna(EO8^iA)9) zveBBkBvPPLX6B&8;(6xC>EY^-D(D#=K1KCdP62J!v4I`vxI11ttg~C*_=0(crX-aa zu?YRHtnz!H1w8o~QtgP~$IcKRk3T=Z;(d|Gy8%B5O%StU;wn$Y#1d<3$=WCyg!5Wd zL|t%&;D?@?Z?jUwzn3Z415mGZ4M1uw;3)j)qaFTvix|uIA0C3?vS5e~2P?GY{LpId zK3E$(pW`o_><2H8BSmbKr?-*n+fEDm8ztPC0RZT z#M(J$WijEK8~FC9`8DA*4t#!gd{O#zYzvp(>#W6fVXn2X_oG-&%jF66b&7NCeEsm} z*H?a*oteaimpgQs;@4{!)p~8j!nd@-PzB}`*B=_?lkJ(U*7crQuHr$vg9sg!LmyjJ zAQBvhUPFbcbCVrQrm{N7&3|oij`@37fO&OxG0w(I;Nz@)$6LPRK}2;)Vy&92Rn@+U z`H)A0(5UK`)4k*ii_tO3`wKNKQ$f_Zq|hllv>H03Fh}c^J)hH#7M~@OYdrfs#W6sB zyO{2}(G1Wdleq4o0^!XYw`&xUH9sn+NO4(0>6hT2Ba$~jY3wMp7%W?FIJ4>~qdrTh ziMFZWY+|+dvIWxE2l>2c7gsJ&JB_CB8vKZ1)(_2Bq@=LX;A#VFeD(vUx6}l$Kw1rM zOt2U^lUCm|uNV;0;js%*!4!$Y(KWOv%zI3myS1t9z7 z)s<=%Q_*HTzr;?pwyzsDOB4qa1!{dqq#cRq#kC{?2|A1hIdXJ*CKvVB0>0zEi~w7R z%4)IPOCKD|XK_LfIo8v1pf4kq^mf34;XC%yl(!PvSciOy9fEOk&VqDQQs*x(SW%Iy z$CJgjC?sTQNmfLvM%g0b7XC`I?gVr*ex5-u`d;RUT0gKPpWynQ)9StAqSq55S!n{J zZfUp8>#wIDz%nCtH2i9cIF6tjuJ;D+`g+g?Wh^H=bKUQvATzXy<7xAUTo@L)15@(^ z8h1nYRoF2Y@GY_OLd%cAKRV|lPV#f(5Nu=bZ9!0@c^sS?{qeAmGG)0}*X1u+xH4K^ zchU`Lk5Z!0buUj4b}Z<2;fg#_&>;MD0~Ghi;ZF+(ail)TU9OzDa=q0{)zZ_Hp?7#9 z)b+!K%yN`aXr3D2%Gej}AMh=h({ycBkq&VZzKS6+VBb}*B`!;{9}z;Zq;q(K)`dv1 zF~&&IjO2JVo+;w#U!7*nBi8U}H-NrKW9e28fqTy0E67Bw2$!LJ)-G0Y{L&{wd zvim$JJ?i;_ulH|q>;S-UAR-@By)d*=VSqOb*N1X_ng-iDA50}BUiF#yR&);NKf>RD zVGso!IqWu{Zn!6U3jPY?mByvj@j$XjLbR!*T9ALUMErR%i%7 z*(D~&|M_Y=c<80rfuo((Kx?0MVgHL_BYQQq`0&M4QFVmtQWq$-WexLWkJYV;pmy0? znoiB*n<~n_IUn*WIQ%94CcJr>+(p?|ySmGKqZ<;`U=}zp^HCdB z(I#GI4{mM&5TmffWl~%wYb{=w%1UE=C#b_x!eL}S01RUxD2*28y_)KY?xnyu!qX(C zMrgM$b)$fuGBc4vdU64qhTd6nJvZNAgeX-6){{8;3`;OrL+){&U*`B5%r+iurt&pm zA5a~3cWDxUx%4&pF@q4SSod`b21E0L5B{I>K7&%@hgi`8EZh$~ItfDqb5mRku8JJ~ ze)BPm5R#I({Tr)0HiGs_;H4(Rmdr)l?k$9B!4&j;k6EEdn&F2OBV?e??rLKLyDJkp1vjE^9|zLuk;5 z-=e|{c(HM)Xny8!XzIZ&fzSZ^2Hohn`YUZiPf2B1e-QrFovqDjkYvN2;ApSwP2I&D^C@cBy4_3KM-iaSivO`T=9eHs8hBRoi^MYVtG!pv!HI70 ze)OO}PKICWpiN0GVW9%-3*_yxl7&a4&{l>s@hP>K`ncyrzq8-#rDPM~ZgN{^Kx&az zNCux_`nz7ypXU6!ezde%#m?p_FfDc9* zKLz1qiiAGgQhDU@O#M1Y43@stvT13*5d4Y zfsrpiG8}<+>18}Bsl}{R^VSyzwq!sx>$?#uHDaR{zk@&j?cyf~__mJ|IJT?_;=4Al z#-Sox88_FdUKWr7hzTbp*N5aUQ zlQ~k7?`T9La~TbXKAlK(D-SMM+2qQs*U)_ABTjW^+A_PfKy@xT|A&_O(`^Li%mHLY z4e6*^+!AncXb@`lLvva-R_sKc`FJO@<=ngkdrkcC&tqEhTgb5v@0$I1hA}Ijkh3S~ zXA0bJ5n0|Go)z(2GrR239F?%GUmsf4UXupNXmqLVmJjg6+Q#_ zF@(K}6p5wP)CI#W!+Ny@D~oyx zu`Q=i z=(fw@%2T<*!zI2bWekvCGQl-^(a*C}Wp=a!ZaUQZyxCfZkbDAWVOJ6g8*W1*#n_cI z;yqFaK`wjy_ZIc{ zzO-*>J_~NFkU>vMot1bykF!S$)oI)RJ>g67dX03=hJ-qBt>Wo#;^9C_g

e=SCwc?rPL~a|7vNOHeja4YI-9CV-!tF8Z(m>TjBNE(sAShJ^crQW&$JG*R6H? zhyVoYYWX!rQc8iMQ~O3G>0*TE>6CPY_MR5d5C)YOK2-d(Y4pl`x<}cH>StzZ5$D25 z4$KZ3=|RNu$+1=pI#yIG;y5Qe>vH>&Q6yr*tUL@m;^z8B#=Pg3_A4)4oCSpJM85Ge z2;6nu7{AR-@ZwJ<@z_aXY3b}~vmR_?c2(5F#>WhS3u}x?@z7@97h%nUl3el3e%Y!j zZn*tz+Tp^(_HY}ap`MF-%C*!U#%e$K_tjWhs0EtssEKE$ilvI1*61;#bY7%{yKeEM ziIpRWE$OUpiJ){3rs6&`@VGs{y7iNG-Cyv_BvK%yYxEoUn$@_N^#<_g(mRF4M zH(eyvV|avp4xpEh^j}Rb7K2`g^{`1+*olX_@rZh*reYsd1-=R2&z^&*_`i83SGJ6z z$)B;DXt zI!)LcfE$>iAK6;HJU+Ldvw3CCP*BQdO67jdk_+`fjswbhLszK@1PN3=gfPd7qaosZ zs`}3eYsYrSRdvOVuz&f?>v1EEaMkW`_oNzjhv5eQ?qqa$$M5qf?ENH-$#b`eGcfp&*?`m&j&hIKF9@4E1$v-AbA)?rYU*%VlP1)ik5Fz ze&|AOR6xRRJWLZI!)CY6&uzfO!u{(b_wImVx*(bMRFpw`9(FB=DVi~h3{_n@Gdq&g zg(XL}V0UZYEms}s#_K4ayCmB%2Z+do zW^y)q=J1CrCKeZTd+w-=yw?dPm+X?dqx_8fPmVc{Op%$xF+Z=)539rPXxmbe_+hla2ccVC0Dbu`qprU&6c=h;_-5A_Nd(*9D3F1-KIk5BiJlaFrh~f}!l1%O1A{hpb;!nF81g5ws#X^r~s`_6%VG1zpZ5)nbe8%!g95Lig z(jNxNr~4f_wrKazlnf5n!SSM?DmOpH#2t0 zJAUMP$3JbV#ev4>L;PGoM_|nTBc!$q;`fB}Iq@F>#~I9zA&Et*@IJj<2%Q1~?O6h~ zVr774@J&XaLj5Qem`7lmqdNK(Ex_Yd*3*}-nskI!Zyfzr^L^{9#%H z;Xi`IM~ZOJx4OtNNGK=4jxq-P&Uu@xxj*8g$69B=#=U5AcQjQG#|2vmgR-sYgqlao zOIMumlham9?i@^0h9l20qOHA*C^3L0rppbIL-5YX^tPmNryw#Rq062{<{Eu1VXZ&cVW}0o_Dk3nCfQ^xRs4S-pcg$n0mNJ-Vb^Bz;WmPX<>>qbTmz! zI*J;rj#kK^jLN;Y9zcfz3Ll%5+@6IzU^+dWcgPj4Uj3TTd%P@EEz%|n-v(CY4F2um z->8$Bd^S*M9z&#gzwV*V5>6041L7Nujag>paTCi={;Yx@Y-(`|vVSO*gzIJqKW zQ@YAq8Mx63rx#GcQPhRAJFKd(j{Qmoi4pqMo7Qgez4*H#MF@pl{ox?_jkT2KBL|R^ za4x40zsc$SoTh+QYhMs!K`P9kiR7@7dMosf`10;aH7}U2X*98&BmC)O!)SyQINjqu zyrN7K!dAj;r0fYXK%fLOf9#yuCp^}E&;J2@Xgw&B#pR%z}wkh0gWKnb0Mp#s;7c@I^AA+yn?t$a^&ZD;)+GQ1D@Ah^!6dX zo^gAegIdZ#V{wUi4ojf0rwAn%BBP+#s?ZY&!J5HC_I_w^F%N^-x0SJ-Up`e@3GU00 z*lBa(;uyjssO&gw#RvF6Gb5S22fgJ_q|Aq<=5{5-HI_Pq@oW-evEbo~+r1v^#%+N3 zl_oZ^&P5tpl{WO_Vl^*$zLSOGEHrQT<-ZR1hPiro!|yUIWMl4AhCfHw2;rOSl6 zX|_RKHX)W8M+H#on3Ft%zT#K8^Gj~dfeg-mLT8zM2R=L3?6!HycIzj32G!}9gY3IQ6#w0i#jB@yFO%shdd4FUKE@bTc-6{{gll_R|wAE|U1fYTO1Z_3cw~hLMImG?W z^91NOe~F%#HDecOW1#fZE`8=7o+@97(|}Vq1}lvjKO1*XpsvI|D2O>mn?b+9#5C_W zj1s>NGxk_|Q!+y>B~vyU zZjVCZnMl8F+Q*RFiky$Ho6jDbx7q3rUMn1nT)#f<%)&KMa@^U(2gLRze)ai9^`VvO z)RT4(=&V%pO<(8+Fm)9iay-bO2WIttr)b;j>h;fQ_t0u{Jn+cr-4-F#WIpl~zD1VU z6ioDoaphT@>huya`iFByd`kjsZ@8|02H2-OWcyJTRS6_;Yx4)CYNty>x`zOThUV8f zV||Fiw#8pAq!F>GD6J!x9=7K`nF1Va!7Jioh(ny~VB*pb=SR^oi z7WJd7Ypw?c+3as)SSodL%R5M!I`6Wn)L)_SaZY%4@O0xoRSa*nTs2<N7*p1D&zv zu#eh_pSpU||05eM6aAEvzx% z)Xn%hqH|c_^yg8*E`}dbKl`IN#%sovc@<5o><3!;qzD~1tF;PnD$wh~3j_6iim2rz zZGaxnvrlS7E?HQeBjmQ1rWq(zHRuP-bY0h@(KnyJz9D}a)NZW!9IdwG#vcObiI&Fv@FcM= z+iQ%N^d_D^4m0=0F_>3!w!FvP7-J@SMc3ivq|24Z})EBz4>GrL=%rI@N zs|4QR7~8a%oEVY>(@Ctq2IzJ`O>qibOxeE6Z^hMwqA~fkU(}GcmOXxbZioong548v zXZV8op6h6Q%l+kNBcOp08-lWi^qo_o&Wzdr;>>(UucPJPd+FFU{C?ad(I%fsw0U^V z$kRdp*WXDH#+J&DeC%yzm-r_~4bC2r>d|Ofh*sj)x^I$L_)Gg#p;)8zE({i{D&a1n zn+$b#(#gL-x4wNaP&-|uATm!UawAhc8&PfPENr_xUz1o;XySfR-k=BPavU+MmgaMT z7pF6LCFXg*!<<2dPTN_UQnhjT{U)ym+RbAr=%L_X7FWgDT`6)k=0AV(^PC0kFr;)8 zx!y?}k10-lBACvG1lc(Z@*(oT6EOLuB*am7Veg?2_nvOk~B`ZA33|m+L~-Tu1sXBE1}VE)GPC($>8eG11IkFBkRPP z|7aYlT5ECoP>RFReJcgP3v_IO3IwvTo=;|()wF6b+&bZCCEHQ8rvlYNcx<(Xsq04ZFPUwMy?E#)T~4ozBH z)qy5JajA%e*BGpJ7if)RJsCnjBniq-Yv^a>G=0VCtm%!)1wo10rxsjkzPHOpocz?& zOW+*=0d^g=>j=yeUo0(v&^op-Yz&yk@^ze^W+T96MR#b7JrhC2_f8h@eu|=}Yrh$v zR~u|)!ajW>fjX7-W2m4}T8_ROk^I=sjnDku*I6yE4$$L#nniWX8|X6!O~(B{8oU?O ze1Q>TKTlFE$_OUyTfUYNy5Xd-{-VP-q%;z8;eYS4>G0QRTil1%V_d{#aVv^?z6hkF zeW|lAmHV@GAE@w9s>G3ZDu(a!mrfT!Fh(Y}dvZ~C>B{I#9C);oi|)g>J)9!tn?DM^ zW2dF`2R>jG_8O#tqj)XkEyAp^#r33m>fHWb+z-jyZA zf0;QhV$+-solZab6AKPXuu&#IYoW`$XC}u3d;g8e%`dd2=ex0bt7lV%6F%Rq>o;GF zI}UjqTl`ji`oQ{@jPi~|(n*enarO9k-=Hc_jQr8{YN|&Dx%+Lhd99h9)FN?ib2b2F zWyW2LHK0Kmj3;zSRC%xA#cXkKhI_^|0bg;X!gJ;GhKV1$8m z;dVJN8q8`J+hS%duDVyN0YMlz1)BN4DF7Io*#Y)tP)E_Ra4~I44GxTb9pm#Y*p|&z zet^Wf&lB1*rQpnsNuzL4k9OH*fuXw5tRe7r`6f0|^$bP3g!Ix2G zXe5#>vn)Zepkm9ww4XrBq4(r<1OYvdNtj8m@f_~jurVhoS6VRV*BG)4N}+h-jt1Pj zNrVuG@N-$o`<_c1gqGr%XHno80P1SEl-wos&*XQs^v zB%RhwmNjg(m-+CXkTGNNd;l~SjC!f^9`iunk>*I0PUpbOZ`_T0mYM!4(44vCT(5rB zO`#`aLs4tWh53YigPZz|RmO`^iCh=Md6dY1W8iN5NAzzLmlSYgxp(Gx_fX^B=|89_ znntR_FCpQ4%P5rRw8JQr{VV?jRvjTNwt%kZdA9I!7*G2yacEtYrcZN6i_8Nd6va|Z zddno^{Xl0#j5-T2uIk$aHQM|kbsMmxsMqS9p09M)8sGY|%Ur*|54!@oE`nnw*gV*~ zL}X8P!T-UhX_su9iuv4Y_G`@7xntK=KFJ~cFXPHbFA8~`#%SFJVjtMLolKf;zQ7FW zjAHtBVUolBvi(TdVP(L_AD!j5|2X>cBPl1vytnra{InJBK}RHq2wtguSr3ZtB{Zg`_X1CJ`h)xU{nvt0FlD8mE7#oK4zHb}Zg+l~pr$qa% z)0~Smd+XJ~V!6o@9V46c<6-VbXiboamzCPTJDSY@v!hi|DZV3XCGN3Eqv8V#8lNX$ z>PmMJYCp?{SkI^4luTtSx?KlLYw>8%PBlYyp3Pq&^c>c@H+fYha1NV0B6sowv^_FC zzhmZf$wwy|pw-$m?-xuth38!14)t}5Xj!_AF3m)d<%eaz1csY4X4DRAlMDfx;z=z;boFO(x~mP+8N5Wtxu^90L`j2u7CSYQSNu7S|{5? z^MfC)L#h}qliA=Z!C-<|_Ae2fm~A!rNjKm7cM;@!kz3M5wLws0PX55}E`dZAMx)I= zMZDb9HgXF*=?Cw`^G->$;$WC|iP<{KwUi>Fes|fF?6MwO5r@i`;nKUVrAHG0Wp!RG zO4Z?tmDKJ4*x9!!PD^}g|HaQv{=?6XVNkov7aSRDGrr@If@X7@U9FRa^#A#;ptLfowiYbP!92V<0bp zelTBPm%Vb}xvOVKfJp2D-O115+BsoSe?wrYrdoSTIndu$#+7OslXU0s36fgKAo*P8 z$$On+qU6qF4}f#~XSg%8e<<`)yFHT{6L=hwRyK3k4Bi<1{aK)$_(BKyVBgn=5?5SL zU!4MNS%76Vu#PIhXx^}dHoG1xAauQ&Jv-N*0Pgr;#=E z*hWY#2z?)=W`h%WXW{Ry|Xn)EOr#t66^Kt8qDuz?O3A`h9{9`+ZFdr#>kceP|W}G zU9{Fj^kLd2CVtjCG;jq2P5W`x%0o{mjfeT zpizlHi&O+ft{*UX!*Ue?exg~-_4D0guH>+74{kCNr41y^r{vJ?mb;SXo=L!e_~{1^ z9OejP?D>fwE@4pdC<;o2i^+5k)}{3Npr6R=87cZDI~hei=t+6WuN8qFdMqj<)8}M^y`aH18!H-6n7->`;?%m_GlD{8uR6Rd*+FPjrh#rh+gw6kS-jq z4&(#9@6curtUhkLWHsETh#Z^Jxs1}Hu^clHa$H+>=WZOuM5vUu9%Oi)P91sWjcXK_ z>~hOhS=Yq1q=KBhg6o{>v=7${r(QDF0G+rYp%k6aZ6DOy^fpaobm! z|E~CsJ|M8O!@ZF-$Go-|A+&g(&ldTUYexaY+UxwB*%2YDn)g>#OU7~2Q-N|QNu7sG zQY%b16#LL2?87Y)xmZ-O(~PWDnGAc7;1S8pRn-Cx7M%RYj0aIMmg>Co`ID(&N-Eh? zh_%4FT0fG@Yfiv?CT?@AfL*gtj99eq%gXL%y7xN}5N3c4Yh@v)uMn}BYl`X`;l03f zAhA{pgH#1J6F}&(-*0{SnIz;e21b>F-O4jGhQQ>AF9!IAZPCvOki;EZXZy>J$O>;d zO}hOydss0sImIado#C&%6>Dcd86)!yW;cIcwT1w#^1pkyWW3>T1*4m*b37Ac@|^M^ zuv#<${8)XfnyHZYWcJ~!fHf>a%jqNorqCd!%TU};Yooc5!a%k~hQG%4x{Tzhry6G4 zgk`9@Zn;+_oRtA{w0NCEwz=De8|o}qJq>)VgDi}bb@(*r^g0+%QTpjDf=88=qRYRM zKJS+I0@l|)LA6PC2jh}J6|@}S@SkNU;r?ondTeN9OK!)OxNui6U-Gfp6|j#wjrEx0 z-0smWd%Yb7vn_t}d5mE@Zj94gA+*{u7xX()aRLrwf)4r+jj$dpf^Ij&mG5c|nJz4JK*+C3ZpNW2LXt{9wKLLhP~?icm6^cLh8gzRljl~? znwTiCNx9&U^6oH>U2TNmxxf98lm*wPJBg9`0(H{6?i5?>OuvGk6aSoivLaeCb|_XZ z|3*JgYrQI2zd+^aZb;T|KkKs`>Bv@-`9630c~Fa~v% zHFbBf!lqH)LbNEUvPeUV&h7)C$!49>yo*@DX^}u*Q=+skC#-l%;R2#9c#%pQn12^g z*>KwrJc1!YRv`9AMr5mC3};FkGE1UH&iHNg=K3;Fhk^U^cHU_FQrN4d_L}8;`8Z=w zg$4&OXO;p7do2}mXbeyNlN688C?_og2VGMqJeS|aie}Pf)Pm&p{IntX4%R-)ym!k> zexpySX0=)`>C~9L)2Z8t0z4?ai&OYm`|wAKHEV4R39kEq&o1|PfHFe^OKj?&+wB`% z4lB$%hs)Uz?mO}t8Q)3tL{U_O+OeV`lYms$bv+&2!s4H4 zcQeO+i&+SKIbg&6kk~B?;Gy;{FB4A3%eBqAarDcrSO;^$&c^NP)CAte7uPe`GveZQ zO~Na~9$u%)ZVw#h8SxgZ?=O(6BDBO`6E--f+x1WMgCI`TQ;CZrpqPE9kIV*t$9CzvWjpkZiMa|u+#woq!!Eqn@71lV5#NrvPZLhQaCAI_CRYFGI#GUk>6BRG@8o^ik zMrpEFZ$R3zzL)V=l1maPm9Q{7^q*u1j2UpKO?uvm@u%Ep)ORqJ_XJiTV)}BmN1?Z< z-}?Jzj&7olT3kkGCDK|JXczvsK&d8=+M~J|6y1QnWGwiIDDgi6lj%Pab*hqY{tLT+ z1MC90eX?SftBrrf^4>V0S>s~t-8WQl`1R94F-I<$DkZ1gf&a@62}yl#Q;g|}VBDyJ z9|YtX(;RAF7Vb%?ks`^_cmr_`%jj@KGZ8aUxG0ENeqvc}K zBmqomVouD2Sx;nai5uDBJd)*i%&55ZVA%J0BGEqjKtlW(h>CCt;57?4dlfXNM3Q)E z)`3K{M^b7tzRK}HB%5NW<-F*xPhy#caW!6`%sOaK*^*b5*t9`w{&wS%g>_)j$l8y- zj~~WQivMQP2Rs7QPyQzDeh1;6wE7XOm|^lRf6u9Hn$lOpqE%sk6mtHmk5vPJaU+;H zCCF8~dMF0)T+hi-&XAa;mFZa&wOlp=Wv#&{-NXrHPvp)T%#zbI3``#xeB%|{{T$l5p$0dO9zGmM0=nIOsGBS(?rw%00mnUY= z`%KE`>qfeGEH%qII-Xeok@kaEH!@8}j9k;`b;cmZPw{97{l||oEZ#=o>do7kZQQiM zm4DW5lQL?fpV-a+Mn`smgSp0=5zA7G?XAX0)amyI!^m?Khy98T0=dJ7mJuyau*Ew8 zTrjpj6*;->IP4FfO3yM6MSu}vlg+106RWD0;8&+u@?BqAyt1cthEa?~ zwJRbh^#sbFm-FoZQT(fiKg|xA4_xN^6pmuCsag|0Iv7q!>Nuj*{(b$}dHvX0Y0z0K zPRD66V#GPyM=^1EM_{1Cx^o;(+`{7ADxdg$yve3j{#5kp+Y~e~8GmknITjuT7O@ud z8KejvtOjHT*Ebmb{BC|2k&Jis?Vc?tKM%~8&%D(k5noq#8`t;|(pxI0x>=&y&x?=W zk;fX4ch{E_cUC}iy>ugr(JfDLXsdKW+e#gECmrlfP)p})mb7XNo>fh}gw1^}vRo^JJDa3>n6KE7THPAVce<32ToPSu5~4kaHsb&HN7w8 z5WWc&?Nbo~=JJD?<>hhdU0LPA()x&virw^b>+Ak6RCyqRHS9Uchk|RWkKbXO1VQ>P z;-s^aNzqfjRD=1FDTa;JwRvK{@~tmVUVTe0fltmh9H3@tZX!xU9MUWov0fCOej>p} z0W5hkw3iR~#VNhEmc>IIZMy&N9{z?HmyhtL^?2j*&wf$#xcA@~qsBDOQ2PFabYY-&C<(OrAEoX%6pea`)h1S$z(IMz;M|RN4iz$I{$*YaF#O@&g)@jJgoElYe;>-?=+tSbjn+ z6Y7CAMw}P#K1?4v%s-ecQcKid&y~ShJ*Ggl%d%514(tzj$z_vSz?Ys7oHED^Ge!Fy z0uLZq`{DkZD8$x)D$$04FZ)U<6R`W-y3J^{EIz;Dh-j+#wjQJnn(^ji(%8g4zHgov zU>Evz7%NN`FLP!$|IVido;>}YsNm<3A&GAY58n8{VU}r-Bwizi>KrYgA4+xoO%+J` z_r`hjzqoOTY!ho+S`#jfA)c3SiYM%kg<*+JqfGleoG3_FY}IPK!It~QOkD}(vKJmX zWgUm+A9*=Y%izV$8fU|qi%KsmS$KbAdDCPwR>zIV?}}AZaFj4x>=jeg^^$Ksxl%Ou zH$mI0y_CV)7Z+O8Ii6&u&*R^;PJ_;6YPN~M8{czWQ#d*g@f;lr=p+=)xf+LP*klfl zO>J6b-R!Riy6R`jPD2YObyc74^+yutwif4z?w4s;`XTRXJyhRtO!#u=)jiAhZ)AuJ`2^c0 z>VG1&%)Q>ePqAzKvIsI->ws$=C4`S9y5a%E`+s4w??GECT8pm`vG)@`GjWy%gOa|c zm~$%)2?#Xa4c$+6Q+kPYm5lZd6XwcGB;m5(C_=?c;L~Un9Kdk-8@rz zx3|TOZQbUV9Mz3o%pYApc^tGgnwKwR(W=?Wn$>q}nActt3DD=KdTFKYPhrM9WEV$Eyi8uOTbkuLiuAVo_R3yrD z=I=-@aV^Tahgw|2ckwT1lq>(UxSsD@yv`mmGV9Q9!q0qE#hR-mxnhED zp#5}F4f=N5Qg0g|JbW_LFzrjFHIO>-BBl;C4r38S)3^{p@K#0y@9J@6*#T>Zx%Vir zO3PJpLAR&)MDuguFR-qD7S4TjoIh2TMEm?$=4T-rh`C}sx6H4&i&ZE4_xyHJ1mF3+ z`DSD;5!Rok~bl*ys`QoVZF1vWenAPZx@Rd(nvvWMv?pTr8*1v^Jx3! zkiZc^{UH-$y~F&B({AtT;oLy7jD0kZP;YN9Co`E;JGHQ$S5sD~fLjFx@oG}%Hv;Eu z90I~Jl_s)f7+EPY%&mm^#7M()*@Lol*B6`6T<~Ey;fix<&-pW*(n~{0XtZ!Dy7lF9 z?AUWepLYXxdc)d8pXHMhn$HeIS%gK(WMF7gwo^DCk_AYX{wsx|w@2%+f$!kGexmZz17gm4%8G!UugzSK z_Ky<=(XeJr4yEUx;q=+3aWpDvf9XHSrCy$Qn)kqt)S|%{_#NcT)mF$E%0=}JL)kv< zmuH&Xl=8u+!wpNKv2nT0jOj^TMGM5dAdKd58-?=t3q(-Cl2P^fLi0yR8BI8-ZIi5qsim3ZQj7#fR5-7|5uy*C=rkIQ0oEcUECPtGu?;i0Un~oQ-Bwp&wk$}b_ zgH0J{APD6Hd7nRIeN=w~$4~bMvEwllWSM@nZ0RPDpjz%UY;tIp&_a=IDL)sbsJIRM zT!1UjD*2%4uwnh;poOCzbRnD^|Bc1l2vn*P0WpYT^Z!l~vTcv>eBk{rNM3abAkvES`TvPl4>;sRPQSIG5FARl4a- zkS1XfX`~BuUxV*huk{>U7rb!@sF!9;34=4}Go>SI{-VRG!DbZKMWHMDpbLmS#8v>M z#S0Mj&`Gefxi#Aa;yCuwIwHzTX*DEGzonPdC{fJ*Iy3Jw|IGo@gjFv`h?EE|z~~Wd zd1!Fem-mADQLQkEAmOIlHT^rcOgD`jk3puRh91uefc8yZ)QD_X#Z=#YvK)Lm!#mW_ zTep2iJt?!{j#p>Z! zZegK)iGi~bErT_45;!66^$9c9p#fvl)FWT!uVTbz zLH0XOCANg;AMQ6jjJ{zR00)@dyF(BGK|m1@knZlTK@pX1q*FoZZWyJzl#W4C zU_iQIKd-L;KKoqzd_3RQ5-*2&-zV<-S2wVpB!OMqLqNro^Mk2^R7Gsa2MkGQ6q|s8 zW0wKhQFcs7Csvb5V&ioRpt(L=Y8wOcR}K$PH-XQVZ>wQf8C$;lX{*9b3O$d^eK&c( zSYGyNkA<-1F6MMTkF7o|vfNLYd~@(l_eV;Li<_KQM!w{;g9pCbyc)rO2BPI`FT(`K zgqJ@qbWr&Etn9Lc2)Z<6(Yp*jG}|ccuwzkA(wqicy}KP~7|w6~>L#|4u{p_T^6*Uu zF7`$B7Jl}vpsThQ*#EuM-H6X^){_6d)bl1}yu9$B1dTlP%lrqax75D=%2^(HN~4;% z@wvFr6+=vur^w`sochgtq2O+~Gy8&=47p)=d`U4gCN!LIDDBaiNLw&405ZR*4i%;(z{n8P{G zo>$%z6K>UqgW^Qt3;qE8S#D5^;9Gc9-><7u>v*N{K6FsWnikI z2S_YQrJhTrR-DFmJt@$4&M0!zrkL?NFRl1P+W}v^jn|a-HM;Kc3o_;@QF{84gCy&s zQiEA4vyb04K*j}O9IT>MLD74o^j)IMumYwYIE05CLJzk<_C-+58H|R2)<(snvaP<5 zGsXYnczJ(JU$BR*JXFhbiC!ger>%IwQ`bpOHxq*$^Ya`2rwM;yRZX3*A$FJN&(EtD ze?1exD@DNlB5rmmNU`QH{*NL7JX+n#-^u)uWvyH2ZCGzXvGM@+uKw#2qp zzo%yWL_Ot)Pu&OX2Qf2ym6b*30oblxIp7YKSzk@&F@xLb`|q1NPq`)}29T;4RgD`C z1YzkOb<8hMt*+*LV=c5?*7x8(-NXo9n%Xt&U|EYz+8tsq%*<(~xPJwgt_lHK%gs@- z<|K=^7g+nuKPTEfF27ioSt|X6hY28kYEw1tSbTI$eMw_%2SOoupS?)yBVGEy@cZd~ z=*YcU&sXMjI|18u;?r7Ia?ka!3>sCUJ+KKk5NkOz<^&qj=V|{A*n?Bz&t$7C|LsV! zAAfh`?C}|}2@4E}AEqRN_t5v4+V&>J0gz5{BeP2Q38@8omH2RF_LB0g1Vr`=LX07j#m9JjH z^fOBfR&>?qz#Mn$x|Je0AU+b0MLci9@d7xE(72w)!npc_1j``o%yBj+>8BiW9amg)!yAk05G0iw^F?MsG>8UP@=+7f(`P zN^ISzHDAyUr7lk0ib~Dt&qYqTT^MOsRV_;CzERb6nc88n$c)9d{T@&eQ290M3-_l7 z%2pCHt?;-myOT-nu?ti{oe2;&pJ%%6J*6s#Rcq0i%87eKcv}5 zT^v?AD`S@EYgc~4DHy@((BCEZa&U85=J0*G<8HU&Kytl()1*YQ1NxEKNun8ly3bkW zw-$E8&PnQIVLy@d#+7uB>Hp{89!quruT&t#J?Xh{WP3o}#&g%9rwaiRYD6rEwfTR$ zaecn(IVOT8FF$ouwp!AU0f@DoV8ZgRIlq1_EV`lI)^*Uo0^MmKODiJL@8owMQ1p(g zzTEZ`?H5}3D7=y~;sXNHaft&1K}tyvTit5b!37|}c%WKp!l{SdR_yeT|0N{8*adr1 zhkDE;=G+4-rd12D1$|(Pu}FpuFc{Hf656dri+(LK)~Dt}65W^9wf(|TN4qm|qRtNl z&|-{IEo^J_P|+NwVyIOGGg2~s?0a^h;ZvT!2JM^=_5)4fyN(n|D0&XGi5&~IVKVL z@8#;H>(a9z%7j(NZi5Tk#%@(-Ny^>%wyi;7FoTuSm*AKr6+uTS)3W5Is?kbGhYXIy zJ-FQ|_CQ6bZ%;tTrAx!{Nj@i`!Ndoq`yZd`mW7``ejO*V1BCqaHYS$wL(- z7IQN_p?&H}XGPQv|8JkJkLqqgN355ys=1^pGsdfy?(um5g07?^vMjROaV+&ZOjI0* zbId^e)~M(U(a|q|4_~)aTqGHc5AC=EwA9s9Vjd;Jzuq%U7Jk%DBX|6_2=0Eeex&YL z*0>Arypr+3xatsO4C=iV2U!^eC?>q|I3Zl0+9kgVR$6}_leu82N+?eCQAjbQboEJh zD+j@6iTq=)Mw&>9>paBI&bR#2$s5_ze%^C`(X=rRGkZY5p*oNV`GX7Hi^z|r@| zM0hrvDC$j{@;)>A`I1FIsq(2Qalf4axfYB`jX?L;Jq_wH!hvYXNZsvz4r=*7W#QHP z7nJ|K?u(;)mA#cvb<7g72^Nrr>c?j#5GEut-J%#?HU!HX+ z2`|MSU_i*dk$a$L*4jdnPzH|{>4G(5{l&@pRJIDFdj#sq(;qKM?xlhq3!NF3`ZDRC z9MK@5LBPNE+>3Xm0smv%*mQ|z>{j#TY=hXz)^h#oc%$%&7AjQGKuRWsy0`(=aK7B! zTU<5sQ%T^MSVUSTa1{~sWlaD4-SMAu_r6#)6>GC_vBhxy(U*in<9L3X_b<)c(+#A{ zf7&0|dE`od7tTOVIm}ufj)!}LFbV%Uk{RZ z>o-|`(K!Wl!Ezh|QQQt*OSAxvAA{>$uKs`iAM)ldFN_RP1yW z#3feA9n@^?H~E3)Uf`1OC1p!VJJCS}?RKA9o&aJ90h@9Xiw`;g6+6@q9#|nTdPzO~ z5?x-kGiKvWW+|P?@`(=L=)+5gs%I*z5z#!y)BY=A%WdZAe5{3~0g3D8`0)x~9eIVo zaw1q>WnGejA<8zM!zaj;pHs|y$NBLdT1-9Av4zf_Nf5{aXZ9?I({~F{x6qDF>_n(W zN@-4)=duuwqgpC=hb_S7lZ+vN`e&~5)$daC>=j1DH=B3zg!~{cg zJ#cdk2gG(m#hx^hAf$jaD1x?`GheO^Pjv4wyt?qX#M8Eh{{{b8ozS1d=F6E^-k3@^ zQk>-b-GM-0+0idaMaq=s@ry@+`qwWmP{E}0QQMRRXgPels6U7jH~`1}yxKbPl9U8u z?N(sf>NQl+6BLFqM#%`|P4L$90!@YHfVmQV$8{tjZt>jtraSk3gv3cFmjilR(=81C z;FZybd%uLdvT5>y{}!R1?{2B(NWxUTK_YlZo9E^EA*NIV_PaF_(s?I?HdZiPt>bC^ zAwP%8i4%9*r~JbX7fF4U1}**VO1h6?BZ_cc%MDLK&RE zl()lHrnrsUUvh@gu(GZT7Fd@CwK%Tz1xcR&RvB$!kjruYVVmFbDM8N)96_v#pJ$fJ ze>SX+o<(8fOuMa*6<5uAbo&7fM=z*NURjZT2aTl_%rm+uQH@=P3ES#jNiMiEA~4M#)S&4pOGWEgwlD$Q*QDYu(}p)dtk4I7^0s zgT@61anoUnEM1Fr;vG$AnPO!brR$KbX)2%n64EJy=HJUAb4b1*%!dVEH7KLqi2ng@ zv)^+`xqY38a5cZvsktO@5Vn#C9WTZdnrll|8rkQZ?~$Q3R*!AA+nyAbp70_f!4p4N z;mkAL0yV1QCOXc3V}TZ}rA)*Kd!dM(PDn}Ha(@tv`09WwF;@37Li6ck?qM>^p(!ho5&%_#MaK`8#Yuv%#vSuSG@Ogg2a@4My* zSt6-zE24Z`HYkHPP2d2LcyQS#&egQOalJz z-k!u6#MdYMz&wCHCEh-hDMp?KkWuJm{enq1v8i2=%j;PX(=mhHV8T3}#0F=p3Ofo+o3cOOJ& zzMm=hK7LQmo5leJ-`@7{Os^w&x?}a2NkRV+{cSy-SoYi;IYG1z+VgEG#Yui)Rni22 zbozi~)eJm=`}v9hE_xI_Zarb2$1{Oy`a!R?09Lu0)@R~4Y~2okXSmHUk6o+&h^^)J zMI*W>#Ex}6$CDKii@hZD@7@XxyINc{Zm~TZOzZLW%jdExGvzF3{FBi#3^fk+9if|T zcreo+x@4I10T5+%NyPY@ZuH37F7}!VW9@;aHnkib^rtJqr-TCG*E|`Y`g$LKxvR}dR`AaN0=^0%e|7Z(jplatHTG@ zf=;GK5&mb{mFk8IpXpH=Z_hnI9CM|q!Ffo`9}ktw0NrD-I>W^|Cgo2!KVo+VVA;Ky z$i<7peh6($7PbnU+w0_Xw3hK&W~I4^ay;aXrfQ->7Z_Q&FTRe-R* z2TsYNYGyN2%(21T7?K!Oq=hzxz$q!$IqT9^oXMk!dD}aPM!cho=o>YYN781?pvl}FI`{J5!n3MvS9OXGJQIj z_N-9|`(kcm@Qu>>`Aa_oF;DV3F!0NJrN()^Y`_b=c9S!yI_?5@IYS8VUAZ~%F#i6D~=hIIRr$HIdE z(nQ(*Wg_$)Zd=n$J~{cnZx$KbM>J$%Y6yMQCX;}^6akE47^})Cg-f2rTHj3XRqNya z(rhH<$ak>vY(Q!C0XI1o|EA|=?aFZUl0;0M!NNgmFPTU&F|@lzFT1`*Mm)=YtOdLA z;*VQMpN2G*C){OCL@i3J=9lgD6}CXY^L)o@k1DP}=4y{>?1Yp8k=l5?LNFTa&Aj;?*A=OCD)cPG-2Xn zM2mIKV*B)CpMj8b4BAMX(j80@qJS{SYz?OkcqhKy6*(qLIKr{z9kD&^=mABbI7o;RxGGh(R1l6g?D@_W3Jxg-6XWN;l^5%vMP ztu3km-ksCpdeFS>(Gl*76(okT*yLb`Wzs~U`rTshg;E$5z!rM~)6owM&zNYtM>fg_ z>;h^$YS~GHVK%R@lR!av{Z7TWY0z+oosU}})H9QZG6!?vlDnNgS9T+$cj~<3_Kxp2 zH%l-{?-qaz#ygAH337cX)*_6;q#x9OnuxiRx#=v9lUZ2Q%fpH_TRJM(e4%fNnd#KpW48*x>3jZK|f-Qe{ z%H!!3HWm3>+``?~09dTFeXlSD{$Zo3BX9?syVGJ_Fx}SKeDr`(H>#@D~ z)1;A8{l;%c0h>dExZ*JMieu@yIia5{tXe4t$Amc+C#MY1iZ5lKra7mYL@N{w5y;R# ziKHH{?IF^;$>m11u%nM98VHJYJ?q=wMp#9M@rp=-zF|O1R(UNeht)f-40{rXGM<3N zl9Ek09>3(4oC)bGnJc1u+w$wUp+qzzVTMKkA1^o1+P+Y10OOgaUq^9=)}?tWy!)=u zm`9Hu`@odM(toRsgn=bUK0F8|!(z#mmQ`Ss@<@x$x}fwIUl9d%sEmgYW9Q*xLs>^x zcOBzMjI3ZWtMYo{5d77 zK~b--PZG)F4^pE9sii2_LxNP3`Z^g+dqxn^OT_HC>pweYR3BY*veD%p>s_I6pgti~ zXJTjNy)+F2I)^@!)TS3iE`*4+E7NX-F_l@MCUg%U*Nl_v7=y?WfTgecqw5B6DU2Af z2w14ig@4M!$_KxFdpkbyYK5|)#q&*yA8y|D`jkM`Q>V1Bl(SNO?8#)nWMG!9Lw5+ycu>VfXHnl)5*?sa18aBvp6G0- zdfp)JD!`z{#|SI1QxY873_qmMF*$-GJsLle{6A4KLu6<*iZcCo(;*_RT8Mukx;6PkuSp(zOH zfu%n*D334DbbehX#7XLvQrF!D#w8dxs;zxO>ddQFYBp8lf*$d9D0UZg8yWiic%j=L zAVT0HffKHB2l>R!EPGo1dI>JNu3{l!@gwa`O0lWhJNQ=+*9lPfahV97c16Y)=Lb6O zRc^^Io9H#oVUPP^#s(SsI$qXONmHXr#wrK622Wzhr zwnZNJxWhHNDt78^d=zrWe28u*bOrEBs+Uq~NoCzVe@ISta%GZ>REm3S^__L3`b7N9;p*eXpi}Q#29bC5Cg7KJ#y;0 z*Wy^O$HNmhyi}$bkB_F+oC~Lb{2%SX=6y^i<~C^d$HWl~%bQTS0oF7P=+r+=gepDP z8$$S;lRHjd*H-4p}hd#WzNkcW&$H8h2!gJ9=Z7Tck1SLG9 z4q|X?`g%xL*a}(7sPj$LGw8Kj7@l&ogTm$Hmf$O(ipX>kV* zuV}@X2-vx@y8?ITMSmMU&_JXSd6U z4h_ZAm)5_F-v7>j3FuA}@t;iaT8Zm4deiN+?yr)`GM-CGbs@)eq$&d;T}P^sH?>)?M>5+h6{R2Guj8wi|^8Q;8%TR#zAUA=xU zQumdeNP`N5V3EvtyGER19kKYhl9sek`PI(4z{d>tqEJNKH}zvZ2o$<}y4w?c_LBzS zlhRHGeJbi~kLe;=iX~z4oE-)aZy3-y5m{`3Te;#bnuT4;2x+G~(FEj87>>(|=iVJ&isX=db< zs@Ebrx+!w|u2z+Zzk9UO_YN>Y>nGarmwWSRs(2B1STz_C#qYs42fA+z2ij~Be*6w* zmz??E@{L{)--^Cdkpe|1Zp6{s?|FzQ;18$QwttSam!EwQV@YG@LoT8$u$h4Cukt z9^y>b6=rTXJvc_YFi$p*SG{^*x^#~irZ@{Iu|`*xT`)vX%e%JoHpT}~&g}5%6Puw- zw`?&gJwQfaEJKBC#{s;i8?UX`;*2vbP;&1G;WTJx{pefVP+)g}AAs%_i4Kn1C1|o7 zq8}#3lxNwHiFYTws}H!U^5<8L+zw}Uc~>1lE{)TqArCYX&<%SWz}dzu6yI>BKYM|hUf!Q=N zKlyRmagoB(tp(z4Q7JY-SVoRGMA8$YrpmTw#P(+g0C)bAzJ5Ac^>$RTq{El`G;X0F z+oM18?Qs}BFwDrQLZkdQqolq*!`4Vqrs+M-#78G$F1bT7=B5;&9{=q%bg(Z2F})B? zZ98i# zNB6$%tM6ZiT}Gao?>fV)?}+Hk*7X9++*DcO*kl2$fl-C!bbmk5_Bx~v)p{`3_x;d( zX^?lFxuNwo6L{yzVX z1ZI+;uL0cP;+`6A-1jO{02|({1%{`vX^Ewx1B9s305~+>QUkM-`5ooXyC7R;<9g8_ z-DTGEbBss9GeO(x{`!(wEgC&4>voIxG1|8>(M_u9|5}A7W;0Fgnk6IcJ&2e?~7L_Q%h-` z`8ENCZmse%*`}mT@SJgxmS6|fDRm<0$xA?i*_}%+N6@gK59It-Q=Kw6|6(A5e*y8s zi4m(04CC<4p1|uU+r0kxY7Vt~XpMFenqu3sE~Z4bhbuQb?4d$j{g0wPHBrAR=>tSv z;6DhjesRH?KY!sbmZ3|JDxxZROnz1QW(q`*Y}71-zx|lJGGC?2q@2S8qh?Oz*N%>l ztV;F;)3nV1HB`0*&*doVyn8TvzVe_C8oin5wf3bCbaYk`A8ykH$%}0;wE)cC{9(Lt z7=Jt!;1$_X9^jc&4W)T+3fCL6Cw}g=cPlYGst1U;4UgDPACMExvURr~n*C_w1nbYR zBWS(QlAN|8^1Sxau%pwM*JZu0H^sTvOyYQtm-j43vUMOvFjMNTzJFwIdUg&ZM+#ba z`lxE6^6E!%DhUAGQY!fYBzEF0{8!*-23rmN7H|ElpArQ>>0y_`}tTozQB0`A(@UnTjD~V3*4^S^&cV zE>Y|qeE4)UN9^ZV$(|U*@u{?y@9m0|&|I4I51Dw!ia`JzOS~8V^1Fl^ygGAE)s&}e zezsZ0w9H-k83ijX9WR3{GTOR97!bkBc5$KolZ=KPB|1k#=ZIIFaZ zf1?U%GlM)w*q4FjC{%K_lyfCu|JBsZT{Qu$dU(As@~X5xmR%+VPcd=ju?!H@IouI{ zafcp^Pd3|-Z`B>R8kfL^!a)5dgktJYnHT`3#XgTxz;Q#u7q5n}l6tAD1j~+E!dB7$ zHUfxa?}zX^FG+C%;kx_HR>6Z(D$DNsxfP~R%m_g)!RdFPBGj*sM|oj;rLSs%4XK*S zZm;|K392yE6&hIi4X!nGTO_@nPM6Qt|NV-!Vj+jOu8WQ?XP>_CpcT=7s=vbJy5%`X znmp_4-C66{F*vH(rP+nY%cs7O?e) zPiHMEbGO}eOWGn`bWpP22~GMS$FysfAnP%5WcOUvOb|x442&%HKfm_hoabaposBZ7e*dDsjoYjw6-mkt+Je=%!)D;guOqV+43`|Zv>Rm zXg-dl^hlIIe(`)GXW(#e@}ra0Z7~z>dpRjk5k$pj5ecL(=Dh>{7tXv+i}F3p_o>@g zaL8ZYK4?dSK4dk@o_FDGY(8y~7SDvuvGh0JChkf02o)yNC}a(!7)u0MJ2NJ@5!;l5 zcnNx5UnT$|zTs;jdYfA`bfV^)o$&<9khkxc;z>DGVvf8iSc^+Hu}S%Wui5s`0Xv*n z6cXVZmcD^L3^YACrl!lys)@b5FZ3S(zJ|6Xpw0!0@~SO>$CT8DgN1`UD& z^kaVK|5>PvC~0N>@0o9?9YRql^rDU=4k72d%84xpA%*hNdA^Cq*70h=&F2{VAhpt~ zDXp#3GlYQcNEZg<5HZo}$SPf$yy>T!nE2=o7!4T^u%7OO`Gvaece8(_OTM{z+9F_c3Li z;JnGEzw%$pzqDvJphZ&)a2)+1VGE(aIC4sF9wgzE5>9S zf?J?Q*{ywLJz&hMVXWSo5mX65U>ZG$6e z_nlawjLSfD-q8L-HhG0Y9w%cB$g-;k0KWck{b_=6fiMYP_76}Y*~blmCDujv_Ju%G z-^)ufi2rl8$X7MejjBh87b{OVs8)UuBw24fVV$RR;`~DpICxJo4%W#EOP6Jn4oj_kGD}j3|MmvL*P!sp+<$um=?VUw;JZss zaSPXB1=j;VHz2MCW--FsKBS&d{NF~H=z~^!Vk37U@7@&2ZzN5gF*S&NPX4dc{7;t>iGo#PxEMQn9uzOTdbCCLO zmyKGIgkV2F>W&if_2REFl#=y{^RhUyGw|36ohQd0U|H3XbdOe3J)>bKa790BtjR(PAt88 zzh+>`;l!7vhErJY^U6ib2wx(U*hOeytDhl04Z@JzcHdGn=g>x80C9DRaYphOmnQv&6{Rgwsx6t#b2LD8}Q^u(T6r`bk|GC_0`Ctv3gC z=Sa%=W&_;Sg#=Nyw`aDV`13N-eRR4}YcfesSe5x-PgWQ+_CyC1CKikTvs$m75(+ru z^{&7vu?`l}V!Ag$e!Cu0=ND(ipfn-1INSpLKH$2Men0kl6en8m@R7jS#lW&JGAt0B z=hD0;dh}MinkaS}6=L;H1oP##_yi*+NYyh_d{|=!S$GNtkXI2IJ8&)7B`I5vfg}4< z%AKlaF)9sI;S`p(H&ppnRf>&H$6+f#MM!Lm;DG{Fy3dY6y}(uEi`V(PUA&{(j$iLm zr+Cm|)!fs44^_bo*464BHJ?HY47-w;nzxNYh&FKBs{m~y;g^G)`bZWxyI48@fSy&4Aey$3k_^ly-48khAO8V3 zRg4P~)Zy_pNS(V20gj+x2zS4$i0jeOLY-Z6w&DpaX!IWFfR|b=G8vq(w6+#DG!?~J z_vV9!PCGDf`-?(X4DBV7QrGmBUWs*5s*Oj9E4FCO_)vR#{;OzQ2`rLZK)E!-ILhKO zZuqV(=&9!i!vnxn+pB7OzPs^7$)`)Dc;asnB3qATC+rs94Anzsz)u(VOW+mvCPPQj zcGSUDgOrQ*eE~ERfr4gEv7;s9R?qNF2Rc#tFUEsJkKv9?pP}Mu8w(qQ=L$-;{;b|22q+IiRC7v`ca<0v~02~gn zwg~{(EnSkm?q8w zehs1u&VP^F9drGm#;%k0dL%Qo2KJsw-yOKB^j*S`bdWH`HoPkg}%FB zEgS8wxQJ|=E7ZTPHsEjgQ#qnR(IzLTC}ANJ!dCWP%OC(}j=>CBe+0~@4fy>RqD^;{f8SGo>i-55cUP8 z&I5}8Y5FpY>1#{1*kcOoPAYb85C+!l|LpEn*B8b$H%7Qfve+Qys%P{?o??%;89!5_?rs&f%DWO@Y@**)RM}1f?xhFb0b}( zPNsfaoB|jg)o2FfDP>2ib$5@0a#)AQOooUu6XW#rXVuk}QGT!uyb77bm&`r7WQ`_G zm=jS&retX*cfx=lqG7g<9Go{?jwrv#;G<)i=&p zz(?>SGe@LX1(ka8CB@cV5;utFqK|D7PN2o~tLG#bHq(T%&FH4p4J-1VMNW#!r)`Emo6{~X9 z6Jgq|?Gk)MN35Y?WidaF0Snxbpqg}^ z^zYqb#^@FCi)k#lA#CW*1Rhf7ONicS8a9p2C9wS_K750#MZDA{8wnxumD>uDqI$M%r{_R4ZnF%!+Y8!qF64^by$NesumTr>spXqai|`1VRn-V%%O6o~Q|<0jQ0s z;HcAkyo$dhMF?2zXmrTe;LL;7zXr}*&{H|eGuF?o{Cu*e_SeDYo1)R(9bhGd++cK- zz?s%)(dqjXBBc7)xWaK#p{>3oWeE|n(H}q&PwGWD50m@pXhLiFDNduT;}dKe7U&J+ z!&ADY4Wf{%23*!1g+cGJL4(Hj<_Btm4RPvz0^C?z+fk2c*srdpGK2%YKMsDdoB*Cj zRpWA!wUhXdLwmcMoQ>Tkj(V0#(3jSRmX|6%ga%A*eW|SkSUd!j+7cI8101m%4(aAp znQhNcx&yNQvmUYN^QA$s&_93nkh-@EjSBa z1`&I^kJrj5pl{0h@0y_hM;CoX9Zer+t>h2m=W}Uyr?tDn%^GyBQ zPdZ)5ajgtsD<=fK>&AM;=nH+{HOR(R7%}ohOIVc<@t-xt$|Jwl1$^YKKp=&dP1nf( zO2YzVJOS!F&w#K%y135)4G=nBO+C*~R6s{^3<{CniVF)?w21=X z@F*;~C6v5mV4ef{Hv8@+yfXU#GS0RZ)cgugeb#l&I+I814lh3|^g?g`UB!&xJL{}D zTP{Lu1=JFpc9{nUi*&P_gN8N=l^HN658`8Z~)T*WUZ@T9kEi6!~P^3DNyo+ z=~@k$@~XPDuf5x}u`NYo{j{m{|boDi@r#AoFZrug{|7|yQqCHwfnMv8i^Spp^ zEh4KEyG6)l@8?=r?vx=eq^fx-gMonD0}F(9uoW<+P62&s<@CrjL~)t@+b0+^kI$C% zA^#q$+t}F8$tux*PxUKLzIYwvG=#iDi$oG@<71YEUz$#S{ET1A(xK0dD|5=Y^%tHh zwuV=ay>bq#1)O)^up+0e8z{%DgbHebj2o=2?%{KQ*%$+=N_H10ey7?b$j{oT%u|Yv z9=mGn01uNOgvJ0bolGyN;9r_Qdu}-gSfb^OH$*((9;*^Q`_rPfu-fwL?;Th9_oVsn zt2?1lczq~5=8CtThmD5|(oaRYTFt;Y4viTR-17fpcqZnVjoZ&Cw^!|SI~_ZfB?c%X za*x4h_Hop27?JC`4EZp*ScU>e4(gS|Hyks_tao|ne>t{Q`v+4!mjrUIZ%yt&I9oZ; z${(DHxO(A~our$sr+p%g6oi&+cn`n^3WR}atPc>Dc3>WJj?)Kzw{*u008_@>X?ef& zrBH(jR^pB?}37a-aYVEMKRWOy*+=OjG*{U25{q? z8Aw}Ne$Noj(pA_WTC`y5J4XiDE_3*-BFLd7uF8%mTP)IgVzp}-|0b!41#zMs5$*I- zR&zC>whI4q@yxcQsmEl3BT!+QLa;|7q>x+t13d4JT*tseHYN6-;m<6Dz3OUzZepON zu?iQOeBoZ`9iRYZuMKJfv)X2qUlR$TVdWsrf?qA-$*_@<_)@G|Z?XTmb^Z013ZIh{ zG@%wYk7Xu`K`sfH=sV8#i~TYC;%+mpn)p?aSJ%671kvY=2Jj+3lsMUE0R(O(_;>nN zv~7uiv;W1kz${Qo@q(uRgTKA8qDwC+=^_afmGsN6g5|zGM)uIZTJ_>T=grpU$K?+V(s$83z|bQfQM^_MAn70)ZT7G zsF!{~&YRSHw#3;O&GmV^DAiWRs$*?`qHgEmkY5H_uR``Y&^{!BO;mbQ*rt7vAAo}i zPsZ$`Bu`cucmb0&DI66`h*|)IADiU9Ha22-(o+9si`>{x?~np|3ifqifVYIjKY0oG zrCyMJ%q&@d@)azTbb8@GaJzMF1`*&iR6AXQw8?CshcyepA?K0=GPpiqjI?T}_dh%N zm>V019RN^Hh8+>uR#Pn-j#N10clZ# zlS#bGUEm2F>z8Q;&I-MPRPg38!de3!SdmE zg4!sKt2TDhEV4e_B2i;zb`SwJ=5X*62A&!2?@@n`CFIviS8{=ZuAV=7dB3{(oZXI8%pbs>1Wz>M?iA0cE3k4FCz_{C z09KEg{Awitz*l68_k2?;SPSJP`wQMHJ#RcG7G)~>)Vau(qiHgD~Wy>|g)TD46C-T`7rW z2Yz24h#!5~h=(ksmN-IV?vy8o11H={XSs^i!4mfxYM&Y=vk_z$Q$ zIM{o4|MSNzK1sfZt~B!2xj&aS2fF@SxTp8ej)L}0M-%ZNzy1VpO(Lh`>5i&t8cB*>|yvqlK=HxJx?4UCnnjQVd0v@*oWXmQ# z7opmPP!r>+LNhi%5{JhTjAcjWKt1ijXXx#C+xohdslx86Q^kEc8$6mBuYTc`@wQ(e z_NBLEH-$l$SagF6zX`>5Jbg{yZKh#>SI*&$7MLN#BsmEjukX1|6(OXf*$Hx^L&uXQ z2>E`eke_>M`xNN7;s^Bxd~NH0e(KGhD)@U40@?+5ql0DwI}YJW0kj5?{%O``TY?z& z#0J~9@+JAC#*c8a?%IBZgfZfZvdfSbL8zZea!jbpf zamxQZ22-^>cz;lI!-)|-Ua`zxrV-_<*U;pt_$B$AuwRQmLNwmF!Ka@OJlK}ZT>o4Y zj+u<#_7Mejf%h;PoaeOZk6#zQQyT)X_q2xp1N#dh1!^t>sS&z;GKYMmjy=N&#d!#} z)*Dq;>u6cc@X}vTI`9VB2>*0(J5jb=72PO#liBifP>Y7e$m4gxtuY;HXw_I&nP|n- z6E8nj@&v>tEB~Krwfg*#3^iuk!+Q5!-*}}_Q?yI7oPHN0 z-_$4ZAY~fernj@z_{7pZb9lc+o-v)`v*dm~0Lni}P?vp&p_H#oYqY8L<=P8H{=DSV zdCexC+K`!ws42YWF=(SZc@OYAQ%i~_2`yt)NeZUTy72gL1E>YulY?q3LFicB={I8Z9Yv9kS!jz4(;Nl=`a#WUE zO6CBe99NGMd_swxNm?P`1MkpPnsz==e(uLKTjY$;L@koL{aoNTlx2)Nw5;||B(~z+)q2FhLhI}lN zVsksn_=F@j47BDYcY2`grcEMX3VTZE--Tj~Z+o`+}`rM02UeyG_BtS3k4QXUOHk-|wE_nyUjMv@3uQtVY-2OvRYL+8a zxfTRgh2HNQD2vuQY9-Zeva36;)wwuy$z%1CZWOLC@NMG|;=kD={q=>)cOHZv zRQq224Q1Sles+pL1b(<{-$F9pCp)(Tyh$>UmwDGKEQq6J2DYwrdG&1??M)(*XRU zl@KseXsVU?NN+VkIEz+T0k{38*kpEfcTRzl_an1N&UVIjK@)gm^tPa|1U@EMM$9c{eXB@xy!6AC@z1F~eocy{NDoEDpk5+2^Gi1BYU*uJa?VemCy`{YFD19siNfjLyzFB+^Ia>{9(|uKg zYNzX@9Fg*38+))|tY-qwSbzjmKO@CWy2o=*QCm;Ka6J&&$-5oMhs<8Dhl#E9K7<4@ z?~NQr?2?Z#_JFwC4?AkRt2Hqo+vWEMQEZZ+PS<-bD@2&YJ#P6C2?FmkaU{~oNlrzH zV%>7>N0n-!zVV4ZlKE1Y#pJPq1V`sP#(9B@-(c>s3?;U4l6<{^w&$m-x$oMbdbXB# zqbZy{%4mdcz=HqA@}wQJjdQ%_j}q@(XR#zlh^+GH!I&^;RI#Oty72GXRQyJ)eQX6^ zq6N*BHi=!^Os%ed4NIfOY{z1yH#h^^{!pI#D?EuvD@7DSNHEJ0laX#8n4k-;bH@fT1QeY|Y> z=|}niRZNZ$Js|;H&3!40;CpRBl2n2zNskw*p^zIbacS(UjRFd4~)neDzxfj@?w3d1iZDEH5YT4}SU4 zIwr!fZETLeYyJ>#&{zsS?~h(MCLRS{VCx>O>GacQF~i|U{YmW8DWhg#9a>+?28HaQ z7EfuhneOWz&u;x`YySR}KW@IKp+t`)q1?~&m&~tBqez*`gmB=^(QMvBP z{cM|79o!D0fib8(Hb3wkt)|yuJ~n+F43=a43y2DbzXntT)P_i?OhvBrpS?K>>$iN$ zMN#?u^5&xxOI{R-(%@2$@K{`=FitP+u;O{5WzGFh`sc~Puhcdw&ZsH(lGr{I^4ggA z9fsjAdbH55AlHoI!a5%|?RIp!%YHz(XVEbS#3o6irSn(Kkv?+#xm}^RFD_}7=AFUJ zEMmg}m&nBW!Q6f*c|-{pHgcmr&VMYO{mL6O4>syOCWtX_O>%iAeFk|VY)rH&j=oqL zgo0PzV0@?~5A0K{>K9zn8Lc z4pJ~HWNYP}3C!;8e0)+An&~UR7P}@=`$*^=n6G3|r0ImGEt$sk7^)j%vV2+joGPd- znR4!Z+T-82%0AsX^K86xQdem<*E!3lzVyIVj@-#|fGZnqRHv>B|8ZmMpm2RW2QhB^UKQBtJk|l*`f{G(n zspq92QU9PtQN$!=5p#mANy#40BQ4yI?)?798>r{kh*(0gY>Y1dwTe5U$|5$Aj`|Mk zbMh8JuFnnf>yXGQ*;Q)x#~J}XlYG(Um%aPG@y1?rD+akwo@*0m{qtjb0;bLuu4S3u zc4V{bULPPYCeIn>g9U7C@hM$aR+e`On@Gviq>QDCQgc&myXdl#cs>OlQoFSO+-&TH zr_y+L+upax@lZ2yJx9>lde?2CS#ahg$W5S z{VJFBdz@UC^9>SK{c?%bXFKR24$78$@|a{kx<_diy!NA5v7%;h?d;GZ4}G1Ny91Sd z0lWM)!nt74h$6()d4S6i;}R(+tGV$}eabuJR0<4w877pg9hq*XWoHU+8U=pN*2Eu$ ztsHwuY`*GTxCV~z^!hf+joK1eX}=CP1IDc|Udj1p{XfuAnfkzU{-FK7_yuH^mnjM9 zT(uRs*RCsWC@r71pG&vmIyLf8AVK&|^{>sHWaqgEBbq5LUUg&hC3e|{9_H)od#Wdw z#PafYH<*rlZu!|!C?0#AYh5;sp6YuWXR$*>G%;^MGgh}hmzfve^>Inl$DJ&9MPA1# zx9Y1%$}*S+?RVjD&^uPDN>rB^NC^-z>p#R4Q{(?SA<*Ybs-i0wAr&NwS&0h>)Uq`_ zbe7a!C>yxoYFq<1t#vM%ne@Dg*$r3uC0HvtbzhkidV^>6&c)+}H=rZul>1Jl)KB*# z`XKCXe@IO8#3c+1b~nh*ZT44#tKSkHM2tn9%fqF{PeY9OA$DV1gKtt zTErPqR`a{Jx+exjVVP2P90JoMBRg^`@HFoI(zY#>gG~Vo&63C_B8oOHuk<(*9^;GYNZysP?0O zenhi;r?r2r3}|UEA96#&YIyF~eV=0A&c}@WphQE0t7n}*Hjfx*<2>gu;AWF)N?n(h zT%HJCqSz4Ll1?t-Go}=C>thFI@Pt_MBmK-gj*E2BxyX*Mj3-29)a;1KbZBu^ZYZU@ zga!44(%m~$H5=$x-wU9Vi$?Ts>TB4k=&-vlEMf@xEe?9&XL>KbCm~!a!|q>T&e=&4 zrAE5A>ikI<;@(}PN`RAM5u8@TPm;fhsCn`R)#)X{qf9rhllXQ8^fTLi7wGma%w>(& zD;wLLE`ZBH)@xI7lVmBL|MO->&%XJwjAkU0w8WI(LY1S=_H}NS6q%04i#eY8&|zJd z<{0JBibq@$jN7t7lKfVOKQt>sDD}?2kp?L%ggNLX4C7zPlSo#vceF_nJ5jnWx4o2= zBm{TAtSS$8E+2!i>dsqJK{ zXVXna=MGdXl#iZ2Fv6pVsHl6X9eTdD$?%LJY_?cl^sl!FlEvfeE~2qF$0pJE>|A3> zUxjVXCVyJM_hvxJ4B|lhnA;&$Xx?RdHdncLRu!5Ng+8!PX-|3i-38O+3ci$0k7(YA z&vEA4;`xg>Tum2AYfWiq#XZB=7NMqv*1uQmCoe?>QitDHYk*^yWQ)oUICQ0DO3uC| z*Uwr`pHzz|p>GC5mE}J=PH^UWr?K{e4Tv@1bh*I)>R`xfl9FZ%Ukt&+YO{}}mVSUR z>Wwsgiq^ef6JsX=V#>dB)_wN?6R2U3w-1z!r-=M=!$e!I`q#T$e!3ONT; z!e{d(yI(WLfc`ie7z-$GvS03x%QxLbd0W_Dr8-bRheHJ{jR5IGq!PZ5k@FRjFVd%n zm`;D~W#?VC^t{B6MBui58v z5a!ba&gdh2)PW^gVgX^lA%R!ycOOjovkI||TzH3orUA~>`+h}MFa^yEFydE=! zqp|L{PM>SwfjDE_JALjG6T~Mj>oKi!lxACULHVkJzLnoKx*7~1+;qdZ*zwOmY~LGP zQf7j}9A7*5%lt?iS&~L*tx^5J71|zmm^F^5Cw8aKdndFxhe2q!DGVbfAtx#!&{h_& zN!-gbbgJHUgVaWuEz>U^8ch*B&<_ z=UYv#+Y5w6)Rqz#Sx+PrH2upUn$Z+4SgSSRU^Nt*r}%fF?mgWvd6A@gFyx+lCi#R6 z3HJGwaPn>x4J-+X3Eh#bMI8(Y+IqQIn2fn>?0Fx&j-^d-CVE{^OUcEEHf|~e{n^*O z$L}mo`u;vkl@{F=b`SL-VM?f4Wf1dbB%g_`R5l&o`f$JE3a)(iuv-+=a5|2y&x|8` zXF%c*PAh8M4t7Jr(q!UA0G3GTo@2)>y>W|Mt8HlPc?ZH`?oQQjwj*}_kQaGj2Wz}e z%FJleHU{dGyY*HBwlfp1y>2Q#>u1A5io146C;L9GnlUQr+{ol|5#lOe7E)+cS}8GC zjdFJ8>1bLEF8D#WX>)JQ{p8{Yeb4)_6JqJJ-bk|a>mE2rAd{1YNss>Pq-JR!b4&RJ z;tQlo@dobv7T?*{PWxreT~EKB&Y@GCE?*gR`y z)xzECO^=l4E5B7qE};CjJw2+n8mBbYtNTS?YRidf(wCt^79ldi3|n)h;;yPe(ram3 z>ZUU1Eq=;Ai!nY8vq^Lp7pVHkhBvV@Zv3EN!_qxWN&lCN4uy>39eZx3#Vxs}EQu_5smWvRH1QU*H$WwW#x;- zTD=k%`yUb-0e3p#x2UVrX3Ys10bW+m=!vkI)Nb`QLeOU6+nD?@gB&W1_qZH@h|j+l)lfbbiIz{L4Gkn$&wtyCP*oD z4HFgetj#&T2k5;L(h$yNUb@20AL&iNcpM_rVW8bt&C;cE+vBFWEyYvFMCUJFEbIR; z#-S#Xsy+QmP3crA*}tZHYFvl3Rp@IcIqw(IV_3v2STzBMhIYzPgqIJVc5>=S){V@_ zt!VxJ9^Wf}IinE==D$Nh%*h@a*w9hz6q+{-Cd=^ZTTR(kbOC;L`+53=|~n%w2@s%n;mE+PEj zdo$5TR4!5reG?3G8EEj{6EC*uM2qm2;k;)v0-GrT;v?Cg>a0X^@Q$wf^|a540HB6c z_&JPst1UNO@M=DxKzA(e9}!@yVo)w$o%rY}{jdU0KuG;4G5>$-}Q+EX#@AikM)-7I5qFk{Cq567w|kdKR8&d zjBk5;f6!SdU{CZI$I3@YmA&6yv9P$*UUB@_PkBzh#B}&EQNP=Tz>e9v#p;Rdb3lA$ z`;yr4`4qzC?IF93*A3Z+QWzg8{H^|PuuBvT4U%^uTz7$jwFPsvjJO*WkxOn~_=#BB!r zJstx4w8nM+lpeZI59R~(NvHTS`v|v&3mHF7d$Bq#Ci7%(dQESIG8^BpZvbJ<4BVL$_Y zQe%AAiq>`6a5?@GMV)U(yWllC@>E2x%3*S3`SX8mkT>I>{`YQOZL<4GA%3~dRjZ$} zW9lSHzWTmD-o=^Ir0jTU*l!_AHBL@Ty#vgFRk#9my-`XroHq@Hid^Fp@ zeh~?0bXw{Ie+N%mXMOn_lX||mLM>dPZKY?|++%Ukbn__Yxf_Q=APhw*zao{u(2G;K z8j6hCi3`z!1`qd)Y<&VlQr@_QkJZ3;mTDeP8ADPAcv+AzA^Ei4+mE?2IIX&1Ua#b& zmlD<-o7yWF7Zy#!2}qZPVPe5_T&ii%VVhKcZkW(i8X(3kSb^5~HW=N!itB;FB_dk) zst=29=Ndahru&RXcaDiaa{!c`m49TS=A;bnt> zrvt-_Bex_4uljk?eDxL1>|*T`^6jS$sfi!!1%0{0WJ^ZaIO^VAQka^8)!mmMizbJTve;bWJprYKXza1p4)(8$=ge{2aFmY z?(30#X}!;NzLQh3dSkA{txordg#ML|prsR7pOr#Q2*ZQDub2B17;{R0bT8Yluqcbd zS_Ty%AFb?}?b!;lQl!v-^Knu9c@=^ibG?0VfJFn#^{WjIZ8i%hy9)~JKJTwpnP;RF zARc%F;w8?Spd;_-sa|G>bo992BT{JKieS8$5Ic38OHDGwHNaw=Cu8t=5by09%D#2x zt5m2o!1j*9q9cyV9L!R`y*9}ATBs$lZsr6)Kgoy1mK@Ri@=&qzPe4oKYS?viDLOXx zoK7eE*In=~DUMc8w>`9A_N2=2Nt-vFT|qp+&e{CWGtu9wNTH38F(G%(*vcyUDv>Wl5bArz*p6nMO=E zhm%gsxxa^rNwkC$SRZrY+zyMxpwpgxgJ^a>35P1PR2Z|1?qSiTndeUa02Z#Csi-Yl zN0aUT-P>K-z)#yXM)0A^3mnjy%n+6*?1htrQ)FrC=buG~Ef37x%L$0WFeEVUbocL; zp8yYX&1g3y88k#aTY;NYM-cYTxrTc|MDcHe?a6T1A_RS*ANc=2DfV4GH0VUQhtmvn9d^|w&(q^Nj z_5-3*cu8C$(MA<;=ryK5r;{w264oL^<5QPQJwO;)sp7kV=BFun6DE|G28=F?_iD)o z9(%I}q(4`JjPCS2w0V^(w~P30FgKLionB)$X()N{dNmyhox~GGX#sA>>c`?`1(Sh*!MVb5t{&< z)x~jpS8gfNPwexDPK8n7LJc^*lJn&+-?n?sX?%O1{39W1LJC)uPtda!n6c+?#wcF2 zqFu4YYhZHqT%c@)+}Ox1tWiB|>8GmJl2h8=Qh5a#_QlptX!oadJIa%vKgu&d3Oes~ z`sr;SQK5Nfb(NR=^>cCvB(e5Cn|X}D`%xdY+SiS-Zb7Hx%LK~3qy1>)loW- z1Zf!o%^V@rHhdX$Vod~4m z>|xK(@2Zd|NhcH+DB1t)PK^NF5dAyR6epjbqRnS}`=&?co7??SF*a#z8GM?q_YwKR z1F|7I62YdEED%f2N$Fc-zh9b{~a0A#EaC)b(rmNDMRvr|+;BG0FNUs7hIZ8jLg?F(b0vT$i)*thSs#-5Z ztec&BMAq|zVjG_QxrMwXj#Bmwe%Y(X>0UZOhVk9Mc4wZ_YlRZ-S7&4D%O<5o><7d> zFJ6n~ph)}tiR_nh4xon|@1S+<8vp*h&h}8Tdt#;EUkK=lqk&C!vtlS31v0@ov5)t2 z<;B>_IET0NuA1_g29+#K?QD(*PMB$nEJuLQzyyxBBggpN_Pgc*R1wmJ6dAXd{3wxm zz1&&Co!)GSdGmIuEbS?g)scbcB7NXUBDJG(N-49a0t4UAmbMa9%xT}JheeZ=>^TH|SGe<6D)@H>jNlw;(xhU0Ga=W{EJ!+@< z;GT6cPa2Z_jWyJMhJ8rNvRscwDsITjvXPliBv|0_;AoTNlkK<_WUfRa-GR znZsE>{QA<>`|cAKtU9+@6M9(6&$BI~E7x65f7kSp4L+M=AXT||*95O)HGCR-k=i>S zmaf6O8BZD$CuonWl&hW>E~{x!WlV}SqSiy`S#KKhYOJCvGfB?^WT_L{a_h4pZppds4v7SbN}aN39x; z1kkq739QU)q25sZS;um&7#!;pC?w$`P`7{omJD(LWSqA5+II`eXcmInKYtoev-Ow! zh57T%zMH7@rlq;6!n5z{Gb2*1YCU<| zKjQ4Qz;Lg}MgxGRm!`P&1(42{A+?r}PWIO9BH+}|MsJ+L*e*nlj7hbBI+zx<^-6ZI z8_GTEp17a3r%&C3>BRwU?cG1={R2fQFx8h$cBjCh`h3X)sP zWag+z9TS>$!Lu40oWBY+(M}c2j~cKMn(1IItnEd4Ve_r#{uNf;5Exmtj>^=T42yug zq}inrdD|t*4Pocr^RJzrb1!0SD9CIkAUyU<*re8`!c-dWUgVg;1o&Q=p@9>vCL90u*%S=aUjk7C@$~1SWFIJ_vbX)K& zeo{eJgiQo#6VrY8?C&CyLUMbDcRxhp_-Y#-Ht=3H4@gC`4Ppu&VrM;z-Bu&K_dU=5 zjxDIm?GdW$(o!Ds-^}V=aP6RPoSG{*T4+frOE}FndtEpUP&r~01x#{UkQ_!pB>S^x zmZ9eg&q7S!^}K@%NK#>*`tubJiGNqdVO{uKA@_6IgE6pT8}Gc;bP2b5|EHu_Xz-`_ zWu6G0l`X(IjAjWhq8hYkL^-%{~cLez0Os%6q zA#sl=)N+#TSL~g@sowqo;ZFjHh%A*JWyN;l@YV8D^d{g|TQJY%OMy0cR5}9V?9*)I z^dQ{+LZ@~lu;#2T&(pDC?>XIAlqEhrhVU>j7JJmcsJC~DA~eP6FAG`dMJCEi&O_Ym z{JX}RMlpM1D!eGuv%KJxojW1n^h_eg4IwnJS`+W=l)&H3N@Og*kRDEP)@{uG>ot*q zOP3|=B^Y(0ZaA%@OnR#{Qf)kRjwI5te0h(`-p{Up;O?MDc80kUYjFv$BCt6?E(ob=hf3BR0S~$BO#j3` zKaZR`>lJ&ox~R)8Ej$;4sVY{T{PAVh3RL7H>;K7w3odikg-8jaF8amIN@hekm_=I* zE4u~wbNl*Cu3c+>(*Mt^st^hx%fzeb(C7Ht72Rwa}Y{Lwggs>-T-u2dqWue;c zcDw>6S1+I@r5(-%YEtMmVsF1?e0t#eB!`!Q5x(}c#!nM#Pm~JVP$x0iY_^hGtm2A8 z*kQ9b*tL&*oS=RqF|jc6-+p%jbSOPta^?8E*5@sc0EJ?gH+TOk#+%Zm_S03Y0m1~5 zcmF?S4FaR2?slt%rE+3*=(o@}?=6~`@^n89@%;F=+c))#?=j8I<^Eq|9bGBet5SNC zp&5yuqh=n8`gr=fs%!np4(m|XNC%VudP21hY-{(*i3MPrucix5o5n=Lh`*odzp#rS z&>iC(Bc%;o=aXai(APNNR;O!WLec}*+9eUBC&Q7oo^R$)dUHan6?sS1k}(3y%+;ME zXpl;F_6&$7CJpGsMK9HoIArB-{T=??F(^(*aM#{p&G3C>ik_dAj}=PEIJ@m8W~F?` zPG#+TX-C5U6zaZeWGZFLX1w6+ehjQ2N_=lF!1ji0IOLSm!2gM`88;MK{6ck&nAP@& z?hPc;WPAt>nP-E7bxyK1burIWF{sdrP$=f4&p zl8GTBtt-t}6E0rj%v5}WRi$GM&F#Nsf(=5GG~H~;rl0p`kJ+%?{5YRX?;e;x8ZPA9 zZQlUPLE%8?ere;@6QgU}!sD~TvdSypM8N4i%JpAsc=(e^e62#0>0$DaVY?7-Z|~Pk z5E^V5QzaHW$eBzZ5cy*CQzTVjKh1}a=l-9#0wbN>1*#Q0X2|R9FCo8P?!HP5)aCLS zF9U*p-y0)}HoWDtoi8#HoBUExDW4>F$Qwjn>YOJIGq&e|LcuFo80Au;3&}NG-f?bCNpPh1=W;uFvUjq_aY_F56iD5i$~i?yjJ5U<3x_q0MM2fOjl(^C*7F(CJ^|a!8^X zE;7O-_MQa)o0uU`$Z>j?iG*R$Vn|Y0BJBoO1>=J5fZ}h?dYG|h_c!w|-#`?n8;d&S zo9>*f_}J^IY zA*n#O&w>{!ffNfJzoGx;I7CAtPd>`^CktZ1!a}#hOv?wkq(00gi?OL!36*66k+X+Q9ds zA7v`1PzX-AvmFH@Sn}0#g%l!N7`pip3c1;R!!-UD*gX7;6s8Wax8CcyL=vIfJVP{W zHbxPxuSK;(6NZVDKs(8CyUwv~OZYipNc39b4rjMs&?OjyWST>M+dFM7Xs7h{@6*V# zdz-HM+ZfTwApK{_RNi~iu(0Cca<-_*a&c9mxp*m5*5du@mntVp`OFk8a&c7SII8c` zD5L|i#$Tv~BmZdjg~V~UE;gHdI$jiHcRU&TDE)>z)2Z-*iVnup#NW0ldOfbI>yQDW&`Rhkh`OgiDV%3qdx6H`; z3uWRV>@b%%&*wh#zK!d7^W?GKSE$pz6l7^oBD1<_e>RTa}IOMvGsvUc_R5uqp zL%!9GI9>)Ad6I-ZFoR09%@zYcHQXJ*D|K++&#L_^6~zYj*6#N~mOndVV(a;4EqJ?p znSnZkl1RzKQDG;W8N1C6=$4E0UI{e_%>qSVy1XTyf50>dT_ z$$Vlos~2~Zge$YM=c~(14G=D*@U)D0`Xv3ytuCZ zre{Jvk!9`O)D}{AKi|8!wB&D=%ktffldZzg<+V8yVGp-BZ#r#98~WNe+ei5MfN?eT z*-!zD*9-XYQWG>gsyUH}_7qt8|Hi|={I%i=spLH;fDvOe4HhRb*+sYlYQs;%U z^<PN=UoA1j?DCB|DX`Gj1s_N)A+D&RA zeB6d<8a*@AKp*-z%P#T9rDnvi6!wL`!Y^EN%_A=9W9KwjTV*`j6Q^Kxg8&1 zU2}Q4909Y4@*JU2+`rl9@Or?-cPELx94q2C>-~8r+G7iV0uzP*JlEGq7a<{cBy{0* zD@Uk!s&tl`y_!>%W}|A^qVLzbyuvY<%g?}6h2f$QOnV%C#oYZpk0yRcw-*h5EXm0iwA5Z?^-kdOMn;d60GCO>U^_hzAs>)sF z!?rsZTc8)im33N63!X{sv0CV}yGsXH;-cFW{czik^Ozk0;mmX!jGVjFN^w=vk#yPR z7!Z_{6RXBq+;94b?q=}>Ke(dhbX@hMN3oF^4ff4_?G!SW5SkKue5%d@&WbI?!d#`> zag4I5+a5q}g>@d1pr}w^*cgkoBH2S&oeb!%#Ln<2cNxF7KWRD<5ghn<0tuVSFfaZ~ z7CeZG9ED_Mpy(TqA;7FXP<#|`h<>_<6u<1vMfTyVY`scR=FG|0lt4ZjLszel2DKPx z3?;}a@!ehiLaW2>wPO|el5X&Nb1;9C9AfJt{WUObF6`3b@_m23rHG-w5m_CjEJItj zxS-WUf1yt;^&s>kf_`tsrZvT9=;c>MiiKN|Em$|RJscx9QuDLqYpF+nM5_$1n0DHG970kOUkWHr46t^ zRiJGhoq(`m&&9Y!((;OhC{Nb_E4VN3_j(Vw-)~JJ^hb*9Es0yK&NZfFD2}Eo=*gSu zC-P5rrv15gS?~Eq|G*karR@Fj(-9>L~NE_ye^F&=*q$N7yDs5qrXnooUz}LkF|hUH(Atw ztK7&Wz%V{n6*NTNTz&llK8Wk?#kuhz_DF+^&)^W7sFB;6MANy{*y8rK?ZFIV*1@R6 zddQ{L(f(X-`CERe{=`gb75`k2vGM#@fNrFkx2JMqC3@DoIMax8jJ{-zX<~I*UFF(6 z!<*TU8ww{+vi>f2drt-X53Jz(yGf2yle|Z92mh1&{$~9eBq@mW1MTp4hAcFrn%-t+ zRcQh`3w_d$soq(Q)6a8U;;S&naYc|znT>bza#{rO7pk%!qan!4_BlTv5&vxN85a-Q z+suuhNWn71_P84DW}@4?HM9^wIKQ(uH((^m)O0-!7DKl=YG}W)IgxjvT4}iW5{0H8 zb?85Tz)X@=q9nJo&p&%X(Db~>_C-TzO>T;*&kKfl97#)#@tvb|g};zOR^x@5^OlWM z7AIzprbhkr?F`~Y^>P$kx|-eOqetdSoC4)*vg8u|IBp~V7&F<$ReW|{UNM@5RgCtW z(H_NOme|FpS068h0(9-{^uIU3{O+KgF&c12hFDh1Gs{$dYjc1-fg87g&OvXg|3sO= zX`9RI;fv}qD-gF^1?b-QbJ_-zBdzm1gXdC1R9t=tCgafl;=vfphcXq`z+!-ZX7q~g zQ8LrYW<#It**BUslRQDnv6LkxqjLsgy{=V!GFMnVb+(0xe7(Ae8w>*MXxb>tPO(M# z1iI7{x5sM#t{ltA!8RpA?F_eMEulFSC7P1~pC41}KH`WQLH3QK}PQ|{Q9Y7t^NF*n1f!vu* zewB-={i?Ba_E5}!TgzvGHJr_=aa5v3v=5{8!qsi8YmH80A%h7(WRdT~0*~_Z? z1#EZeVEJVTupn|qL^J!UeU&Gt65VE>gSlj!y0{}v-C#|bcwajz^*2(}E$#yL3wyfd z@i$q4X4rZpqh9zmoaNd-Z_sW2M0>4mhlmX)$q)Y7v?f_h&d3^ArBenU-)M|bpAfBM z#3{{&zy{L>)yM1g_Y8WSXq`=<(;3p&e~L5{#o^kh8bsd*CH0MTlk`XM>H53uG*j~1zSNGiCDT9oCFKuFiizNPaQQNlC@4dj<;Arfu0F|`Z6~yqyf6RnbKwO zhgU#f61-OK&enDGQWObMk6hku)ZY5{AGjQQ|Y z@84X$>In+XjbGD9r(Xu>dpRNt95TK(L9VwF+Sk=6ChHE^)U=y5u0C?rHGzFtymXfF zO2bJtAHKdwwjbWMvg{G0b@2y6WNr&1eYQXz?+GH>^x848)@?HXNa0DsJI5hPIlJ&+cpn zUlk1QxM(j-1?cKYV`an~0dap;H_Qt{#3 zoo07@p79Cr3U?Ym8n%a26;w$13qceS>xz6YQK400%3X4NYmCD7Z^hMmF5jtes^T+& zxRc&I{d5rma!mNHW%2(0hb;l@*z;Ouf;i=CbL;yoDk9Dr!~};;P#<32SPaanYr5we ziraSjAa=J&k4D?f6g05gW?A(f1*(fIM8_>KYN_<|WhRoFG1of2^UR7OAqkt23Rvi) z2xa?5aCvq188FN)d=5Tkzn5XMvyk|y{VBB|U7OjOqS(p!2cUQwDhXdr>JK$Ba1Zq& z*6}i^=gG#fg)dLLTEEP{-1FrD4pEXcUMXpR{N0e*3PQm+G zILH~YW_+ihoo#E;^(zekXl1|I_9s^^x#<+ybf*IFaS>qJ7A|e-M`3vrk!PO(%UMdg z>y*8eiqCh9zSgBmcA0xif4Myj{emF;0{X2;I>2qK$z_9P(58W@LbaVi&3fB|2!N;P zw3mbUmV$Dbw;Me%nrN&wv46hPgJ56arl*Q1j^a&(h-mF8u@vwng1-dhiqd-4y-Uw+ zp8VKjM31Zle^{OrX4#o=l)Ll>8;}sPfCur zC1!^&<#+Q9or3Z@4d8#QCYqoF{lqn#QtVrOTZJ@Ua%kw3w4$+q=;_<&AOZs|B@ipY zx+3@(7t%D*{PxZZ^^#kKiuoX@A`J+4re-URFHk;uvrdp-X^<+AzvD1IgobSwT(`bo zlONv=U=4m+tbEDBwLMA6os#3<`kk@nE%YbM*W}n%FPjX1gGwG$mT#CI^ny;rFxgu6 zen6qd2)?eK!x!%>qS^#zYBC0IMx!e2gNZ(IoPU^OvIxo;mkClJx8ic}iECEpUBN5& zM(rf_Wnip7n9Tddte8?j=FklJGIZ&=8O8OO!k^3;T!}CT8Eh0MxgjLZc?#%xeu;^& zf4o4cP!m!2*86MuOO0;V+kh&~G4Z_)PMNF#wkDE0gOKrutEKZ8(O@GIFMD)NH^VHQCV6FS+-V-fG(vT)hynx^7h5iu1O2A3J zeUy$EzBIMU)VO5x0%q}0DK9|gY0ByJ>~Oj1IGgyR-GbA4!8t7|GJ=tkMCGYM%LKPt zwhgNJ$x?TPxF@X5oZA%rP}JBLkv*;w6gj zOrQZozkrTuE^88)#&W*yE;S#?furo-npD2Gt}u&L01-^~K}N1tdbKozOLhX@FKp z%$EutpR3;50j;3wiW=ekmW^of+Bo9IECW>WLY`wYk^mFC1&b58y<+vYp6b5US|*;i zjs68Nk$A=zEcna**1PY{a0+39f9Z920jy2!>R&*jw)JTWu75`6eK{7+oCpCF@J}-- z%fPF>4>W7Pg^2`aZ4is{dg%5|kP&HM1QAS-AMQ$8V{9`zYxtQ(hH+9jnL1u9q*GL)VYY2Z1t8L=%N{BKvI zbGYR&vKUnP5R9&lwA>E9oAryTQK)4LAs9u&bK0jAs)qCL;)PDB7_X6DUMpYO;v=j= zAGCy5zF^N6b@NOgeBn>mCn?0+R~yO)vm?BS;L#_R z*VwqOF?_mAf05Pyt$WvJ^69FysCeoyB65gzK_&_~V7Vy#_xjeSb?z^bLEQw;Ja%0j z1zSfedb8*lECs$T&F$FIw`m2JVQ|uTr)O4N^{lx%cbN>UsxUI)mG1axJ^!Pe(R zg{JxL0|L+uN5?!MCup~TG2&++;L`*UPo3Z=;JB^68;kLIHOPDnGPlcQqKFHwfnS8B ztXb%GHDDijQF*&-b!{37bO2*vYoemiZDa|65+=dNBzPzYdupow-Az6L4i_O;6%+ux zD*F5|IB`^(O!Rm0KCu&pn-bp z#!IyLzTlGrU&a3|0D=`58B8MUc&~xfdUCo+iYJTA?7 z?AN7?Sq5a!OqynmA{ZmhU~e};O1CPMoeB-nQ2P4dxgJJ82|ehK+X7qTXP_WWQCX%Z zbM=?R#b&Ba*$)q+? zNi$Vy{G4QxFsSK0nY=V4yG%cra)pfC^Yx?!0<^O(2h#Z5}N=HNip%G%1WmIi+YzI z4Z0?co&xVEo}3W>=uj5ZiWpcQRv+^6sc2Er!J8^dG?oBbE8)j$iqdcxv5Rec+DYOj zQJg_7_4}Vs2a{-gM9QB6)Q<@*w}3!7^5+Ots{ghO4sw<%=BxioC8pENZc+aZ*e}fS zR_Fo+9~80}IKIJ&WLlT}J_0=ZGUeB6&v;x8wVc7Xidn8iu?begTPUWkA^F=un_0Rw zFYX0^!)O3CO?4VLExwS^H~RLXmkzDF%`$}4MHTx5N%YoV2ZV@M+wPfiFp3$5LU-HA zhgyf9&giH@04A~zWL*EwqVpDo89L#oz{yzz`m>53k(oIFk&W24o>!C%0J8Q0PeK!k z+^a&0dj$NZx&(>_>&N35eb*%os5qDI7FwObevjdt?{edN2Hk0aKPC?C?mF`26DGmG z@&j_ya>CP8QRGwr%5T-HB4Ps0Gn0+9d}f6G7nu(?txu)Ur0_0S(oNLAvD}EHu|YnU zdE`X^GpYO7`gHSznDMgcuds}N^O@P;*Rju$5MlV+0mGHv&%7O%SsX~mA^>o9)xEMj z*uIn^RKR2Zd+7BzbKCDuAc7SuZMmNR&7kJ;I|L|&Tmne+MoRC<&&7ZO?AEsbk+pYw#QuOxr#aX7?z zP}`7NDr5t>)4<#K_k%b1lXt)pXqR(b{8k%}1kH-;xb?~B3S_bVNYXUW?i-4q`mxkh zl=d3&l8xu7&=uuuiGpYm8iCgBvj=iCHK18A?Uj@Gx>h+70--+-#9u8bcJf4`nOwFAuVxbEX@0QIz74E}*uE0Ky;ka}RV{UP|}YE3If|2@bUH?D>}T^5R#LUWnL zi(G!1WvNowK3I%zEAm~LYos5OtlS1S0+u5lUr3GPY6}xYV4O!k`p3_Nl7ROao2hk} zM>H$BHSTUI;L7q5$)+#n>R4TowIEr`2<0ku#7oBd*VOyZX%^oZB{UXp{%1|){y%G~ zmjr3Q?Bkn7=NZ-erf&L^x=}CJUU3t|FG_inC zzHzPS`pDZrwrl>Ge9Y7-M?!cE=1P(x?_X&54J0fQ2AE1dC zwSfaM%BEvL(b?LCGrV71US{XQ9XeXWnLV=rj;Tg_Ugz5)Da#=*9YWJy+vk!jPXA-G zeFoWRZx7SaK8z0k^^ikSbJl126LVP&)*$puS99F`FlIv}Ky;D%f2exPsHoqtTUbE4 zRJuWsA*7KUN+hHa0ZBnx7`jW4lJ4%32BmY5ZV9EkyM~Zb-h2MfI?s8}7eBg|%lTdR zzV@{vTSe^Rt;;Y^A6|MHsgCL69_9Y`*Mr)v^^Au}HBna#S!HP2gM76A^JCOY4~1V; z*p&bn*Wd^%W1D-4(ST*IuO4Ngr!rzv{>(3yJDr+btI6>3{bfTts{r}HpXU8a4Jue| zER*6W3KB7P=_v!KG&fu_7t3;TyL@kG0D#5E-NIxo;4gI0D{KTIeUo4u6>1r{Xx4!q z+uFpbs0hc<_(hi6nS>!U00PO{Gwn2kjG<%S-?5`1fAhROx~W%f#M^|Qt^#yHA+U0+ zu$UNlC+djl)(?;kAS{X8t;p(iJ$Mma+iL)$MqmxdKhi}Mr(R_hz}>5$AO>m#YBZf) zm)CObH!YW{deF#toz-AiQA6GKHLxO{l=XNiUvlY+$oi~DuE%z7-20ly6^ISf({sp& zX3Fhze<{BeY!~tU^O?HCU(MEBD!U0J7uLlvs6u9+d|#DVDf_zHHCXv+Hm3eC5Z0LdbOfXz znWA7E%D%tb-fLO@Tj^l>22$z!lSflA#gIlbP zJwQU#y*hkF`gg?6H-2CV7<(d-IAg?LXgXE}x0CkYIIi^+E%WiWyzSG>9q%QdKiPX< z)>TI)j=n8Uee6Kr(%^#Mg^8?Z;8xrJd1hyq)VOk45k8-K+st$1XygexwRw6Zz#}vQ z7ZP+C1sRyV-xe*%5*s)p3qSq*rE}4esbwhPdTZ9wes<$fOxO_K6}3E&5?z5xJ4PXQ z<|pQZrZ82N}yn=$-(o2v3K5G;epWi=*Nk;$m-8Y&<{H?L*!uV@$2{lKpD@!s+W_8LQK@f zIhU9bOvKk6guXc^M!3U(QQQM_k4Lr+)V1b!iax0BHx8jOkFZOXpaq3abzo?vUGe-Q zsnFhM)5v;K&zZrx4E_P?V7$eSklEAN&!|%<%zAtL|2KO_5r>Y$d2ffa-Fn)Qk@vp$ zCm|C2)>N%zVgN}$$q*BreKo>ca$QKa@nyFtduf7|v$-sPcH) zS`@(%=3*6;tDI1bh68-#4V;{L&@fSh$L08ou9@q~cG|#A6J#+(gw||ld6j}x*n!re zb`?|gj5+T^>-T&*L6;T}RVAQa#v^lt&PgI0r;Ekv8fB`Mn9yU(`7FTptHoKS7mk0_ z_1Pbw`sBrjd)D@L@_NRJuAz91n(bjkOQnG(i!F;c5?g_Cf-Ii5-2rvD;xr&|fIsP9 zlf1>`sH?8W-x=5_IA>n0$J|YE5{UXjO#Xp$du0q6%2po8_*Sa;)`_zvy8&=qANlNH zWSzwA?C5U{DgZHUhg+hzDK#43##E|-ec6DoQ3h*W0kyRQ2@uS4ox!jp^~A)REHBOD z7zNeS>{Ab)u&LtM383$#1P=ZdB3t= zA>FsqZEawy-WK_Xa^^GZr>bimq(RK8TMBsj-sy_SVnOwHFS7x~ua1PyE^%yv$M5zh zq0ek={eShn^2hk^#SH6!HC$LSRFlCBovTABJ7*713}YBSP%1d5FXi5?l=1d%RYEiJKo8&hN08l1t42vUQpNWs%_5OHW0D&(yQ~umo-28^>RGw)Y?sn3cM^^?X8c zEA+@31ksXf;cu8kIL0QUMA!j9w))%Er5Mh(i(mstuH}azOqFeXd68AiYsj1N~5i7u) zl0Kq5tSF@T8Z3kX0IVOTbsU0WV7mZahu?u{V@Wo}SJixW9IW3IB`;%}Ch?*R-m_MoRW^u68;V;4U)Z3HT|GLHJ0POONU5rOp3 zXw*a~N-GHn$D`f487r%7RzNbQd&s>XbYHX#ph+79D(hFE0hDXxI*F1+XylsEh**3z zanH@kOgE^SdKyy;lJqF;utAw}<*T7A@R4LvJOnfnO%DkU_)aPv_EmH%x%%2}0drIY zv}T!wv1AzWKvdJ=&Lky|L8hI%nu&b_A*aCk&4ZoD>hZkQY%pn!2?vi2-J8g|!II|< zM#HcjvOgt}#kkS4J2*F&!Kvc+f6W9xz}g^jJB*4z5*R?8+HeE@&tQRTn@M^qu%^wV zK|xG~&OW+N3mL7ZN2ZnL{|rD#!^j1M*G^G?>j?Z8N;yde=2RI|e!yB*wydmDe zg5m*U^}Q&nF2N5bIrOKM;Fiw`ebEE`qM<~y;cPi-hd}I_dol1be~ob0cSmMp`{#i+ zI@v=YVl;=>ufLQ&jSG|_wVLIA1xG=O*BJw@2JN=vmqd#sB~F;$u9PB6P=4#T_YJ80 z>BS;u{I6on4eB(}j=tkH{r*#1EE%%7jxqTuq~;yIN3CrLMEC_VE4P@-XIC+p?qL;F zee4Z0!K#DPtF_m;!$#ui{qg5R0R$rb{QUs^7KwwzWK1f|pl5eqAdjHqjoSMixZs~u zf#kEwkipeG&<^NT=CQZjD#vs%o0ClHMQQpm_%4kF6jHWNo;vrCXq)y}x*et!1&;74 zbA_Vf7Xpy+i#TB3_1to&Cq^2ja(+Ebk_<^D{JS3gL}_Qda8B>Uix8Nu=1IzRLPZA4 z^|<)^wS{^Dluji^f)J|~@nqY$2_=GH*gdwAyR_7XOmTn=Kpo7q75`npG;o`=x_jrf z!NJzR-r7HNhSE;)zJ%%Sp z7tXxhTN`)vZDgD4PFqvf4G{No*GjqJJ698qedhj4E|0STdLf9In2(zGlMu&rND_#l z)hse9MlO}nr6^tgGwiD2+<)8jI;wg-G~vY#I4hdE<9jhXzb${J(}j~Tsk1q2RoAjqx8FgI zD)x=Uq;0sFnu=>`bGrg{UbAMIYI|*m+w?c=9NE@uBySKE;~wYh12uQ1fQKOxhyp z>;akbz^70D&ay*l zzs3EX8Z-=@Lj0z2m8be)ddeiGDt1C(WjyBnOX*kK5$I2(oIuMIq_L`t6TbZ#)bzXp zF2IF*4|4XE8(rlxgJ!QhrUT@YwBT0HEJ=IANq2%-vc281(@;VlCNteF{efGo?OPKE z*Bb3Am#JprgU!_|t{YnCw;#zabg@?Q%=bo}4t?R8KZzaKv!>j;mWtxFw}?&TOF= z2OtrBcvTha=+dF*X(dS;$L>V*kw(sYcLazk9k_YiYKn%aIOnJs?iaVpzh*cL;=5&b z*eD_F#NU-MAboE*xA_{@Xl=g}RAoAjAf_FI#3{S44Ui)67NVIE1?3&y>+SQBx+r#A zbUuI2V+4#w#cQ;F$+AiLnjB3G_BExO|)WY61@5Hvul=YWMq7B883?_f2K^I3ekzTgsd}Fj5v-BMHx{t8! zaZHQ39O*>*>#m8-3Raf<3OmU6lR5!MZV{gr70>mFjrT5eM(7%g#>8*zb0WXmEv=$?8O)CSfj$koistV(J7;yz#j})d zjIcNm%VeuAcD0S$+`P0#5Lvn{%T4S`A9dX6P&HMv{iV>E;|RZ#g->GgKl3`XvG5s- zd|^Eo{gL5Q2_2X*ok8wZ2MgO;YIG?hH$|dy19K7ZicG1Lf*r5I`)1XtOi6i6<0?hv zSAVM_{-t_g=_g2wez5AOB5ak{;&9cqoxOq`pCwJ|ycVy_)JnXl{2g#AC;Hx|BxGfE zHws$^z2)vn8C}Q?_oTJka{fUI-BTK;sIe?DESNqm2&g)KWsYo_=UaG#0oxE^a>;8y zn@2wvc=DcVFKv_|Ydv2;iE!_zUyhE{K^;%CWcr)Z8_8+bmGxO9aVAYewGc)h`~&X? zIm_)1JwPq34Nt3Mo<@ns@)W325?CF(OV0(UO-WtL%GIMtzw5jPZ?GyO{&#i%Tn>j# zDpkE=go|T}lwOQQ_yd@atuN76Rc3R`XR2QG7T+1eG_&UBlUXs9E)uJ}pRr@c2jN%u z$3p8Y!~-<4Us}!9PSSp^F=cu7OdOY#6jTl`gM*K`KTt9n*`Zp5{!*Mqs*hY~QWK4z zw`x6}u>OyYMghwyM^IQm>88b!``FLmeAB^Jj&P=}iH0T5A@2#uc1@Ft7fRgDR_JNg zu=21A3u($w%CBd4fGx6poiB!MzWgZTn$t-lM42h`@+!X2TKhCll|SwJ9ck3Y05hGF zXqXyGc3iw&ccNoXpv=!7SL$AUba}%F{8{NA0EeAqm8z+q}&gJ|nxLNxYX zzGV9e6Y)#ggnwV#)G6{h%JS5tm}|+rK>ER3()V5-0+=g1f9elHUrq$GL1!yFU~8|_ z*8=`5y~;{>kq`T}WIL22PyFu{PnRyKcu%q7)Rz@0DK0g$N|qW!moqaO72%W+)4#ed zhipz(yp4%kN~4B(NMQ630HX`b-*UZ~)ff%^=l!VE7!VGG01){&u+yg(cN^oG)I>1iBZ zqp1*-ftTCcRai&V(yp0;GuB}Yea0v`z#F2J!tD$a7s&s<2ub!Uy?r2%buK;w)QXsU zUzPq}#&L+8CU^Zw*SiQbSaF_PQj^Y>(3a?yxpUhbk*@vG{##mhcHArHakGv7(oJ?g zi4Z(n(ZsXa?Y?)|H0_zmaF3t1TX2sM030A2Tk&!QkM3h-o!?jTxUfh}iFS%!de($J zSMZ#A33u56TwgLt?xGLflc(tl!ryoO`goj;31v++2})*v%qdT-w4&3{%DNr6y{2@w zs%PYHS(35tRGBWfk{GnDKpcZ%@g&&2YItG0jN$fMXU*k}(lRvR!r=A~o5jB8&`x%bnx=cGN7}^;5vS@G#-JfWvn`>7&ScQB+HB_PMb) zjXm?wy1tPTmu$rEs5q?b?7?Ek$cxOz$-aw5E#lJge7SVHJ7jIz2#IzA`WQxoLgm-3 zum??@3aaiv=<=1<;i^y5dd@m_0+)OJ5_)@b8lIp`xUr?H@_Ex!ed&d4E>=X zD#sC_EjAm6po*aR;TNp}OX@ejv2;xRhAdC)m8%4bU##kH7PS$ixWUFu_c*aF=_>Eg z?1i~55|4LheQ=0RU;W|v$0c{dj69iI(xRui8pI5@4@-D@|0(18`g(jZ^Sz_ z_UXqDcq{qNjZNuSv0=yJH-5mm(+@2{*E+Mx^4Q|h&UZ|FtWDYUD6Q*ajWeCA=^v)& zOb&_n77o#tc3VGhHVfml^`1=5#F8+{S(VR7ia-Xhc9?y|^V-c)5W4lUGEqj{UrT?I zH7Aid_0I1gj|>mND%PTevNhnxFfX1#Ikn zsOZ-Mvf*~@V{`8sk=P8YxPNY zJOwMpUZEAVBys!Wa0<^?{90Z^7`Usz8ZfO@nvQg~6h-49+1?YwPJvctks>=e0mIuW zTVZ4Ra=otb;i}=9OUhIs&FRW=i>9@B@69wGgklWK7%ozcEHLlxQ@6mYnEH_#kbF8W zt~0jQbt|Z6B@Iiyax^|`yE=`xjyKqH%~Blg9b(JgXLW(I5~Vxi{qfgSlD0_>{XgBn zdMsF7>t)6=z2Q*zRa8(>w^DrF)9VMM%y$*{y;?t`r?jCJdTpq-%q6`sNhbMj>EL5z zM<)f@P^H8>!kp=i0nJE#e2ajw&Z*gfKac)i(@wnBqRDQ$N!b5{a?=ZTZtJD%zRBJ@ zbA!T2ngjvoVYti9o8JwhBN7SXgjMCA>N-kvLV^(V8D$*EMj#>?D*s|+Z%?gD3(R)3 zt-tFsF~oblRH^c*>A$aZD7;08BWp6}<`c{xF1h8oDCrW{oFYbN>i5#w__RQT#MUNd zz0{Nyzn_ni{co0&a9BGP4`VcA9F0^)2_-6Kq@x9YBS?V3wZ*Zb0i z5LJ8Peg&$dNa3;|!Ea>-dx$*o4mu7n9l0b*bf*s!>5t>mOFWgE`{4$g`B2%zoUy-s zfnrBg7`BueSnpkcA2v+=k@xN@+m#@3KxU^bCeoh`@s332M^X5{MoTu;sPZ@B2#&Pu z(13EkVWS~(%}wvwd0A2^=I{Rded7&Ii9#2OJk%Kswi zf^>dOGxaBA71Ct~w_grM4GDc*z_Dpy&lSk8io?0!GyTOom9a$^t6VSosGU-TB6zkl zoK(Wa!Z`S>*CmniC{0~Dzns0a7l(3Y$}>}d3d@f%+Y;X*&t8&c^8lAbDk_$1*r?B( zdaN#>r6!Tbtr@h=BphEy2G#e}6H@&mV@3NTLxl6snl62dGF{)yS&nf;rK*zOuPRQp z<^@3VV7EQZ)CQ4~(79Ybqh)1Pf)ggrjUdPP=d;Ke< zGU5T^IjYLVK*`zD`pcL*1Escs&Lro9@6IQ%B|{+Q#ZI&(;x23=2s&gKwhy&_HMdP}ZoBou!7FkG9M1C@n@TV8JV z3e;3pY#LEGylWf*cN*r3^Nv!ea2!TMD5NmR>(4BIR;>q;;v6FIsFybOs@yPQ*%u*m zUGlKt>znI^T?Xs7ILTyn{`x6s`bysgNm{w=XZS*J_#;t0)>Ul+=Gi>?_ZUUKHsjf< zBR;rqqhg+pNzZzgvQ=YVYmJA-R)*QU*PKFmk2Ul5CB~UBSwCL_7VA=3)M&Nv4-6rv zFkH}YQZkVx{F%zh_6|fMm@ZX&ybVnb(KbEg#b_v3?h%@un%qhpnBEc!jENL9wHG*F zM9Z?x;w^d-^*GSyTReA!S`zpb7>+Qi ziKcvbLnqsIZZfre!=_wVrIeuB0SU3=PCz+ukiVkbrrbF)C~hWP*^2ii6!?$TW<@)C z7>e2^=`Vu!58-S)#?+k-ENA;496+q`;rLJTXF1ELDP=$<@NYQPf7qB>m$l4|nJzY( z`{_&9gf4b(wDUT|mKwFJ=S?rwx?kwYe*-0_v;&riP_N3nP8F&qRMnrwEN0s_DK54v zeqoJ~@ool2Q0a?tl|%3^z}y2$zShpx%tdgRD~e&$2LUq#!O9CStv+@Fav63Xjfb=8 zb!F6)d?;C;CbF+hhpJrPPHhY6>HyV9q%`Gi`tf3eIK5%w3+oA=TNZuJ=cLQ(&5w>} zo!+Z+^h-~DeWJZ3;XHC6HL*;gDEw$w&u(isTv`N6C)xFb{VfRBGriP(bD0M@+lt`( zX?a<6z!U5&V-i$u#*<_K?&WxFxtcBe2JFf+kh(1c}i*BFw~ zv)w_$EB@2xA6|tEK9(dEb|>u?SwvTChs zX<*xh6rDLtQL=T@o;S?{7i(m7EB{P&>y6uE=JA(KApJMQKsJI@W`L>D{iPR=>!Yf( z`tR|_#5B9FiU}xm9z&$IiF16?3RVhaGZ9QwSL97N-@d(i%z|KD&4}43U4x=@MN8BzsY&e|!>r7G9A~XeDyH{Vg zmZN13ljJu29GSj&^y81pRHcW)JA?{AD5iigmH3WtTedT9L&0CGPR@Jv{Eg=jb1AIc zqM?Fi0rpp)WHta=w$m*?U1GBwRgNYu5HQx^a1zr+LLQuR*JuBD(Nqv@AQag>Io$%J zxeKW7E0UKcPJZ88^&};1_WXZ=ue;us98FVT5`7NlBw&6L^X$QWd8M7I@vr6W0r{=B z^Y#W4h+4tdr<|+zxcCZG-M`JS^5TZiU-V> zI)W_$rdrz1>0W4Z@2`h`L$S9eVVTqy!0@lj{cXhA;2s>vqIQR85-y?+*54+|uzHP) z)DFT4UFphu9-e&p;{W6?-n#Gi#h7C=XZI)5KJ_i)JI*6%&davA8~0H?ZV7DNUY83Y z4vRpgMO6OqFR6vNz#UK#@!y!^-8{7MP2lzbpX^~Bmx$FW{(qnCQ0^$y=CN`Wwb2a+N`M-CJY^|!+-Z(hQa1j2maVfm|U!@(Q)#b-&~62 zD5{Gl71A8Oyx%m}y_A||td+Xl#E$n>(=_iMFBC%5I-Eoim?Gu&9Ur!T5Js5CzA&Ik zh~7Tnk!meY$HV=nS)naezw1QCva+s&XX_A67YLe7#jg&*W!d!Ai%+_z;srseNfOsz z(OVc`{Aru{i80KP0&hn;7s!0}ScbIWRvp}35aS~auW$WpJO13aVs(BNYrE{c)pj>G97Lq0EtitUaA{Sl+Rsk% zJItH05RVB`Y}sH`52(5Y_J`Gq8Wq;#SN?`YlF#A8U1f<@=CtFThR+atL2a)`sk`nf z&^wKE`^vT%vHe2zSUc0DoT~zhSoppW{ae zhEMeiCnt>2so%)ndp12=i0blsyfJ{TiKJN1ngpEBNKs}pg>)Gf5r4t3=UzQpcph7; z{`I<&a7a;YNQ3HG%5i;`LhnmfjU^3JLf(o}qB6xO%aWZw30n6R6uzU)$=7xW0!7L^ ziN`)711h~1u-{g5uc&PC*fCLRpKTVwTChEQTGHJYS`jDpHUB1i^MX0YWT~E-T9(!} zE#c9CCi}D(HS^lF#+@+&Gd~gAg_bIlR9-r>=e?#$T2~rW>K4XF;pH%$BHaEovEOoE z+`twY22^W8*Kl?A}QfwHf4Lq znWy$eVkRK5DL^>FL+xLR+f}g5fcM_#VdFUQV^&WK1WR1>mwfyjJX;_6pls>Pev`vN zRNnXV&6XNif4P|CT;IU+t|=CfIbXS$hy=gkc@O7gyZQ`O&+|Y10|Ot@(JWJaCH0aJ})!PY%|eU);EH$9{v4i7I}Q0{XCKhqDAExiwJg=}3jB{ruF!>vE~5bmh`j?%R1$tWNcHaq;R#6bU7@R75q_;zVut+MS>w`V}2Wy!U-7Snk}fxwcDv+mTi zf6{R6`+!RPQi~!;IoRR+I<@d&6~-ZRlL$oMMjG^_@3&S-?9z^Q*;*Dnj=^k#3vY5c zEc^-%tg4+*z~S=rMEQC$mWZi)#XlWx$pB5~5~lb{66!HfZ6^cC+-!c^>J_GK@I+f! zefVO{JqPopW3W%BIuv^^$l3Lf0?`Xvk}VM5?j7Q?%if=V)^gx&#j}q~B+98ZYw^Q; zs1obQF>+8dx@3zmK5f#%;d-Ajm_Y$&TsXIO}hB0ylhRUVQ5hIgRS8vjGjt z32DG8Ro$HEPZ|ot<$C& z#7Sn!vyNpMi2@7>!*&vY(WU#VWR}vSUtKUwG0KZrJyM&|IDt$Vw;)Wc*4Nm?9;uQ7 zZ9u>jyr}YQx2kE2vJUj|)a{g%_S0@?YeKYSqKcpH)9*8?hE_&4p^iR58s|=J{0SZ% zn|62LCg3v=c6FcbG69TW#+m=zv9Q#Dv=z4EB5fDL-ixr6S`w+%6Y{>^ScS<=(MtHX zHiO<*-5W;;Ohreh$_fqLsRpdi3wbtnugd#OIkfqU)?VvO!Ndt0^jX8Uh3K#(=Bh)> zXRk4quO*=j;Y!_?eoL)`(0=;S{C4vLpdBlpz{D7iwB9g_mX`50aH0F5y+th0_&?OE z!v9jQIoVUWghRiAq}m>RnxSp09gm&pwWaueI3MA?bYn(fEqAQ6^_0$`g$?0P*eHAs zDvjTOmYl?iV6svo4sh<>ScVvC2=WxvqYJL9zOaRmd1^uK`3#s4_0-oxIjbU9bFmu0qgl9ei&K&W zX>N+XE{Yr(ri2oz0{TITVQDD+7P0r?Q@n>l=RsX=-~gZM`-5LnF`RY=X~}f!*y}it zc-gzG+sehh>wTc@J7cjPKvp_N$Q8K#$pD~a+(kVY^t47kuNK>LooXpyFYSAOf1{nx zMPCWC=sgzskJ?==y`>%dT1+EaxD3R>b~jwt-{?M1Z>gB|#;7O{vYGI^dMzjv;9HWc z6ZsK@*n?3t>zGkimgo$(nDo3x#Buw$GuBY}Nr?J~(0caIysGsIK-v9vtPeshMWpCn zR76{dBJ9~|^}jpzvCaP}O7!U+OxJjfdh=1AsJBGS=dku+1N1blu*6KocmR{bD4o00 zr6_SF2~za*>SwkO!ms*uqj_f%e?p`kh`Eb<#~1TDpJax^V}P(CWAtRTPAg~Ut#N-> zML|P$M$U$F+V7$I;fD3XKSyuqo%ixv-UV+1P5((;K@8H=llwn_gpA+Z@Q0pcOO7CB zjj+s?-PXs}zWE#y4(2Q^mAQ_lW7j3!?|YGDB#v7Tc~wzVnE6ICfq~%3Z$v>BT)1^G z^aB)oAfuE-fWv(wL~G5|LFf>R*n^BorG?hEj^5T3Kf8!$gF$7Ap?yaNI!lPAVyrsiyHh0=1u362Zf{C)%jRF3Be>5$m-h{(Q zdTn5jwge{9eCz=oxB@LA0)Y^kzJ zx0|dhi{Nk-^S)3v4nH9|rpC3`&77yGc)E7V6Hm8V1SH8X@pZY|8_yvhiA~vE{-S zy;52j=Qx}>;bau0G=vSBe^B)AcK?6}M-^U`&ijAwy{eZNyN!dvB=^MYUt5LY}%=@A{z_IOp+X3Z>*D(UW1+s4H&iomCavZRlLnPm$!Pe%Q z-)^`Jpg|XOjrKbR_HRIk?QYn)Ymb7|lT5(Y4eu(4N*foATGx`+7qiA~gKhuKwP)>@-U5f6V<>?b8A)lQT zlPDf&hr0t{DG05)UWt2j^tsI(a1(SoE!0YhgZkI0M|Yf(qJG(q#8P0C=rb&_r`?9_ zF*V?hN6!YV3@n%*C(n6o{KrO6to!UwwBCh5yWViFTKRnI=KSgrG8!n+vbtJ7=$ZVP zc+zA{Y(Z=Bk6*oviMWHeUx2)?iIQLzX-Y%A6{B#rLuhs^)PmCp2 zi{uTDV>vEE77<)%uQ-2!X-m+F&?Ka7`hA_D;X^vimlC~(dduCA^ATQwaHRyuEq8L9 zYQH&JCb@~wr#bbHim@^KKa8VqIUakigxDQ*ba6l)e}0t4pF(bC6ll*dmi4j5U0(x# zOg=7Y;5RyqAQwfj>J z1z!}A$HtXoY|B3Bxa7<{^4EADOKQd*W?=6XNq&Ls^-|;7EnX;GLvYS{(LbD;(HfGL z4)YySE>v5ZFfch0_ZqXjxjMv&b~J-7KVs6ClqB+3$VTvH!#aKoV$KBzu{b^~P|`O! z{_OLpPmDibl{mdxqZcWdQ~vl+9zGi`G05VCWCKN?vc`4BgWS9t1_w>hn)>L+o+y3~c z+w@937$NwmduHrAxjv7VA7MT+@mWI)g_Kdv;T%)G#Q3*)%Cue@aS;)8l0=x&ULY~# z65kC1KO$+!)I{X}-3X){IQ z?VeN5u~ezUr#ZlXw5oc;6imly_nB84chYz-{>GJc}g;vOKMv`M+yT4CHo@vU#xP%S(oTEW9EU4KC(RVLp=R-kRq> z3y7}2G!0s?_(_Efo7Be_{Kr5_UPizS_%|_Lg{;IgmL)_(!#8Z#zGTgVJgcYM`Gnmk zsMlRdCO=T@539%iePX!2ufvoz8D_Y}c>-XB8U406_6g3o$3AZM%3t|D?UkTN570`{Cr;kCJ(gVi6}gQTYkR$dnmFhB z%%lh|Z}yg@LM53Ca%Ye{f?;W~j5eo`9@y)>cJ)9kr1m?!WRR>UaKQUvc1|{$NFqfz zo^402oeKA+^r-A2OBsjU6HKgAY71hiG}2A4|B{fqWEy!&V+zgB6gSwEkU zektnTQk-$$MffplBowHZp%LqxuSb841PBM%Z?qbsFE41!u8^)NZa*?1pfeU)eF^<% zv#$Gi1G^n5h8$-L;E8ySA?{rxN_I{6>F!j=_a>}17bz6Uk$Lxf`l0Evyx!Exlz^lZ zHhWP@f%ryGwph$O?n|G)wcr0Si(}yb)|gl+na0RXSDjUbW_NIeV+}+Hg(^jG7mnDo z$P)cl^^c*~6x;%a>Pl^3sLn}deH6}hb`sXXK^2CK`~oPEqaZn6XIPMY81-^3K-n9G znCC-EC__oc0}C{|o?shu1aU`l?IkvUt7#YyYq(rO8SnJ>5-$4m9&eMVjU4PV{xA*U z%>h9-_0SdO>qB6_;7Bjspn2n1{Uyd3*n{ktE!4DHA};gB1pKf(R_yv#lCEi1=P%VB z(wLz{s&Tmx4j8da%yjls~vOJY>j^zB0p-_mZVEv)#FMomW(+TBbI%tEG z;U2+gg_mi+H3h=+9*X-#r(iyq%3f=Wv$N^McIMUIsL&qT(EIPAlIU3oXh{v$7zojq zjzeTJ-%~;8UB8LB2_h7d{Sn)3GcZpiWCL{^lZP(QR0u(^JN_!`6@i=^26q*`Xt?)} znRUtqLtv^(Rq9yfAZzFkIV4~B+!A)cz;7uB!Kf^CeAQA-Ks%Ge@F`?3K$WEsy|GZmK@K}?OoB@@IIlhqHphSrWT&OoD1^Rg`YBU zTE&=w)cBvn4+4A@eIHmG=8|}N@syek8)@jnPZR74*w?Jr-Y#O&!#;xp?gP8N&nb;2 zlftWqVmM=}2B~#a?cpqs*P?l4<*3yXn|cHgWuxdy^?o-ds&qcb8pf*u5`t+C*GznV-w^0X!v^V1qjxDN);hKtJ*C}R%|rE0EFJ^9`9DRU2Q zGmkolxtP=+z7sdo_h_AAF6u8OnQ2A;A6L`=jx=#Ea6OV2|A2iMR_(B!+ z_gVTf|8jAePa~}y=gJD9wAzMgFS_$_J%Q@RJlj6no}SCdT;N}p!RS@?^xG;2Zs z0?D4y&9)o2CS0VJyX>}z=f9cda{ePbz*i8^ua~^Fo2?^_L-#s$u_)r=B*(|kzl|+5 zV4!PB?^*QI%*2(tzH7F91A7txt?+GgV=HdiT8^cf^LVm_#D7eU9?`i=$#4>TwE=Hx zmk?HrucQRY&RcW5-QP@~vg)a2DOk$Nw4WJ%*&ZWQn1%T;h|uR!EFY$)lum^^UabJV zg`i2rjH7&phKg`c;QS?B!-8Wtwlo}pQXdvEU!82;x5`bt+-*NiJO7LpLE~T(@&-{s zmKCvkL|GOGMia66TvHLDPvE02e394(nZL|wcP$a!YKd+bW>hECM!0@Y-e=YOnX@-a zXJ)ig>^y6O9$Kp~4b%3&ma~YpgD&2DlYf#t)r}cOD*U0_XgZw$g3H+f3Fbpk?cY3P zlm^KT7~P#z`IXqy-nk1?tvGv<{G%&O+GWXE1COM9i>K@HJ99TT_Nn7`(=n{D@S z+g9Gd)Oo0&?{;L`_2!|~iJ!(=v+9K7PLTa_-b5z5dJa}#LdJ9R!x2e@>(G~paZVEo z6G&>G&KN05Czm^{%VdMDlY0&=J7F9$Go*~-h#E^|Q9v>((+VP``YrXFf@8R99q?^g z1uwptCFC_noV&Sqk+`;8h*ohfZoQt1~&KK^x0o4)Z3r1!`>f4SLbT2o7V z^|gEVCI>5_s`?=K%f?2Pr`e$(yy7x1`6gkLYHcEmh25_^{uJL<9c#vLu7L1%i`Ul1 z!M|x>OK??qAOsSoNhOlXj+iPlLljbL{&yj2vE3C@&k02$sY?(Cm@6GEWc#Iv19ISY za?iKwnsVG$3>R<8q4MNE<+qN0frzq!c#2G~Bn8kuQO&A9c%EJi0IOE4Sm{o8;F9LX z7gsZyggH*yT=rU`(L!r?zfIorYfxYw@if7ex{v)*c|IYRrm4HW-srIsc2@sDqMZ*Bf?aG zl+n{7Hu{yt-cK*Y{B}=U7<8)gIsJ`Rc8Ff=VnGB{CMu9qb5PsdmsIzAwvjZ6@cZ-G zH<-@Ml?NY&2nED%4I=c%17`g4+41-*oA=m6XUO*+M`^zyvuEoR9#VjwNnxpx| z+E26RyMJ`LC~?(Y+Fz5n5+rmRXcE=s6b3^cr}V$d|(T$ z7LO|vXs&qC?06k@_paf?m(3%yT+wHAf0$uBs5OxShmNPT;l~df^k{wOowDcq7MAN( zWT(QqW9P942t^d{gQE{Fo-LbIP5unGr!NS2q<<2K>v6OFR9X|!49rTpQ*py6omD5n z5n`1c6&!?EnFk`TQ(Bhw&D!+dMw{B-wtv@|Q?TSZWNBaYA)ITs9EPZ1rDQ*|^SJ4C zyNR87A#a%3AHk5Bw!xt~FEGBym>>kiy`rvUZ@98J#a5lBAJi$d6+Axz`KyT+Lg)1B zja1oad8T<>a-M*B^;AhlJ0cSYAczU&!rGU}!NKOPDP2(}Qy@L1r z5Fr{1F6(t~JVE%WpT0@Zhf#Fq6l8a8Az$a!bCE~%&m{C_Oh3ojyCEQ-%DHYA66q7k0ge3p z+u$3+`}e@U#YBgp>HY-0353>Ohr>hG(z)%M$I76r2w?>@szF4gzAAHg|9_*Ukj6^S zO*~G#ZOL<=!psBQVXb&zO%_WNCig_!%8{iWoLQhlh zf5(e*elmc*IFavg(o5^+E_W#_K$MweZLgR*WJQbHNXRY7m*7wTV3jfBRbi!T!_Zn257Ftz9m%{I7+WfO=X75aSA|J zP_(0eQj#6lF-V>sf6dJxkIqkaL&?0&oolK29RzV%_;mjlAOG2cKnm-cb%(kOo#aH( zHlT!%7J&at3HkX_PFT1+F?^K^=w(?sV0T7rZ84?lE&SEq5*z>YnmUW2t%iKzDV_1# zAqFc^nqWJjOf0Du#JiSi$t+G0)u;qSy&lpFuyg5cI6Rkl#tLbc8~2~DEgC`KZ5KpA zdz>g6NM?Tglfa;?l)`b~W?CIZw;_@@+3(@`S}W!rhd~29jXBh(r`Fw)GPuJ$-je!q zzrf!g26xSk91BI7`fTG4+#uB~w=65)B2{W4Bz#M%kGtUU)Pc3P6wQ{cI=2u03JZ{4 z>ZaB9Pr&&#r!ZG4n$08I=z4^d-^(ofCa}N>rj{QOG0&6!gYY3f%KC41=1By8R)2hAO zn>~VK?hZy=$F(0*P|jNs_8xT+N~L2Gc~D z>vOaPMF?{~Z*#o66#MmW5Vx}ZcdA0Njaz+X9PL}0aWI8~h2r-MY`zyDrll10AJ#ZG ztGz<}(mD;>2G>{eur2&)3@!z#`V?oRk5o`a5cT4vq}8+X2{d>b(1!g6j?9Hf8x2~R znh}$Gr*_6WcOSFYfEo=&z0U_6@_~RMtlWf+A4E{42v5S^Z&|fH&;mB^rZk{5UKkB) zdW}oW%;EG4sKNN2M{!Bod9uNjinmfs2ws3fpR2suK&zm%30$?hv6r}sy;2yzRoOLv z1J6RyS3of)LBoC3WPNbvhMRPYxx$tbk3sNN=md^Jp=x3ok4dll*@Ar+{$!-!QgMs~ z2zi=(VsUqMs*ruDH5aa?*m##>Q$3KN^^%=q1$kIz|C%T+R8ZSdp$iONx^NoDeg*~h zmkC;)Y!$`U*HeLXC%vadnFfmLDiW*xM)1Y0fu~u&6ok6mi2GrmI$z0tUG9qir79uT z5j4iB`te!a1TG$9NHmRTJ@=>3F>7dv>Lhzbf~M|iJ~C6RM0SWT+U^`x!^(u2vFmmU zI~1ZPuX7_O=<$XfbvUJjP&iFE^y2v7ZNlsO|C0q!GiuoUe6FT3)nY5tZK-}cbwb{` zTV)D(nPPQY=7fHE<^7P?pifeg6l>uiYpgYSE-5~VV_yf>aw>|&NTQpOg%NVUBmCKR zJvGhC;?M0G!g&WbXu9J`J8VPcngyKYk(N|bGz>b1Yt5ryqeor-z>;YZUIiywR!%qY zC3*ozS`po;`ttPshi$QCwX0uV9vMaIVZ4*D4A8Ergczt(?Dp+6g$mx^oh3`Di>Lrw z_5{|OZg{~D`A9VJwVv)nc2yij;uCd0U)>P#=XQ(A!m^(w2KO?xLDGf`$XsDN=ewa# zWr*LYs8!ERbDgvDDWD>qs)SA{>*PdG&)QxGYknK?V{;V0k#WA-dA<#rKI_k!<`~O# zs&YbV4$;TtY9w;;hk_?1sqol0aL=c9W**jB=oS(Zm4LGFcb{8TVR$ebwEvUxSJy4P z_JuKmU}|JO>Mhy5KVvlJ{HBCuZlqa)Kn(xQ8judR2KBmTB9_Yf^E|FkD}Y+&A~$>d z^1P!>QX=eijB?Lr3x{>bgX46PFNZ$3} zd4KmE?;Ycgd;dFQoO8xGuDzbQ=KRj@{LF~gp6K588DcwV+y#%&;dPqxqG8u}4Dm-5 zCBi#L4kH|X|EMFHj7pL0(S`Q~JI15B6$JPFm_4?g1k;8OHKc5_@gqj+KMrV91|>*5 zwT4Ybzx^3F-__w@YAV-Ayo4#mhtIHNIKRH+UZI;jq96uWIUn#JwAr8xEB;w_sLDsv zoH6xBnxrp8ayhH?QNdT8W6q9AAunS%Ta9FBMyYxrhwf@H!0L2vrCJv5n|Y6Y{5=Y| zBB`xQ0S=Gm`3f4w1nU-zTrQZ)}oVR50ST`W%(LpdI8_f7JkZs^4-)koQ zis7s!TL1G8e&zE&pC1#VqJ2UxGC?*^YD;^xVd3{`{Fd3+XgT|GTE-WE*KXN$B|1#8 z1@c7ytNp5a!@U2oA5kuE6Vs&@4tR@3KLdR8aHp&ic%JW*_gfa)wEZG^au2T?i7ddf zu<{nRc~I}6Fs(EFchGR1`Z^}|BCc^_%Lg}YNxeu!=T zYUXBfo1(0m^l1{Aqj|p-)mmX-v`=mNtoCh%jK{7&0I)f1G$)s8+hu_{G@l=(EIt9V zjT$;OvBdhJZ{zhnEVAr``kLGa=RCriAL7LtThTRqW3?v06J4jnR5Kdrc9R6?IKq^- z_6m2r)MFT1Vot9xqZp9R{YCmLrAAw%wSJ*kTmY0ghBx00L zV?I2OTb642e9G6~%v6yRq4UH2KRY9NWY(_Pkj1X6;&W;2iShBu~>s z(S4%Z6fSvgo>9`Qo-k9}-fIh(kl9r$Hef7@af%ypA{_dBkE;SKF?!op?IN?k*cqnj zW_t)_D+S^-*7t7yu77Uw_=voyHML6rJc9Ib?Oj^{D1dNCR=JU6FBfDUyZsE>-Lnpf zHx(*p}+sE$?U0UUkgyUj{t% ze3V}{rmgi2!0RlJ&z2(cl)X08H}VXwEWu|Qx-x@k=}m@xd?@Vy=Hr4E1vw6buK2>D z4Nc_V#v4u|*8M-c@HV74|*cgQ^pcur&vXoLHv9JRRg@8?NT8i|yPlduwvg4t@1 zami=600b5wmPlVh)229pr2*MN8Rq@*Fqv5Tz^RZ090lfoOrDQ8wj)!;~0?g648CPL{WMp7K-@y*Sy z_KoSHy_0vw-@BNwj>!HIP)}d;Wi85O!mdj3yk5^$CvFISk^(194A>r53ebFj<<>;e zT^)vRJO0Rv$2|f+iIo%AGq!bRuP@i6*lR1Q^d0b}F6{*@M_4o3UAhkue)vBU?dm7j zJN9Qf1-j`8cB?M7D^jZ(yGRSUu2D2;@C85Jcsk3!se9rZ`6k~@8nBQ=M#IH+Ce-MU zR%pGBqNc#G;V2GYk751avmM%-vyaul<2LfMr0)j+og~MJuQ!wG+WS6!YipqD4bCWc z+O|fqSMp-3?ZR0hJ;JADQEY%^?y&3`Rvs|sr#1U{5#tCs{z&~61G;K-6Wkxntj@~G00{QH56*2T@;s+zEv+JP4#4a}Xa<=6Lv-|0Zt zsW+=n>c+DSAb#Hu-<|m6Fz=5^NW>ER#}5QDJA$V_@niD93%U_alvJcGAgQn9YYVdd z4QSq0$++Ma-t{+&$mRPeEn0+=FwBWM3>&!_bF zcFXu>&j*nJVQ6XOqnLRqjlwyoCx3wPsn?29S4WnBkYUMINA=)#0BTM0ROC<*kC$i1 ziQsY42ZxRiMN=oD;nsmq9Z5UJr5wcR0HG$(NESi`*z|4cJJ%Px zyK=qW;aCZC?Q1S}gn!Nzl-UVcJhA zlvR68{9ib?$e()=y`~!Hkh-5*(z{l+!#ruT34!d5?vUx8L@|Qr!o}8UKCTgo`C-vjERV zWZFJ@2EN2ec^5XDbm^u4UT9sEBMV<|aAEVHw_sHp_2L0_O*K^iR)Ybu(9fy`b`t=y zH)fw zy%<H8-`{D>BQFPc`7M3dsl(Nf3n2RLX@oKO+!-0&N0M=OfE#R2yF}V2{p!LK|1H6NvRmDq)<|qfQ2TA*&YxDQg3L+@@RX@gN9*#ckwT0 z4@d5^)#_o@f<`XZ+k0DlRhl8u@nk*E>(jf-Ps1O3KBWk)7$7u)o1&x;^5mEncAZZOCcQD>hMwGWx)oj(fo{U}t)Ez6%Jh#ykyQxCynk!HMzP#n}fxeO*70RH2 zC{o*-T6*KOkMX_UAHaLiOM5jE61>@Tb~*QcHy6%l5vtTO4E0YVF>mrl56Foyjv#=z}!Den2Ywtw6bGd*-=%9 zcvBc!;YlU z=E6#PhhM2)RhZyZN7CHWZwBa$DdN1(#%kTwmd)-hd6C)Sn8KKvfyvq`-SLMj_-Z(! zf95&V?}yoavAVktc7WDe*n_=j33-96q$!+_$Lj_1XL7}_Z z5P1KQ#rR8ryV1V|@B8ZrP~Y{#!c*S`7&Oa4SyHe<0!USQ8UIp{6t2*wk7pTH z#0uoNjJHHuW3nbrb;&wm^l6@T3L)E>UpjM=X9$#5;?7$Zt#UD;Fc>u-1*BM;f@;#j ziuy}1bz=|m$wesxtIS_Nh$?|i7{{P0b01Xy0W%BUuy5H3uQ2Bk8oKbeB zIjR;vU(YZzz)s8pZ>Kexh%k{a!!H2vlxi!m7|BuPbRf$+BXJ}cyC<@SE`(#qFZGWY z-jejC_iA}*67cC~PM$Mau|m5R+}+5N@I;mgo)oe$f^*sxfVkNhu_f28*RXx={ZGhV(h%$%qauHa z^Zx$-VyF`3XV)8_*#im#rI)Cj1LmUIKUqwfR4(kv<=uD+%=d-runc_XMd7kZ06(1m zfhSZBqMBY?Lx@D}4>~y?sxJ*lvNS+7K=eS*pL_o2`Z5Ki+Q+oud9-XJf6HG%TOM7n zltq@#VOU)6eKs{jahUrMKfUXHTGN*3uJss! zM2#*8+3LYFo!rHI*j58#&?tE8t?{UiHuBf&t60cqJQBrFnX&xYR2ZKHsJomn;TPHn z!$`(EhTAwO7yREfBTj&w}CThsWXE4OTAMg)@ulVi#gQw8ijF~C{ezZwZeP!@FOwGHUs{F=&6!?GVL|8FH~iNL2NORi}SpQvF0Wy!jxjaoM>lmQ!0 z#5p})`sNhaGZN~Q9nuKXt$;#NFHZB~lGHMaNIw>Ny&f#ok#ClA*H50ktZ8+1t8eWj zReD%|l=ZO6T-&>SQ4A}p{k?D}f<(7SNLs(C0k^P0T~Q!*|2`N~=m$?iqshIuU|0`9vwK1K@L~@JWMJf+ZYI=Z_!Ap8`@c z0QgT!bY&$$!}y}N`HX)}Xn1_-VZYSx-0O<^W6pP=^mBP0+?J_~RuN`_rA~0J4U`OV zJ+h!DmxCM|nP9!jh=OnRS%lgectU=AObe{cS%a}&v7FEC@4;0sp8{JAaQB5H{rSQ> znG>zaczA3f0K1|v9!Y{{-tw;|AF76JGb4CAXR_NbYCf}`U+e3G5OnefAawQ#A2#Mp zOLj!!*!I)NmDt|N{F_1f@&(vGQ>xZ*d)yinSq7hw1EBN9B6KC7$1fzq^8~3eKN&X$ z;?5vgK|OH4bgu~1{&qi;xZS{ZUT8;(84ixHmOtq@Q{3zOc}R0a{UU2r#`X<=(3Gg& zyvDNc4M|d(0DUK7mTFdp52OzG;(OAB_U6}117m2_z#;Nco6YLuQFLN24^j5#3V$KsD-k+qF0msWZYR=mCH za6*}DhCqd%Y*RofWFoF~;uK>aG0S56e^T6od_513%%dtqPJz;{50R_L*S@{$~ue% zuDm7Lr{Qn8oR8hA%DyEF+&SQP1U5BvD?D-T#pO4-S#i8_lwv!T8T%=L*VM_Pb3qd< zhznOxRv@aELC=kwrt`I?iX0wQx)XY8O)wB*qw^ag{ubKU2T}KcNW_W?a;c7}cE3+I9;MBhMy?=o0`S{Mw}@$Ph)A*oZj?cX zrKGVAJ$!##@2+b)tON2+MOlZln%RXsg|#fqdDAGv zs6EQ{Xpn3L`E8Oz;C}ig$k+40ZR?&;22_2$)oF;Ld{omB&ywPnj#(lxW0Vx)O-U_a z(eR1OZ75Sd@Pyg-5Z|5nFR@5GCF=k=!`cq;h&J0Ym%baC2%~e#c;9A=in0MZ7QLNy zC8;3y%E5QlNQ@CxO}l|8a3F`e*-o*X02BKO{s()(3k|{S1?D(9cf(Yw^1^HalD`*W9pE9NVvBz z75cVH@WXjpEedymEKg8WAwCckC0Ye=jN8MHz3>9P08G^q^uKtJx&PcfGfRG_aX4L2 znD~g?PbVfN9fSBy$xq&~)_89ruyx8)>+L6ijQlsCY^wsB%Q5!zEoMS}E2Pc3!edTk zeqT9wrU!{=_3(dq18Dgig)z;Yxf{m-_$Yb$=dTs@5;FnWanbs;6;X`|(2MXyNIF(vL^) zpeX;GYEi;Dufwq6q4z%a5=YM^#x13bk6{or%qN9;Zf|!zm>tXEschZkC{AnuC1l3H zcp%)*F#WW3AIW_MsgIodaoZ%Ns5_4Rpt=)l4>}pGu|LiPXo3A*-0DH4vNU{A1EwU) zJ)2ZqfW(L0RaHP8w4TYc+{#L-+=48eEex$BT9+fg>S$afKBNtdrR;G7jTpRqs7St)K5dT}mhEdowg0#g$(VA~yO784-+(jmo|O zX*HQp*{vx7>`oZ%_delcAUHtsn}OV#Eo>L~vT1G|=}H);gv>9v(TI~W@B7fkfTIyc z%3_4yBPrA|jV+Q)V*BY%)Unhpsz8Ztm;COzI}4VxAM&0YH6>0AC!281;A6IkM;X$D zPz8!3vcDH>q-tVb;l({A(}uctV@%BnE?B_5-36Waci^-)s~Np{IA-aT0D)G_VnHF|h- z1+r~T#r8YL-fqijQ!w{GueSM}%3KI9W)k23pwDPYc1_lxRWia4N8AK+RP^H>Qbne( zcjz$okrS2X8637syguF>i0jl}^_GyzLqdt(A3XLFeBhz2cI|lxdyhjaIRhNqVoHUp znIb_V%}Qe1%R2^Ox6|6E(D@$JFIGWUly)XiMUJg$b*0OA6`zPwI(&cYjYT;(7Uk!N z8REg9E?>cAY1IRC_8}9Ml|o#~5R$4lRICa+InvKgeszaai;a!m{rMzS((A_XgKyPgATkD{$84Mhm;pQblOxxkl54rm#W_(#|4yrPMhmM zyK=4O7UdRwz{2kIn5x0Z+1%kpW1w(jX^YJe!qol*o*`IE8WN^|kaMc7A%<7B;IWyp zAB&RQ=gauD_fF-ubDQ~93`&_}T4-xYX`?b61)0Rqmv)H^`vz;$M> zGlGsb$NM?`GX^jg5`1D`X*ft-$-bij2266ir0%{<&`5rrE;G*9z$uN~P);ECC_IUf9IIlF!Nt2l}Wmh&>HRPY#`(t=RY9DkT0 zUT}p;zQSWg@A}*sS{kH|7LAiVSm(Aw2Lcaa)sZ zKf-*7#j$#k*wzt(Ypn|?_Ii9k;gAYGtd&jza&I>|+e#LGrR=UDy?%$m7j)^6sC!sQ zwz78Nl#-vC_jO?wJg>13<3hH`-%%0lEuK$c_2SKLqV@=B_igb%i?Yb|yy$8h`gjAj z-RnMx%8iZL>7D9ttKas^I;!(t5O?Y+>WB? z+z_Tm?&57D! zCjh@PEVVf9rN+%9AjmIt^^{cN{rPyfE7Ir&G<&CrfoKOcv;}Kq7W_zIIVY+5ziTMA zUSg&Gck2%+2@2QS-7;jKnl_Wuc%tLeaH!5$^nh&i7s|ZjIn`^@jtY5o4W(@M&*loI zrN-1!!IwW0T(X_$xJs}pw~rnc9JBkQ$OpfqCwKo8NF@9L!@dFCWl=PB=?(o&D|Hc~q)q7_1GO-CRSO`AidXvUUHl)?L()Ez>m;xf&q5&%|Qby`mZpalj`ipi-x6 zU0FvaV(K~tYZ)f3L8I^B!SQo#h%%48MC%^#xJ`)(ClU^G0h){c9}Ih#aswP5utySD zVMrw2fI^_}h$JaJ8d}5^d2L0Bm)U6=6{})e`E18>YP-+3vUob@Jjb_0HEG1TIt<0M z)8v@}X`Pm{qR2hsd&VON54Fn}xq6gC7cQ z4H;PGX3g}2B{Qu^o;-2sR*$XSP=Y8}#5al^LKNS^4d{_(iW~aEZ-gC&P(0WX`r^u_ z^v(`AA#Mk)HSkE7ZRa6KY~$MpiS6p(kzN@l81~&3_tvLkurrF>aD(oJ%$~I=Hncaf zW47%Z?zN>Zb%^ESAEJepKA-JII$Gg9rxh-!_BbuCvCVNOcg*4)#pP7k%%RHZ^NsX2 zkTCP2U-$cbaAH#{oWA#N#$xz;Rj)ZRyj89rlho_t-8fZM%l zAxk#H&dB^1FTS)mq?_00ToU)bQT#nBqS8|NG`S?yOTL<3|25Lb#ZaVd94!p$Eim+( z`>R_J`w2aKS{v4+mJM#&fPFQYKd#sJuV$Y$8`)oDZmmVy?dGG}C&rMz#u16do9P6@ z19~*+YvawLkD4M{zJ0lA{$m3?5W}_l$k}QVAN|;1J6PC z&?e~)zR6iaq4gD{88t!GWw7g|;C&DS$;6uoo+0$yE-p`!K2^!+pbQdN2aU_bn?OAU ztqz08wHyu}k9(RfXCG^gF%jk3k`8`ZcA>|cuQ{o`<`bx%MR(s<(AB7y9g`o{z~ldb z(jiA4ND|vA=P99>K`1g1%**Cc0<*oM{##%1(&fa-gs29=gPfinOsY+5Uvs{ZM=AcJ zm@pOB$f0RE#?2F%k^O1cVi-vRuW9gCoASxU!FxW~h%xl4b0m>6Uys&^U?!Y4ZIa>r z6 zwQ!)V1B(d12bWO217GJ$`u6-}K&TpIBfS@|E(YA1D}ozr2#w02$p_ng{F!nnsy4PZX z7WnueDAhwFzo+(8nU4USaC9*lbfEhFP%I2s$>R57RpRc)MhBysV3(sl#jQ^Xq1L7v z`D@y;$vGE5zjf_(e#A3sJ>-2UHxoY^{=}y8?z!Puwn6W$k(B#dUh}K zF>f$a0(8d~;W|WEG5jQhNO{E_;mGt)pL<>Iw}1D!x#nVtp^SMXBKIK9>!?H(t^>z% z8~VVkoU&ExIt$1!JHpeIEYs936OBorv7kymWcwKApDA4Yx?fEE?%C0dQ@;q}VgKiF zG9{E5wQHab_mQh>YMByCX&u|^G=`nrL@~$9jurg$4EY)TJ)g?_4tiu5FAnE}=&&=7 z1UVMRG-6Y=BQvBKWEnlMt0t-aE}Ngy`vvkvY?ew>aZg<}#j zS4PtngFttOdk+bn3bD$d`uzkA#)~!wT#0NRy1kWbqP57j3~_%HkGc6X%3CUe~%XWwCrJQQZS~!M=~pKA1iRt+H2LN?x<@udvDp zSw4K)bN-3(J5uz=OEQDHtnBmYn^}L@(TnZVavUOR55v8L85_Demr>N~P zRixr$r&FP|@3ws(!;X>lVRp}L!|3z^I9(_>KL}yjD@YpsO60frJPFj3**<0$;cf6? zuL4nuDTqO}35Fc>k=vd0_hOVzI9|~2Lm!kJsQI}ig*CSnK!+zo(!hD?fAbi0s`LWd zk=?m8=gIPDYy;T0-z$O$W%cTRk5GZgwv>(Xicdra$nZ+jUj)x_z;!IUJ_v^_8&!fv zMtgelu4Bt9414xKRp&KD!AZtg2kSi})x=?HXh9z-$-|%4V_lEkVHMWaPd>&iS?_DZ z+jHrk1b*>FK^NVvgk&z)tVp`1h%n#B`SD^# zZ&a8M#-h`Q>ci`;H1T4XG#{vMPZ^cYbosV9r1f~y#keMfk-~q#@INbscJO^P=SRdb zxVLU{Raf;WFB&L@FRfHAfn7li9?8%h_|5vJuCvuQy=}cVEkieU;29`DR;107SgS=% zS9F}~_`O!7N$`jScA{M8iXx(WHFO{XXg4yHB%z=nkQz?0=xUl^4EC3tX=5Jpur}5b zAbvbCN`M+iD26Q(JD)3Hwx{5c=W|$W>1mbcYco@lK`F;UA6hQ%cpMjN7xiwaG!`Wc z0W1CnpO&*%8wOi#15xr>qtk^h;L|`08t(yJ%7P(CQ2>rTg&xp8dvnQM{|)aU3N}|| z8g|4Qvhygk0}Ih8h`q29Z2XIkWJ!daUJ0;AvKlXTK$FnU?8_UpQ&D_GT=nhiBPsWU z=kmEXOOpKuzI8zqdv^COVnaUD=EDLXj@JT9W_RH_4ZmS{Fun07rD3`1*%Yg$Wd!@6 zB(2kbiZcE=Ffe~vTI&iwi_Q*pM#CHbYLpxlk_9ini)LJzbH<Q0+hS!gBc8z zm!L!LQI(h$kHFGa0BnG`RZo)rhhP=% z8!Ue|1ZdHNDKZW}gddDPHfBSgibnb7kPZ^KSi8aFp`%z7Ef8cXpMp+uJvg6v5$%RQ zNR{YRT$zKwl18|IO#}9@>i4w-x2cSvRA%W5yVigoH>uzZG?IkZY`&d;K+<}@T{dfF zJy<`dbq5g_D$_3k3^6_6n%C^H8)I^J<@%R|EVf^_M+jFORXEa7qJK7dic~S_mi;XT@Lyh`3}~j@2jfVo{#5taz0x>w4j$u$Zpgux9XJZQ}&X&sj0q%wz9> z3t=*`z?ccwS&(rx7+x-Z)&~yl|Lw9FYFmog&ItR_N9&zH)(2x);=n{GS^%tq>Xa!( z3#biQ7|%BEPx_EiJ^X#?cnhnH%+%8XN+Fu8g5U0o%6v@!3`7|xPyVo>gMYUZ?DjE7ibV-<`tNo&a8}cb(v|{8 zU=6NUQ;xV((0y1%v3`SvYme#q(H{m`XHBIh1fytBfQ*Q2#C*~Y{pKBAuP${dsrtF` zJ}9v9|3b^c>3q5^FhJJjd$J;}<*1@jzkQKax}4mCH049SDZR(7c+ygYw6N@Ku(Q*Kf7AbM=`OFkWITfYH5tbK_|c@W>`pWcyn?@3^;g2NH(CbJsNaT>LPA-Rn{A{U|?)~BC*`TTH|0W#E0E;gTlA%hu^E(o=PDRF`xOz z-oi#WCHz_gXb|-)(x10j5hps=>&cFEgwQ2cZxKbwT48VSUOq(ZDo?^>(9*iE%DobO5&%a71H15;_uG3@yqc3S44!(6Ac=pf#^)1bQ!R?`bo?NZ)fP|#g?)nF53 zJbNsz$Q80IqxF|Wivg{5-4QSor?5`E7#kq@7ukgWPHE6(Q?{DZYx+K-wd& z9KD$SOCh%Okj0#JwBHxx{?7|M9$n2VtD7tSdzSMjX-Z#q z`InzFY26id)fo@UwVNak_2vh}z(n`(6#^X9> zCpiY!#QOl@BJs@}GPJC8=ZoQ2F`$@a=8bz&v08>Ip;)O5MS3ph1+=N*m9l`8(XaTx zroS*VYlk0i;JW)Y`iBUM;*WUHXd3xe3xVheFx4he6G&JbEO+7&`qD5h`^l_))%CKL z$+*4mYz!{5fVw_HOqz|i9%85ptMCRZ^Hx*d?>M|+6_c5$R3xSpm^1$d#FasjK*F~+ z;@#Ml$G){-F>%qGCuA&~8QI{)*xr#bA9`xgo=f?%mw6jmV9!8XOrrrfSn}oB&?#Dc zGp`MhDsYVon1>~xQo(FQlG6YQFB1gcC6H2^je+%LIhB$Kl71cd^8nafx^vnc&Z3rk zfee}J+>7vOu$53kn?D{}gIoyBN6jenlzz)>iTK3?-<61;x2xR`BmUMciLj?N6$#?y`1Vu1!FclzzKneaC!^2kln=))E5b3crR;A*i#;Jq?$p5NT z|M&dw|5>3rQQ2ePpmuahq-gRSV1fu-`y13B50oBDN1O;%-DNJoMrn{atp{S5`!>ea z*tpH)kqdCJ%T!y^G;p4aJKa$VB|zSL5I7I4o(;cz3s@UC-4~f$fVdF1m5kRn^Vm(M z4r$&I8TC%#KpFkM$ELUEp>jQ8pqkRu9>`%bKfS4-K*BQ&Cqf_82k#?VA=cIQpdMM9 zNUNVaO5mF=|202g1~0qszA9k7+U%5%KgUeaU?zyR$V5tDcMptHi|-x4CfY zSKZv7YZ=Nh6NvxM9J9`N9(37g-yXI$!U@ia_4Qgwx}3J!Cy-koeepjolr>_dK&ng@ zv`HvQ#a`Fw+L=ySAve@j`lQfgV&7F{R|D-8?FCZxZu%8Ym!tWzYw|DTR1gC*2neYKgD_z*-?AlhT(V!-@ z&B+0~tG=ndfL7dk;a%{O*%Dl5vG|!6F!+fsQT`SwCs9_7WL097V}0gu5HWHrq0`#D zPuYqq&1t&Vh{0h_3;ILEPaBw9*S^}}Ts6~P8-hutG!>OoD*S4wpK!_%Q=)@yc?UEj z+1oU-z!R0AOQMxme85?(lu+)Nc9%+8kjQ=-L&=f?B>DEYCF?4Xzx9(^Hd)(U{=%Qr z+9x`vBhOhOtvjmuE3Xf&=UN+v5H=`=Pd~PcQ#AE&L<9>>IV`okqS_4p$kvq6?^J7* zQ~+jkfc1i`f*g-pBM8@KeXV|<(C@wnH_aWGTN_eE`sU||-FJ_MW z`u_3cJVyRC=mZGb(RaX?KcHbO*Mx{tE^g#zN1RkH zg*#DV=YDjXW0DZW=e2_!g}NHi!v;#NYF}NRkN=Kq-|+z0JIdM_XuN5VDu~omM`^vG zX1^nf0k^%43CR}ek&{senBYyaAbcacdY(agTP0(-vjgH8%OE;+gKzQjbJHIv6cHMa zL{vZs+(Lisej#W^Yfe%4Ae%MFIJnZQHcmuFqk&WOfuMKl#8#j;&cb&0c%6G26LW!eh`H+n&~bd(Yc9LUC-J}hvir*MT)7?TR!-eZvBjz2SgfIju{HpQj* zKU3T=vWo@-L;SYz%_Z_o+leR8(8ODmxVQ4-_j!oG9_243ZwhL5s?lm}B>YQIw|W*4 zjmp?K=rkrD@o9IY3M!wzU0!~;l}+H{OhqpZ|2$|ndFKR_1~qT5e?w@h9)WS)ox9sc zAaWfWh_%~+!t>*T33}>)*C`kR3bs=Lk+$8g#q0K#GYJ2*0JpsRzgxai^nDEV-z~4v z`dgfH1u7&_dv@$j$1R&UQE%`ApfNcj8hrb(U&aZ$H>t=;-+|Ev;!#@y^HZF7r#aP% z^emNmoNgPownqKF~~&q2g=thYunwSH7pXof{3$iy!u=Be52cR0N%p0ou=j0{VIE(N`

yZAs6O&NGkY@8Oc^2M}>FJnWu|= zwEZ@GDb9favwLB&H3n)QNPtV&ex#5^WzGy;i3Cu?ipXUAMso2|`f9xNjcQwm6W{r* zQXFE#?)A}9+4HMQ-gi@8Kv`puewy57l^@|q*XL^%O1LlnS5Ko}-gNLSc+H(4O~ixW zW2^ZtGG)p@2`sD+n7OG#zBTxwHfU^ILNjnzf5Yd0lo2YS5@wSEu`HLQ_WS8XYtbY= zjrhc$sxpLuWmisM1E@xjDg?OI{2rhuwEX*(6piZ5hDH9phd{JSR2Aw4ibDZNjk&tJ zD)fFw$JM+ShFh~D%HP*ljFldXr14Ik&*vm6kRgv1|0TdD0?j;bH|aghC1IF$Xsg>J zf~L(T$fgW!{Vf4?bGPvt{UR_iIMJ;^qMG}zBG7w#k))CJ>6bGjS$XPmKcSc&OA&pp zCAQZYUK?t#Y5MnVDN+QHsEer3K?m8@QzIQ`IYiwCrPp$P;i942+SDuXC26fCkn?T4 z)x;}B1{L9HPGY!M{$4;$2F~ptb#@S~G;X`~-=B2*7`LpHv%#0~k)>QwS62o3yJ7Jd zlw z$E7dPilSdmajsRElwEl~9*%R@LeE)wW&l zuQ$z%3U#YM2EW3WWdb$w>X|u3)(VhOb#q^oc@7UCKS0O26>h(}llHytO*6ig%F;5z zE$(YaA&aPt34;UywOB1$1J7htT6KvAb)e|s;oAZDJ4d>FY7m-~RxO=Zq>-qe4b>6Z z>%cMuI{Q|oKhp_hw1MVxXtf1Rm#+&{j%a~$|tHm_xygO*v_#V zxmn#NF#R$Bt#LFfs9NP+YLAF`y+40*J+2EF)phX7J7-{fVGo!AdkTsZ&-N|gC{#_# z2p8?DJ4{Umv*~7_Br^lYBLE->-?4RY?cakDv9F!cEQydCF_cP#_ql!c99+oR*Zgoie>5vY@)uqhu zKdCyPa!cZQ+Wj_%tpCLVFg7^ZO{3pjlD-W|UbUkWUB35)BQxK#A<8k7tP-e!+yibv z0Jz=%-*14jBD=81f#4pK##4`0~e`G1A_ZyR&W zSQJ^PP*3Zr4Oz|mJ}&~*BN_v$Yo&MdK53GLsT4dZ_?Fu}b0U}^E zdM~h+OO*g_aH1@UR*QtxpUmioQPqY<1-2zjC+!0`;S~lVGi|D%_UqLtN z&;0M-hd~!$eaMU_7-5QN3g{w49Z2keFkkW}x zWe-1$IfOjvuYyO9SD=E5JL~`Z12U~ZcEEZ80LPTl6>e3@VBWOXx}?{PJH-h2h4l8x;s`!{JLeV6E0YnqC z^A{93y~4LKHGndBD!jRNP$;<-iYGtaGrH@*g|i(VLp1u$w&g$aLo2)d=m!39y=VJN z$@L-E7eH>RSn2+Wx&;>6x0$0-AFsX}A{2akUkaLl>;?7af)Y^^9W@*Oejrm(6eGiFqGm(Vv>n;Q&r8X?;x-)u<8(gIH2>3XGPeWdzVkN^~0 zJGwf2Mncl$Bp{hRCeM>kT|tP@*uIxP{JoU1)sZgurXRPmH4i&PNxo(9BQ|Ggq?XYq zrXC>pygvjFJ}cYn;S`8fzzaPs$><5$soqm77huo}lJ~1GfIc{13xJ=B?8;-Ia^X}K z0QpN#nuPir+*dKHm$;gAK)cCp*hOs>$`FOC9By#ANV*DP7G)iP8;;y*^p)mUFtGo?0}uA5o!T|jIR|W1 zn9+qo2aD9-Pg>wFGVH%mHk89{d3xHBDnNX!XsoOSQ$b%i%O~!~_)GSK77hrJq(j&* z<9p8b`CoTKA1_uXQD{@QFiqQ%zl}#HQ#?PkpS(ob4tN<<=c)0h`+g_B5vvErsa{}c zRUu3yBYX%n^n^uo!xd=?^r3U#QnxTSO-{QxTF_y}vnK7g3lkXQeoE!wKTN!|tGyz$ zG7Vr2dJYAZi&(CopX9|Tc1Is1r%gYNI zXl{|^7r;+zMcKgom_5Jr^BeDRwvkVVU*<1Yg;qacb8$neiwMXWHqT#ECt+gWyMc~#%MGev$7J+d}pXCK} zk+`Qp93X7O&L10tbs*`ZSc`#9iUzy>cziaoY4N61FmKui6b_ivfnvf(?NH`u7G*&w zpegFwEixuU){)B{*WcK-&k8!YSK4nyJ+c=!*eWk_C2w0^87SyYf%%BHE-^g3BCxC;3zZlVVl z_-M}oPJ}4mAG-xx5GtxNF=%{r_1I=+mO_LYL6766xIU&%JKMj{ZGQp3`wnG zVf4qo99MFW8w>A7p6T+?5ugDk!@gC>D%qIuCO$`l#;cIZ91Z>Rsw6Jb3?NM9nza&Z zhHf<6AB5&;g?Uj{?tsGj`qh-uTq$0{f!FT)`H-%;o-GaB*Vru8 z%Y|>&d03#tJV6r+QjnS4n)PGB8}%R!lMP)o^4~o%dV!<@G^TMm-Bj=_ij85>Q3pz! zC)$+XF5M*h9!d%0;*de0!o#@pUnHCBTAO;Wu~8Ne{(w)rM0G+qjaAUiaZaq?a~|Gc zM1!Hul&{8H%6_$0RI5_%wC8Y5RUcPj@C4^YzG$@dxmNJuYDxbKlEF<9?m?S? z%6apQu;sT;bwkRjA@d_z_Fadj8nKo|`N66TdFE z*rfa&F>kP`>31F4)0LbT{Ue!Ajg2_Th>#TgNP8jhE4DgQ3%1$#qUKs$EATvigc^3-gO5AO8h9}|ZzFl{Y zOD)lpQSGOD(9+#amq6`e8lq*8Q+$wLI6?tr{Yj`U9X^OfeToxn?ed8b8<`_;7R&(J zHg^I>6fyqL$UIi1&4U^-Nj{Sd;GZOmcl|JB%R6ZsNX`QTHLO5u4G0bbB3W4vqEVnk zZQ&)2H7W3wd9S8>0^4a|t1(R0Ax(8vrXI5+Fb8V8Ad$Bwdgoi1pFO{g3s?tAyt=MU zkKdIb;lvue@`>#Q_2UCZ^}URQ0!6abdbdQBqrl++Xl}HxL}WMSz)5=bfT~^GWozOR zQ-IA3M2CcyxbjZsd|KA(d*5n7U&bdfD^9!1Gy;7aJZkBhs$AeLT6eGMcwYE?-LD)0 z8E+CeaoYTs8A9eRK)01Vd`8YYjZjIrF*y_AJ+faodH!RWw77L#H8$>3!pi?e)mcVW z0d?J)5D<}&?hcWXkS;+=1QZ0MLAtveq`SLOP`W#$ySw4g-5qxy-}k%Uy+3t0gado8 zy<*O1xmJJDVaLr?gQ+n-khfnC4HNUNqWJYl4=IPQz!C5fWjs0;d?vv-d zR959XoUe(vDPHWk&02hZe6ywXfdCzUWO-nsBqNFKVsTq#Oh%OtZO1Y>{N;l6<@c^^URC@5czw`}UWh?GOrN!2lyiYr$o8-wsNDoy{l- zQtO!F)%JiC=)7S8yi-Fdhrozuq4Z4$;fmSgTr%I+V4Agf?u0yMT?|n_hN}4FSnc$bmioqUF$nGtfh1@oLn3nVe~p>HD92DMkNp6!H?Z&TD=~ z9#eY-)3}-rz%Lf}@Rj|t13wcq=fbF*_MU%XI)N^{eeMZllXdId@eaVlZFl8_*h(df z`-etu?93h+hH3v8YDyXe3$QJZh1uF)vOlXR>aP7}%JUQB7ztwt_{>(E%I8c9>W)hH z%lng|eS8E_=%-D9)`sXng;e%h=QUnlxCk58utxhA5*gf#J zaXpzn_`iw4*_XbLnl_3}OceYIW{AAu@cKK?-m>Ku1laX9UM53ze?ZPcDjQ&6*4Atf zZea>Y_xmGhFG+A6P97J`r0x{fxJn9_`^FdQ&-VE@FC`$fXaf-iTSuOQsoA$n3aC=&Kl z022YaxLJqx5T9NThHs6A9;!wP)@teU_Z%^_(LHw&2k1^}IklGm=5Jr4w|17><5z2S(q2_C8dZc&W8SzHVC^B7JksLO_VSih}bz8X19%SfzU|Dr3 zP__GcAjSyZ=_uyiP420oGj6mmqxBwg3?S+8o`TZHZ04Jf+t@PQC>S>q6#%Bn1hy3dvX)(Xn~fJ z58cr*;-e*9p#WcRU=2tzx%mmIY5KZtGmgWD`P1E0 z@b~~9>3-VWRSW8R(7{hKYzlki3O9zR-RO$A9om4ztoCSgPwHYu(P%l$VoSyT^P9Cj zeTut)g3^Zs#cG;HO*N37my14`?dQ@;;u0rc4{^?ss=d21q{9u;ajFHD*!s6htbd;C z(wz$6s$>16Fz%i7;dR-kZlMfU+*fyEC>3y6C1)*0xV-!Z(GlaHH*P4c_APd@h-1FG z2O7pAr$!Z z2V*{bNGJ_1$%?$1dYgT#YWY6?{~M< z9*%Qf?+VX93hlfva*h@kV3Tq)E*T&xmru8ezRUpG0eM8B&Yx}{?giIPQo)TI5GE%# zX11*F1!ZU}5Hd{{ZJJ5)0zMM5H@iAC`h|u?7 zVuSP}+1luZ7CfmRGQEw}dt(G@OPQC_#HWG746Mw!AnDr=X1Y?FK19Y!T&9sb>;?it(WUFngz z4d-`Sox+skKw{EvtY2X7J}`~Ph)>ylrU^tDTg2+hjpL zs$qr(3dshc(dpcqVxmzLrD1XjIs`6a*L`eD{%moJer_&gS!bB$dwNTK#Q1jFbN?+J z#itk6BMJvnggDmc5+|UzThKNCP3Wfw3U_En!l+r&^;3CM&$ZRad!&m#Ovc#C-s?#p zE!S2;Wc{QguPDki;Br*Su4B;6&dsR&#i)x{OP|HB8{fmYM;EFVO{cu4*F{6pW~)N3 zo2$m=F&{=OA6wlL57kNI`){gPN|#Gt>xvj1ig-{Wg_Ra?l&4K+`^uw__K)q8{U{Kt zMlP99C6G+co%Mo+S9gI{@fuDJlV!I34rW9Bsjfy(t5wf5g&mG<^|!92BhMT@ zJ2Y@PZygm@`!=39>aXqmDBZ{XNxJW^vsFfN9!7G$7{?LoVoOeq)g;P!DFyPmYTV>x zo6L&;=5y7qNhbkmKgv_0sT%fw(BHmx3e-tpfe=GrA#Wf=e7+}=5r%ew)~=wf_lJR0 zmwZD$@1a7YZ4h2+zRgltizp5Y;(mOwxN|>X zCMpv)qP=%|>TJ(X3#?})B|#Vl_)B?=5=!SYQM~V4^%(USq`aeK$FF}#&_Xx0S*K4> zs~2cQg|Rts;?cw$J3?J*>ASTO-5vcL<-TaHprvzKn{b$tM^Y-CIF1)-&i`U%=P%s8 z#_e{^iN@2R-xZ5o`iBw;+90jH@cG6KJ+1;`bPKvcsC3zW3Fo-EO+XX#$4nOL(~na( z(KxA9&Fkb%V>%hycKThS4KJI_81U1Pg+Ui}|16m>U|OQHuS1O8hVmSO1mRpFWy0Vb zBXGaN*l72Ert=h(5!-5eq8=oGaz~=sTFRrNC2CoN65D0*fg)c={ezt1uG@d36U6vz z`5Nye!lB!@B6TUMd+6g_Gik^t?e0$5PywPNX2Fy2ZPg6Ft&>Kq>a-m~8+!cnNvC0Ka` zbV=Aw`2&>?b=v*w9)nLu9an!6k!B^7(ju-ZD%&G<2m3$dq~YqIOQ$$0Tt~Y7IA8kg z2Qbg1)3T*9s;zz~N_+LDO71wWsJeK1-VzqX9e3;woMuZH>BnURd9Na)HH++Brzwv)AxoE&Wq5>wiuH4C?2a79 zTgsg=x)IzDmb7Ggva(|52frHIQ^-jT-J6oiMR8wm?^gnMaPZk5`oyr>2c;>$NT#l@ z6rPP;1+;YRrJ7y8vC9qG2vfE*G381+ZJ^_Cd9LsK?XC>A9|%y4xI)>-hI%BrkdAo^ z@1Ea0kh8&(ngIQvttM*{5i5(Hg@k9sP?COgdorb|hxJRG(^AlJm7cO_?m?!<&_%pj z324>m4N7tDV$?E_A}X2D?%w80tgycQeZH}swzi5p9F>aso*OU5Nar10e#+zqW zA#g*vKilrPAItGM z6>%5$>)*bcb@=$(>pX(+-+ibh;y-H&(>|_rYfJJ!AHkHcDcvUbLJB{_YGu@U%l5X; zXN?>u^wmo=jF|VaA{o)VbckGtq=;X31H9oO1sML=t2#|9nZ_{&r1%%>RwAQ&8+Jk5#}52fv1})5ufC7jZ+vo zzH|HmVYL^Le-q)en>9uf0>GsJilkD(Af~YVBVg2&sGv^IcwV(&S5lFDf*J zM8c>U5>ikxPQ7Q`XV2?1HKaiu)s5oA<$;ZU5j2>z45NNO81_hslA=0FMX`s|<*f^| z5=`~{s_ju1Hr|f>7PD-Jb~YTDN*|Jb)YYX*K?c))uVuD#D!8Y(c?!gC+hfERM0xz6 zejI-G`Pnz+Ku7M9R?^`{|D3;mr$e^X&6@qdD`93X{(J0n^SOE}oZu+k$Yp6StahUN zMK$7i=#~3RyXFXWA_Joi7r)!%^v;_OdtdG@OTdoj6NqPQe>L zv!O)0h37@QvCidwz^eqBR6ag9uyrHDowF~((ai1}82OXrV;*Di`pHAMh5497u4F(2 zy8TZC3PTtX*K!BEk_K((X^ru7#kuN>AG=+i>tDOH>G6oTtx~^+Jg_qfja_uFQ>)o& zHbe>G1?~|RM%)pZ;Nv|&x@QN_1ILiwA)`kZS9!>d_2_!`&tI*NW?@_19VEz(ML9EY zPUi}$%~hd)yX^k0YW2JaM!Oj(ed?;{Q)7@}i{TfLZiqVF8t6^wRw#ZLp=-Y*pHgbg zdaiObIXbhGkap#R@V@#P%c}3IBEuykg^*mj6=o0iqsuLLO!1P=f78%0&hPv1R?=E~ zmi}6TXS{8xdLe>?nF4^Dz-4xdB6YJ@b`AoOsn4 zKW~0X0?n+@Zj||T?gSyo*V6o9ELbb=_~cK*JM~h-39_*|5?^b-YSb@Nh(t!^^IH2c z&DS{iexLh09TqiQz-Kt63ncudoY$~uBEMnDVLrnIJB}P?JY0|0L2LwM znGbJW$T%sn2Z^42gPN#~1kkW`26E$#W9oBZHMpUk8I}9s)f8)=pj0mdWcZ#KR3eHM z!kfOe#!vWrK@#dJxdk{@DK&-J($w^gv2+nY7c(?jVSd~)wOz;7r0$m+gnQG$-_CO1bTMm958Z*Sp%CK32e36_md{`C z3+PutZOYrvj=BHauOeJdBtn|(slg=)UtW*+l6o2>OIGgcXLoMm1=p)wlGY15Cre<1 z6HQ;sc(x2ITV?}r{Bh1ontTk-A*4h#SEp#Dk&GVM1t9|`Xe8;*+?;B{`2#WquSh+P zpQGH^q*RuQ;nNdoW7>@aQWCNDGBu1Czu9)pITi>HW;308`l+Wd7A;^rVC0QYBuHwb zl3E}RWW|$XlUIYQ!q9O7@}G?`WoP2yQpC6qJp`tT%?~o0K~;qjH@80M{()P)LBX+p zf|8A+SmH2bGw$0G&uTNC)pin9JGEX3B;Pof^?E;s)v>vwQJ#J(+`KaDHjhZ_!6Cd@Zm5saORBE^PI*2{r@eTfrPow zGDd@ObRi|Wk4jL+v7}1wQD8)jPZS^qP-Ym{V$aUJ*sh7;x4d00!Z`{7N-AUMGebj@CWh<#_V*hieqsz}r2BJs%%(A< z;*d`hyaqu7lquZoQk1>u&hSP9w288a^KHK6bF4SFXf^jo6no~671!?So|6Bnuek-W z|GCLd?vNIJ;*n6G?O=9`gr`WQ|u<^vnhRlE&rx*#-SBRg7L%FX?yJ#_FU|Y zR>~`6NMT$V9QrXHFZJqOAF3`>9>fsU(tM;yOsYU)qRw^1NPKZmevZB}Ycv19+Zi8h zI`G78!moOXQ!NCF4pPmKP>ElYkZ(uV9jdD^N=>bjd}c9RJm!*Sr&yV?^j8e;S?NrQ(%6KG{^Bq>#L#Q}=&n;akc14sKO`A7Z&x?vZ+ z=*CVM47L?4@z>!045~jumK=*KI5%u&PTL}iPVdXLdgms??(t`dcr&H>3z{7YQr{Tz zie*0fi=AlagLloW30N4>xL0mzuNttcDf{R+b8D3|~AJV06H#HU{>49ZzL<3$$!)^kME3qPN^%;j(Q zGKfXlvw1M8{k-40ZI21%a0KYs4#QuC2aGQNv*f069{tLtxOu+Qlr`6@S~OFAZ&g*? zU@)o-dqR;DA@o>Vkqrd-MRg?8k^v?m)a8tc6xtu(Xhs?mEHTNT+=1xl%qiA*QO0KfiMg5 zw0gwOhUysTwdFzm84AJB3*Di_8F(h=dmzed8=wr^drUrkd9Y$wZ0Jy{W%AIkpW7NTotV&kraMYSs53)>^RQ@>=K!%YNtZSt~d0XNG zbQfP=WoD8Aqr+!=4wVgI2`iX7vu*?l&-+y;x|aw0Z?GfSv#fn0XeCT1iR1{q7{@yC z&Nke~-dU+NBKKsBA!vT`bihOcphQh- zb6!B@BdhV5YPzLl(^uM65#FB!LW-8MTWQUTXm;@b?yUL$+}X*{x>!F168_=$UPvPw z^cip#B+}%g+6Zlsrt0x-0_Tuh69`}aUeTSFH8OiLx z>lC$_)*f;3E)6{^&~ReqhQ}P9v{_pQgVcTDI&3k$>?ziQIaMTM_D%THFa^SI?4;F; z9#BHVEzx~}ev{0#j4RBKLE3MePw!Q_p0x!LQ&;`w|94mV6bsN)WmpO%s_7%-O~G&# zssq6JocDEn*>Cg6CGv_&BHWITWqZWBE>-+f@G}^2Q+WI0>^|I_Inqi&H3I$Q-Rm?Q z1k!H`ge1$)bkDa(EhGfQUpn{_gITl1>G<>3qKt$V(OH%R^tPz?uch3f;{Pzm%{q)23P4ejw>Tv83{1n~lrhO3zI}vQm>vhvuh8 z^1nu^lyt3^Y?gok$>O^R&vD`r8Q*Jts3)J&k^-)FFon!mDdqUh3g_ZTG^e%PuTzeK3qE5|Lwz_gw?^3hI)#Iw`qV{ZBdsqQx`AC4UC`IesywnD#BxT zoJ}vMb%La{0iY!@p`OdL!fi{+0Z_X(aR^jT`B8AH7MHfY7@B`&teb!+>{ZA{rl%P= zNVH4aT0|^FRz41S2<cW)q@8ZxD&{=L~a{u`o^UE_k z^53)6pUv`I2*&zto*w%Z7@~h?ZodBR_`z!Ices?-JkS8KpXvo}X-+l%d1b1&_BY}F zgfd-x=IvUz%UIi9gB|exi{}kC(0`E>6mhYXXM$-i=S05I9DiV~2c3Qn_qZyB*2;1f zUx&aN!BoPR#M~p!*X;%ipIVE~k*a1MSK@^5ByDCs)2?uqJTS>E$0!G2@-Y%oU2k4| zmPFf?VwYa1bgP)l>7|pBh`$#@i+bN^2bBUEY>#9e+PgtM#9O~X4j|XX4Jv=-TNZWl zf&@Pl0fssMWowaF8yEmDZ|fN-<3A|#A{jmD56Jv>lDxbxV?nE>N#{mgPk*OE99YWQ zkF;QOyH03Y_#UJER{=G8&Ee070Mbrw+OOu#RF@R%NzT}Gs?bf~n?Ob%pfk{#MWNsE z9?Rx=ZG7q4Nxa)>xXR=ducX?s`a+Bl|JnrJ=22mQzbqStTZ264M@{&z>N4$_w>fr= zD#0#rW~cSfNIaD9W=@`$yXdK17fzr46KB9!{C<*4s?8Vu8%<|He}dD zO`qysiT;9l5$zLPz9}c0>pKMQ9t7Sv0GE*)4W7mW%E)FE>0woRPE1<59*97nQCn>B zY~>P&8Q7q30cll-L`gxLiwM;3bZ5l215w6!-p4~o$dbt}5Aomu0xG4oLtwF}B{c2> z4(Kfy8ASjKp>JX!>y)T7?h>ppDH8IRUoml@@iS#AgxFLaW> zP1^s(ZDtFBHr{<^&2rLO@%{f$0Z=8l5{+zVjOvmW~bcz_tzunM&bWIt=GRAUwS#^Dx z+XAW-62`t-Ysdgp@xs~EvlGH5SE%pK7}8Ac7wKogV#l%AeBHHbU7=g`u3jevBoXTERYXo1$ zXgpzw<6&##SV3QrN^{~Mp;5xQL$W-ENEqxWs>I6QqohP2Alg`&4jk-!zRcLG&{CJHzgE29x z3Bb;ja0Q&bmNT*5=29u`r&6FDhqX+pLD~Apw{SiKptRQ@VGFW;LD! zvglIRzh{c&k{hMjf0h})uRdc^FDLKg+-Ho(%1dc_N#^=l_Ytyv;e|iKJC_T(s4SxbWG2yyrR9jSyN*Z@Qh^`+c^_apR+zrf6)%PhWEijxa@B$ z#^%IwPF2FUi3Aqu?UZDdMXmZ6SbcO-Tdn< znP+&Kq5A+?i|8Jo$5J-@w^GXq&u`t_9vF^C^Ee}lPf0s9sQRFKb$ij=S!>ydd#O|@3ssz9VY)OnZuf= zbSC%AFuJ1Ts$4Ckb|CXCJcTF`#n1@y=XYKzo2UNd&y~8h{w|Z@NFhK&D%gJ&+8y@BF+#o) z2ehWf9kr6V=%nr&{Ml|oSP(B6-~TlrMLh^u)|A0iT-nMwM7Pw|j7D!<+<-LigE6aS z*Uq1U;^3t_Q;rj>+lCY3%!j)(*{9~7I{J6Wz3I!!J}Mux0nLHKgnew2afS26M?$vY zU`PQq#wk+xE-=Z(OB^QaH^VChxpjvUK#H45B`D8l8@szYCbewW+?QAxWDKP6zRURW zyWhoKobIKc@OMO%=+cUx%pXaI`yvaqH z1d&Gj>CcY-MbG7Q)!0)JFgDJ@9tGD-k<*A#mI@hB!&)F$98}MXr;)G7Q_!-F>5Ll( zxB2QE08>^(C&=Tg59E8Aa_j&sgoK2p5=nDA0KcZX;vn%8IyTl)_n#oYkF5LO&f z`xfw)?4Fh~PrB}-1#hR}bMIKa#`1K?v-)ZvT>0H;MT6KXghG7n0BFSon*S!)P}|G$ zU*R+Y1T#C_+6<&~L7U3>w$CtLmZ^9l!$@?njJ1uWIunf zMLf50>c>6wj>I#{0jVpeTxp#P=7Y1>lilAiqOTXJg|zt1{0de?Hl!Ga@(NkaS} z!s(SGU8=pkmkf9%wn)8LFcI60I6-?6;ZUDGPF+4hG(A33J*Rn+)oDNuBFx5&+Rs6o ziwlmM&(8aW9Wvv(rW*Jn4nI?83OYAKLuFFASzRRXoh1lFsv(u-uSyg_aWI^#>BW;P zmla;FJ-|oSp(ns1cCU>FlMk1TULheQ?v4*yUZAV&LFl4IiWGTJ{yLUxKIb{l zrPD!vBFt7HQtRtbOV9oa!FVyPK(-pL@7*!h0?6Fb*8mhS{5xV|*u^>6?j>htwrvle z9TLUz-aWaOdVtd_x4mN_4DZ62GO@OzKB!Ofns0QV@??%YPYZ@yz%|DzsenBJ<)( z`(O<6_vQ*gIfz0&Dwf35{2YOmnkC=Wyt>l9*1M*cOPg`#Yj6H#4oIyBcG$xX+Cj1F zxCvfUfl&GoWNk(&xU8#H^Q6dn;G6!CK#io8V`0p*=$xwc8pW>*QO{0O3V=$Bc!xs5 zK57~)8`wrFs;xB2#oPCOY3D)> zM1r+>jLrq%{$Q;d{R-I4e__{8XB230|HjsMZy-U(^;b z{QR5+wv2^g{tfDE4RQ{*9PSetZV}|g7b55?K=_)Y?R+YVSMG1%c>fFGQrx&V?41?C z9(_+{i3(LEzeSxXU0<#S2Pd%_4&@xYi~W6IH~)bb|2}2nIQzrBNPRPz{~f>c6jjVR zy~Ki5hIlh+dR}VoV9m-m3$3kq{vtyb-7tNNN9{0C|D2uwRoFPDzRb(FjD_#>mIY!) zURZwWBeMGyq^6mjz39i8lG;4Pbc#(98noK z$|w`;Q(i_;3#wz|5m-D=&~$a+b{bjN{z`(FLg-@dFMyvGug9 z)ys;YTf0W7P(tm`X1D)xaTVe)RSd8l;yL$3%{ZJDy+*^iNta8Pd$0BJ8_jA#SnrR1U9LZzLzL4!H5cMWpb>>cAKp-2 zJ#gzJDfj!indii*z+P3*){g7x_UCNrQb8|4MRdRQ%yf>54w-(gCA@$!>G7xs?(BwB zM&nNq=YQpn6?DRW;?F_eC8~#W$G}Uf`== zqGEM!P{Y5`PmfWw8cI)e-hWF3+|>@*0^i_N3~dk_1LV)Rh40Xd261_~e)?0)p51*! zseM;a((FPhnh0M6<@N)prR@>Z%G5Vu6YTh_^U++2^$11&_90y^rD^_U9gE$F8VB3h zBp^DVAu@!|ZW8UuSj;48ib>(uRZ1TCSWm$Z%HK}_4bXsc+X|0~5$Y0z}Q9|7$U=BPXCr__Ed z`U~=#_Y(92?M%X&JSMH>nE@Itf@MTgXs>bjXr6Z;DxZ|D23$FAMP(KD{tpYlwlSXg z=soe{v0y**75A!Y+SLiktNq=LIFe_v(X^!^_)^zwhp$ z0Nb%Z*JsqIPOTPhL87-JxL)h&5dF8ZPF%W%`6SvowYh&~KR1SU(Dx6q&5CuQiTr$v z6dk#@Iuhoppwt{z;QcF?c$*)MJVC`VW|ELOOwIVgJFWI>C<vKXd2Ii;=RlX*7k=NTydc_%lUW=IF4QUU5IWRW+Pe%Pg+XECtKwKlz|skM3$nrY9O=82b1xgXR*M^aaW&fsoZB;a?(T> ziO5N3=Rkl|XK0~~S|2n3Sx3=A+9Gu&uCEO>wnnd^{*j04dB3qv^Yd^8q%)HcfrvUA zpoR_RHa^qZPsRPb+t>;UK_(^?$KVf44oa9nOW% zu~%fdVzzK4slT}VC$mxEueRz_(~N%f)fJ3+KHn6}v(v<%BltZh;TTBzWC$QW0P5`s*xuwkdwiDq@`TR_lkAS40E#l zUyidyk)9o;e49w^0>qZt(z#HN)w?{Oq#z zav&@hm}VDOW-x}v6s{#SBcYkv5sFd6@z?)CN?$D`LDSNWZaW!}~kVHd;;7{?-wYU|&M-%?+M=&C&T72qx|!CdkoT|^G>;B{FhhGJM1Q&Qv`BKL3He0@Tj4qzt{tL1sTgp4mf~mDiF`CjiL#O+@^vpUjmt5YSCjMB~rZPCyh8bY*(=6g*q_w@Ln(0w4F%djuNHVUM^JN61sxTaDwZus;b|hjisc z(6sW2cJ_;FeXLIeXUN5t7AR0vU>p9S-IfJ z6XmiK$OT(}5ZBuuf-g%xr78u`4FhWM*Msiev@N^)0He_toDF2hvyn8Go7+$oXN<-i z6(`5${@DP#9EaTbc<8dB23bhA>89na_-YA(zv!b~jcMdtT?L<9{a3 z1{uF{RRB&r?2Yb*hNH~5va`eulNFt9N-?7%YYXqBMeOvWlJv4dJlZ59Phd^0!KNv! z_n{sCX5zY9$GzOmJ21{?A z<1rmCcqxM9sBXcDW+`#Q{eEuXMm8^8#X24Lf)8}^QVf&PruRA3Ej9W=GnA1AwK+vtWY)RgQz>>Rs{P5aNT!(gE48LwJ%J)so!S&=^&Hxy}r9$~B zB-hu~^A>vuHd}#fMKw!vikqEyS{x{hrNXXX3s>a-e8L^jmeB+;_c?U4OaNSzBRj5^ zh}S&1!nvPKrYu;qpcoaBJQ)3(cQ$7<4&;*n7i1vx**E0xen9LFAe1 zNrsphU>AHpdb0#L2Af?(mUgm2{{X~o%;`gCsXyXlst9FxFxFuXgeuX#t}n#G;V`-W z{kRtr4uuRA*OVLcrdF@I)D@gG!~q#kj@P_}IjZW>0(8!}5HyKVR_JE>IvWwpw@E;s zVg%%bW!lTEM??Q?rYH$|LO1c6Hdm{f28u)>AVS13Mfeqy*N>0QwOetIdh2{UMM zLHu7p3~}MuYmGjrkA~xpqfqH)dkisevKRoVY(CpHH|&>(fC^keU84o;OeWaRhIS+v zc8i5#;q?LCpG-A{$;RTNdq{j!xznE;&WwMjVhrG6|DRJKs|IVqQ@sK4b6Q0M($8bpu2k-V~H+E;?&1mCn*Pe2LH3Ek1+47Q>V0H&YeCfH=> z`1JuSbNr60YLqpUuLp0M#WpK!U?Lwx+?vx4HYDf)4goy~^GAuW@Q8^Bc9kUq-Xig{6Y~l4!YA5Eq8jU+u<3#R(0BEo#u&oH;`6 z!4!Jlg#{CoH_ra?n^N;&e#&MRv5_)J8ndJ{n(XEEYcWN09?|8mGj}a9k+SA zGxr}TH~*mp&Z0{HHIfNH-T8i2xtZ!AMJ*=YeuI|JwxF1y#xRcvrcq|T5xHXf;O{;; zOm0o}y+Kk9h91zj-p~UoKlmPHoczDh>Wu>GtyglWO=j4CW0m=RZ{;?)>;Ks_@#c>k z$Bn3|15+<>*k=~Hshv_8Wz~nnR|0y!!=m9)?Tb9J0!~~kUl}1KV5y^uO=R|Y7eoFVqF+KobY|C)IP`mjC{Od&upxb=RlC_UnguH* zfS(^M)qpa$4)!l6i>jn!7{J#vEf{fOKuT`+X6v3}JF`G@e3u~mA7{QhVe@Y{JCVIn z-iiMIe4~3C30;7y;sam#^q*I#uef|VkR{((Qtbu!j(KAL|FiHD#)1yCU@jLOwXR5@ zvq1KK#tOSdu2}%39e_H)0aJ~R{d-4Xae*hFGB=b}l~H(e34jq$KqJN@IMmiC?f~n_ z&OXGg+aAmVhK0~pSu!Z&C!t&-RB0|t5kT9DyV=uvG69Zi9%x^9Q>Lra)ZyuTLP0JG z*xiR-5_0rF{qpv48dO{v@I5MY4DC=t0s%l6?a6_y02~$9YaxaPr>xz?y3mQfEwHO4 z0VI@OI37BFbT4#D2So@&vGki@)beim;m{HCMfzbe|29E2h;x8nhV~yV{ru?2S~ zA$txrb)(^z<#O{TC_UK}el-&T+;nB%vv-#BeMBrnNFH=MWkt*}(8cvU!0|ee|0QRD z46K&VHQA|v;~qg}Q-PW1=*32>oa3kdnSc974=wjX=mM8XhK}6)v>3ta4jLJtT%_|F zmp%~`ru9w#i})`P2BctU;Q{)nDg~b=Rj9pjh1j_(*b=XuwoQ8lXH8zIY1=0f|u5 z#3mG{6Y>N$`KADDQ_inSUW#KVM?e1#@H=$@9Cr~}aW|P48f)HYF)ag7`FLUM80+=GW1 z+wh!Vo55Mrk^3<0&m5m^88xWJ>>Zf)TD0mxwTyKD{J6LFKUihdgsyPDLnD|)gDiBx z>(;l2qR`F1&`4kYLHZ?DbT3snciVmoSj~dwz6{>qRQ#6EfUrVOf(^?p{&Br>Mhsyp zeYSt6Vgfh%d`2l=YWIKErPRG?0$<>m$l*{0Xgd(R-cFR=Ep#(yxz51q;#bcGz zy0d-z$PTTr`F1zT?PtLKlQi944B{;x-%5VvZF{q>kCkU}t z-+cOi13{UHH zLP0Gib<1;P)eCgLe+xtLue(iYlw|MRU!pG96X$cvVs}PXx^@C>6{%Jd``ky90=e+W_AsaGX8aqWMVr@<4a$4Vx>vKsN?J zx8dTU5qEb4VHI@!<`Tv%raW@7YSQ1?yaq>7vl%>Fl_%}PR{&MW0o@4Uyy}N{-#r97 zl@$QoR?8lDANZujR+yi%Y$jDuLEyE4w>We9sh|0`pO(+(cn%h9D1xmypf!MEpm=jP zP(Et|(LSf=?RbWKNI8`GKX2Kx=zJ=T`fWqMfXR-I-e2(#hTG!)qZDk-U%63SmdJi3 z_yyqg^t98|XWe`PvFlGr1V9_T3t=n|Bq}IrIOMGWz$>vGU?_Js0Q>6R{gZFK&`q8C zf00$h_7h)DrjtAa^iIJ(QcjR|mMiSfsszv-8OT@cE)Ve9i)b3Nso*}(jAHBMdeN)I zKCg$lQf-#xwwYw8?)fZY$q9nW4vHIFqE`v_TrI+iIz!bQf9}+&>GdX(<~=S7v$B`rF#LU%sf&iAx3#bbKlUpcv)EW^yQ)NfO^C*tHqdXS*!wLqiVDL@~hV{81W zY$WK1y}J7WK_Q;H28WX?3A)zLb0Yc*oVazv-mm#kdH+e0PgR8*_^tCB%vBl>(T{@R4et5vIRkwC>k%!t&!~4PwbCK%N+upsv1A7R;M_ z5(LK&)lstkxD3(LBdnFC*i$pA`@tP*}xL)muX!}Lj$Tcl$%og;e z5xVmIwq*yCk6Wq~x*uF=2!Th%g4|Z>kN*~c4J*ygJlZuMgD@ZbD z%k7S*2k-k$?mQ2g=iBF{Jp^>&`|1COtH1Dy^8daEP(naNK&4wyK)O2(KpLq5h7OS! zI)(;CknT=N>F#bAy1P4v?zqpqKfmu<_ul_t)|%II&OZC>vp2xHPJ;E5InW-hBocx_ z&Vcxw190t^IVXk_cvr-f+k0o)1M#MdfzJ_$`mEQR8KpP`uSb!#&rDeR-nn4#^V;V4 za#4p*!g-T!fL+8?aR^_c-LtcV`^ zMoha?R9)2BXRg~R&WQ+6@%p-2M?q`!v2=$}P44#pDUi%eZ(8&4SFRB*2oNi_t^ObR zi>*H4NST_AVY9;jrJf~WBuMgw|}r$m@zW7CyY8I5QqQ$*2b z@F8%n)gP%lTx2T%4!6&TA9Nwt%&-@v!1mMF#peKFZl72s<$w@C?*X2>(@Eg}*z8Dp zUOW;Zbufg-9*Ag20%rGxqAt8RmoRUHv51Rl$Fr!3BHxZ@mhy!RW!3ofF$Mfmb63uh z2OH=MbY&k&RjQD)W?7%2U|N?Iuay2C*qJ>}0&~LGNux5QSo8Vdcp}fL!-des7QEhpvf6FhdB+ zg5Ta~Vb|67e&c`5C)Svv5yut5|ciXcgpDHhQ~JwpI# z5mzo*MX%qW zEv;w@Q;I{wy0AVaKf<3LhY_ypp@iaqiRKgfcu)`I+&W^jQr;;9I5)A-K^%jdamJWD z{^t}6>~RKs%!%XTjkW~piX2;lW90-!ZvJ~1#U3AkUUs*Pj=}Ycva$vUw9u6RTCQxy zHj%cC4+&z&#C{9Re9sYl$M&S#{72Dzp99hp9qtf-YzF-Q>o0-QH5y@}6Jr-EuwD3D zQKFE*Oi!tw=toK^AQ_urhtCjUEJVigBdv-C3<0!j1&~!PQ369>kVG3z$^imooRWDx zuXB;DfVR5@6iEmAnI00mF=_fb6&n{%z)3V|kZ)O-GRwjfOOg}Fpe2=b_$U!&oQvNI zamRQQ#TJ_1EyNm>3dqhX!QQRua6E$<%yz>a0NO5y^r!)-bNr|m^+}_Y%&N9c8}PsT z&ogVu2>>cqlEK6V$NJnr4$*C&;PEQpSh~nXD2$FvseO`4%L6jeB|>xxaON5 zfCcl`^?Ddzt=~33IQ*XcV|zQMq|Qqw#7IAg@DL3!bWcYS`it2y`s_o{gcm~i*1huK z=ThZM1hqx-Ted%r_iQIK>_3YsZ6Jj@pldZA)S5B^n08I?|1)V+PXj9O5x>S9wLWUF zA9SG&HAeCA(-mTMBD}L!7bxs`o=H`=cn@tnGHr@~k8lax+K4-L_!R90ATvkQvsNF} zsEqilCAZ;Zn|91CL{J=Mbp%&vlxbYxXv=qfaN2`KYLZKd zutH@LOBKy?dxJPV-9o4lAMj6B=si$2yMDd)-j)3IIuiDGm~xxE~M^71g1wm{q{UzpbJ^@z}RS%>K(Sw4DodQvoS^Xt<@A9P2VX!uZQQ{tvGy* zm=M6D<7jyM@iVT-hVf5N3n0T}3wXxOWZ+$ELa-%=*gsSeYSUMz^qe<<=BM5^MrZb* zH5KRui$}7A{0O2Ukb6yR1QQ3y@DA*OZlfxR>q)lw63H1SilPs%ehT>~W;U6TJHj@a zn<1ps4di7j4ynKZ27CV&=T=GhFE$ykT;OcgGygUua<0(* z@)omkn5&zsn^Up7fpDpMP1WKWdOu=~ysI{Dn;;uxh0Vsmwoc0F=U>YIR}58M{79mi zHu&8C{yS@^E{!S{o8tmOan%(M0yKShA<_dJwLEf5kWclDLU;yPY8KuwzktM^5Pr%5 zNX%EiO~~tkaUcamBMgmXt?vNx9JjaN8Emr8^tSbv0*RD_T{vneIgP(^6UB*!LunKz z9Xz{*x-G>!rPr4LB&?IRH;lQq{=xpusZrrp7UffKy_PX(uV8u&;SCaD{k$_3O%6$F zWW1FA^GQ_N+HDoq`CyCix-rWoPhZgB*~~^Mmk98We@EoG4}i-oZmQ|d2`u$r8L@DZ z(}x0bj+vPxjC-%kp=U=K<_k}izK&a3)0M#8;&!sLNZRn-k;kR( zdc}0bR7L6qcv#EeH_dZFrUwkypO(jf!H-V-6~bFkg5RnT+b8qeu25;m`1VQ@9+?2| z13)e^o{OMHJYD{34!Ys-SlZXUs#guaXSPo##K^z((ZURV^^e)Qn|12n+XHZ~r5v=) zgt^mg7N8SI6#Oa;kiM7x31JEBf=p#=bj$(NMPxm@ZPKNzd^_mEe`C>jDcRASzuIPE zl6X-a4q>8lO75^HJ?n@k?${6sF0%(*-*7)_h#6Y-#Sd%11lg-Cz2$b0%3bX1pPeZ= z82?#s&UQv6)*N*^AmWJ_)##DPIl=L-u{ij`25rM?KN&#icuU3DCAp}?mp4T$rt<_! zVUZizX$Tuwh_q2&r@D6pr6P02-6i}8{8=r z5#jk)sZ0s9+UpOSkS_pfT8ltr+`8dIbQx`x`WL-c;tOEhZqXpZLA#z88?+uRoAjF4 z#ey9y$}|+?lpL$KSd~lWUflNk3 z9c_-q3mZmtORYz&E2<5)iA)UUszLK&q*Eo=U*K3>&dvdW2ql zZT~a_@zs&*i-Ar?E2S5r(z)P-WH)tsru=oztbtGDcxy7Dk!-Qs`qI3ib!%N40eE6$UMP6hgU5c+h-Ry8RM(S#*x0HgT?aP)_ z`!>|{nw*B%?0${?;`=|av z%BAl>0u%n%Xl^2jvVHH_9?R`;4&7NZ%C(S5;GbUl2bxF`@ZnP@ zfG3@DhBct==iKJxKb5(PC*2tYGmK-6>1RU^_&cjPH0}^4yYnv9%$$8hL!`C~(zlaaMS!r- zR$Fc(pS8weY`1?$_H%hcYa@^IrfWl>C4faZ_vufM#hQ^32->|Xmw=jSlb%mSOuHy( z+kg69=PP7^4QX21{OwC#_YGCEPEZT7^N=+s)t~W7J#*6LLNQA&>mk95*4+JjjKj(h zT_NV7(w|{q(LzYv35P^4*{LC9c_sojrHL6N9AKzf(Q>FUqbgYxx{s_bJ=?A8O;J!- z2zd1s2PTxLboy`#?9{(dyO|n|FoT;v+0IAFOTiC$szQSXo6O}tmz*mMqHC;uWQwsZ zUA>jpMYV-Z1;+0ycbA`NT!IfKXu!GGx*i`Bnv%E^caC8yw>-P0+hIBE7WiP(0N%aB3k8RaR8{VV>aTvU3U7AA9?cUg2CSwTL^&y4VMF;@uJGnTQ{ zIz_hPjZor=4E|cmL=~W+M3(IJ3ZV-JQ%$7dU>c|`Kn)~JhNd6+!{226{vfZ`>`$_v^_ZqqJ9^|=M_73CuE477xd$_P*24%v@C8RNng|es= zs7l~m9{xwT1ZS_%TjHfr#kWuQvzKX{WAETHVWLPYxa;Itx1@@@SnS1tFk?=WgLJr( z=32oO47?H2&hlwkNzdQ%EK~w7SWZ1J_vxo(p4iF!4nyLXKhDh2C`&(`5!=jfY_Nuz zJQ+HA0-FLjjE;GZ#VGG3bE6PoagQNt!3@ruNV-!Y;tR7XfR{AuSiL^ z6tfZLNeE;cpS5!}>%4T@Zkoiv{DpI*$QFN=%Dpv%pMT!iWBwC^lt)3QDN0@!mS&qG zaLVR&(_hEtc@p%SRX%|u`J;S?|5xnCK4R^h^>XM(mk(SZ=pW{HvM8U3-!(l2l>q)x{ikyJ4K9m)okY$TbcZSN5~Vdf+J{TTzJppf?0z&)JN?yO>565>kmp$eOTnHWNsy6U*(fCvXO@j3S;ZGL^*)5`r+S5@ zp{hN!UfYw&l`&g;ACO{1uvxCnm>24}v1hmG1y4uHI_S2(m_aS2+81zg{Wk8IX9hi$ zzVH{eMpQ4JWH5h5iVTQi+ff6%J{&j1e!#-$lm8UI>2@G#1=JrBXUD-hU&Yuh`o}hw zL&+|uiX~N(qA4%9yPC#pO=bs=6`*;L$+&LDoJ;9~DIR;@g)#4`@_L2dgnKCxV!$@i z_m$NV@J-Syiu}jnFHUd@p}@b2Pzy(ysaV^W?ONfJACWV_h85YT^rA*@*Z+|xoP^dD zWS3XbT#(5l)i~b%oFK*DG|TM3Q}iHk{JgYZJo=h%{4KDlT_=ZIYW)%zd{U!xBeb#D z{J;aEQJdu_DY(as{YVM@-j|~SqMTo2>;-W$%)cC-Lm`H=v|a}{kqd0sb=z%Xh$nDF zl#Lem8=@we>=jVNRT<3pj8WBO^FFuxLfdLL9OZV?%6=Hs(cwTrUh3reKoC9uFRJ=di##YLP3 zA`7sB_ndCPX)M#74O%N3YJqUp3Cd&MOX08tML zg#RsuvZ!h*yDATaX+DYsa58xIH=rGAE|0j5mj%rS+V@iX<1b$VAwFa4HniBg^-~RY zN&FCC*fpyXIyaYf$KcI8^$!Lr$^7}=LV+UVxa|ph)~T|n?D^}Ri$+scnqeB>QQikpIyQb8%2^t1U~keO%O#p3RR3G*{s@v`(Y@mN1s}P+_&-a z8|y%<>Z1AakIJ`>qM0soIY&WrOV*dGdrp^cQ_bNeIz#e5jL>uuy7&Iln%r|q9Vjx>FCFjgzRL=@otj4KN>F+q@OWK_x%_OO&Klpv1K(tkp{_LaEz(6cQVnFYjHUSJoJ=!u zkOTxdc#4o9%x$JRnkfE_Y;b}r-@bic^PH_FS+#u(0+vwjF?Y(88dFg1UTzmdD#kL_ zKAfi#IP>sz4hkFmzuI7<(ag-cZX(+atuoVbp(G5h zMVXyu8O|9M1&anq<@yb(nn`|&+21bYJd`!5=$mIUMIf$~6qEj43K3h>#M*~6AA*=T zW@7naxtMHcwM(z{FYso3i;U2?yQpF%mP391LV2p!(@O;yu^N#O^hro6Zm zzx-;fWFt*1K3Bk{&=$I-;usHk%L{66<|zIjILHCO0X`9NF6}!fOX=Nd`5tMDvwRD^ z&kAakgkWXg;19vPeO%752L>3G?@N(g8=numX89Zq(%8uDyi5!NFRJnSmUpp^AuGkp z%uiwKeut40#~@(9KQr7QF=lI|UD9>hlFLBIyw%%xVwQ5g(t`rfwDL3V!?;90`ejwG z8K?gUoq7bJBT|U2)9X*MZHNSsaeB^{fO;H0=bMu6-`$Mg%Ni3V|Bg0uO5Jy%GfU+g zNe4p(Z9$KHzG2SpS}VK2PCl>Njf_-IO2tv8SSiM3r-Ctt&NpMnIlBGYVAHIw+kYZx z-*&q}eZ>AtM33hg$m3%7qI0Qrh2^G0B8w2LXI`Sh=O6k?O0_GY{&M-9na z4l|v=D5~!Xw}_EMW=ih*l`qyK5_Nt z0jdV%=6xL_*q#9lqWoa*Zv2U>Xj1ZyuU;ZKEn%MOR?fzf*NfT&~Ky71Azj%t7V{9DPp=EE?=t8gf0mx zYj1VDhnRGSa21Ad4ZG~!)|O^&tB{_@(a%ZrxBk;Aj{+G#gHf8U?7GvaY*qf@boqy?<}g- zW%F3-yHLxkH>qyxfnXpkcHx^8#b#rq_AGsh`)S|MFJ5#g58KJTzM+7)kkIO{Tu0?* zl_h5fvwF1$pDU-maE`e=vFh}%>j}f|ISqg}YzpXEir9<4&|)$;$&$;voHKDkXCP{1 zx6Ezi7bX7D!?S*oea&IU)OUBD{yAroFSfC9yX+SmcO=;Cdby2iuC}s!R`lG9QcrlJ8I!sV+vxhMbK|iPfVg7eukdgZ&3l~i5ueXNs4$BqG1iFmdSHeY7fKzV)Dl@za}-R zIB_4S1&esDj<^^teC=v=+VtW6C^?c#a(Ca&w9QxK?@$Dh6_ko8dMWUEIUC-pKp)8* zw|gI{QqaQ03YzVV_hQHOIpBxgKQSn}$Uuv|ASR%bvnnB+b6SuIr-Xd}Rtp2GhDQv? z1|VN?e;zwlk`x*RIk4ajy^`Dqw!~E~T{%bPnnwGv%}jOGmt3%5Y^=K~y?bX$exk9n zq{W}uNDnjC4heA>xTR?NsAu%;b%5oPux|u*oArjRwdYw<)Jc4QNjZ#hHD&T}()qee z?P@&jk(-21Y=HbnyHCDny0jpqeQGeNjJSb}*JTT9tiLa+jEY1T5Pf}qoqD&h?RUe@ z$#NIRlBBo7+AR;C9lk-+pGMG9srM=m2J+$Jis)(Fkz{z*a7vA|-8>LmDRt$ZeCyM=J8{!D= z{dGfr_I`@u_pCm4OkKQA8iXkfVoMOsQboyZsW!V1T6d9?BwBj(ecFWE)I=9{Kk>$> z&T`Vps+e8B1PElhLVro1k*}Ezz`NP&lT9`+ftBMGXA(c_nVKK-E%SAsNgT=$L!jD& zJppCFh1L}0fezRCb~l%(@awE-P~0OOEeO#;%?^0EDlGwzA^O#_9yT8Dy*2$5lf<#vgaWpoogg_|*tl*H$Wh{kIpQ{_Nqq2!r> zugRR&0$ClS!@dD7G|w6@UVc9VXhvgUGP>of4j(#Bj-fZzgVRiWe?#&^?A7Lb?0={7 zF%(=d#{~AgZp^Z92F)}^o6g3h1koHCS~8kKHU%feRyoQG3-h+;^3-z`+fhl)G<5Th zZUk=tOviKLH~HRD?Xch$wZ!r_Z`YB&>|BZ(oh&pklZ9qEcA~q9#)7Km)Mh{A!T$2O zSvG}U6LNMh6KzzZ+#xF~&BLJ|MYqg6r3k)%$LH*Bm)~I}2fP*B1M?sl)7KPH>g?PZ z9k=S2^*v-YFsv3rF15amEZ16=aq#Hto8pt}aC5Nx880Lf3Yqhg2`hRR<;khstJR1V zUH)e-x{vJp3jy(~0O^MAho7=1h(Z-7z16r{^>uiu6fc&2!h~b|J?#B5DxCP%4_Z^| z<=OTZ+7qfDF^ORYcl+PMwIorNZ49_I5Mzh<&>&Gcmys|d!zKlj?s*7+1I57t z#8t5f9QeK252EZv`3GFdV{xXeS?HP1tLap=U)yP_@WIkQq(kG+y;fv!Op)5_DWPwe zCRO{|CKeJ{yQ@>Dy;FTlal6N3Sg<{vYDv@ap(|XQ^a5L4vJrO1D3L9F^SizNN!`*g z^U&{#2V;Vgu#TcN#=-o8m>$7XH9tLNN+*%pqMi{(F#d(QZsC5XFH8ItWiN3{V&1Yx z)p|LvPwsxodU#ZNJ`00xn;7gzfLZbOO%D8-Wz)sUfcP8VEjyXKRLf>$WKbqE<;`($<3jvqJa9Z_|?R8re4?@@91TRm1# zsp5%-{ravRY~KFX2HZ)56WJ)4096HCN!4jZ)2VD7{Y=C2W;2L_8(L~iMBUIZQx%bcu=0S$ zRoP9c7pn-pZ)(dq7Wa;WxO|k3`E3ea&B1}98RQzOrF9X7HToE20u9?x9_6 zXGoo)CMD^9chPdEG*u1!Uw~EXS{tg9j53?BbZ)Qf{JG!MO3^seRGSfsi6Mx=G0a)2 z-$*f`rX(5^UhVqgroW>Igu1P^&ew7yzw;To8lo`U0STDi1#VZtIn%m86mJ`uxUgu} z9N}`ae3Iq-ql)VRdqU@DT#x6g$9CR)k+iWIKQnNZ<~gfQZ06PJPJX<_t(oX?l~OaA zX&VYaT}r1ocM;LEoX)o`XG<`~sRcrB(b=pznlX%`6%0 zQmV<1DHh4#T8QMI4vk*7Zr#Ss-e2Bp+}I^hH4vhdNRsyx?PIekDDoojYbu_-YPVy2 zNqO_u$GT=|%`V=2+3Q7gNc75y0c;@n4 z1YZQjjqsK`mwU(egT?%(CrR9r#5jZ?rR_87EqgU`gmInRHpSMeI&T>#ZcUzTWzj+Y z!2kbfX)F}jlf(I-WfuNaY8#`Hm^e3GxFp-q6N(=tGWh<8Z-ZsGa$Ldw?yyFWfA9sH zepxQNi){P52x0l2n;kxn>8RB6tYZ~QU6|$bKp;KIYb7u4hM}HtVu~qrY-oA_*%nxo zDa98TXKsWnH2|lF7}hmYSfdCvfdjIo9uR{IHW?-PH4VsceApdtY03Ut0oCV!Q|BF8 zeakkPvq7d+!PQirZG!uU;tgK`Dksg97q9?}8LfU36?kR{cUg&cU#p-D6iD%Q4=Yx z`%AWVLg9vcCh|J>cFlw^GFYwXZtshv+n(*L)+jq}jo>IPPf5`p)(0dR}o zM(g<&+$13-KS9Jw|6({WTjtr=`H>$Lt=sHUs0kyRILIHp~;sPFx z2oifbtSOSe=jbm!=0(Uf!)u}UB0?Q$PRTnIAYtU)rp3dZkc3qM-SDH9Cr>ikg}b(l znQyzmDtzg#ji+;v(h6gSlR!+l_u}^lsAjY7pI`J$PD#sv7&u#kx_Pc_j>7h$&@wkL z?d@+Jkha7rbC*>Eezx$!T#CQvUoirf8@W`@#!s>CVFzZ@S^qId{Q=WoBaEl0$}*%r zmz?T^p`IZjgn0=IjD@J29uOT@^KyC)W0G!7Y!~VLyR`6e)jGDN09ovju~O z5B;~O{5vs4BRK~{da1bcDQeYj>K?wJ1mnxO|MLPcmd;5xSSnW5<=8;(ca2y52^~|` zo%*bvAgAs!-U*Hn#yiSKes{`JVSY$ZUVQo;ku0J7$ zTD1ub_;a-hZg)+sF+7-q_T;E_pfp{Zww9~Up#?YY-xBZptty%Y@X~3liy1>2UE{#| zkua~q<}Y9$B`ZSlJ;FIq_*K!55~0IN6~?b8!Jf}NQh5u@=E*JsuU*x@9P@c{ltR-^ zZTe>dgLA*?k_vxtUa2ykWs}1Zp2oef1$+YXDY3QlP|FuOJ6JF)BNlyv@x-ivRJXbk zk3$RlsR}cinGvb;v#ekAOLSS#Xd|sWnc{=wnn4c&MPS{|4*(Q?5ifE_YN}+$?+iT7 zRq#WPS^nAX<}GAYiG*X{gbd)I6Ns6EsQO+=5&JnqK_A5=x+7}fKzuN&^y+BvcBA5K z2?k0MRfpyC7cyS72@=Dn;t%0z%MK-PZxRLAIT6yN2t2Atam^(tdM9PrLrvg@<8ZN* zL5C!3nP!NL$%C?Hz1r&kjWqqu;(Wsmq?!IP)mS%5sfqi4(>SMoBr}0~l!bL3A{OmE zQO(17HU?b{>4V2AESdx7B_;i51Izuvw$7KuCUzr^@&%_wV-X_Pjp0~s8Lu|0EI0sW zxqmNEmywKt*C4{U&~h=(W=!Hxu#zQhGNef*Qz@6zI$qF`6JG?PPVD8J z&R?tmzO#J7QtHaailo50y&W?uCi09`c;S*3t9KA^{E0Ul95MY5waEE6u8}V{4EX&E zEVBw_X&ri)zl3*e;cRIBZnv}S@xS|Dje>J0NdD7X1!3w?4o0T ztV_;FpA;Ju9F0t<%<4zpO7ZTs>aSRfP8pfb+A7{)eEB{-%LOHE^pByBtNgN~()1~+ z6T^)ET;WYRL~w+5XTSVW`hm;?&oLkXjSr^aBH^@_sI?(=GhWk=npVrJ1KKFJN14f^ zi8h7Bpdh2FDzy-xS|v@TaaK;M_{r07u3W(%b-eQZ((Rhdn;Tl*`Q@kr~IW^1Z*tP{Nq#jx5J>Y7;gL96x(?eoi>`9O% zK@FEnKA+g(i{;QQ5sl#>bBGc{E6eUpRP33j;}-Ra`;wb@(pj!Ln%j$Ie*qC;hIj2oZpa$(G;j#_40Bh478*gGah8wpIBRI*Z!{< zG$V>Zo-K|`AYWK1L&y!itHlfAwI)n-mrM`v7&(bca9#)kIGD6T1~zAJbm%a2rh$d( zpisZVMjW82?&3FwutKJ6ZN0nE@ zhz|b&Ds%)V{m?sGDDG}zMFPxsax5t-(PSA~A!IJ^2Z7SCCZm4n%6>^NqIe;Mg7YRv zu@w?mj%2OTL5F*eEju$C{+fyC(qqy??~wn3LQSE$shQ8?&Hf99a$cEak3Vz&)rJ4l z*d)~df(P`ar7IoNc3+jv{(?F+o300?sTa?k<{j3TvnV!O5Bo$P4B)R2PW|{8<%jiL zJ;?b3+NX`PQ0aJDmO!J{2^tX@Jgm2g(AUE#RtYnIlcm4zI3QO2$GONVaOPLx?p5Ao zSXr>Ft~vhHrELqZ|81#r81dwbgV3G75lb8)T#YrHzG; zFp$@>az83%p9WB0f#n^aWjR%qn}J&tp^1d%U!Ia=SWpnUWU1NaT_1opG^@S&_r1a1 zCy|*EZ!acVrr*rHozKlYh$;bvb zY=tDvKvk8Z0~{$sk?S5FvBh5cc|SFtzIhc-+dXoNT9c>$#;n`A9+XckfZieQ?MI;We z-|pz?`yJf}+{)Mdphro~nWG+_AT)!Mk`<=@iKFoR{8+nPTAI%LLu9)OQ9z!pWZ!EJ zjC?|>uhe1gBu3}KrlR4wrqBGA5E^8P9s{DJ{7N|zmcrG!Zf#Ea6UT7-cB(>;On1w+ zrp-TfCEd{hg%ITc%9gSMs#)SaUhrG>Bv#u++c4WMWe%Q=GDm{l8okH5Nrzym>VL%8 zK}DIQK}C|JRnfi(EtlCIaofWlYsic}^G1dic zX6?cmJyrXn9Uuo1zT;GoS8hbEf9FJ}qpbkabv_tDx=!i(i{R>@eOfA#FP01I7NWaQ zZc*M6Sn@M^Eb>H4=vl9Z8vA%@*)YymTC|Xyxn=*||F@I{xxEp!N18nff}M6h7GH*j z#EGteT5i?8$sv7#x+xQPtG+gR{y+$i7lH|(zx@l`Yy3q*M}9S?on_WC!7Xee`~NGD z;iYif_oY(*1#G#u7?6H#JlA2#NxR>m|DC)#si;q7+(Y%C8yo@LS+lAoy08&^+Wfhh(R_>Uz4) z6)j6Q?rds=O31IyDqdc!+L-khw=Z~qniU1QlpRVbd(Y=Lx6W0Wm}Zhg9Ip*-tG1>c zk!#kIx6A)V3l#F+w_A9gNx6;Dsd-WXe)e7ND4ypW!-qg(sU^9jNx2l+DAZ(HOj?oN zY|lfuMHbmAU|N+jfa^u^r_G91aZ7dA&M_i?qyYpllGLKn#~~QwIo8+x8r8=d8MKM zXxPp2^%VMSwHFnybGqe!tjk_n9-h%F&bPvE^etw!iMiH7C%_=_i|Or|>%@Th_8djw;E=)s&csQZhi>7IUFgwq6Yh{rt>ysTYG+3}39grS24+sf&qXAhjqxL-z9? zyy|7@F#a^+KUrwGs>|W9&-%cWf9jeN7?oy%GqEYICZ@y}QoWjg+MQHq3<4R;yXK{4 z8~=2qYuYC5SxwN1h9D3NuGa+BXpNRRLTXpFseg5)6EfN%vlQe0VHuiSLG~HnuV5=6 zG7ri+5KmYlfH{-Hue}-U$DIV*VW;2&+RvV)atyhH=6b$+_Pd_TA7Dx*)VburJKp_T z(`4K3)_B6O-#aNzp)#U7Tk4N%Zfh$=i;-1i;09ci(9NZsT%Ha5m8sK@wi86rvkmim z#~tSuF~3ENa6;@;`?ox{N>K=nWVf$?V_6k^w7X|#nyK^hSsnxS4Ww7`9XOesvjr#% zb0;rT!Zi@Xt`@e0xNv>DOiST(}-c6tgt<=fpyFz6nzsKC#v#Bj2J>LA0#tmkB@p~%12=-5?i8irnG(rptKM`+8rp-RA#7ksPml^VS&$=POM+dL zK4NC`qjUWsGNH85$eMUPdrNsP6{l_2m#lr13ne&v`;>|>88iv{qri4$6-lkaYAO50j98)^g%Yf!Kl4i*jP%q?45vx=xcAtgjiMlL2y$9uc~QevPN1l0aVl=hH0;`O4-Gj`6I%te12Hvwp8{%eK5Nfq%z#?Y7(8 zT6?q$Ucb*uR#|I}mz%c~z%g+2Pkolyxo8?pkZ%U*OvIGiL==@W1 zg^Ke7@qt0r3Q*&%@Xt7ysT?t(Is=v68mY2zN*WvZ>oz26yF{G^3S`3(yQZVr%fOw6 zZ+SKHLZlPkEUkOsF>^=8b4qFE(WhhK%jYk`TyU1Thn0kREslp+1@|cEA;&lrp#rb2 z7$QxhXV&Ez53)oGA`9vT9W`t7>(%?Bw_41HFJT&khCD%Cr{qa6DbCl!IslB3KeUL( zxZ^mK60F|ywzNx>BPc^ExZ!bCAQ*+Shic99x%@4$w^NZz+>e`mwRU`2t54X@X@V0R zh0yfypGjx)Fk2rqlnu_oIGosxc_ao5sz$-KwTATL48gp*2ubgC`C~XIH$s;;=UI0I z|8Fd6l)ZUt?Z6QNRy%_l2cPH~WyH{1E(sQmO!?cs#&wlR<3DkA#3P~j&h%!5P+wWD zHx4EoB50_c)^+I?PwvnahNwCqWUE6ngR-W|K|$7AW0-n(y!uoza$cuJZZArbv?eGd z&$8%`OO93g~x*?7OJN-7^|PmMams;isk{kX3~zIVdqPz z2jrafQ(6|k8!6AzF|g%_-AWyFU9cSU-;KZLx2mI)7t;`0_Nkv#2M>yz|HVbN- z`p7)nolpFLg)WQ<#^ zd1bJpci)}^2G&s)^ox~`ysJ5`fgwroZToZ?x@~`}OXFCRHwu-Ir@`78W`}vs8;Q{L zr;^&Wz^ZdEa6WTXELrCAaJ}5vRAZS~uorMQtx!~Fl*BK8pU)jDhw$z4J;6a4Nk9LIku3nxK4g z+mp2qf24%lMXuX$S=U0=zvIs~osY?;=zVb9x%MpV?8w&aMYW-=fvvt`(v~V?B*kqEY3nh7!&%5x7(^d;v`^H zbn{q-5Z&m@hg9VdsB2Isc&d=d(?wDZF=OoYek6*~`{$liyq+;!?$@6jYg;-b$a-do zTk05`8=Tg$Q5~2zKq2zB+aOov=^KGAeD56X1(_bvC;zZB@@-)vH{Yv2d%Uy8cnED% zwT?;Y z-L?(nI8~y!?9SVbC|Gz&2ZC+2apA(Qr5K96q!xa$cnCPkQzO5;DEoUaC3YKe){xtN zr|7c6AL~;xTfe ziOw;9Y5O<+EexKR#-M7_nO^j7xtid}i30pN0$KBOnYsFi+Ys6a-RRl4(+UG03ktsg z`jl%}hJn$~t5nsQqv(C$H~fDX`>MFAx31k4lz@POge=OS8|hR;Lzxj*+J8YobHy zWNabwN%}3_Ug!L)3v%Wq2|L8Ho%sgeR@_-=<)cKKlz*p(7o47>!{zGM=7MY3+^(d! z*AjU|nG%FaY*NgG{fpQ>97b8aM7i~|;kF3(957X2`N6*QjD0?ds7{cqX|c)ZhDsRd zhe>XX;Sf;2ps-DPuGTSRgo{5kD?6pH9dL(hm6_l^0e2;#HNo;_dW0f={9^U+)Yw#7 zzN36CP>qzbJ!pn1qsCeC6ggdF5l`C{aVCP%=8^b>E0-oo+%v8hYua02!^wm_FQR2} zv2%^Vq2U~`9?VN3-uvh+WYGW;&r=#>s_-qgsgGG2zwX-UsDnh+Xoc0E@7j7U>PyOE z-)-gzzqlWfwy0@n(#|W)>ST8g!WyI7)h>!Ewc_9rJ)ZxTIKSk-Xcde=%P&oy`#C-E zh%}vv^4Y>dk`pI?mubczSV);7EfeSvEL{@>iqRZO-k@GTSxlIi3Be-@$%d38+nSX* zCpn3PrXlzFZmF)S30%>X!qkRoqr5MgFge0Bv>(r3)_inNP%i%BVz-jHFFb5IE0wHo zmh7z5FW6zY5d#N9hYCn}+I%D-bj!E@QGVs(?V}7XcNT8owG-l?0AauQ5R`DHHz!45 z`@+x9eL*ABTv+}HK{+fI6J878ZU>~7*!gzj(yat#+wDn~2GV1&Y7!Gy2M#a1}rire3v|;2rCkMBF+sYz!Eb8TE2HO zuzYQ^7?@^`>%5kiX=>g#mON7{U-?FiU`xV}NLHZ0edSd`!oU2#`1>zy3pKQTy}5W? z+~LU{QG9A>SHp|Th*3phI>m&z2Q@l{a7#6@^S$INgw*Xrf6MBS>5mx0PP-7`a)EpM z0GL7120#4sK09{;lbJFJJ%zk8N#4nYPS|1{1HUYFgu6O+MFxB1ry_Z3>-1-NIFuu^ zvO}dB+!nB})jL5}_Q(KV+TBn;pEMId_B2+KYPY>%6a;q<&UIfDH=E)a&J+df!1zIvJK(xPU-@Uh6Gl57FQML#h=K1~+CY+^LDVmf+rr;tNXi=ja>Yq| z@5^u(n^2O4)z1}1Ct!(&#Z`fbA!?>pr*KJne#WH{pQ!rDm-v+O>^3zn@7j3k`mRT2LsA~ zfKiw*WI|;u#C=`=5Ad0LmtOx}6^RFab0UHkwf%wZCmpozdKa-pCJ z|L3;g`h1uR68s5FC;BWfj;v`)lK0yye~I9pA~eprT!-q+@}`c3dIu>r`6ZN3Ip^m> zJkHb3Mp`8nhd|O@N~U4{%A6UKaE9gIkHup8KOgG>MUaxYsYuU7hidI?9*EhPuNG1X zP;y^Y-dvKrIuS!{{`cMbZY$_K)H*Vp?k2oWk4yfF{0F4`>d@+H5&ScO(RJ0s-kgIw zy|kl$DO-7QI8GB=2l_XTWOd18@ssu`q0sO|!iw(hyLKrI;D!uve|l4Y)={paYnR^T zDboNfQ_NotFFg9NNlY#W?;JGm@??!OPk2j~+R+H66QHBJ zPJp*<4eYJU$#ie!Aww$|elhqVUR9p}pP=wAkwpj8l3J9MbYM&^sIejU$4KYhP zOC@%1n`u5QXe6@3I7R66Z+$otJp#^vzjFb%d{el``4?o(#A#OqICuF`Y>|VDA$%Ge z|7wQawb?k?Kc3T&Ay0>D`tS;v86gDj8sMq@c>cFAt$j#EaN6mF0*Y5VYWyMXf_5BS zS{Mj`Q^Q(FQu5teU+gD5UPO1Kj@HoaH)B=1X8Ima6{0c;) zuma$Vqz&C&8%wk0ZtX$DS`h6EmmS6(nR^VrtFp2E&*OZqCedNbIg5D~lUV7Ar*Mh0QsQwNOY`Y(24>IiMt zjb29?r!H2OTosj$el6gz+8r4Vw-J|79$$MzKFb;fk`GSx_8=(1L(ds;SJm2+ z^tdmkc775V^HfpPEXxqVwY5t^f7)*5pPqK~CtLk1gG;Nc*!?{VD_Qm6X7D=!@48>2 zyWxGEr1*Pjz)Ou8WvnLVqjlUsLGBocaW2@zm|5o|o7o;!kfh8`0q54aSX>%V(f1y) z^nhA9BtA#g6MOU_obGk|VAcYyU!M4TD%qX!#sxGU9ikZY1{Uy)++C+8P&$l#V$<( z->^+D0?ycS;aiLDz!=J*?(!hN5ogd(Y@Pw59&y6NtDiN}U6LTHz>{8?30#n{lmEU? zTlzHq_{O7b5@(Mm>^TU^!VOV>ZNN2w1cJzIC|mpDJ$1%zZN6i|xb=c@I~O1BGtfvU z4xuz0%egDQnEBsIvD^qyJ~{$#|9vsA$GXBn7Z1y1i$>* zsNVY()Gq{_f4q+<9eaP5buMG%5pqENPhq$ zvO9DG^XZ>cwYjC*FHC52*b~I(p8p477n0|S|YW@S+gZ-5MUlq|O({vrEw)=OQ zmN2JDZPL+w9c1!3V9X!y-%UQMUaACB8YhC!6)0+b3Jgy-uQ4T%B)lM5jz~T?7}qG?-iXrWUJj42- z971b0^a)V^O(z{UF^w@t9sTWnUVn%_=e0|T1eKoZnsrqdZ)c>Dk+$1$Bb^qBb#k}e z*cRWkqivnevrzJ{C59)oAp3_%rtBKD58Hp3Kj-5Y#9foZ>_EF3mof^y7<%ZvNX8`BgUI>RdlPe&+fw?C#*pCo}j zYL%78*|;vJo>KPHl`70Dj9_9sW~Smq*aZ&hG^yS2oi(#_yiR zF7;h@4jDaXQ{I!IJ$ujl-ph-_hdojyhTnOJ+S>YHQLwI({q3$Z;97*xwfBV484(dK z0JyIORv``?_9uWlSI$?+x=Az1_NG&vD6)LM*{SaA&lCU4JB2bXcT;o^two)$gAtP8 zWk-=4w0NaWI?9{I^skUw31Z1y9}T*rT!%fOGR4rWNSB zV}!O~G20CY{x@}&gn~}l!&)|R+w<$av&~Y!@#Pun3hh6RRcG6+5--IVEkLPxTt7h6~W86>X+<}`~z7z0jlkvSR5#6tYKZL)J7O;}>_DL4KxGRYG^o~4 z##4JqM}$cJ98$lMD*BaXa>5}Q2^G`euXC*{wj$UN0jZ{`)1mU&;hCd~vup##lNoT? z{~~dIVe^U5@`%CoZAI4!o7RtaE2qHoFTgs1SYjeSSS1bHsQECxwZ=KRpSjxU-1GPMXvA9#XQcR8(E^$04 zg-%2d>Zf+rzTI1UADDMLdB!2mjeTe6*%teKcs_O-wDu2( zwIl!PzqdO>)I0 zxZ@n3OB?Vzs}{~@S2dlk%8=1NzkeA}IlyH;K*qWaq|q*X0QC(7jh+qHUGg(u01tFK z$T%jr>ias=Y23yf@3iAr$w4oQJkZN>V0J-7;N02FaCuMUb1+>@716XnaD<03(ZI~V`A%`PO%!gq=9cmCdgHegYO89V1oR+Q^**LS zzu3=|yuR}U+CF;&FMl$`xl4Zn%;D!BbI)UK!S3W`u}QXB$QLUx6@&_N(_rQTj!xGE z)VSOkKG1weya{Q3odkp`KX#}tquX2cX5I757XP&;Cjr1O}keJsB4wgJWLmw ziPEsmu+#OrY+{n&K~|Pd!P2l=(Q_QId{<=ggkAtg!|$CQ_f0#CUh5F!)GfCq(U~^6 z>UsBB(qwBOi2bes7FT~TFAfL+m?|K}4N0af1kpMj1!>cTA?`WjKx6A2QcDN zi{5`1qkA9>Ouq3n6n@GeYsT{4_ zLPGv|)U;_w2Fb8US;Zv2B3GZ?3z|wqN7R)H2ICs!Y1u22t0fP7gI#d}${y9&CFqmH zkAPdZ2lffL-Jy2=}84{*mcX0Y+%=1a2I@A((9+ zk>n|3@UYY*r8gDuMk{(Uf@xEO3qyAl_XEJDV&)`Ke{F{sd!{+YCO*x461*CI#^;T8 zWOIK2qHu$}O;yb>Dpat_VWs$VpYSai?^IwSyqGm2P%==z?Vgn6*cl-IleerLzdaM- zZQpb-umqke#2#+`0=#l!`&*dw&6$^UF00DPx97i{VbB4YE3bEZ@e*El;~5}Kk)C&> zWT6E1QW#`ua>doWa2%m%rQ+3#VRb)Q&&cz1X)-$-l%U3Uk7l zP*l=rzn|L!UTN0O*B4fi(ndsGthlG^xE;H+6w?A3ThFYTCz}ytd8Rz&EfGVYX`&Gb z*YS{^YWd)+AX(Ovt&qaz0hCgBna`|m-)EW@Km8rzI8vccys2U)kD%`UCez_L*>cy#Bd69a^$DKVpo6oBW#dj3T1v2cG+L<2 z>A3nn@K;J&^JJ0j#hP`Bc|sPcQzSPSGoQuTO>}wM07Tm+WOt#^>YX-ACSM@@Z!<}F z#(UzvD1~tfSV35K@|d>LdALD#L8Y%_edY*^@_)wE?q>vlY$v<11t3-$NE74`irD_; zRLdtnE&P7+W{MX1#M>8G=47Pw)KcQnZ%GVN>v9k%OSOWg42dQmTJGLXtwUa?dTff3 z^o9#2$rHJ9aKk^k22w)2ufX7d<&BH;k?iGWzQ@HHTnY}gkrsOl5Gde=5;Hiw5dJ% zWGC-#)EOoR2_-Jl5xf0VdWwW=zIA4IYZQd937eucoGU)=1y&&!vY#WWpea$^+$=Cc z@38pmckcvsL!6gY*$a=+Us32>ltJ=Aj`2tO3H{zoH_9F=Rb?N-Es!iRb8C*d<(RBc z4HX0-Ny^?1rCGc7*)JH{E7`wpqcda>&gHZDS>o-JHX7=N#|{R&GF&b%M@kMscQ($$ zC~aX7jtsZj1g=?u>_u^T@>7!l>TL)t=wglD?!yOza5P-Pl+@mMuucRW&e0t{r~b98&p zJMs&fu(^qs0jzMK?ft8h?>Wkq%6s&2#|r74l@9i34K&AGequapb>8y)m*;NF(scMI ztBEzW3mjJ0Wb5|W2eo$)D4vBUF-kX1n?XPX**>(!s?({tXBfyVF&ywaTL4GTI}CrW z5rQ!XivI30#pKt4h&3eI2l-eF;+$xUXH$k20SZVGm;65|9k(gsXJ7gJ39cBDP!cjf z93j~FP9q=@{Ghi-#?VY2WdS`5Cvp@TYRBwQNjOx9MO7KxM~@;y@=$(r4*2G7>FpwV z^5z4Ln@(Lktv=nSU>RtHF!+73`S;Su3`g32)WBRCld#um%0S)sz#i&C-}rFL3{ z^ZMFy+JeE7P0HT~*E#u)WE&!@88DCS@hcMJ(^+(pexJTayQQ zPT1TKEw2%VP9K^gE!c+Ms{3W^HfA~L^IMXNe0!joNaN|W+NPRL6D0)VDV8OQRS}z5 ze}~%7n0*^YXyi#IK?`sd24)>i$S08g@%UKNh)_3^k2V}41{n~a@gZ&aWlTuUZh}uZ zL6&ffSJU7Mv!7r$3E$#Ia|9gi@?yYR+^rID_qDc#*qrO7{G6US*BZRk*2*+V#>nhO zu7xh@leI_ABA82y?1wa+Jgc z#3u*BItKbkZwkqd)DKYUdy@r^S<62Zo1*Nq?gpGfEEpifZLhvHcS7fF`@ps+Ff>L4 zwT&7Fqh)KuoWbBQ%*O>YoYR|suJ(@q_LK7dR*1}u8Qn(F?y~dpc zafWE>p>sRnQn=f6`eaF2RPhF{V*+_4__TEGDPGW8p#qyDajoJ)J03eTAMpV@lHO$K z13i7h*SKADutg8$W>2*UIkEcAega5V z4;>7`t=sMveQ%Z$d)~>%Phh>z0GJWCh>tL4z=%B`F1Hzi&0cBZ`*A75@Z+8b8W?zl zY&trK7Nuqyk2Jz@qb5bGFD8;`r40Py0K7CUj_J%@>HH5Em=co6H{AcW3x`XptoVD2>J4<^KKWfeT%^aaJi-e22C<6h0Ox2`^He z?TO~|DBJoakW9wq^UwoC(!KVOp%**vh$oN#FijV)xnmzdlznOMgc4`)XQ*PX9~J#6R&4#|j=-MA@>72FI7it4y#YTprVv;q z6nXW$bGXaXmMAiabOE${-vF|$e46lV5p4pZ!<=|FU;Yp~3_7&1T|Y%E|HWu81v?n{ zaM>|-Rp2Cg!|7i!_J$@F=tFd7iDw*Cq`bD#SB-4Mll*E~`aH@yub_Cb$l~}R+K{ws z;-=O8uIRz95_KGJ>s@A`+t0-CwgizLrS}?PJ&=6}ev3(A-!rz4Iz050I@6#MlTQ|M zcfeS5VB{|g3&?c z0{X-hQU)tqj-ba4T zli_`Zy9N)r0@d~fd2>i(f>P# z)WYRjcv^JOGi`X(?@F%u=C|mP@p@UhfRL|`{d7nzS;h=O4H`SLxO>|B`W=s^8e2r3 zvj>LN{%QJlgp4rG!QnO+OkQ!XRTRW!e94&6&r1Z*^7vmVfEcfvMB#wSH-DnL$9$S& z&T)yJJ(0LC-hU)jJcp*`;# zSL3J77xhR97j!1D2??M$i#7h0OthtXTt8isSM#$PMb>giy&w-Dug%+C#y-Y$eM~KL zD>q#_TLD1y1u^2z7O>_8%iY?=y5f!=%wn<26P!~sK7u(HRx5%EnV4qh$G1{Lq;q0) z?^0y!Yc95pts9F^@OnUfK1%~5d}WcLO~uiIera=C!$hLb8;)JK-tILp8Y=~V9*&)c z&J=jVhp^MlhGU+Jst}u{-E|k>`SGqvw_AaFZxqu0{j=AbvsJO0>$ zg20@P0&cm|h$a73V!Iw@8|7I0ixJmIj&b9yzM$$TSF7GF7uGrQBD}${_JKzu%)D~7 zDku%eDSLRTaS^oT7qx%9siQFWCtg!%c^3n?*~8X)&)fo8X*JXy$jVlOG(E8Duuxt8 zOm3}laL}>;p3UleNylO%n0Q&XSr(*;Tcybi1gnEdt*LM3A7?6*?!2qLK0Rb9(Hy|F zw-vj67&7cZFmKU$B(!nvD)RRMacUD)UPR~ErsSV&SSD;%2Un;1+dT{!eMQy)X? z(Ssh**4EC1K6~2~!0<@uC=yKEFnsm=kF4k~3*;*eY0lvX*7QRs029sqAp{W(wlAT5 zfRShUY8I@&zg5xttv>G$2A>csLQ6pLAlGJ6f8C@N*qOl1!r4}kU&k{tF2J7nflz5} zFuM_M3%m5r1L1DdHzHiC8}SL*xS^AkC1$bQBmudor0s;Jukr!&XJW1kntF9uRytjuW?BMUu{d|Il!TtIf}b@Z9>n_KqL`3 z#-1iU1*HgZPff+U`A+YO4ozO{?|R_a5c(ISkOZ(m}#_PfEC zqiT2r;hIxCVF)`m2Bz7DV^0MMRm z^DR{@;xaeb{!Emrmatn8lJCCVJ&Rw@JPqP8<$c}vCO>@5VRDfl=wuqz*#XAJ2KKDa^s}H zhWyNVee{jZ--BODeMRP%4XGy&%~odEnax&yV2;=nF7ydPQdyrtjDOxvTZ32@PXd3k zbJs!}Fv%=`AqI1dLyhfe9NYnrK`LY?o!7JXux(>)0HT2b4sG0O5?b`;|Lp^sBZB#v zA+O-?T7Awb>W*cgPjB__l*zR?v~8N-LeVc|lyXiVf{acFWR>UZ;MXp!@xilDZanTA z4R-V>n&8Ul)bJzJ54(y9PX!CiAw6oBDB_6%<#7_nSNi>*Fo9vyAd{V39tp* zwfwpdYD0TTq!O;Q@vYIb51)m8j-mNimS3SX0yPoJ7(`tqdIV;9&7Xl-injHM+SeM0 z)(GI7;-bpc1Iu-xqtkK`ntLpdw1hTkNr-$aL?U4mdO8yz;pdUPlphOBXlEK%QmDE} z%UWfVH$VPy=#Aelv5E^}$=w2=t&zi-Xqmum`v45E{N|Ppf&u4rDEw~q!@I-|-`|_R zxeYsk*vmmJI}IXj$en#g67G=HY|MfGx9Xd-G%+7OiD)#CC`q>LxW*ZUz>DuiIJ6WF zP~_Z=xZOAjqQNLyhcxKbmE+P8pb}3OlNA~+)*ftuy(ro}WT`e+X7yHupH z$zzpwPMKX+TqpNvodEB{FDM!#r>${`t;Rr^EY)QK(1{Oc<5P|r=7lmv3{XpBiT8p5 zLDbfr?;=mk#16+`L2zrf#EkU^_`6lBKe8u4jt+HEbY6e-R@wQ<2baGk*$?#e#NRS= z=fj7V{`K_#T4N(XQo;1}8r<2XY%%WM0HbN2dENFBQl7Bv%khQO;Kx&xMiu9Nu9Z8R zd3yHeOeb~yJ}b>QI`IV-rQbcCW*xtDpyh^kx4MX&P$C7g%OIi0B)XW3+sG3FRr>B2A6^@6y_fox8I-!F9zml`qHuD z_8^X_|FeWJe^EeNx&7L8In|HI4U0o-mOnb}em0(!2rS?Y6mJY-sX~PEW8cqwO6pX- zWa}1;*HhEveA21CxjlBDSftQcs+tt~ZSd>em1#96U};G-83Ezc6Jmx>u(~gp$sK#2Lea+017P*B4x{9SpJ<3=KLC!8S=HNNO}$|t}pXu^(HLn+%c{N9QFYAK1Yya zI|!*JUA~Vq@goUhrPgHh`^()$8H`{M(!W}c%0@=(4GYUwNs~{f75v-{-px2A`uHhd z-F^zNyc)vls>>%ka+uyz54#W-<48x1yIhs*ROI)2G}!>K321+X6;K-P(4brAMqMAq z`jZwXPkuRx2*fpMt&?T0tMd!6{o+P%fNVX%>1*0MA3&PrPYf+~hAI9jI2UclftoI z-`VlN{A#hlfo%;sS;H>z%vZRC)EE?|M36;dPGSJJE-Os z+Qr-fR|HB!3g1mulsI^;tECb=OZ;Nrw$yCf?@M3yd^jv_EM{~I>Hk#+`2Fq&lGc9J zV81OgCdX;Whp{6Cq-!L;kPu9zB9v{?;BX_)J6mNY)sBJF{H3f64w6AR(|- z_al6-uZTF`q?Tan9$+vNH25=3J$3v9f}Yj!t9-S(pB0&y$}vrzm{{4UF?IUpX!595 zP|ZMbQeOh7oQVrE|DNRVZZ2SMNI4BoG7m|XHytRl4^?c#63m+|nUd2{iD>+K4Ryw4F^N;xdQt_)@(% z*4ehNom*ZeS-JGb!?@oVmeSLcYkwyY4UpXSBo+!LxjA~*p66y;aq?s`a`sbwKcIs} zFA4s!k05<3w^PyKzXP~?eTe{wnTZNyP-lOG{iddK*a(ocUlo&$eYC{v>%ajS zyH8Yb2%^GhnMnu$8=}S@`39$=^u~x@jPf-@qm$eeNQfR^=P3o7CH?VdF)33DY)JivISGZNKLNqXEyFOrwxPjIz)A- z9oE}#JAks5a1YI4d#7g*f?6LjGgGYOX_JO^n#|$#bf6teqzTV~AmlXwwge!@4ax&maM7PLs7Qc0mN&Y?ePM5i%*v-N%id+6+fU$=Xo=BtzDo_n3km=qXKXhDY+&=2yZ zU5?)+6rd5Cz|Xu5z~nd;7HO&)&StRlfon`}{K^AHmLXQoof?b$qH8>~1!tf!r)aR= z?F2sG=5tjBZs|yeCagq$po-4Kr!)t~kASz@etZtZU!c3hotI1h`jaGq|1g znO^@8+3zN_m7#I)MB9{}4=LJzJ+VWpeMj&vZ1QUZ!L0rS;7m58 zLG>iOYKX^a4kezN$#?Y^%IW%zgIM4OQN;{>Z|fZI%zZ~uRnys-H+BU3vlyXz!9!oz zvBwAp^g=HlS?9GI5xzeG3x{{e0vH(+x2FU?fjz9dFchcY`VSaM33TGUO-PAV^-fDe z0Bs#ZAOu#9$9;^B$Gz-qysssy4K^ZvemoV&KBS7w_*t0!zbZ^`Mj>8SE1@pnSX zu`qldd{pS2xs|QI7PFsZ8Ob>rsHE2$?({(K*hX@loC5+dCnT!c8)Ewo3}Hl4lTcj5 zHoEa#vfVS1{yseTL^r~XgOUShLhms=77i7fMjAg~cl4+y&?2E#LvH{Weg184i*!-2 zgK9N~P4Mw|H?7kB=^qgHHi+#W*q3oX4q8y8HCD^Qjs0N@d(bFKz7M!!T&RIY;;SCm zz4fqnZ4@@#)zHNg5b^w-xmm?mN~#)Bc>h)9$@LV5(cCKZ`D>0gKDgET`~E);(G?=$~&-^|7}?W#?}fwCU6C#gd3c^UUxi3=6Hk+f*#OUZ_dSjUgC{ zi0u>K4LojRpM13Ldwce`?AO);6#6R`#29kCS~XkpnP%6KD~`@uz;Ki{86h*z8`0R&;Xx=hJg2bw{D4O3-%b!DX;ByaOHzM9K(M7eHKsf ztpjA`(RN<}C5S849OAuGUHSV7^@>VGhc~0-D|DkL`m$BX@TO8#U^Y7?Oe%*hLO!LJ zEsH?p$v3c<`6B}JqE)^8MAd+pv8i)LX6in&&H`aPy*A^IhL9!Qeg0uEv z1X}t8?Luf4nO=_w*@q5cXx%bhoEFzGx{yOt);ElFG8uaci|9KT)EW>!1EwPuSrwrm zW5qqEyWtDFt8%Z@w{-u%jOomD&v`vX#6Ms-dd!T8^+;X_o5Zm1+BRwLwFpPXHHh&x zAkE=$6JqPn5YvBg9QxO5Ld(T>!$JrbAlA6_w@@6UdW@qOn?Q*0izg6qR@?(mte=f< z>-Dto3G4MZT5#~D`|EM(5Mn!!q-m{537~{Y57G5()@D41+!pS@z0}3?R2>V8=k*OO z$7Z@g(aVPeuf^61hP;t-R{AleVvQiyN^zc&(3pBO?jMl40@Ik)pH=tl4% zA;^Gu!iY{G(NRKKL&hNOMgAd~s(t!}9{??vXa?&Y&?Nf-$QR+-;efAWBlmGuXSp`oQLMfWPJV8?VW|jf!{ecseCT z_mLs0U>ollG`u08Niw(tCkI!GaykjG_F6#?-)Y8(G^A%CE@WHWytSwkMv*lI&l*br(rZ}srk_J_Y2p#KCr)jAt=z_ zmZGS&%_=hxV)KqxCbH~Ue=hXf!7DswI(_lh6+_k~bWVHvfml$m<9cB$4%I_RiIwz- z&o+T+{R`KB2FrgVZ(t|6P9zv6*O2zSV1~$QaGwtZ$bAS|qMDE9xuqnu{D(x!W1rwO z_9s2Ey<5oOW+H_+PUWM;NJpBu^pJE#o#T;WPgbT<&&gYbu7PkIfo@AKY&oUkTsfK(2V~L6zV#gW_DLU4BRIb*zn=v$VD-)x z!NzU319>s&#`Q1KxKBj>A6|nfp>+W63SeW^FyGsi)yS}b`Zg<*CVFFkg^9G@Egqw@ zxY6?xVlD$nwWFx|XJ{3Iiu>&J+Jvu2q#P#o18-&tS`Pcb2>~r!)Q*}t`XkT_F}8h{ zx`EYDAcJsbnNvd$OF&kOcV1gUiXa-wJJVFt;?)kr?M*MG@QsCu^mjxy#JszDeD ztB%l(BGf~*cwHpXHsNT=44KyONW{CrksP6LF3~)V-hh@z4XwQRI2#~%A;0_^To7cZ*Ap3FEj_X`A&Bd-dk-=WvqcnuruXlXf?rJ+(qu?3|^ zz9t70efkL8{gN49YMh=bG5tLPEkd;dN=Nn!z!ao7)v%9_RD9$TN6Wq66D~h{E83=m zld+i>woI7#()NukqcVYRTE{)9JyInxn-r?|5!bW|N9FJ8Dbwhu4O&43c;CGFEo2z( zw!PU-$x81^8aH2ZO#q$)7)wz3w>=ax5H<+?vXOjcjta=$B}{r;uk;n2JPH2Bm^ zVC@^V$~9XHtAzV>#NK~IC(~M@pFU}maiwc#PJ_JPAkPW2+m!Pz6vUZOkN2GY zx&)K>`0CTJmDXXKLpe1i|4Px*EdWM7)5^#W(JD@Ov?%5A z4~jfE>bCm@L>&#D5@()8)fBg_JIi(Yh0E@TX-*ZE@q<&6gAioa$`RBTEK}s^fRuO9 z35`CYzKGLqdlJ<*J`S^FVRDghc-E~_&|D}-j7u>BDHJBWTYaS`+iK&lIH<$vs|gt= z$eh&C@OdlURQox|t6EPl$+H+Dz)>WeR7tP_b!FEv@pmXQ%d2D@c|S73yxI{hCA!f- z3k*kgHyXmR#nA0RV`stQMo;7o+$ z$m`66(BwtO_UZ>t3r+Dh5OAhE4kTj_&w%hD@fw~diXDWJKOtlsgPcKnw!u%nU`V25 zgxb%_=b)?BrQp%gdJeIL>@;f;-12>}ZB6F={V83D>vx)}&++-h));bheLUldI+*W% z!)nKEXBEh;1JRt-(ubip2&LNsuqSqD;S`gvpl#}U&|udmzh{sdfWSM=7Cfg)N? zW`{ftQ?U&6jl|aRMN{|`YGILOuCk_tVK2uJD9uj(r+-ASUC~1bdwgmc&_W|ej`Wi9hm#zHmIm6G}KjhDFc) zBAk$Mr068>K+!`NHR>fyUc#PGraW-FjP{fDN(J5o`18a!5)AZwZU=e?fP zZ!Y`<`D3wRn1zH&TTP3ZfFrk+{v{Fw!24Ct$(Xm?5eOJjuqm-2|7hX<$lxlZl9e`h z=NX%xykQO&cjw|SN^3Sv;h~-O_`>nk?yjpiWm59VR+PqWI_Ey!zBGw*|I)+nm#o#> zSCrDfGk#+aY;6bcHn4GAvbky0vVCx)F;0#=@QJNTyV}gYN}Zoi6rTvbyl#gd(fXH^ zI51!O@!i)h&yR~z$rr$i77&jiVue+oUY&C8840vJG~XWjLh7h*ZZ|R`GlElK#aBN3 z-HvBEx*%cMUsF6OLO;3n&}d^-#Db}`#U~dbO6AD9YqZCnS(&kVqelgj-f~Y?czGWq z8W(#FoXo|@9caS@VO-%>kN$4v#C0)~o4yx;E zHNLwxPM3MQtuPwd^W~d)iVqXQjC9A8QjD&g1AxRoJ0uinI_JHefT<=q0f?9KuHDsS zpW+|3D-xDE+tRln&odZ}UoYcP$XEl+4goQR+d_#X4L+I2irAL@PAfk_PmtS2y#6>BE-fECW>ZK>9 zLj)P5_K8V|Qj%=~MPK&8rzHpk8eG|VqsN#@GV86-KVc8mdKtE!QVriifpe0f-jUf~ENBL1?FqQ4bG=r|;Mk6YiTwrX=huA-5FTc?ej= zT2aX?-JWVOfQW(mTCyPU)8LC4u~;c;{G~zoPEakbGnN}Ise_JKGxc?m$L!@c$TQaj z-cJ-S1X5-+lM89yvqqSkOL2Xo=rNC@IJ-#ioENH7(x`D6;Em+aQb_vU=W!LftiNN)>dAUXI?ccwoW9eWyA9FZDr!+@yf*l;+bTn5q zi(SeWxO*UJWLCagc4gR<5fM8fE(k7WcBeffU!-1qN4wn0M5P~E_Yx!cpvQgnbNDgD z5;q{u12|y_{PhdCzlre+pmv7bYjow55`g?DevJHniIL8t9a*+-IOM`6U^qWPpM$8{ z`3t{5P9R^(Wz8%~2jA4kI}*NWD)0;20=`n45bGB!3uYh@i2r;1$IBGLiKDAgQDSSe z_p>v8S{Zj$u%Hj2JGavB;^mV)bg_CyLGsXr>)94Pvu5a>z5uU%Ry@`$)Ps{yqP~nZ zy3H7EgJ@yb2=OXc$DX8c=OkArC4u&P5%P?2@{9}WUz1)Vi=|A1ceSd0P;z3gkHz{s z_-(fnkfqb~#FL!d_CrYzn$obJITKo8a|cy@_P1>>%YDW6LcGSF`^u6X7=7nMvkvyQ{1|a6rymkxQW6b)<~n zXw?&p-GHscp_q7}P*Y03{`6d-HCq-JZBh=~n0`X+N z=1k}fimXFgt`;%(pA=3AWImkQ^uv8;>DB3F_e;2yiaGPTS>-2h>CY4P?HqKs zD>TEscl29>Eht{6J`v8KAP|50jYugi}rv_JEQ0 z3H~wVcWQeRd@I3K9HL5z&t|zTfmHn*C7Si#HtX?LwWb(;Jbi6wJx7ZJ^J2vZ3TX)_ z&-~o}1x6EDef?_PSki7-X9hY0Bnp;0FHm|mU=J)5JWSl; zuICnW__!Vl4KyfCO?u(UR_hKD~{%W z|2-AI$KK;VSiVTs2`RNHWi#pt@L#@AwU#9=S1565QWM1fGMn9|>`-prCHX4lh^2R4 zs8?YES@s7=S0*e}N;)u_jy<4p_wS^!WB!18ermS5PlH0_q((Nq=zW;C*oiY zV`+ymR`5Pv-l)uYDoyj#=cj@F1Cc%simAKU=VZ&@5_<2O;OBEnyM>UMe1U6{I#06it6-_wa$!(^K2Z!3g|0Q9|t<_OH-dc%N^D&rC-A+R65S_)Zfk zslhL?J$a|nL(Z!8Spj@J{k`e=2qnk!06p#5-Rp4L>RG)PAxGDtJ9&jb4H?@^q5aNl zPWdJMZu*@k^~1Wea`QX6<&&%6`*w0HF{}782~T(}(GX7a_=IqOfrT;2_NT9gnpkV_ z%j_*tEL}S>9emsc?&2!`riu0V<80Xk2jvu&+RtJtPMt01cd=cPVG6@Af zZvZN@A~!H3jaCDg$`&ObJZ`7({ zh=a%VRv?@XU|H*T2}@8KwF0vR=}NlN#&MTrUXW{)R^YcG z>b@HUdt}H~%OKefcIAvfwOGURa55)aPf^U7lN8*_H@%-A$REuClrZz&A+v_}Dh2{6 z8iE7FZhg)WPz4$Kf^V&E4?0d{L8kxd{j{gxtI&qDc-WWHj?P%<;)GM4%q0utX!_1r z6>X0ymlYqxL8!i?0z4i8G3btvjlP@IOi?=eJs&lrK*&l>n z+DQ7&Fa04cbJ(Q$TTb81Xfc1xZ6#C6>a)#Ctz~}bjBei+xa4L9uO`}itb`xPoKl*u zyLnr{1;z|gUefHxeb6wdvGDpL1Rt*IPJroGe+Zh8-XB|Bblwv|yicUHGw9C4)i}LI z)Pb8>Il^}uwwk~_ZNfE5mVv%EN;yfHlQR}w3a_u4D?|rhPfN|Vm4CFy(s?Q6lTV|V zxR4{DbiqFLqa(29yC>0R&(V36>be=t%6d9Dkf@gWZ$-smNGTk1Zsb-EBo+~fd!XBR ze7A-8Ci25ibN`V0s$&O%YG1&M&uFU+S%tS>a@kI1*6+sS(==;^1koLUC^w{vZUXby znOq(%w|^RVBR#=X-2#(DnJ~#69!`w2PDIyr2t&vDodMJ_DS8=d%eZl!ho}W*zaA-$~;P+zOCTaScx8@vwF>y{s=G@^`XW;Cs zzl3*h#6q@wyLz zWpQ~B$a(d_8!GUHs1a=E+=5ojL*Uy*9|RkR_Lq*+LUkFIn82gUe+ojVcDhYnny+pddZ6bp7 zZEkU&+3jpU9WARU*>)-f^PQzd#U9RMgIlmtv>SY(Z!s5j{6gQ_fJacS9pVD)8$)1W z#YUQ?`+>PO>oU-kd~PoA`XAKdu-~;D4Vyzd8kc5*bZCOq871ZOM>*?louu5?-}|0! zXms8AH@0!49dqk?O}u&DkM|3P|iBV5GFqhu5R>L;#L{ZY3I%v1X1i zzocel1&6U3>IFSb>HDZh-~^zOaZykFX=gH^Bh!=^xtc+kT`Kg8{x)zKah1 zTNj7Ke>8_VfE}oHbo&WfuBH`W>{>Osdeni=iPs|!;`N5J*1%)MR@(AVuRQ(;%&~R| z$FI5m)UGd7ISNqBLLopS*y{90rZL$lr4N7H-f;!E@wJVmB5_e+O2#_e*tNJX=gb+O zM~q;@zf#D5#-bxwxY7rGG5A0Nt5K{Rhbeaw?DvqP*T0Td8iY4(H~S^vS<^bMnF7l7v|j=?n=zg$OaFbCK@s@X~GppsFo! zpg4AxKx|WL!d}oNG>c_<_t|KRt?$d9AkZYqA6M&Fli;7 zpfpQ^$<&ap0#6CgNK#s>LPsE}rwK?n^y=Ws z_rbb=v~5&2wSoW-b1Gnk+GfD&((&7)d7>@hJHNLxYtFss^>`12AtlFeHjcm8f*1;X z>|MK2oy$l%e94)@?kRFvXAZQ^-54V=KF+XjsSv~eAVCa?E0SIi@5f&cpgkJqJ*wjbP0FufdG*nlCdS)FbNS*0v>-v?945YVvUQ(~~>R*AoL@B8%s z^g08DDg~OnxpGA*B7ihWdD*(8P<{wlMD`uc2k?L9=@A5m?JB6rV==9(X3H@07(fF5 zWXEZ>^z8@tNvpThS*64P(Jsc24wf4J39m?{%};uzVvMwF(SNb5=vjvp%Zlk1y5MjR z>KJ#bH_(7|$buO(w{nlky$B5HVH`(o*KLZ1R~R{df!OJjnKz8!oqGF5CC&b(!m4$G zXr|Kr&~4dXW3RNA=!JJQ6 z8Qw0j>rQst4$ZD=7>tH71EDw%j6^k|#ZR9G9^}Ycj357AP{FR#KZmpm`FUU`COo23FDfPIas#JQqBI`uusH8<2zl-Fz@pch)or`s@P1T=xTmklrGo_uhi$|Iid>qet>_pK0o> zJRj}*Th5�Sq>Sx5{iQE; z642t&sT}tJ%(m}z=Ha1flhj?o3r)_~XG$aNI3I(I(1yKQ;A6*M- zKbTe^VA8wLd3iFx$O-yMqxm<$KHuUTh{aVr(f3^*d9X8apgN10bygq5CQ9Y-7s7iyCd}`tc*rr zvm63;+pWe)n>>9rA(w6=!X?Yq!)LlkVi_nCRG#=KNDeGiT`nR`9$DXy13&xl8raM; zx>m}64)mqN`;jHPjgtrx^@?MEBjxem{;n7TmFD+Zti@oiE*|Qe3AUXLXJz-7YqWbH zmglZ>QDeG9%i<&}5r)ZI&8lv5fgl|2189*_kx9EBFvgR4zd#n%Kd6;if)g>1dV%@XGcjs_N@;l22^*}M6JGEo^)R4aeXt_<+D$&8`S zs`y)C1_srg<8U3d!lB+0FEDk6r)INTC$upH)Doez??xUv2?c%&@KS4>VKnb4H!%Hs zvTiWkOu$MJ$({&STQ>g+uB@Oo%jAdDDTM4hsR`+po-rDG0aUJTH-MEKqv`7cmnf-@LGCqbD?LK;Mpz)0sethM5_v%^X6+~WP`_i~c;-7Ay$on;j`m zZ24{I664PhfU{7}3>yAz$)u1zqka&#uv_A{f$ieQ1kg=@DOL*#8hn3*v~7l>HK~c& zUG}GyVSStV0dTC;1M673X&0LX4nWjnT`H@+<0({L{DYvwM3Fn>8SzuLE*0{OuW$5Z zy@jD#H0+{9F)XZv6`yIMfM;m}^gvZ5No-HQ{xg;rOrEaz1U)yB?<8pAc`iDf!Di@o z8z3;9w}2Kmfz_ZdB=x*lUK94d5{=mLrG#X9Zz#QMK(nLUUAJ_5eyY`8NC!#nAws*N zn*NoJViqlTv_Iz|Q8La-z!%^Jvt}a5@%`-J_B-mUgs*zGSedb=UF7=@47cv=9UP{B zb2;|tC$0wfiMuoftZdJ{q_SI1;T-rYXlDhR4uV%#UTbkTz#l+LNv9(WO{YEx4#$u- z>DVCihh8i@S*{F3vKijq_x1+aS6*JNNAgY*4Xf+=zg!3x1ZDS29l)SNAaTUE^XdZF zJvc!Spvd)VSN)|^#!2>mjCoVaP)?5j<#}{T_s*EQd&^88!xncO?NFPLe zdSm0Gn2j)LU(hOkfdxnv`{jZQidFD@A$W7<-LedEXB==~DO z(hbH&BA!My6>f0qx% zWeAj|4{1DbpldmwJU^DtL#U~JE2)GFo6OdG3HVeL==SmC<~nC*|IBR$gy=N~{or!)C-D6LuWpmJgm z#5!7Qx$aW30_pSsC{!)TcqfknaVJ!%IM+K=hQI39Z4KiBFPnFPM z1s;H+)OO}aDIY!1Yp8{3F+1f7e%&z}&kr7B^{n$|Rzt>i5bZ0CH_1OBPUB_}IvZl8Ad>8R3I6*28#k$4uy`kk*4 z3Ci-^d18dWjQ>7O&osM}yyr!ko^5i(0R8!77$AsBh8!NfIVThiZ=GYU2X+Q0921va zIHQj*$^mfZ<>xm&K5GB?8}^|4nZq5VzX`M+X*E=Q^sB@YS+eSl0M%`Q7;U?yQs!Z! zyY=c2X!e?wveL;gZ-$h6Ni;N2e1Qa^#?&3SLpb!i!quz? zEIa5X0?DOTq`rp>kSK+tOK@Ss{{ zd-A#nrvYAWZiqO!g88w17weSc!t=Z>^3}St61Ob(xHmboz4Y>(J;=V2LrdMMUd6Lp>1H)434@5b3feo4E0P9Qu3DJ`V|Fpg78ui z=v7L7_2N$>xl?Ozl@9uErffSbt{v)Oo5;u;tTM1l=1(bVsWF=x5hZ9uCfJv0Py$s_d>6 z4&6cc2+2bP&KwVo(erFfaya2R{|KN)bX0wz%*Sw0^t`3`VS7sO1K#J;8x)+fJ`v9K z0d&GbK+)!kXHHlZC(Lw%Eq2$_5h6MA2F6paw6x06#>)3x?>zlbtOj}!Z)yhFe?E3d z#oMMh{tU|mO=iPtmTy4g{a@s^VCDh>EK;Dzgubj3)5;_A_t?q+qe9D!OYZV+3v}Bn za(BiHVj+U0ZD?LbfXnt;DC3{A%CO6$mx>NU==^2YV$|MfxE?Tf&zJXk*6(jX`{Y=O zFajnKTMlK7_N*PC%Nj29edUyF`)7CNT1C$$RBsPzkei9GsKo>0puF%H>ey#tIxskh z8ksw+wM`&mauB4lrEBoV8yxiw0N#R6=9djB3UNw*t}YO3a>%A7Z7?g1A=Kph;CtS! zlQwku=T513OC@>U^k=p7T(;#4CA|1iu_d=!Tp`bVDCOf>AjBviaGRcAb{7qs4()HL zCqqps;C~bdZS?J#64-}f2VwUDMxvWk2Jw#*Le0nBu_cd7%>qTEiY`RRoSwZBVU!&_ zU*O1?fA)fST?zsU9upZ2vR;wfyk!kH1WGiT4fTrS+8B3PQ$1U-}hc&pe%`*OAS+1F(kk$F=@!f#A&Aay;K1^m$ z#!0lxyPuV)bR`k5KZD`81leTTmld+=OlT!l)1N`qv@CP44iU^r1a+q&$|CUAxSYe@ zl7c(sauWVP6-Z{_B_?1e7m|i5v|NiIaDwVX1V76s9Pj>g& zXEfF=eu`~Xsu#X2E9)O{Yp$Z8{Qbe{Q*q)=oZ0m<7+$KKP#D;#O9+_ws#~1zj0mid zv0eDUy4*0HzG2pgcR1;Mp%U59e0Or@);DrFNn)i|Q{g!R2hfB3clJj>U+5(r`ajY9 zLR5*Faop7vq`mP$sX-PWadaPTe_^7BHy&@{YbB=s9B3TJ($l0kvuGHSe?eVF&IP$= zUwyCAb~<9az^L&c%o%KL!*hO*vHInU2FHt^B8gZ_5DJ~I0h?SlQT)$`bGN`?#sT?7 zk_uU58$*Z(H@t`d%>vV}E}biASpOQWZ|pS-bKKp!J=echuo2n{s&``0j+R29c;LLJ zWs~Y3;aqU3ge|623q13|KY3a;sa{C=Jmd=j!uA84GcOoyo|$|#hhywUz^lpT+qB_E zP-}%U2DN&MLU9{+MiqWTE-2#K?#JRa+_Z%Ed|j&Y<69mfcDRQ0T7)o4gEAy|O@sy4 zHg*!CW|$v~_#U?)@Nvnp4zXDc>V_HL;p6lYAnxT0$JXwbs1JJC&oS2!Xyrzr^XurIl6Qg)dE42 z8z5T#T>LHkqt?=CF)^+4%km1DCTznuNOI@v^w(p&f39u>F}Zpd$IvqJYL-qoYSokTv2Kh^e!AeDzO!$?f+ zV`edw*d<^lLdHisQYjOIk&8Xi_6 zUeJ!BV}BF<+Yd?yaTZ45;+Y1O(RO2N-;5{57_~|XHQEzF`=&(TAGP3 zT{}fwj!+PK|7L>VM;xtW3Vm-1dqnMFXnOBww4G?=XAU4Eq^Q-*!`S)4wrg)>{TG z!-4{eb>~Wkqd#PJGr;5kB(=2O+Fj8REFiI;^6zFk_VWK!A-`3n2r8>8mEc0bo~LbI z2I*(=%dNaiMys@EC`Htjn%K+ms`{(vG3W9(2-%}4Dh46ecO(4@&?_6x5?@u;zs7&^ zk|ZBR&s)R)chNgW@#IsHzYutXxps(-w6cw%UV2V$4vPTfL&_m=KV@?EvG#VlPvqL! zK5C`s#KGvk;sx=LCwpkBHoY*i88y_yb{ap(fwPXtiKXYP0ec#s`% zVJrQ2-X|lQakF+|D|6kywIf&z3t(|db|u1_t}FPX>mvF#wC>QLVaL!LQvP-80FR!VHxABvro>@q1 z)h*a}Mi@fSftUoH8%j8~5t6?r1BxG-l~b*c&a~?gMNWVHhkIE-U)(Rami-1dkt!}z zNghp4A;d8Rn?~M;YU^oS40CUwIw6S;v>#>&eS=q6#_U@&(?jA$AN(fun<;U!*oq== zfNQoKad6@}_F~!+xRbMIMiegDY~Ay?Q5-DxKHLvg^WQLhWl&x+sY<~u1s%EOo=42l zVaT|K{T^3@9~yVLShK!yQnp*{Q67~Fdp^=~ByB3Z3!YYwH1VWYxASH8;_p3 z5|a8ft#5Sd9EE&3&v z9q!bH3a^*7vU4!eZtGDd>;ZI+T=K=?*(23-ejI(L+vkg_ zLKqhlU#B%>M%|zR9$0-#w1l;?wC2PBdeOGglo~L#T>i|US$%d$PgqF5L_w;SX?h{?s= zGVHI{dgkBGT>RSFxg(kD^D~o|mXuC>D zXIvx14wXtm>*muNz8m_Vt*|_w2Y9v0H(V73t~kUh^>9At#&H(L3!I0Z)8Pk5hB zs%0%opt=h4Ed+!GAEWt}r=z~@Q_Co zvz~)W6{zu>HVohb!>wm+&@HQ_9!Ck+4Cj~CU%dQ<+8j^E0qCBOO6pqYTsSOjQ_saN zBYa@%9ekYhpAuS|(oEpgH~vP2av!@EzAY8t3I(!qz~E`_sNcL6y%KLs4Q{L9c&j_8 z3RI$$t^>+ezb69v=b}2cVah0dVeT+uiWk3`#nv_`wFK!i(Tsi&L|vU)x28V%GQHZb z6?T;*2&H2BG!n0I2^S2(5$azp(u$#El%hrmGgWAeDS)JQ3Hj~2dyuK1o4fqjo))O9 z>wOi<<@?g=$%~QH7|u#j32>&frHn^jkUAuo-%hGQ3?stIGVn}q?K;UmjAZAv;Hc5b zkPfHV=iAP(Q)Bw7+dfI`9_=w$IlgUz)It5MD@P*8g(8l0}Mm!nPt7)f{SpB~(DMkM=y) zI3ZidWJuk=typ18Dj9ygSq;nT4 zFLdf2%`WH^9flf1eS-X%nS-o@x#(QDccr>W($-J5c?x+CIO-~0J;RZ86$s%8{ico9A&&X+0e>dsAi z57DsTA<4fgr)|7n_*C}01LztcIkb%(V?W9g?qy*h`hl7kC7X<)K#NoH4XXvP>WEO) zhDdGUbk0}|7|xCaoxhIz-cgQF!w_!O)KGs#&Y!~0;jmmaJnU*e*y-ab=eu)S#KQ5s zS|yv><+aaVmz6x#aJ&8-=rhM-m z9*^1y-5nbEqGKzgx?*8}v4d1&#(qbK`buBNg{ahs>DUkB9A8_g%1XWBEFX*79YU>n z$C3m4OM95jg!IkCxMhbmb&cU3Ra}U=R1pz)~uYkPqV;{1) zH%EIdwSK{&DXNt^0kioXl^#A&ev+N%5H~y7TSv!d*KzOsu4;-vaBZfrgGssazGhmc z(I$v`=k8mL!BYUh7|#edZymR+A)eBUmMwBIq1Y>s9`app#8Rva>An+V^rK%mr$s#;Y?Bsk6taT`D`bis48kVnW z*!q^skMH>`PEocrUjx-i^8zX8JFy&RfTYfGhHi_Lc60>Dl^Ijp=SM7G4hRr|A8@9$ z^AZ&kn9q)2dvm57alCLT&vcWccgq!Ghw1{Kt(JU_43JbUG;reK`WBFZ!bl1UP6utq zP&nt(PKgo)no8R9pqW<<%(_P#$q0N{wg>g>0I6%Kn{$&;k)4atyH{v^ z@1&}ofU0!ukHr0}h_);t<$E^28YGwOp3hsd3kGK4{Ant-7iPz=`tHhu0_V%^xC#>u z`jE$~Qr!k1nN>XuoQg~%V5N5n*TL2_3;NFh*|84GPjH`(7&;MO8l)$S<1De*8$?y@ zmo`_uBDpwvh(uK7Bi-@=_vV+g&UUu-bE(Ab-xVWHoY71rE76JoaCMdVS2;HD3=7=; z{*!VFLKvvk4$C-50fnDs<`RO~zO!2GPjBhcT{W6K4JdDDmK<~*Q z{^!%_-PP*9S4PQtd9Lj3EdKbr>m6-zRnU4&27XuOMXwQe2%hU;AZZ2TjvFNdy7g5K ze$Rc`swHn*JP)BDQmMo)NuFhv!ySqvhj8Q1XNYlfzGv&N%suBK+>dhIz*4l=Ji5OL zNWqdj9P64_+T-<6<$q~((nq>;o6yxi;LpEKKV?~fzxuTLfbEY$;|gXExED5jQZF8X z_Hy0$?Jw}fX{L;tQo6DCKKt}%Bekca_#o`<+v!`=pI^p3C`xx$Ipoq;uMa9T4kZr2 z$q%m=Cjt+F%zqw&Ir*}M4$=QS1QX?D`S&s~keuh%Z~#J8^>o@vB7Knj2cZrQ#P)mp z_r`_=AMeB@4dXL%f&vTB&s26g+2W36vM07(5E;GdH4ga5KdegUrW<2tA}VW=W(KMs zM0dO?bv(;<8;RL>`~4Uj?TaoreQ!G3G9nyU_Y)4CpT}N4N__BzLUexEWl5AXmiFVf z`um2yn)IDP(Sz(B=Hoen5cBXaG0aHlZwUIqDV`T`xCaWm+P5Mn!%HydB8R2q=6q#@ zfzpdd8tcC5R&|uY6ieYSlc}-blK7j}7vGAgQf4jO-MA7Z%Uh~|Mj)MestKAzWCvtKf*%gJX67Fb7 zt>MB?1o1B=n{_~5+i=3tGY+86+RHfiWZo_KGPmbrr(h!PY^aO!MAGjLJL_@ZvB0y` z-cshdXrqeQ#kJX+n`bw^jtDz92rQjikAFflc9U5vx8j>M0t406oL~M0HgC}QuO@Et z>J5xvy3$(f!^2kGl>M17T!N#~wE2d98hzor)bx8b;e^@q=85&b`wXXw|CP@f$Ro>e zKj|A@{|#NbMkj$u#WLPwpI&kuZ4WiLw^J;1<_J4HGexiI#JK*@`IdE<|9)MN#OnT1 z&V8JK9BiN!wZ>LOUdmO<^L>TF1_o1<0;w>rYm}ykpudgIiQqBY07QNi*(KV$>}4jD7O{dsFU*R_%wa_6(0d*Mr=`IEx~D;wfNulRbp< z--Eg{B0i$|!I;Dhoj<}K#R@;t3HXMd)|?A*z2T)zTw=4VaZ#>j04m*B1C5_GC*f~G z&k1&#&6}y;Pea=A=+(|dkc})!WYki~r!#YfT=ZlUTiin2yXb({Q=kOO~T)XciNn8xD z-|$8NIi+IWT7M1O+6J^1I9yYj* zp%xnc>!2i2blIOEzd!!e9SbZ2!Ksdk5ia>nRsP=? zvbG0-`q!TgT3OHQm0M=&IPw5M2l@q(mu|;hxL9>Y)gFpJczRkc@GD5c+^K0l<<=7E& zPco5DEeb40jlEYx?q{H#yXeHTMHE!+ms_sklU(sy}H0a@B;~DNMM1XzT9m*>`}lc$fxTJ@z~y2waMV+ zSMUM8P*)K7g6paHeyT|{iz{2$qS&Dm075)D5+@>KbO=W7q*T7@C|dqhkYp)qvm2B* z*~#7(2nDEzM^|LmdVIYI%-(is%O`S#!crN&XM-{Oj#g#?5Tv;TW~yhF)qXdUe@Bc^ zn6OvlN>njJ5;4kgr^{!1e?Akr(iA$RzWSUaaU2o0SG{>(Zo(;*GnZ}xXO8tPB1Y$E zhZfx*j^bQ;yd^Ue&J2_F7?8^0u>ovRc76D`Ov8!p=OiK+>zFLDLxOz+#*IY-e7%Qf z75Q1x3vyH3YX^e=bABP8Vvk3(l2akCdXD5SY_BsoY5{RG02)pbatT2^{Hv^V7>WSb zwU>&Aw)PN|S(*TfUX_FJrt}3Ogd9ZDrqpN1pza#>wbR)fZ0U6(-$PTm7`iL~yhf-w z;x(7Qihht;&V8IKY?M6uLCrxl*IEh+F-L74AJjL*8ju&W@adJ7=ygJ~54rhovU>zV zig>juBr5!j+pN|oXJE{wtleGzC0XR=~$Av;o7vIwhy8xuLE-k z-lZJAyWJ{%&2mW^rTMJC$3{4=`jpaJCC*4pxr5JdMo8gFW{=`8bjQ!*Q-Rnve8EI_Dgg;1(Mn7@Z ziU=>Dj#}T9z>K+eDnkeVgE$65uP8!|`%JsdhuyQ&Y$@zBGT8G_q%81l*&@eNO+yA;)t5`9eD`UxmXK`R6@b+3iiYo}Dw0n|NkK zd3>I4+Au`O@@5_f!iAN_CqBcd8y35}-#;Ht9Vg!SOGaSVeKvNKa7sM z_(G59y9xUmsqer2#j&3igy)f4OeloIWYh|d!kPJtt-sB!;E3AM2J&rwigjW^tk0dv zaIq|!JI;s`FC}hM34|8dDT0N)I-<&RpR;42OX0jG8lQbu+KT?Fbcb}ejO(C{FOKwC z#f``Ntk%$GZs8l+YCjh3_@BT!#1bVca2-%05@t*}QYnCUJHXaUjxXI23)c?2TPMQX zFzB@2$~4IDvF^oyP?M$+gTTF$<(oScQ-HT%1(y9vCwc0w#rhBJ zo}yMGaX918;F|CT7~oFqNFGT=8$I=#HZN^T(CEVjJ-8Id2SHF`QDNEs&r0n7_i^IplXiaE0>9mY zW|@OWu$8hv@TF_dK>lR3-HOY5Z^8<(78>0fT7;S%wh19Z=x*PfGyfg*Y{~=P9RMr# z7ba1TvCk4vzq~@IvCxwtojORE68vHDXmx6dpYHOFao<+fghl}ZqshnDBO!|;mGVm8 zZ$qV;0SM6|I#qcp8d8f7-4T`?U3!NqPs4v+K=h9piY{+$rhA~t5cMYm@QD-?-hcZx#z zTqd7zoji%lw01PG zqx{)@^G-0HX`0fswf94_eUM@YRQTF#yRJkaV!njT*f^RuMpEGTxzRWT<~8J)2_2|4 zVB9i|`vgh!83 zH>DhBaeOW^UK5-W{x^*4ukU@}j>9s;fSTP%GlKIMo8L(+B-@j5xgrDDO3!Hs#dj-u ziT2_-5@xP9HBa?_7Bw9sp`9_!?H3OdCX4f$5#-Hh2Wc8L*y`YIWe6w@Rb_!T`mH>->jvdA= zf%M@W3}ihiGegTVKXb$Bq%08rG@K9rwH(mbGO_*jM8b03upWIDFH8oW-hlk{3NS1e z09rU!VAo6m+sGFKR6cH!#Si_qdg*a9tTq`mN+C8S%uR} zh{PEmtP6)Y*z7%Zold7)mN_Jeob50(Ja?(t}0$?xm$f>RF*~Q;}*U z^3+ZS!=MoZ+?|k1&wp=TcoeUGNd|I~`Dlvk40cavbu?;!vr|2EdpvU;^P)h9 zQ|R8j#5A*5!#fRD`1&ryT{AX+PR)oj>zkkKQnqctAD}K-O%UU}#2wAf#xZ?0sw%3k zAD*RQ=cYQq2UO-(2UMqT`Z&)933#P^QG=U!78-#+%<2y(7$EwUn?0|Q-_#(mPz^9d zofYv$g7OZksqg*YxI~sM5v+6f%QCe+U1H8WNA^ztFjbG5XuC&xKkwS?bngz>EEx~W z#|kXMLZ?RD_NCHt)@t}uRGwVmAMjvlCIxC~KY5U5Bu z`rC;9*k|5qs1tTHp2+R_%fbb+r#YS&1Ake(LL0SdkxzMS5AgLRbCNWwOun5+9rH%K z>Gs-ZYdrgrid9T4v?5+fP(o$IpH9-viGBuK&N z7bTMETmP{~Xten8l9`2&?S`FJ9sFFA1H64@QYiBZ)P0dL%-d2vYv2^4gN86oB)y=Q zm-+;M!6|}&Ycv$}$bk;SjwN#0T};PXjMevK@wA1c&YwqWoyTe68)5}Y-S_29UnMwU zAB8`H#)Nok4OpeI0XB~dc|S0ce>D9*ImtA))f=efn=OzIz1h@@x}W^JB!^Ep4ME?d z_+;rBtsrl)-Uk9lnYJW>_c}jmM{_N#FfVm#%!)K8uzUYPYl#fA`b~-ltM^aPKY;+x zMra%pbcN=&BB^aBMz^c3vzv01bKoC5k3=&%xB5-AYqDV}} z68D|As**p2>^zdE+ozi=n+fbR&baTRDLgN~u`T!zP42pR^{b^sB~1hw5l3yeA%lVjl^hQcKc z6qThxQCWxZcGI6Kz0SC)NZvg81>W7bFXwrT6w7;ba)Wix;N91~KI9PBK|nmGX($T=r0WO&l&%w zjMRM=4eKlCLuF_mTZ`E6QU3ts(j;h<+AFi3e3)P$J(fgbQ}}1{=2W;={o%n&&2LEsy?&3Tay5AC+}6+B zRz%VH4ZyB;Ro3%K zpAFfTH2mSI0F%Jvk1Co|M1Y*gd2T%L-Er6KN=}MmOSPZIfaX@tz!={ZA_xW1R zO;`GLxjy(7$d@^`GrgL*SG?i=3bh-)kzYqs!!6&iM!>t!%skqHsW@oH98W)}3G6-M zgtG(l1}V}cKbnEkSLp?{%{M0uxsQkE$E7m^D!Hh85%YiV&f=K`&m+&J$;08}!^ke- zC~sEiT{~{Gj!~Me1fXfxA%*ujr1!m0o4QdTu@e)3aX&fbTM(g{?Fjs{nD6LytCw8& z+ow!J&_mW3engT4RFBO6ay&6uV(Ekw|Ig8-6<1nv1M>VK@VPoe6B?4i$1pDoYzxKl z!7Ty6ZFOI({1s&n9BGGOQ1^KLQ$o`f+46~H{#8(uz{KD=Fz@&sMyF$ent45FJP52X zCSackuknZM77t+BWd%62ME962sQcUGc?ewzlX-Df!ZpYo+7F9%yca$EYYhkXm_d*W zr3YQ=n~ZOiM2^k=9IB_#2is&BlcCd~K@b751@<1iYo5AhS$03I>*EP1uQaB%8Rp(j z0$uFFUxx;ePS{YZp^DErxvSw~lppD7{9!HmN)OnACIFLM2BE1jagxx$PEGN!YY8Ma z5g+=cZxuo=$Dq$lHv-yICNH3xmUy`h7OwlmuDWated}b-dXJRljng#)_7lFe2hj+d z{h8P8@82nn0>ZC4vPZcu^%@y5d=W`IVCNyOy3F(knq$aE?q<+&k!sP4s*?|vMr?a;Tb8Wk9F zk5B!sWTx&r{u=GKUfoDwO!C4O9@~V*=@@|k9?qkAKmh5u?=Q<=nP89O0iPMIA|ZTv zx6fRZXN>K$nuPsb7A6E;#kQ*ourQfhQ-epI)9d!^u}R?J-1WMC*3-qt|Hd?eL+!dZqpEvN^NDWMHis0@X#psI=)~FINgKx;lbC1w@d~LnY4gDqRf-TgT9Gh8kct zCGnTO78rPr-1zWU2tU1$P~cj9T2s?aqOJs_NMr6H-6NqjMFOsPa{`P*`zw8owfcO5 z@c)GhGO>Y|KWBvyy`ZTmP#ltn`Rk2NMeCBVgT|;xO7?9uc!Ve=W}C3eB9B*ln4j$v zUSRz~4+epjU^y=2IYT9(IF{kek3N1m=A5-J6Z1Zje|lxrzT z5jXM%jn<$UG6fqxPi0-1qs$N?fzbGP&B|BZO$R5Imy0#4vv1{g+%&iXXx7n3*4}xA zn2A&zeQoXR_{b|19WX|kkx3zjgn|TL4#^qjsqVN1y-q3^7rZ%!r8Qg?lKtElK6BlL zqb~dPYypdM4C?IdhjgHFo@reFpm{+kiY3pb8}o6AV-}R#p+4%&-{T&a4a=6ijPG7J z9AT!c69M#9(&BNyukEaV4;twGpDTT0DCXAz*_%uwx9-k=t?Nv-y_J-I@)A?kKgl!FK+*l>mL-M_k8R82r;8_P=)NepRH(g!%K1d1L9xczt;W-9uRfuVMgyS+C=dAla+p=I|N z-P-!=Bk)|{4gwF(l1M=Qz|8w3l1Gfa0!Lh4Kh7ai*ZX}sEOY%Z*fG;UBI&Df|MnYA z=a1(ks3c~<%PGBGNh!wKUe^@R(M%A~wqy6dhsZ1HO{G*c1A$(FwDztV z>J3^HW5i&UYmAA7o~FDJgb9GJU)}ZpwR8|+sw6v_;{R7>2W!s^0WXv}0D*PxGv4wC zvNrr9Y_&0$<6giwDid(j&Un@^NO{q56gwQr<+OwrjhYwczJu{-P#)p|#Vtd2&I;%& z8NZ|Knh+Yz=?t;8K{p~KPXMn##_KH@=;0qEB8r~-)gln1U%5+=iQ-H|@Kya+9lxBM zZOY>J$iZbe0ZaNOl@eG?3ZPSwp`4iHXnG@163^84Y0Zw4Dv3K-5E3dwW=N%JfqRz3T#F9)b_4ss1nWa)FRld3(&E<)c> z8gmYd!V6AjOw{+?e}PH533@Iy|L+kEq4_-^m~D{Hizmw2K(=7EevAMjUdFxxs1(Cv zc#$|@01%+6`f{rEB(D5=5a<%83o7DdZ49)t%Gq>S zzRoK_HSPzVZ@^Ql%v9Wc0*-Q|&4biQWRBw-4$L%e=n$&uza=cvCp01)`L2D;*7jMU zw|<7{awg!@gnP#&MbC$YmE*Dlr(OU?4@_$OrmnLzyTVSi)JEByX5X~MC}EU;RMZ5 z`m*1z-u#tH15=%xqu0dIH`*d)aCNN4!BxN3=3@}cLP00{s zPH0br*mqvW-JkXRrLWJmfkMXU3Dj&1eJihx74bKc(_6NMf7jlu04DJjAM$2p|5z>e zQa$RIxYzr(uR=_%1r;f}D|fssZ6$Pt&K9-{ZVi9^J-W6640dF;V6?YV&vk!VLeIXu zB=Ah)NQY+>{j7X<;6K4~YsvMJX`X4d3})iPK3HOzKH#@5p^# znF0f>wb91`+8gfWrx@NuK4a%Ppl1>((!+lLiHnj(!&sYXo$PPX&yyc@eiasGu+OVm zhJ|TLs5{W{I0e}PP7uCyBfn-rBCsy>I|{5>7rXZhTe6y});0HG+-o28Y=3>e8|gM|i{RR51G>)TQq+0%E%t^&pTDyruEGH{Iy-5K^KbINg#cJ<3^X!hF!K)wg<;Rv*YCt*u(=iOEY9*TQ_(|1 z)XRVbtgc_2*B^kOwF{*A)w-pd&Ujc{i}aP{zLC}a%+f*Q+V68f3}(YLO#?taJ@vXk zxU-7)YDeT1>mkN6V5r!Ig?!`;vrSbHpCe~Rn;r%*V)S!X>^8JZZJ9942J%CoGr6#2 zg1-07qnr()QK^;T&M8~l31%b{s;?P9rg4z{?8G)7ZRGmv!ymGfTEH>f;$HR57dQ|| zVSjKW2qgYU2Oj-_%Wv6QodEcysay>f5F~ALd$qn1Pmo1Su<=t9(RcG-7?+sDN{x^h z#lCJzZWrkP+)dKf`^lKVNY&!N{Dn<~`ije?Xc++b#mQ}~Mqe$_n*3st;m&t_WqK}` z6FSlz{n-p)WV-GHVd}LkhBR$j?boUzRIan?aYS5Q8*nO#VmiguN;GGqL&UMi7M}v- z-N zDMvs-b+zr%-vKtUJV1&)Yb5iA0sy{^!DQ0KSMm15Zo~FJtMlrZp`T$f8q_lI51YU z+4=boY{U9OZ?PD?Y#vUAO|kgQ37@x*j|2qSwOyT|mc5 zyc5M?jh|^dTCu&~@Fv}Zz*_U~4Pc^k7ABu7^~kfx-9ZH3aod|wjxJ}EOX=WjQJ@&4 z;#`d5ZK$|-!8v2?npy#gx>kUJM7|Z2v7`dnFd(n5g7zD};W%XqJ;1G{l%y z_AHPYCO)$;<2WT>vxQxFRfnIdiQSvhp2DnLrv9-VeI2iJKPP7G>wMjV`Uk&=vKwXS z{a6d*rhB_?aYuX~i=8MWH%E!JW6XhQcyR7JFG^IE~enAgm4agaeM!SJMfgK zggubR{k86TmANmTp_k*(jc#X;)von_<4*U|cd<;U%k+)s4!noU5^rb8U*{zPu&jS^ z-qeHzpw|?F@^7IF@|&ev4~&mh`%zX#nEe3GaGE~Wk9j&C>Y=emveqgOXhZ~nmP)+Y z?tZ*616wUnI7r+SJe~o9VQQTL{1)eyiQv3s#3;QtuCOE#Y_8sU5xZq9$Zg* z3p;kTf)(FJXH>5O_eu5&yBBqMU;Scn`3m2NTPxNp>3M5JYa+wg$z~ zxn1nVa#~d&a6zQKhGtlRr9<~|Hz?9V5JUc$_P?Fh;w>vIKr*}doQgs>XW5(8&#@_A z;WX|`x7KF-hL$6ie^coKs~*1YN0>av>TT!WXKIetg^`M^_C#J!kn-4W|MX6 zD|QYs+C_A?D=dgfb#oq5p*oz>z%sU`8w~tZ%Vf1}$&T%eFdkczSWW`)0d$7)BX_dg zj8><#Z{Z(B(~S}}3F|unq`9+SeURIDpxavrU5XvV^N?@M_~6iVeEdO^&WdvGT)`sM z3jK>WTGtL@ytbJ&{&@5{UHeM5<^2sHGBMuedG3b@wy;zr@^2>6s zAPr?gxkCCk79yB$yz%U=rO@7~O?Lj+EdE)r%iyZb7iwt)a`sTX8@QF>Kwmie6yylI z7!kRfJ2%NoJa3m9OC1~)u!4)WE8h%wCXUmNFQzLP5+4HD2)!co%a+}OHTxc}ez6=S z-|>j?bSg?uc_nlllgsalO`q;lX_Q@Q?#c_ttzbfk)}H0;5`gvo1AZ5o$T8HN-CxWH zKdmo0XArU?IPIk5Frs-UvCq1309)m!7uz29Ydtu#cOFdC6|KDcGSvAk2E^?wbfD?h zBkq~bJu>bWz%tuG^-R(6 zKdk8@T{|j_$uH8jsp$*aLgZl(6{|DF^}oVI-d}oVnhy===B&`+SMbP;pA?TIzZ5+| zDH-o?*Xy|$<(reRc%Mn@EOVu%LFjNVv0HSO1NR_w<(DMzT!&Ia2h*)(+|{P=bc2i4 z544w-qzyQ->pRrauYrODI#?Xb(#0L1N<^RpIR#OEPEi>a$v-5de~EcbtCA==@37XERL;}dqV|dE425&VAF&V$ zE>d+GEgy9DUJu=+^xI>hA^94KN&|hHVhGT;<#$FY7o1X4O;fMoyj>5tD#O#!D_e?M zv!c+XTuJ3;bUm@hiI4AQ*r7fJu6R`LwDRvdA9OJr3$F0)HSe1q)4YlNlY5MpDBcnT zOo7cMoQpji9IBS_{iKYHk4k4z{CrkJOSi$E4U=)Ac?otS>1kZU5HD}Ew{QPQ%4CN||JQal$+$^MgkJ z`1=B0jN3&3(=x6U6ZqZL5D0J8=5>XI3Xwe7ZE0+jtRtjju66>AKxf#b9f{Fw zgRE`{gQp-rrqHscEU$gYtVZ^QN!zz+p(&ulXUnQRC&qYG>bd?WpCS#GSGS7rYms6T z9=aV`wHK!F04Ba^l++6YR)I_6KJP0-jY_K=x1jKpg1pyRL1 zHpY19p`bN+0OSoVHrNM|ng%lX4twQ0`Y3d!aU=KT`B-dW`PG))Qivm!l1heOmPLgkZf|;Skp!Xrtj+>k z+Zm$oZ!bco4` zR_%9_e81iV4V{hd5OJWg1$Y<{aK;dKOCrPsFqK_LC6T|~Xr(l|m}J9fTqT~qMrR&2 zRqfR_73FBUz%MOO7F95Ei%S-0s@EE7Zune9eO0Vnmq#p7dl2N5b=n~me+`#XT!M80 z*ESV$!5a+{feEgrw*N_!sjoI>`4>juw@7mCRq3sD3R=5bpkMNlRn+HW7T>t$9|7_4T)OE^#8tGnLTFJ_ zxXv0K+>NQyPTM8-nXYWlx-ObLr;HTNCV@Q8GDneP8}jz4D8qElb}qpPfCB2FL52B8 zTaXuLRyg1)Q-8Z|Hq{fs#aJxvJnnikar+<(G@>7I!6hCKWU0|%tyePmvJ`7$&PlXR zAV8~vNOpjgnAehtg=*$V-vgtazio7(_!8sb{E~FJa3-C5aRA{{q7abvWY@dghjm%&M2WUuE3tMe!-Kq{;%}a71vvT=V~Qn9c?QfxCjvFm zEl%ZwiHU~Y5BtcGg@?!`J*1ENerqNAWzH{rJUjFhyd<4F^x~jD_fh)^@!asn1YV?J zR%hA{t9J71$?L5I{52hncc6}+*8Be|H33oG@XgliL`SS=7SL$AjUBj!fB|Z@^ox zB7MQXldPVmTwhUZWdgw>b%)1*XB-l>izLnO$M)HthW>N~vi+c+(N(m2!Aj7MbnSmOQea7IMxxO??xn_9#)! z^&vC4l}S$T zBPV?PLc`^Y;U&~QD8=C$M7$-+Ew>)h9?(9`iFX)Mc4Spe3F%0-H%vfBj#4`R5`-^d zU#egTHMXD)EQHrBb>!wwbPG)9duL8~>4O@6!$J$Hy6cn3m-kX5)+0n}UOJiG^TMdox z!KeFJcUR`*2iFH?DQgHkjF#Cpy_$r~1W%QcDPNf`;YGuW1+nk?gHpswVm*hi^kPAL z9}k@RZ&wTdm6>T=LsN?9Y;ggHVToKZoziML&4jI|11$F8Z-OM#ijd!LEtDaM7s}uT z?wjHPci)9AtQQ?d&z`9tHyJ$Jr7|FzgBgBgZAMiwvYbb}S-5%#E{&0t6&O zyzwwOsO~#Q9iAa%0)3~|?{hJ&Nhmlm{zkD4&-?l)qMi1m{OMiJ4RX9d6FcixeIkWf z8ltd(uJw7TKA2*GK{Ed_Q1t^48#7ql_$-CdOwhl^btmP(2*G+2fp)qM<6*vSYA&O0d)-l}tKN|L0&sukpu|vxwF|QPQ;K|@^ z^}qJhIMP?{8|Bv?$8zuCk#L?biDrZ=czqX9bD;rNKu?2P@#2)DQio#%z6B^QZ<46I znBXmgJMernDWmVIZjY|mJx}&E8pH=ryi;b%qEoWq?!}k@D9(P7RXLBXksRfI!+c|< zI?6go{2nqrQJ2`Z&uk?^g)sG_{dWJLI5vTLT2IG0Ou#y`Ybnr}$y zwH*_`PnR6{{tlDV=NuhCq46y)XtLHz$;oTn0Bid3EdGA41LzNhG_OL3%Rr_*ZR%ZQ zJhxd{Z#0OJt1}?zFx;stM0NAUDjgDL=1+EL;HXQff8>r(V3jGM^iWE4VS7N52`pKX z=s2I1Q(IhTtaC`YAhIG$;nxtTd_TRje|rn8WwoB6XJ5=ZCdHqN{h=9EKxHUr`yquP z#VrOBXPgjANZ!yb7=nD6t^o3VkR(8O9}HE;P6_v!9~M>L|0ls=k)3Jav{~=_WtnDr zG0)gv#(ZGrJGa0A5CVdSZ02a3TJ4ZdAn#L0?)hMv(Xm=Z{u!=FO)HtvdPd6L$I5<& zG~L7XmYvZRyn3lGJ(4YD$rgs?X_?kv;(ruN6T@9MI=kuvp$n_DS%4P{UV>ilo5s=Y zd=@JzSP3f?_&U7`8I*n?xe(>-B5N10|0AP%*g=zJL!*mUUAz}ka7PRsgl9XLc|e~i z-f?59cH7|ToJDCgGi&?9ThQ@Su5DJ<<6Dfry;k*|sD^|lHGP(AcFU@C(>1Y1s87KY zbk59%U|+^>@a~<<^AOnZPM>Uf80&38mI{|sf{O=E?BvqxeY57=f%UXy-qB#9OdQi6`+xos?Fp0>^ghfqZdP!hy)`vE?bpa5q&BGvgysdYn z-?E5_tfXIa`@JGTOvFJA&es&SHxN9epwYxhnVK(tt?251?r zc2id~!Y&5pB)8Yv-#TwEyuanm8SLU3j#26E7S6m8KI$Q-b*}qanN}(5stl!^f3Q-) zaQs}DBfb7R9tzQ&yC4pN^IBmQw%Rbc)7!KnKb{|2&J4Z)z%uWQdf3)H4@EO!n6JoX zP7@o}`_F9A_cB}&aqGPkrD}b!N4SiO)G;Q%YcjtXA@xlir z>KlM9pO*nS?hbNu4qAJwMB|)yw{*d?F|(S_96-=}aQud&saX^M37gKEEO&Io%rIDA z*6om6Zw@zP@0Z9vw@@`@D9^Ci2RzujT>eeI;LRg}Ph0TMleg~&c*2N|O;<;Od3@EL zn@hu(m>Euu{BmZ-`uoGs043q5ASY+{_?%`=%_|>gV9iV1`g0{|51@B`0%!;2^rNb9 zu@noj1|FnGzi83ZiCC#)4UkA$ExG5qRD)J#INrssX!E-L-0Jwv>K)VWHlc0S0*l(k zzVXp|v#u>0f0$>-s1`l9u5g-Oh^($r3`MHXQ5F^p6+f5{Fi;?Q=!PlAelr6HM>n(8 zHN(zCrGIto-}bYh@!qREQ2Iu7AO|E1fMU3V#HiCkCc_O_V$$Z1Ol>?gGE>7>9b~7x}jBnYN?3ZFcuq$lF|L>%QYiJGk zrS$9PSK*6x3&h@`dK;hXj*`tDTVD6tJ&<_+%Bl$y??&*r zt|iMv$#|7gDGzcc_m=2~Ee!2q>Y}W*uwSO;CebD@){uQJa56Q`4}zD%3^ z0YT(NE%OYs1l?ha-ybNA{VbVszjP43YW1*o2-WqTi&_!wPL1wl{N2e}F=u zz-zRjU4bE%`+tKQ%Qi-+0kAN^f~KBlI+8K5io4uLRf%6~8)MmxUCpSS4nu+aR>Vhr zOGA{_#v9#N;@$*NHQ|@~xJNc~OL$)Cu+D3W<~OS;Z=^-6>nLqB+vesEY(wKfsd3w)u`MNhyP?aYIj6E=E|T#$R({%}}s{y+BOGF45}Dy1-}+r0CaVa(GSl&Q+D2M@VCxh|;4Zd(lTal8TLIvJe3l@EbvSGj?;AW1yNa}G zMp=9vw2JxJxL86JR>8-&DP%E#p^p~>-b=t*`4b~RH>TGmx&JobOe2I9=MIkKpu)`LhG~rf4i*53VNm_v8|I zt4UZ|Q~KiHO@e-)_UGa`<6Xgvtt>G0lEBwtIn%nx7N*Zn$u=^6g3*Yrs}l@oyy#uM zabtMT;!tkjzvk6^TsLrugW{l{n8i-UahN^!0H}U@0BKJ+zk1`)!eMyP0o-bO`y5@3 z4JnRE$E7l*|Guq>X8-2F^3?)li6{}Z<>Vj_=nnlbe2-NW&0#yCPsc*z0PymU!ER3` zr)xLBz#Ij(QNrwA&A?~EL*q2-i~f20BjB`yp;t<2R+D|ORn@IT*Pont@tC?5u|*G^-}#Zdu)$N+?Pk45_E9@w@%4}~rR%^CHz6_dR-!-d-JWabM zK<{(sA|^_H_OKhHP8R!k&>>U=F`*OSRAn!yZcV#h{#r3J|Lb@dTL-i3U<_wr3n!1W z@X?oVM=`FT49P!!eglI1KA=O`mNcxZ4B$XrTYQErCFDK~M>^)j5jd|yhgBtK(kDty zO$iM}KDpTTM&9CD;^0rOMX-WMrJqv5*RJZ{@ysotJ2+{OFK5$lrI7gsvBp)L$9faB zIkiL+IFm+LgU%tkD`gc@6@Ainzx|f%DyDZLPuu1HxmN0QJQ78(KD4g0eF$;$h1wXE zamDm>M`z|;iBO90MU>&RS``GZh!`5XELOOy_B0^o7%_1e1|h|JklV`FzB9y+vq=KW z?kee6swEoGUPiJ)XZJQfPUCYTb$D%)I7>TcLn-Z;^F%Q>4y%_GwxzxFv46>TZ^SaT zVVRzrf}AvNu@3At=C3q8N(P^Jb5J|aUx8Nr_ND7&%OsYP(r+BH$~x~&!Jywm(c-P> z_-vWIfmBFQgRT&QyhH>~<^+E1?Xe=8He5T=u=g}ZOjKJuPkjrF3E_FZ7t#~V(7DQv z>oQ7=x^O)bdsECoufuc6L;SpU*+9S4BPrQtvrxZp)q*$Ycvek*I(N(~?ui47mp-}o zxhc}Qp3`@`5ykU{C9*HNMI?fhT%GCnERNEy3iFX`y>Alk<@ZbJfJI6qg`ttIbpZX; zCa*?59jv0rXY48iWphWE(n7~*gi2V*BdQ+Gd6h3EG2U~&xv;ts)d9bb=DE}UDVe)y ze=)v==ohEub8*G@WT~a}ii=2W^?`KvwH5}P=McBqk~QjCHGt-hR=taJ0z~Z>5J}_2 z*As)Wg$LiLo5tNZl|<$?g^z$VY=tIl@r7(t^Z;}v z(oQ*2nBe+;=fP@G$wP3?`^1B(eED1tpr-s2hwAYkiNR|#Wjktf&sX-~_%g{kTpmLU zQCau=fo&JRf;CUqbgL|~iz9{(e6LsROnIZ>MU=>2t{Cq;KweGt%YbPj9}U^-ybh9k zF@g@>boy)>$<S^tL`SeCZ1I=C?Qq-jLp$6_D(_a;N^=Csx6!B>6()sI6Fwy2Btz20Uo$r9sC?W1xsy{e8?l!Cb>hv{Vw)G5|f#Ig&&z#Re0cd&qZT%$@q(itLrBZ906(ZAm|Abfd}k*t&`R5CjtQPDapaQ@4n$J&Q_@ zgMvbru7{w$&wvBhDOV^zdd1j*XPjd{y9~4K{l-cZcWXqrUSi<3714+xPNNTE!p0;$ zh6~Aekkxd4J9z}^vm2k%UgAroXiWsF6quJQ-Z=ZSUC4lYTZ7(CWla{wc$V1xAjGY; zz$)Rp#BZ;4gNkGFa8GR=oW_`%&3k=t+Az7SHL82fd;eQ@zD-=}>D*5ZJ!r-wd$1AUG>$$dPIy%50yi{yt)fw(0QQTWSM_Ou z4f#Q*O1c>cc`U4CrlgIDiA|@Ju8umNi}}OwEiGK&u>wI!P|q0F=E{d7Z5OeFTd1?l zkh~qkTfl%n2D?OSSG$Q)T305Tkyl8CA3vQW|1iYv4!fR%k>-kdspt|$li>BEw99z| zxQY4MJj09-xDhevMtLt~W#UmRVF)WwtAKO{Yk5T51twQB*G1Ztt^bXyL^)qQFn`@& za8RPFiJb72;eeD~0<2(#sum?^yvK5om+8JlvLC)XdY@?6qlq0hvSJ)OHm!tZA=bx< z8q6C$|1;$Y0?KxHb>}ouvm>&x8Y<55a+uVkE+RG2YGfQ_ZmYo0rtxeH7V!f&PU9q= z?{}WPk0zJx9DRB72;R>Pt**P(+A!H>6LzJ_=j@Jdn?o1Q~75v3wVK;Jg`_?y3|5<+vn~S*%k?*hO#W+~d2h@4~sL?2}h= zEV*1=W|02dOBEi(D;^%bGrZLyc9=2GG(dIXV?54VEQux&WYZJ8Q< zm}--foET2y+*jVA5sonWFBjYIIh!hY#L-8bqn0^*^o7fDm8a{yYqHQeV&5px&Apo- zqd4_R34gi_%3jCAX)NC2YnYsD@pix7YUETUO`la!l`R|j1Y&}$w)oOh@LdPC&j~>+ zQsE&fusCd}G!fN$s>)%ZC|UyQ#zAtXMjWl}R*w>~nIUjG7XK+*?ojItR(cGeXPYZg z0<)k!U$dkc^F>67R)W|~&osZ#G72gM$^$X_Efib(*kJ>ba{+4O>U@V!b6nm?ID@kr zfSW9J;wQ)u?YOioT8-3~v_iRajQ1ll27x%=|M+bkfOVv~{CWfr#y) z{6ib*fPcfhjzugujW=-V$p&@qgf`7PX;l={7r)X`s(sIjZk}k)Eu}X|M8g4Ln}5yv zlrJcL4;U@e*SG0C34v@?h0D2Ku>_DM+maBr`_=isD%Y~ugniB+PKM@d17L42vCX|x zn>82rH{(bPx#IEU!zA5`C-26O*%Gvqk6hz?n8tve(?^d2DTi$j-d!Ujbc*FaU(?n6{S&9Vs zc+InC`pw;`YJog0D*Lqin||Bl0z=b09c)A9&0-~y3w1|opHjg%nJPfvzc*8-fYGwn z6Z}S67DyRdppzhYUy&@29-+E4IL98n#5j)-+bv3F9>L2|c6p)=d|ZAC26fm46b8dL zsOQu~UqFlRA82iLQKWp{F;>%BLC@U&i!UWNTQt1;FQTK_U}=V`WMUEr$&`v^w&6-= zS{)}4HskQbtExJj%TRrEd73`hp|~F>)jr)BZma+u8F;@HV^v)9D}oI_Va7D8Ch@X! zrWI3*@LSL;+qG5sm7{hy@NCu7x%VE-TKxZ`t`0gn{ttDPj0#mGI_xRN1KOisWr0f< z#S<`kAA6ozHd~=PQ;|IU_rbD40m0%E*b?ovZqeVa0TGWTew`2J48u`WFesxiGBhNQ z5Xc|YS`uyc0jYC-JUb`kcup!j7c?n#a$L@0hsVFiIj9R1ve$o6@pbW~tMSkns3}Uc zN)$AsTyWn>QELRb1j6BAic+h1O)*W=;3ZO8As{GzSnTPE&!i4{K}9;hU7L6UA2nb8 z`LnX3ceDDKdkH>m^>(+|9nH?k;C0>=v7nEo@2U*gQD9w!&`LhPL8g(XevP~=*Q(>I z6A`Y?NY4mZ{;$s)m5F7VL4lG$vT5wDJy$!_D!kK7q972BEou;tFG#kEg9uNP;EYm&eQLC+-AAgPSL3geyPUZhSgQ%(DR1pS&|`eY7(8ibIRhY^HNk=dw` zrQDUkSbpiZ`oD35IO5xS4+kP|W0>jN0rMa`cMKcup%`8KC_cgCgmgPsvEpvA*`_0!F%I^H#6L}?lCR169MpPH=D=7T3`^~P9R=9R#urA@a#rx?F@L9k&y-Ea$p0umNlku8UQDEvMELw&X&dqa{&kzS&6L>*hLcyf58h51lKwZR%$FYCZetJy@4L0ruK>Np zulqwkupn_WHp)5;tdS#&$Uaj``c_(`?^v@8`#w@EwwR5pEz?V6t$IY!y(;ipm+EFX zaCK=KWLBZIa@2XY!2psepC>iP@!&$PUWEu9Vx!`6-;-j`J z^*Wr@Jb>ZmSEWP1bQjn`S5d*5KSNvH>PR~3Pp3BHyE_ZsqQK7cik%eqJRUIXo=yIc z`G=0u8Fa8!2$1cQquMt5H>L%c8ofH?SE#EYm-DkROVOo@)a8_F&9{E>Yj8aUN9S8= z;GMkAn+G!f30LAjwM^yMBR*p24$&tP0>1)?rnZnpGIDZgLN$%BscGd};#+Eb*+#wQVKhbWMN$L2FMZA9r;xt;z#Q zX>*_9FE?m_lI!>&EA$4@Les?IT-W_XqXya zp4(DtPw|p{G?}78r0NY4HOzEvosGuxJT%Q{84uC9K=RKZpHV|24!HfKS3Hs6;W3FJ z7;Kp%;P-Ub6mLvBVjo#fLYD{#IHfdw)9rPYc z=Szlb1aoR)Z>Cag@x5yL)sM~08rD@Pv&1A!IZh_V%Bf=u#S{I0BsX2yGM>!V5o#hu z5$4^mKx^^0xAaN(LeJaSd^r-^j9hMwZk=R0OTac$=6s$<*f985 zAsLG+MwEK794^YUOmHl9>PSre(E@)EIJMwMZGm4BTyj3=t5ACty^oI7#ISXd-JoR} zr|XTk?<6=Ffpaa#II148!Z zJYGO@>}RT%XN5ho14sQgB&y{2`J(6iT!#Iao^Xv2rJnsMZA-uC-^n1< zo&3iX+cgmWlPJ!qyIPL(5pH&Z$!5OHKx^%w{xfc)+ z>u-ibt3giSxK@mJ_5_*D9UOQc=J)=ZaMe?C5-aK%7QJ+W=SXIR13%E|luKe)U@7Ke z3-41$9#(6_wFT(WMj9kGd9C&k%k0T6&0Y+aDEk^8GlH+(H?uO5$S4fm)p-PbRKWpI2vM6xy4gELV5Tw_i>?u-j_o_bJu2i&nfj>AKyqc zp3a7M&)ah@IQhbKA`^I}yp|&a^b|SDerr(m)I?NOd!Aq~*cOX!*B7PqEf1#8+*d#i zGALv_6mIpCAN&!Q-6n2pv)v+)peaVHKXrARDrgz`jnOAQH?w_?)YxQ^qxJ0X)gZf# z$TN3Ht^-~nVq|`YxGR4Db3Op-%M`C3{R65^>p6FD5yRK_6=YSUZ8ptzew7N(-kCwY zTf*1HPHmhc&_%Ce6` z&f4*u7+4Px)ZcqPH>IrUa{{QS%!=L0WZ5I(0b1*hI+G!sTbqk@U$iD)02ye#iMRW$ z=%v*pP2k(lz&4yEis*+=dX>y|50YOtDS$`jgHRqNA3KT#4gLc1up*wi?+cYRmdjABunufEPx72c>n34mit~VI0p#M_?yHETKKTv|f2ie9;WrPmSC8!Q+ndjI;u?ZS zu7KUDw)MpiauTs6A)TfB_OI!3S!7L;hc4a<#i6u7{Gp@uZ|=ggUnZI!U*gm7!&u2a zUxRafLOo})v?4W;9F#mn^Ei3TX{r(-`MF5bF4pZphnCl`cXVCX9GEMj6Ic8gvBW5ul?)~1>TSU7Hsnh5*6Id%Gu)Roz_6h1 zDK(?f@}6Y;A3y$ zG^Ib=&>VmazW?25s-bMcrL?l<8 zt_0HN1eB+BEF6+#U@S?*OHU;+FE2drLU1PA>tt%6hXhmgE8Wh=OrKU?(_^y z6UKAj;4{xAohQb~U{#~Z=uupTdO)igLlZFA9m%}$Ta?|fhM`SAdUlD{H?`P)emqg) zUbn6pIEZde-%BJtxeK)pI?{ZcAGnelR>hZ?oV?Mhzc? z#K3c44pM}l1Nor;;jcY@)`+&j)FrV?3@?>Y57uk!i%#7jr@+|` z!3c~LOY}R7Z^E1a|GE8Zq2yZ`` z;#-!&W;*i=h$8F1P9s2XI=M*7iYj20@6A;F1~^@e0cqq@xf;T3@$bJg58@YtK8a#n z$Gl%_>BmBc7l{(!v+#=lQu`KEJiWM;KbU>2^IAN7Dn0*oQncF7 zB3gzy;JMxT|5}S{h%&?k86FXFRE3W4x0$cpA-C3?3~_w83y|gSzZUfYb@nakO_O4E z8PzCpqbQJiD+xbjHmFJ)TI~(eLQuNPDc95d

    XNs1!$i6430i1KSumUj~|4$>=e zt~v|GLQmzW=(F-i5Dcal1JmSL|6E?Mo5VAAnsxfB`@TC}vOa4y+^T9!lWqR)okCY! zc>Qg)#p-KEfc`c5#}Ih>5g&~_mY>ex$%`jI7~ZzPLRZk*ty}0uFIO9*Mp&iy9RI4H z495A{DXc8Gs`-~JC%Ck)8WayWOIi_*UN+t;-iBLwppJE>UbcJLD(vjLf3~l8$W(+4wmrvXqwhLic;;ZXkxa&kLRV4UgiBu+Bus~36s+MKoV)yq$wovJ zOobRCl4*)(q#cv&1TA+4Mnch;n7#$cRsAJZk56;UGX0Z$HW}(EPL`=fqW^sK;%Bt`kj#A6m7>T zV!EE4P$S^K9yrbQfAJ*pY;n3ECy~uUT#+NQ-R_Z*Fd%|=*01|M0XxL)2)3g&uBN(` z$+G#9dmB#m{GnRYerja@{UN*aB)HcDr+wUqzq-9*l$cx1(1rNQuI>(a<5Mj5Ckq~2 z4<6Czclu+=_GsS)7gZIH;VAO{hEMcb8ZczD_E-KZuR1)fiJubZ zHnRTEYGM<=63`40&9c*ZMDQZY5i=41MEE zXq$h2X}5b_mkMq;ECgrb<(~T@5uTaAAAi|?(`x#5*A|7dpM2qrcrAvQyRgoHj-Au& zum|uTAKT_HuteSPTisi_izN8G-dXzMUAL`NWp*9dYd>GFEc#!1BU;y=eF9=Kj44WD zPF^BP0Ko>nnMb=jsREMS_9pQHt+Q>>0-ZvKwsqfE#X$!BNTVh7?d%seN3;|FaUdMF zqAgRFodfCgR?Fnhy!hkJzc0YQwX@(w>yxvbo$M0jR*L0JePi;4@4mk-zd4_Bl!SD*B7&rJhjgdX-AI=-ocpKm zcdm236Mu7gJ@FJ0S1-6E?`v%1$2{W4q-P#=?#y6m*nW__&xy%%&nI{Ch3Y$s$k;YsOe1O7(l&53 z+qq}c@$evS^6Hplp+?7EZ!cw+ch#h~qa>iZ>!7IqL8u<=tl&{lWo>*m?e!*~|C1>2&aoc;B7Oby8~vW;urv!K+ENQVPG=xn zbC60(TNe@C#w`@Hb%N&a<+JD(9!K_l20nn6r@0p1uWs_b3*P6n@X*$>5_-6#c{~oQ zq&lfiilZyduZ)k45&rxlEd)B_KQsC>z&PWw+B_a3{kMM!64GyGQ^ z=dislafPt^8sG-|;2}#*$PyW}hphx${q}+C>fMG5%7862k~f3fKnLTRszX&Vf%DU< zru>(6N#glGfVpcw@>Sjeu>OLyfaY3rj_B3Yk-MVztg=6X4av`L)^N7!0M;VqQ+mEQ zGFirvawwXFIm(r4U0OY@u*%ou&NSfrb$@+#?)&ARDSD+W)ZDiis`~}Xqccqxp8~1v zfyhFj7Q}R1AIe-}g9btC#nvECWECom=K|7T>f;%a+W`m6VN1}t{SF`p>}5;pWy^oo zy<8;O0sI5IrvcdeeA9rrT&(y#T0yAG6SyA$0MpKM)@c**+xsq`>9Vm^k(P!0+KO-< zHN||zVS{?9y^(W_iFC=;2L163dX?3U3ul=2LojoUnGIpvPUWDoH%MpH6G|!PZ+AXc zeK+-zZ%Lof>=}w``N!N-zI&`87KBn!unvo*EKC2pYJ149;L2T)S!2hv>?2EP`Y5A= z_dP5#!gWndl?gnRu3A%ZGnMba0KU6^uNmv%kr7q~v7S{FKh6Gl17x)gnc#-30mUsx z@Ox%Vxh{R20lGlZ4@%gY*yo$Ut@W4{AZzOAGBOTk;>j1CtOr_UXp}XYrhAV14wxsq z_CI=rS@r~~Lo99$hAE4W8G}oY-Khs4C_yPBk`G#5Ro3E2#?S1lweH zHI5t{0(NRGu(~b|XPSc8?_P#$Y^A-6VIl{eNtTMKLcg@%?YB|$cmU_d_FYKCkYBF} zDYn4S1ausCz$%SbGD$#gKIs|KjSOfEPuocs)gF)?H{MR>Zhn8Vx6o3nY#q1JA0?qC z%GYFN>X~P<+P?LmFUG`UMCSJmj_uT}jo!4o#NR}|NH$;b67%)DXbBI7h%Xvbk-oX7 z6`7XpE%bvQK+I66?pr-mBOaq4#Kj!^m$NN9#(1e2efr}hVy`4(>x3`zc;afAUwy3t zju~_8z(&b>xiiwvfRsT^j;F&3BJB=9wmPD&Ixg z{CJpqWV8N=w}6e&XD3P`wx(QWcIG&itrE%*Pz19WTh+;kVfT+BP$n^V%k=k>tYajQ59JG$JK&geg-JS>^Otdc}#L${4Joexd7B|cyE4#)wPrQ8$17#DnaKhja{-2B(5i9 zJZ2FiX}*rHr)AwGDee4{ttuwo>Xb^|K8|w9NJ25Wa>e|1j#=EtNGvP^IZD6X&ScwaeHjvItji~bpJSzA6F5O*PBl(Pjc z=KfRqfmG8#A!jpv4k+pDK%Uo-P#EwbT6t^F4%6m~*a1C>HJ~aKxfOZWfhKeZlFeHb zc^$Y};qfmU7+Dofy_H>C<^P)v92%2X@^55l|0d*{0z9>YD5&Z&M2BXQ&GQla&m^GM zJVB8TE~g?Z3bqmMHW86S`6!i;g1&$BOWlrgOC zIp}o&hs?DY)UHjw7J`#@^G!Zs{%w$~jdkk>0&AcJdEA@su_NdLNKU6{vcwNZ9^lv} zuM|9BFVJzfcCU|b_!`?rKdAjLuh!N!M6FcF{Cm?{S@|C;rD^}uE9jqXyXazm>0_F6 zUBbaw|Kojg;ynXREzpGkhSD0y@D9Ehc+NoZQzK;@WULJ_Kw=Q15EVT3AJNUAdm3;g zSPpbU&Vr}Fz_H}G{3W5t>p0IENGS%VyIkP>ecAS<6=U1w*$xNks^Q=X3(j@f8xZ0{ zQ7Mm@HgNP>iB-SsPpMu_>e=m21kcUiWlRTTHN6uce1Adp1SG+?Q{6ulz5>zHS@~qX zKCu18LN_NfQy1HR@W}nhO#GISQfE^^A-JO=O>vs#+ zpE)ma1?|6V0ju>v+=}*09H>ezuY_=YT*|n00|W|B_h%p~{bM>S{P1EBgW4!Rk9n5X z=70E3&v&-a9)(xV1s(ET3>KXlj=`ksxvyqU-CPZqR+a97N~K3QNZ6SN&Z^c=Sc4bVgSUnf*i|)uhm6^4ySEkn=V*xEAl+9yHc8F(PV~i2& zVAHV6H?HTKWO;M7>+QlnZRd}8j_N+9@R8G4mT=gc1;GEM~c(?>Q|B1%IP0- z9=#@*3sCK8EduOD1AeF9DwROjs>bHs5(U)WKSnp_TYJ$H$IH)PnP>XK7E~s*9baQMO@d1E$8ct1l-<{k5>{ z8Sm>q`H$ZyBdlZ6L9Y+m&S;P}9);|Js=p8hs5mufOJ+a8<>>@X_G^CIa5SJlDNJd2 z=hjp746V%Bh`(SO=H`BzRC^VsA&IYzJn2tpkoyDdbi5|0%h|RXPUt13q`1A3hH_3C zDq}n82c-#fvXiwE$5`AdOWveL{E1c++hCMWT8`88as!f2fVD}O%$w$QZhitx&U*rf z^fXZrUsh7b%g^bR)_y?dUSgMfPhEg?mhkGUtB)l|?wKW=9vYd1Wv7fjv!H6#@CKbo z(s;&H+uh%=u$|^Mhx?taaCmRj57=2A%>fnLFY}^TTR<4s5jv*fxNl(t4y%1FuU-x`o}SN+XUx&YGi&!+B;J1PB%jaE@FI}6tM6HLd~7Z&<2**8)M zGja3G^|!RJq! z7KaXhUG_}YL<&Wp_vmy?*~sL(xSbZS@53^zf+-hN?(3gsi&Ohev%_%mMoUv!NUpZY zt3gCmI1hg?VlR}=;3bs$eM5mVEe2$#bbxOs3VG9f1||nlvQ0y^*H7M)ZIqId2e#mj zrA^r5xrFq=JJ4%f(#kg5T7iVHS`56Y-3KZlrTrFGE$>XwpXIQXpxa5~RK4^9X+e+B zOb+y9J!}nf8R5Xb;0;=fuQ2*eN$U{LR=e?!vvI?4_GG!KCHZu*nc^Ium)-}mMLL-j4_BYyF{ZrQ(4?pqAew*cLO*JE~8Jm@aE7JSndbvefVHlwvY9F5Zy*PQe4 z7yOSfd0v4E%CnSB_A!asT($@N58Psi$VzVc-gm9duxk>ZMKrQxCa-Y&v`f)zc~4bev&Slp7c;xl;9O;=0t9-R@Ji%)x{1TXdz)XrYdXAY&MvR7tHIkE*!8~g z*oAAJy0CmN`7oXamOj6j?9CDngUW(Lp z<#w1m3COj0C8NrrloLw570!ZJA~72NlowS41+O0tKg{ZZ3gW4D5H`wA!-aLAq#As# z0f>cK0|~#}zLzAIZ%HEV?z(qkEk2+_e+8p~tU5qfw|jO!zzc}exx0P-Kt{U(e_eYZ zeGSP>;-N=o;<%2cKLDA81>=?1N14IJWYkGkANsb*FiNBSyG`tA_Y!`Z63n9RJ(9JWMm%&-ys1ma+S8P1yQqeP{;= zg@4tRIz3Fk*?L%iq}=gR3BM^4$RxMTRc_9K32RmTu7+MEzjrQ3oZaUyQDzuQKE|DUo_w z!+s}Kpj$pQOpaDae+`Y@*xbE(NG*Uxyd8;wz~`7&ZbIp$yvLF$_)W#X@n>(wTm4K; z!vryGaqM~psi{np%o%TLI~%VXbTmP4UICuE1xCTbpE;Gh#fv%0aqT!%v71W=7a;d6 zT;~pY;8D%T7j-R<(ZeQRd?f$1rX7hvqU{(tciF_4u5D&OytHt^w)qT% z2%PcKHv4`{5^~DD7)ifgRsj0U)YU+;d;n4M1O7M_o2@{3z`5kjWuV2Lu9|3?aa`hz zdH}W^&GXIio6EH|uIwMa7}XOdslWafcg1M z8zi3f`#x+l(@eI}G+@B&dS1LNhr&zPIlRdWm%Rja2J@5VooEU1zk|#zo8suJy+H9J zT$N$5mqor9!`X)p3ZI!j~aC1y= zKTiR(4>Y*{(cIWIY$@9v+O+?cOP&2|p=?)gKputB=O$W0d5RgQsveTibZNZMPCtMY zj-M3~ZjB2-DuqC$W*s`IZ7hwyRYfBXx+E){!}A5&@m_4yRO~O>-EP@ThnuoAg=4EmtuhZ$ENL zfMU~l<%~T!c-DHzsb{(zx^DpKSp&jH?G*T@^odEE;K*PRrZo-XB~tzq^Q{ zF==Ijevlk$gGX(1<#|JFUN*72?@5ZEM_zz2zP{K4KpwokgDdOQBEJx~!3ckU2JHSe zMJL3M2A|Gyf~%E~4xP_~kw9kDJq10w7ow_flGeFFM~K$HRMnlpr;0uarNIcb?(6{_ z!7k0h3e5JNL|g4nO^>*ic~)#4Zd4zW(8H5;sw1-G_p{zNp57u<)cK^`kgh)Oj|GJI z^7Cq*{gnM?K;K@Y_SoVo+Uz{6Y&d4;w_olQ)A6Ag@*$0nWHNpSQbN6{$3Y8MBz+l|_t*b=&nrV;fKEchB}sm4Aneo#zy7)@9=01UVND6MyT0inB2IJkg)e z46{gUt!g&DT7%B|SU;zc(j_#|LL@)}615gTPvA;QQEJjiBf3k<`lw+A6|LO@zjmi3 zb+_z!*e8RO3&1lt+g|~)U|Xad0cj;p$r%MhX~6djw_`l^IdOZI>z4~~;#u!92d2xJ z888l64?QP2p8YMLpycdwfj!Y!7z?wy-*;+`oGQG^kF$%GP?w^W<*%%Pfh_Gb!FF}c z?!#6;n`2Z$%v&JO%c31(L%8k*&4qUsw9##$pX|boE6pyEq?91usStQZd>sgibT90i zq_i;Z%}%^9R3H9R1-hgO`6QmMsq$IR6K!#fjtVDm-SH>UCSJQJI?4Yk%uSqHrnqCl zpIW#LXeZALl}!!F)G-$WK$@e0DOBsg3){|qmX3a8RMj&5G!-< zH>*X@co~T0UI8frVQ0!N>+^c3%g94}b$3oJzGs*pb2$=rEZ(=8!sMlvkYCNbKRl_U zGgAqUe9rc#oTseTiut~L^T~2+57;}uK55*wU2Q&R%8m&1%WR~%oX4OZX*nl6C+@EG zdN$7U27i~fJppLHhv{;o5S2BdV4V^TYdV;SkP_Bu8YTe_q6e7tuc`kc!(K-$3(>=yqf5>I1%jZ8Aquhk(e4${|OQYU3u{|WDSE($l)PG7tGA$#uVuv@TxU`{-NVT;w|2H+iB2694L z6X&3}PZHUImfHEtK2hVxFK@$d5wzgQya{uSv}tj9ex{rjaXL$?4y4~J_Egoc_*TYL z(|aCS5So31z;{`)Yo>j+hUf4~`k=^2O#D0URD-j>C%(V;LX+r-%$4?gtjo7tcYVG& zTNU<0G-&*TT{m-fYliYsu_40<{U5)%E+uG$Q+4gX>&ftb- zDb`lT7yznHa1eHKdp=jc0nQR1KQ`8}<{^fDuzjZAupE9aw(gX9N!a<8;_MYO^`np? z*D40pb}8xP@+g7s0Jiqjk!;2AjyHsH&u{S+Js!6HCQGV5JW2WDZkVzO;*J%YIi;*S zn`QA2EQ8_@G{L57>DGIbz;9(`6`bLpmX~2FH0jZ?_u?6&AO|$4Z9Szz$++0MzSi#5 zU+qu>>~At!_rS_)nXklnF#nW zDZlB36SCCmNWSB{_$uhGKO#0C0+QT_udkgu!n}!{56+j$L~w>0YM`Qv^8B~?)z5=K zsikBRM^q+0XIamm+27s@bK&AUrkb>zf*Er=YLt}*NLG-l9D&_#6)1RxUnP+5NHmQI z=Dc7PhO&Xdlf@Q<&drZo4g+5jbzjVDJ0Z;_Y;Y;%7OXI)!d4sXveSs zEtKGt5+3z_g)F{!1VVoYt>WM92x2h2N9}={^1VdOP98?q>;~Na9)&_$3NU zguUOa`_m@&jc{__?uF{OlEoQCB4O@MyxXjpO?fQ<2Zw3+NESV!H^+~+hwC+uZ2$cB z$}=ejYk1`X_$yrYuR?P`hakYG>f^=hQn-qZ1DX6R+cvF}3~(B8V06xG+{`cRx{Xdj zB0ZT6@NCvTABfS7_Y&x-kj_AZfO~em5vDG-2Jpj^lJ5&iH-_W3EvEodvfxj*<~L zx;Ov4&UW$f0{CEmhFUN!HL0q=^YkdXh*<*Y+=-rvM2suy3%sZ6+9DC8E71U~=!}0- zt)%%*Q{*%ClQIsz7gpuJ)UNONvss54n=9gnyjsM3u{hsHmWg%@X2{w7c@=FE&F@nN zA?$UP_^|3n?M8QW~>IBhC2&tV++(1jxJ>zXh(nm|=%czDU|1fmP02S+Som z`Y6Op#93QA&E_r7{4UWvhX_6H^)I`O*x$ZReydUg0d`k}IVCg?nrk1-t2JOdSRu14 z!`c$DX(e*fu7aYiVRI##cc%y}o>3~Y?N6YFm~!)Vf=j4Pz41=)4mkx}_w)v`x7?|c zM+5O_c1CFBS1-UEUU#D0ExKv{#67GCURej7xm;n2Ez?Mfy9%^iOD4IeDh`)e=wjaa zmhEX6?;X|7&#^8g;P95&qHH{IFBlutHcKM`rY5zIE$EaF=nK^Cg_xKgL{dB3o8yTM zt*3{zync}V$Y8(m_B|6il)lrCVVFCWKCEQQRvmOSDZ7*}eyXgd1eI>%cQqa;{Vi7eM0Eu|IdTaqFe zHZ~H)lnfNu7_oRE;POL1G@^BA-pFkXYb^J--D|2Hw8YnBawr8c|GH*|Ov+a+emX>{ zEE&W?&xp?^*a@N@Ac35KbU4*V$6=I&1+t9v^3m5JS}wqF<5XJcL~aYsRyI&h;DFh$ z)`3w~Zn4~csUD^&_#!@xrUp#U_581Q;24}_cZM_4%}2ieLVE=hA#6dXJ{)#N$ex?4 zcQL)VB^dR(8KoJYWb5@qQa)4>M_?$_MkKrV=|S78MD(t&%xVQ0(azK%B)XwYq#tV% zb5*=%*!X*Dr8CqSXaiQ9<2a;0VR-}2*&3=J%kI(Ls{+wZlp~`|bRv5A02hHl3u+Bf z_#OK@^a%d ztw7gI;}$FmU0Q7u$LfBjXzseBDBNV@c|_N#57+xIm^o^7hm0GK5~m4tMFMSgUts($ z37|f7>sUmoAtmE3eAEqH0Yq~6+kYxKEg{1~7Qm$a5t8>GJ^Y-?=@l!)yj$IUimAi` z(~?ISZ$G`)F(>V6^(;~VsWai)wnzeVr-ScA(bNT-eHP_v_ao(AOnpH#Z%cei%XpW~ zU7|*Q-tO7S^U&vHE>DiIj_{tiF6#Rb46j6;IB$z#8huRG!l~L8GuI4*rXmyBj9@z< z*ssJR+H%lLlfm3MU;6Fy+{VL5i!nKfWCJbVBf;TitJ(1Z)q=YEIM& zzOmE<{UbSrB&J34S@#nx_GOwNE5*jKY^oA6*RAp5Yp020q3tX-ks%DNTbt(NlNo>( z?M%>Ymi$4-rB%VFzWIR`%6fO*F^_PTfz8P2DjF3gKfHE00OE$+XiO;-%a`&o^W6`M zuh3zxSfoedI$QF^TL^2A30ExtC}i|0a~^!#HBMUni?HHISQ|yPS3Xkub@D*w#oloD zIrf+O{CF~olDLp1`dgALDbvhf=AhQr3g80Qszb+_Jff^MG0&hyNF~_XU|DpK;;+fh z7i+8;bKh;P!Kcu+T_-K%UbvLvo2Hf2Bq6S*-#ARrCz(@<&&}!hDqd4HtTD_2SWp7}V{+R((Txq)a}Dj8 zNUR7|g!M6Q7e2jjpm^P>f7%fbhi7=agx$w5I{1LQvD87(lV%D%DN=q$u-AJ`;5yXv z6eVEs*1c}bEM~PcKA6`WFklet3V8=td%0@O_{wYM@|bOx(PvdQBlm}G&R~|2fl|zz zxq4kwfMoUN{TEVe0GvD?N_SnvtQ?kMJ(iXsCX9kr9v{&~=K~C4BAYo`y^KzkVv*O7 zt7#LHzGE2C@5_U))`7LlK!sBkD^f~CG(bc6VzH$2hY20JB0!SMPRN^U9|=Viw<6() zcf)`u;){XU?2~97DQu&UFxh$#C$m3ze5&jMduOOJZ{!n^qrQcL`{Nf8lfu!gSq=r% zxVhjXBI4~hot(fdyDyEhRS)2ndeb+2AA;g1Bhs%^(W=l~6|S()WZ!v~_*zE~Ge+@^ zEu_9a$O^w5!()6I40Xf&Y<+` zvQmA;eB}{<@(*M)Wa`u6E62NnVb*q??_D_LE#qR{8gwwCtN9$>!V2lkYpE@G@_+fY zVv39-c*nnQxu@n!n>T$}4UFe5W_l}3L$O;-BJt|0Tu|zY)Ek9G!U!&%;qOGG#>@#iWpt(X)X)M6@hzSTcKSfk`1URLgPO4c@0x1aOU^DUG)&Cm;1 zgqz*Sp+x?jYy1(q;PTBoPGWXnv(z|dbhUivsm;PN-jkE>%(px4TRJy)VQ#X+RE;xZ zV6vFHMwV3oo^uaXTSq=`_uF&3*siQMbsc_K;}!GO6h2tt}I+plO7wlrm=2<2_gxnc%RGOuuvlA~HoaA|)CLfBERv zDa!(06gT?2+3Sj*N>hp_TfJL5+_eKE$7dn~z5R~)8#}p$*G|XJJmcj2uIFwpyjQ_8 zP-c0XBpf(bdpg`)og@P+W9$u>iy*th9-V#wJFfzCs5B95yk<&eA6BIzR93y&iq~3 z{t`WzHiS0ME;qp0DG6-ZbtLUhga!ZwYN!|dZRbpmyU*x)KioS3Le^Hb=FZiKcRTNg z^FXkPCRhgd0t3nAw3{{Y8?F&~{?xO1U%XxbbQto@x-PN3+Y0y&Sv7iig0*`xF#Z!E z<~ga3;f`wupoM!^SA>rX(M-q ziw_7aVUw%@{r`Gknru9M)p&i(!98IVUF~tk2N@MsgPkAw@LC73ezE|L7)0E_^dxCa z*Smi1LdRVqU0^@dL0Ea2TTw_T$$F@PRGzk8ic*TwOcm52m3&? zRM7D0lr9Fd{_zNZ_d)@S3OLoTX87VprQ?i2Q1mKj-1wH-KXOab%m{cD0R78VXuI>s z1AGfsA3DN;83la^q{EpAB^g?ENCb}L4=~=k6=wr+d4$kQuoKa*z#hs@$p1qBhAtWM zpe6AJ#u@!av2|-gz*nd`ef<{L09bvqXmE|V|b#13u4{cTS zow5-HlV(3mP2#zm>ytj48!5aHI)BdahsF$JEY*Q$w^c+;Bg!bMVGy z-T;Q)L!n(`PnFYy@*>YZ5kS;?9<}?8vnxxZA?5g808dLg5>g`-$6BFfb)a z?bZtUJXt?!5r*Z$kQppQ0GxiT?~B973ErV-_&Gt727waxDWH#i8$wQzR*+`EGE{HP z@5!(hEbpLo{zh2CZw~+mmxsL|^7y#{B4u)>mk(1B`la%!`lRn#ni@&&wdYI2gGK$0 z!~Aq5rU}5x@kBWd#TbvvK|v784D>rL0<&nb%^~EE<|9TpKe}eUv|H9R*cpDrYL_u3 zh)a-azsurzgf6v2+C zsZj$EWE`YrQ*i_vISdWUizn^_PK~9?IA!~S7;MOh^#w39Dv9>-xLml;v>uMY!2Nf?InmQG8Wq#64oc$n9Qr{#n^yH}=Eb5!DEPZ5 zarXLQ?%~|$jci-!Y1Q}n2pL->*0m|D7X3J#wn3-XvoZ(Dmd-;@kW=I2p}h-+yV6Ps z?$&E1<9b}Z);A7)E8V1}3;W8*(#f!Fcx8T%=UI=g^TxV2AqU)=SAFrsc+y-X_Q1yA z>@BAPK~urF5uWfCr)lkH`sZ7%bhHsa-}6-hMJH06;UA;7IjKyg1>^~%E>~P;Rkz07 z^oMIdwfSg>uk(=n?yej;mf2v!y|W;Zx-A}88Rz*)=(}214X#CK=8KPSZz-$tUxL7+ z6u9dtvpfR!83}^im)kbp$%4bt*gc@;FS8|QH9dbUU>o_7Ey`=FJK)i1gcq>T?08?b zhH0DJlh(`;{V|I(Pr0epr=Pz$l8g8fCN z-xig4ZF~PIO;6kf#<>a+ow(XKRnI%IX~d?(S4FmOBjczD<(e}@Xg47R!*R_ZQx1u5 zi_eL}4Pj=%QAkDu;pmVr(dr6|fv`%5o4HUcfy~{T$09{=)VsbiTw|(}MQU|?-qOvv zZ_J@pC*5519R2Hh5V%C~v8Kd(jW!)jc~@<*jkl~c{iGxUA7wf?lzs;wnT%a%MRJ`9 z8F#t9w8JW+IGePH@gj8j=iZfy?3ha7z^$`-C##Yf_ResURU$54o2>a@1rZ~rWhS>o zz<{8IljdauWMj}X9%Yy})dvOJfna?=T0y#VjD7nhkK%s9)5`!Nt~g-R zdBR$x2(&f^s()MwD=IKHZO>o-`Q{viaB|2{otTz6+w854wa=~!Li7nlFpVX*S^W{4 zXi2hrP_IZyI!T%Hsv@pSYs<(9Zf)o4tIcV1C8u!j%X59<1fwYFB%w~sg0U;GAm)MG zb1f3wkTS)M41gJVVVmeY*&o$<@GB#;?$2XQ+kD#WN9IT;0%5ybx9E>sW`*pRrB0$n zG;Z3iLnTEih2U}|gvqvG?rN1EYyBIGrvH~%%+Gtfdn3S0SkJ5?u1PbT{LHax+=Q+9 z!*vG`203lxm<}LZCbJL%V7{F5WVS-l`uR(#{`WV8`FAb8r+gm|wf%4lJ*b@HL-~Vc zPT-c5XLm`@L{8si#cfUOk#5P>b{g}90XJp=2FyfZl`t7-l;Ni>k>z}0e^f$@zx90_ z*nm<<6boGg(yp1n6V%&qYdB>c*nmw$@(MlFaZ(gL{)wK6l93G3RUaC}GMyHt3iQ|} zI{}`M-NXHelEp|%AkFKz0XKu?-2TvnA#>_>*4PnFlfFG^iJt!>RcK!G7DugpudR+C zCLoz~zZ~6*rs|3!UZ8u^RN4a+C2l(K&S-v19ax|4>6@IcNitu7o^7R=jH@qxnrj29 zfPKj}^{JvKHc@+rf>B;fxQ_f72kpLUvN}#8W@xs5of)Z2B`3K0OTVF#?E@PZ<1}8! zdLueI)T$LT5yl{h$TFq*ZK-W1gj6{hZtXO=mGF#1&mN0z6JjN}aG-lT`T>0VmuU2( zH8+$<`A1(unBF|Vd((Mg0&bCS(J=`GD~2{qTIBdij|pHHw1>Hd{;3OEkxdr@;HNg@ zy2s+D_JP<_QWDymGL%pnnB_zkwkxqBr)vQjSUDifF3kPC#Lw3=O+a7c971{>8S6%E z-8R@Fum=bcXdk&hT^^i2LzxZ`;B!r1>FPqQqNX_yv@*E!m^NZ1x*vS_hmanE)QLLq#1_{|h8fbv0Hu zw>64d+Rp5ieV97bwm%?Z^ zW%W0*zid{5n;Zd&Gf1a&%Pi$oc5V> zjSllwtIs{koYJd~gNOGoE`_>6R@kk!Bb%urRMJ zEvtfmX$@2Cj)7I;gj{@LNcEQCO8lB6JD?g95$9@v{MChT^%qadAR{fAC6(H4$_a zx;3M|4z@>jFdavCN9DSyTQ7;*;ZkArQ7&)9uZ~_F0`kbuV{ONgTk%$S-{ZRz$QG3UTm)4hyIoNirS3VCyJQq+hy$D~?e)gyBH{<40F$L-7HMlh< z;PmxWy~5Sp)W^a6oH8Homzz)1ww!MXP-;xMAs{x+K2eo7AEj}UwFOCga|eC^$Zye) z;z&k`T99f}JU}=lasS!{U5C)Fa&M~-DF&(f6na%#NFMUFt#rQvDl!>#(zQM5n14Wi z*$$Ihg+J`IGsay=jSCX>6Lt#2gg@w^r`#=bSH6pwCM5BNA%q@|3lgFZ!e5|C?fMxh zb5L8m1!m|Q_=ng_)L@?@iD@N-p(BLaHC=AnJmg3E_u|YkYkh@sEO4%;dqiol*Lv?C z%>cY6=9F?k>l8py}@2B&XGV(@@%jN{vE&y+m`f9;JxXS~$2V z{C_+Otob+`T6e<$UFzi!O4$M7We#-7TbvIhEzQrqg&*1bY>77$;Whh;=&+)81`pkF z3&_S|401KYz{mPdf_Da!nUHuQxIZ3t$^7?;z#D=oy}?#~nvuNQr@=?zuX8xueg7vb z#p^FAKVQNCvrRIbdb>MR%;ET#dTkKP{4`-c;kPds4<$|gCt=ZPgaHYC;`A?XrR zN;ac0nS_Xvb)a(#-%CZ6P{dIe$WO{|k9b8!o?uYgBH>N_*4iTGgR2l%w=Fe zfvcoz*^4jvDM*PMH!$H(uU3NV%6|V}P3LuDks{M3`Ba4bZuZJYt9as?C8)V|` z*0uhLE@?#x@j7n5E{&S~Cme3R=B6BtNH-FJ_k_-b@p~9^-XzrxufHhq?JxGfuPKhJ z>sU=NVUYEidpr-xB%;8vm&Nk&+xDd;~( zZhH~mc-clKL639#!!Pc#3Ip37TpTdqRW@e~6oCiw7*(KY*G`i1e)vZi#;nH;!eOh+ z)MVf)nf~(KUuEJ?xbnd^)7FE7135 zih{27rZn#FK7E8k#*Q4j7w{8*o_LRydXX#XNlffVQJAIwaFVQBeO&f||iSD|4Q#7AQ!FLIjP(r?1o zD-@yNw@#T#X}5u$lA4vx_Bm|WOkXtZfj|erWx1}DmXcx++|?JqwQ~YAS@+X#F4fy( z7Fq%mzikC{^Ut{pdl1)rV_|w~o@EM6rM}?^x033S@&fK%g)#Ol@iIX$4`{8(MQs+? zbGCtLVEW%QP)h-;1glT3u-*l8vT>9n$~5^o6u*eL`%yIP3|f2fG3x z{X5V~Vc()Rw{2^GevXf{r4;we$)^&IdEw5-^S5zYeevHLr_mC{qG;l8ig`#a&*6J# zaO4bFU0fJzJ6}Ce>@WF*E>RFsWOL79-xA`v)zGe|r95J3O^V4+G{00snZ6zPx|Web z*5XpOmuLsKPN)e=EJM#y)=JpjpC!V(^RU-S(5p;@Sb|fVAa!JcdpnZ3E<+R&RMwatS|w2MPjL!WO_Ach+@-2KFa^ zQu#2K0hpBBkKPHrDob=)3=raQd7fx6*4aP9O7nzccZ7|6)d6Ev=1+Su8>|cHt3n3Oc|8cr%an8;s7%Rzle-%!s%N*Y}bQ1_F`|DAd3F zBB>(^ky?>Gp(jsBxe}$|l)uV0z9tJ@!6UvY5j@RB;$C6imrynOVwoGsGa>T6!AH_l z9;K@7{zH33qDQ0?9bd`i<<29*KWBE<=03vbz}gFI!x)mL??d2;3|hTS(hne8epy32 zFVQ>xlJ>3a+e^vuNr&e5_-l>pR+17F&HDiH5Fh6po`NMgDIPfDi46~=#4Sl)KwCR&aac4oIuI6IHk7mFO_p30g%(XYWyVyHhh6+E3zbYM`V5QNWbZc{Ch%fWXg4 z$3(@wVVH%ih(@tj+-d>@mA{4xZ{iRz8kRUC#L)*lkQu+4E>&mU(eDyui77OKmL+hyFs_-%PpTvxuuid9vR zOYv5x7%np^$=e_kxX{ph{*qg;rz<1Hb*Jb#oy8ArpHGB~elPi&zU#31DIgJKd>x(b z6gX8@?IhCK>P2M?G<9QzH7aeSWvn+b3X4s8%Mv*QJGE09+>xRz)f{RI34?&KpawuR#V9>z#pPaNg#TGuy#@f zY}rPkrkvehAp*}azYljt-q*IZ;(0(WP8{aAPk#%B!Qn|6E=MK&e7Ei}>@gCaOU`Gh zkzGP|XJc5$uo+-s7;Q`nu~L)|dZ83=doL1+_=a6dhL!}-3gCVjbgzUOZ?9zN2?@nS zH)>ekmfFwVYDpbKB}oq0ccH9fopDS9ADG*V#39zN6|+Qngp&E+Hv(!h$IS3fRY$Pf zd~Iy%_5(&fB_Qve2*;{FxcPAuDi+kwGpNF&OI!nUB%)3NNFh}x->A)-jDedV>d;x4 zcjp$=@Te?~4`F=-QGM&+27!-MjMLh0IJ=<4?l-^%?5{MCrG3NlyMYfe%<{PEt5plJ zzob}}=l^Zho0=Su``Ngu$fVK4lO_kD6@eImh~;yo^T}^uFq&zDki=BC$|cr1V4q@* z8?K%AK|7<@UAy!^Up@Nxu|k~DeUH!mwi$)auR%O4ERuY~jiI^-p&ZfXaL6e1Qc`cI zzbsImz`%oI#A!A41WjGj_$~tG4CZ2P*Iug^s-xis<|XZyfY?*(#Gs(wt2Otm{XO%2 zximzQhK}!spcQjLD)v{7q~DLmA(Yw*K8<^43Dpe$@H089B(^ODmhP$`_4=MhK(b>~ zJ7)gt0FQbyzMqj_7%^>GQ=|ae^9iVa?PsXs($l`oqm2~wMMVP*G^e^WjS#_yN{ zr&aA(UBq3y3)JkT??DOC4y{B*%SGYr=zd%vdb;x*t++9Mzs&~NzR91gWkQVCixS#b z8HMk(4Ag>C1O^##e@YK}RU(@sJFd|vP= zrkU-GdFgj`)2Ig8qfM{ zriDeOAiZFd&q0jAOmVYitv)rA=Gtc!t@(EZ?K1i(bMk0@#@ZxL#7D_e=Ct|{dnv;2D5fYF+AWxWwBdE5Kx>eQu{*Oo)L(dFyxrwF-wbcjCUtg#C2s zARvjFgEdX_mMf)OTA^<=0(54)@?eU2R>O#kjf1=V5u?DK7H+Mzq8BWFM^GZ2QVu!w zw+96r_?=h%0G?O{wiKM;wrNu7vg}*GXtxhNlgCj@mI3IwQE-1|5jE8Spa(Vmq3Wj) z!H8vd5@3`7KGEa;e^271*|bdo@Zz+dh17t)ED`MYSga_+>~lmp{{8CIg;^?u7?UkN zHRq4PcMxd79NX$M3Jsw}+&1YJ;E*UCDnrvt(2?W(hMHl*<=%#ii{0PPJ##FtY)*)A z07ZZ(T9qf*Df9wjwH45uQIpYl2lf%GH`lv2)3}pBZks7w(tkE`)(?|tdZ+<9OM66o zXK`{K^UiN6~h;hez_eG@@d=uUO`6jy8 zmY<~oczql++eE7XyX0&M#N!8e{-gZVEcq71;oVK>9SC#2k*}r)kN4j@2(e@Em!Vu| z`Zh>G^z^!PeSk9$P;chGv7>UJ{BFJrtdic4QT>oLa`D`2Ph z{V!f&I_tY~k>&1~hHxq$0l0yPWlw36$vykVCv5 z*dxUfVU3o<;bCsj~9y+(J2Heh>OQhR5pc_Q5qQ?rH zHA;c2lSVgy&-Ma#zS-AwuXAE$a*>ybE|5X}D%g!z3jP^4>;pZfipL5VpL1M6jSAT> zws8l~Dj6^te&&PS>?&xcx8kWJrPG1k)hgghIPI=8>0V5Zo%_q;xkn?)w#!I=CeJ-o z`wgV2I_dyMXaeq3xuGo~o5sdky=AhR2ME_ook=W)(t`&+yAS6&D+p@Sttd6|CIRY z7xfcfwe*^v*aJKVu=Uk7oz=IF@pcC{1ms(7toh&HPuO)(X`^7us-%S%v}dq0P{`)J z*-ATosvTC=6Q_(p6Ea!))UyI~i`e^+ghKUJNl!1h7Y+|lgRYc+HBIC2jW@~h3_Ziy z9S-+dY63u+NqZ>S(xYiGkW;NY&)d_y5%d>|`uSajdD4+LWXX3&!V>ph;CqgrL%uXX4=r|4W^5rkE%8T>?r2#FvzSUlFKj5X8{y z(r`$X&5D7@3JgMsf^An!bg`HqSpWVdx3HBBK7mRJ7qkvYwC`rNSi1(i7>81zOC{Vy zPNCI9s8@-=7093?NB;?szWfEv^OvDur*;&j579yT%{Z?)F(3tnUH}dbbNB#y%~W|7 zB+SwWE`ZO0IfzuMNQcoT|sKzmdXb1M5N=Hc5eOKW^`D0P{s|)`GGq zte%u>a0JbIrzlpU*ro<7(38RXah%}_$gw3r6pWr#z!2tPEvz#5lbj6vw>t7`e&^y0 z42RFINbq+bLqaM(jgsKnbdu4~K6Kpy07HcyeJ`AhZj_kXtGm`-HoI{NjFH>(A^;+NJxjGba&U#EuGTcUHclJ z?|Jt=-f#Z_4jAq^@3qcaJe4%&;9LSbE3g~%3(BEZh9I)f%%)GAeh6DHTCdMQSVbE$ zkGX^i-&xFg?o!NvSYlJO}`NJH) z)dfN5XV4#MiSrT}5g|+28z$&pmf7=O%uDU~`v7UaF>c|7)Knf?ctSY#vZ(GY))U*^ z9Kh`G>_Jknh*Fe<&OiP$_3*j-ilNF+Oq#xb%|83S2HvI&4fX(;0{V*^5Y(2%XaeDVuSe)J}mSnT7U1oab^prfb>{7-Jg1gz=V@3TKRGZ+nH zp3fw}*SHof8&$x?$OOX22=r3Nts%)D@^``u9xbarp*aS33^|ExY7IghUfuNugNL=A z1w>D&AkzlO9f35_YPxPFj$pw_q5qjg$*M88biZdN;z$||#sj{*(kh{Vc>TYkivQ4; z`ThR~eP^tFwP;gaWj;&8>@l1+)X`^yyx$ftaggiZDdFwMF}>0TO)kKkl<@o8dJ&WC z9q>i<`c@J2!pcZCn{3!TQjDoOfUjxOR|0r5q~}`FJh4QhMXr05Q)Q-rg`iPI*wxzr zv0ML%tAUxU?;PuQF$FS%W2qW^Jnm#Fo*Y^R5>pf9q0!O{tnNya z?iao_xXOa|3B-^6G824{}tz&Ehq448mh@RKEDksPV?(Vt&ZDz=1{#a*IqZr&r>|PDhn6*J&u=LQ7 zrN?UpckUzN(B4VE*K$m@dc~XHkeZ&~v%j;4J!_JBWI?;e6A!mkD>=JrP7{B;#RP_ zlPFKv@MX71kuEiZF|*$J+5QU(R?ob}s{VvA8)5DOTS5=WuivPgemjd&9 z9k4GVgMtM;)UROm5*mgfX8D$AMk8QlI7p2?dV)!N5Wt4*NKsJjl5w2k+NQ6bmS&9a z#egvd^w5O@GFI6Kfe z&jh-jwZei0R#CivQOxY;AbH<%umC#@s%>bY;6+|b~iZ%L9_u=g8gRGSHZ1< zRF*%MA775(<(t*a(MkZjnMCo*pzym(J91hrnpr0ll{ml z4yQKBE?yO9&(9_g9}A5a2pJ}o1axNqN6s)?9UD(ewL%$47>uNeK=Td5Fb(418If9%uhF3nk$0VlK+lK4u z!V{CdnJnQsoMkmKWz@f^IV@g=Sr+}wH3N9eFuq|DA@HdG8xYDru8aPnlKb>QfxYhf z>$&-{9}@Q?@HTvfn!>bp1`q1}f66-A!bhZOYj7UOM#bbLu*PC3fEn5iTXkR#Qpcx8 zQA0$sJI?TYF^zBC&hh^3e3tKl_WnGc_Ss-{W2ua6ckHVSkkTEVIlLI}b20dOSC)v+}Fvaa`=FWE7#-nzY#fPnT0fj8S)_y$qy_ z;WxgXczT05y2$;u@*wzp%|v@0;}71;Gn+Jn$vXv5@NEhlz0??TtBM=Ip~*)4GPs7~ z?;?0R4D~-<6cTd-;?>^`SR;|H5U2)F+q`iHF#`@Rg{YPkAgfexp+ec4!I6!yQ{fKG zHDE<#l6M5_sUt=_oACV=R0LuI)W@cUQD0X%N|CD$d&Bn^^}DilD=*hYN1uBBM$O^O z>=Ajq9xmR?k%@-fbun%O8N`Hys{#3qa$c7a5bC{mAUuV@Vfu76c0vG6Fw{nzR9L-lnRtM_vzOabC6Q|yB!z8zRc*Fg$!CH4(TIKQS$zc^}@5t)+F zduhSx`%;74Sby!85O}j3d)4w>irtvZery0&&lkokI{i$Ex4MrrHIv70JN?=Q;BSme z;BBr+T?Mqguh$py#PGF%8+zU=?@S@F_WlxRohg9xUf6c<^#d)mrksy=rzxOr<5tNm z!R{tpH+qxp>>2IsR^%4NRwQio#{9m(IckjQJJfT~4|7q&x?P5Dr(xdMptzLs6&l@o z2-&}3K*tHzjWh3wQrxW+nu*26`a>j>bsRrI2cn7mlNeYJjsoJ-@Ndv?wr+f9M!J&6 zi$Nnn@$gQwq~^#9e9$6*+G65?xMVZOSyYqYA(2PVQ&2hs4m0smbkL2i!!whBQY4I$ zg0peDbl3KE)RrVNKv@a~*KyOWN4|QKPvPa=%D9mNYkoKt9w1J!59Y^}8UDa$u?egn zPU&W04f78Dgm~Loz)YUIl4Og%42%EP0hM~ef*fY$t`M=Ro-s8Aiv`49{IOJhxi0b= zoiu>LS|J*q83lUaxSnnOE-OoQ zwZg0e)HVk6uc8G{JjWxfQEZ{+h4-oT{h_85Bu0<%W1^C1vXR^F1*LPxc#|uAjM>fG zB~upW7l`wi6FglP-DT795jpGAyia;C4Wlr(A7nIciiyQSkVVhnGDe;or)F6LXX}}F z%vl2(@5rEoPGc;`V(IT-`_JGdX}kQ1v(M*3v42)-B;n}Z)h?OKhcgO#R zdN6F2Y0Zlr4(H@o%cYqTEwq@JAu1j^pPLBxn};a z;NFS%u+U}XPW{#>$1s%JxA3PjXO#JU(uoa-IR<|*&!vNS4|?sP7jBEeHbH^oD38f` zUcW>2mYZ*m&)PZ9Q1OCC*G-IwhAD)E%hY7GyE&Zn_UH;R3>%K7vhJ?OAK%~p^+~qh zh|pN@!MDsyV{!W*2@FOxkgct2O@Oy7F43Et=evVjd_9PJ6Vv)5Zd_RrVcwybEZpCx zdG|zE4VT8QztN|3Nr6!R9$R(@SktDBK7Ydn$O<@^~wfcWCgT zo%ZW5Vb}{=DUl(eW)kBE`hNNK$5A~yxK=?_E$W+bz|d_u@z@Ctyy5%Zf7wpdj>8@; z3|pf?Xu=c>u}r@|L4wGZbCY=dGN>Ua79ha)OYqI9Ls9J09)H9Q{>H(MP@TZ(m%z=!V}2D zT>X979S*ig1!!{^&bj38g`3l81vxi2bG* z(!UYQn6_TBC%Nul{ZPn?14Xc|I6MZ)f_0klqal`hJ*;%sn`-`ZsoK?88Ql*Mq7pOPS-7@N>BrX-f6 zIq_?n)BPHy)G*SaWi2XWN1LJ-ibLNMcOr97?=gA&3}30qx7N)fxY;c>bs1*nJ$qA= z*7!z}o~W6^;bzpCcuSg3GgtW;)xPmkm0m+Dd31RJQmoWmHInt2CYvIjnoa%y8Z+0EGu4IRGogFko>yGjyq4HsWiZq&C7llwb=|jvH&t(b>qLeogq>&x zs7sLE^`tm*_>7)@)RB4A9ac6E{`k|EJIKzQ|4G-KP~rA&jRPbV*Q@9o*;h9W*frsMP_Z1Pi*7k2%&B?GSpSn%sgCPfL*uh6|-Mv-(GWKzZCqg$^xrolH6`9QN09 zO}APwKBQ(3)JnM5>*Yl6T+m$(tP#z{O3>Z_ z%kkWg{qFs;G9CPxBUL;8)qoWt;R%3+|p} z4I`jeaJ zF#aCqhTUuyg0`qsGe{{UZ2J6obm<9gKXcIuN=w2 z)aaKp?@aXR$rnOPF9stl7Js_(OdEB)-I3v8hK}8L2e7846`>3C^l`F4rmL#qnmF0H z&A!G#o0FL3gV})xQ5Yk0jaR6?7Q29+KDeoIc>H^hfO6>%Ki_^Fhxvouuqzzdn=UK* zNEvU>`;_aSKMBa3lSaG<8#JGLKwd|yWK?AyG{5!LdKal5Y|D#oLh3<_>om5qs)_Xk z6OKGWQxK}3CnwBtsA9AAx^uP8RzWm#ltSf6)$x}TGz+7k+}`$YQWlr+tw^GMjt_TT z@bKcYg6Qr98f+i?#C3QkV(Z_MRK`qnn+7tV@pCvQM~=k3V} zhm$!vYOJEzTRm{dBPHxtUy-l-gR9F|1g;f7%-}del#e$*pKh3A6FW+6 zs6#@kw6qhNrCRj=7XR*RR2godN0Y|9!C8IUD%%_FQvU8665^RP$&|a9^Dq~7?X%_T zw<3S;5O}SG?9btatI|*B??heEv4WgtlC?OHk2mj*bhng!ZsH0ua=RLJHb`c5voyFEcNA(*(16s~u<_mU zCfB?1lIQIl$)l#=EcY==z^G0u_E#2Z_AG{SiNDqEgK>jJKNpz1nQRwy&o0phyLu7r zm_55%>6dxP>;y)ZCXnafE5Vtb@mL_%Kcc!ycN3k#XKdwgB#g4+IE|};BSM42w|}~Ga+{o5^QMuuo52nGO?Ws-N@R@O zojC)^NlX~d!t1NBaTA3}iDVu{l#mH@5UJ2*TX@E*FGLjwL3XDu;EUoFbz^a{Xem=KA^9A$0XVk&fz;txqP*Mc^w$=WDS0` zW%^kRt`uB;Hr4HFsbHdK_;gKv!WY+1LmU~>m>SB#803t;zTyprW<|@vliloIJPrV9c0YmYg!wzXO|KSl;?+`iA3!5jS0`Aa zuz}U`^{Zb4cM5R>h@)bGF*(Z}vS=Qtj&hTft(2elXxCpnJASv=Rjj&aDz!J`?VTlz zR_#EEF#Gl?YE5lcj$7B8vb08`hEmeVxjl-5ED%@o!XIEcN&>oMEk!snYpX;*waXK# z%L^(K8C!efD4p81GAiwtj;SwSHLVHTrpF(1d*^;9aJ*BYREz-JFu8``JeqPl8K_ z!YAkLMK!_*epDfLZG)pZlhc2-+i<0$!YidE9D&U~RzVs<&H=iOB5uD3m}|RWac3(# zrFgi^ZUqzBY(oT$2I{0h|6yCZ_ zaILTWl2ufl0~<8F&QB-c)r?1UjzX5|Pim*ZM1O-Bcs8kYO8%2IuB1m%fZbWfCa|yl zxf&#UMc00S(w&gnA?X&flMFFRDT~mgo@3Q;QB{Nc1R0bW4qsD|z+8Hx;z8fQ!L03(~-{E7w zW~WQDD(}_)erGiF2GFeaOT0Xf<2LjUpsBw$wJg?I4KiqO81zT#NLQ>2&g5ZQZDU{VPr|9$H zgo(nX9*j3`K^d)U08myOawfXSd1y+4QBIENVoZCf+D)=hl3X#4%v+CdxDfHcbd%I# zD$QqpimmFu68qmS0P7D?_ojtqDa-SY4X);A#No{r_#e|2+mgE2Gr=iUC%2y3&-j%K z^~v(B4;5&O(pE?VaeI{ce-F+%`r9#mJ z?Cske19ELB0Kc)`)JC8uKrf1qGi&EH!zmd?<63c zH33*>62EqcWt$l-0@+gEv-mvVmH%kPWedV4P_mG}tB%r{zx(Qewm8U^E=*=}@U|BF z-7teC=~uOMA+7eFHxp);3)Y3dpVXR+g*&XdkoOk${BdvMA|QFE!t_~?sFS96!Owu8 zQBzV7_+|%TK`Px|8BB~lrs*tEaX5S?hJ}TG5lu;>6}OiwW@)kPLa_OHYCE8G?oIxb+eJr<2<5*9L>K#AO0?_I&+$RMcb9uR@ov zCt_z+!~Rtjd{pp@Lpj688_-NOHE5%|>4$k6*sLrJ%iFTk9u<EnAvOqTR9lJsk!He^)hIj)<4Qg?f-{=8 zl!p69j^RgMw|HWat`W+v5wVfg1M|nNNk_LYa8iMy3V1)?D7fiqBliVYy4Wgq9dwry z7N-Ress1ALr4xlMl1;TwHK@eh8=sNU(RG)7;AI-05SoHjX*%#lE^zK*bZgjtKG1y} zC(3xUTphkQvR&gW)FjoX_HF8138)*QxA4JJ8B9Ie~OBEtgKaH;IT7S z7;}$yAb+wao0`SSX+u`CF}-p+$+bJdgNrOpeju zRwbL`&3lvi(fe8V5@$=U`n|2+m1ccn8Q5$r29*zmxBgq7%cQh-STI$Mg(cm~xqnSf zyR!JAbMK6)pKLq^h7`J3O(EY`2@_@*);Ev}obksGWN< zHqzufXS&qw5`+D0Slb5FlsoS}e0pHJG}{Y)QrYKaPCPkW$7;DmsT68xg3A}dBx*Lr z5$iPl%U|b-p~NESrdxs|myXIN%U;UrFY}96^a`sFL3HjF;>GUQ+6~?>z5e(|&n_|~ zKyXhE4i|}xS}%Gq&x%%3nFOV^sATnB6oV@Z{iA;USVBFC9a;<0W=B)^5~>;$iq=P* zGw>;U2)gv5Um&!KaQDmP3fhb(axZb{Ak91{)^jt$SyFO+yGcX)K=>x`P$pL(UM`>d z7`9BUzqa%-4#W}0T2_k%Nf?BO%km00DhD*g6AD|&D3#~OW}Dv6{d z?-l5`CDnaX91&X~xqpbnh-kx3V90xhe@96*Eq^fO*4 zApxOeiQ%KF^@n{@`g6`6%QgpueKHum(vYF zz9&|V$t`_4-}Y&Y5TuXUa7*y}f|0KY#ZyuAhIIBQ_~0fWplg35JNs%z9&6iL8|c+W zho^nChH;(pjt8{M1R%2tq8ka~j2V4K?_@Bj3ty3&Hi zwiQmi_CSGc#qsqZTZ*IJ_{&^B_h~A;(y4MYrEc~CAP4%L7mAmYTrZb(xzWH4DAjI* zF>6}0SiR}C(k#jjjV)xj0a{GF!|je~rLyF*%o6;7=~QTA=09B74~ulL#1SQOe{RIr zDSZo4p7O|yUV7c!nyNKpXu9kqVg5kAo%_8$cSKs!!8yQ&SQ90wX5{h$s|F!GK@l5= z`|#7B#pJ{d6>t2wBE+^h*i5zg4Uzm75Vs@C%%y#`Ik#_!j7`!h-TK|rCOOyBE=Z|; zwTcSZGmg@nWVIW|av~~9`zX0z5GfxYL^ki)($ZpPzP3Vy6Va$OQS^5hB^%|re}h7p zarcEkm!`9uX2XJaC+i^wh9T8Eyj0g`?QdWJa`Asj`&N1r5>^`CX(Nj8TcII#i<~SK z^sk!YJqQa%)hR&gr`}St)mp(NVy332L19L6XeTaSmMYrGYhlEzLpwi#E zrTjgF#A={B@trAiY^|Fs<)ULb+5V?t7vth~IU-l>t_QJeyGe>ue^46OZ}3w#r)OT5 z`?+ENbK5ehJuI-`g7y-_l0PQJ{J}jge>?+R#0z6f)&3$nNL0TFI|VCc{bBp`6;LkC zZjg4(c@0N*KYWk=)Dly92TmX+=f>5fQyZ+k`X>+6Mtl`|OM5lsK4x4se6I-0dkvR(b?HJC5y6_o z1)?Uy_e276E-QOaggs2!o*!ryVlKRwdB(KVkBOprU6(af-C=x4lZqsDrWyUzYceS= zsOIUi_X>5R56zxF^-ZVEZPad$9%+lA7dtEF;TCSC^1WB#h()Mr^tj#OIZs@*b=wh! z!S%bJgV>8KlMQG4)Ik{-AFE*ezxnHrz(c4KgV@AP`l3+nSpx4!1@SKiMy(<{-DZfx z7sa^Ix;N#az-wCx#6UNB8OoO5pYivu7TfXa@u zh|0geFFrHrRlgM3=r~E`^HatchdPGEcJJW*Krz{%{MK!7ZaVrXOL^7;%qgSx7Be;t);i|<4_^Fjyg!60Vn}i;IN+$y&FZ?FuzhM{=PjI8Cj4aQBt0%0J zsP?=(mG@%47vhf&q>B-3Af9|lW<}ZN3$Bc4EYR)m>A;O`u6zTw67@nvadow_cm69> ztY`zyU0GhITKx#gc@ZSieMKdce&G=^+HD_SmWfnqMfKE(3iD9y&dh$(oa;8e>s@VW z95)K}oFa(cLzQD;?S7-k!82a{Vv*{xi<|cPTD?j5$Mvssw6w(Lsq=~9bFUs@mct)b zS?AQKR8xTSr)$1Yl!VjzP2L5un3i4_yuhZn>d%9VTM|1yd|64PDHu0b)gE?Ib+N zl=nYVY#ayDNiU@#y;@l> z1$AoxUuGadYNL8SZ(|5)^c^t^@sAO{QE1H9$olT~7;E?N63g-LdbiJ1e~U!VIpj|s z38{^dNvsZWBl31j`!hykF~0mLoo5hHc2|M+hJd}#XVKLIlruz-Odd7WN|L($k``yT-PhI`Ns*3%1MmKDSxuLE%Y53tOdH`mPUy0y z#J*VsjcGX*=!=d6*wAo^t>p()9B=9~$j(nx(iJx{tUK4n*qk@V?hzp*OLNvUNBkvD zOG3oU0+2Zt>+LvKhYm{_Qdkr5kYmLgQe)`mNE8(Kud`=*Jx4l;&pjv!OYO_MU{<37DCl*!(y}XY+ zwwheoUw)F6oJvEs_LA<00X|g*Y%g>R7Bgj|wew`YCu7}p{RX`)x}emo%COX`K^jZ` zk?<+}?-^B@GgU^}H!Wl$7Ibc&?lef;)|*^Luv(dc)rvAhj?v7b!%afM$2X=6T*qsP zJ9gbecRNRSGbzIqOHDjTQd+~geCVweinrb(mH%`@7+1th^NGy?rUiHjsd&t+JV8PW zw(cqFs~s=Y!#}rUe*+Xp4id{)adD_1dP@54)Tt`82#$_$-0NXbW1K- zD2DI#^K|4i!fQ%8CMF5TeV_a&wtr-&HQB8C!z#5hkV*QXPfofRf$yfkikeG@aY$)2akHRUva~du?DGIx$`pIUV3^h?^{f zmQIG6eeClu`dUS5MOL@~97)VJ#83$a>v(&TzfSBsFUu+F;4U&;?bd6M@KWSxlRH;7 zmoZ*c{0Fs`C$53TYG|G02Fl9`PTILJgdL2lLSq`6ojGi?j!dhJj)jhj-t(UrJ4pbSGlX(ug?&r>1Pcs45T*uu|}H0H{GO;aX&0y7VdqE zXRVgc1@Pn-#9BRSx*ol-Opn6aiW9Pcf{o&oK7%=G77ZUR#d@ErV>t=;ot^R6`O zm$qE@YNbW6afI4z1mk4Bl|aVE=^7O2kp-|%e_6SvB?uLlN0Y>=qF@Q(+2NhZ#wVty zIi1g}cAxm8C%c?sFeA>nWk5S2XL5~fqr%r6M&Du<4YW)j-aG5QuIE@kYN~si+__49 z|M3Ioum=S9cR_~my%ZGxkQPrnn+*BT=svzK{AiQ~@?^D~DxE!qQIhN{@2od@>~Sm2 zp;tPa^16<>Ot~k_Q>Fct!AS^Q4%GfmQ9>K9)kjHcU=;SrP7F_NV=A!deKCV)m2?Y} zPlG*&hQj{+J4lRWNiO@LnQPs1;Vt%>v~ntq<c()emPNP{vF8!X{#bDIl0MrQk_YtE+WX1X(pRGeMNpeRweMyf#z{MGLK^` zc*eLlHP#ZNB@WiJzua*Zfn{)9iFD+(fu{ z=TC~LIDVFQ%PjGOmLa0AvGy@8S?E+f6MDbMu7kd@@kGwq38^^vGvq?E|jg=;h0 zRVe#(H1Y;kMWLMdOD>Hj%+~2s~+oB&!Q@9GK|8TOuYfeEmCDv_v_0 zj|HDZwT`rjQ76x=1K|W#%1}c3`q#v|E%52(p2)Y&I+wN~FZ#li1`ke8^iVtSt;^@QkBFmq+XZLJQNEMZUcN4~%k&0GX2((W zH~jqD&#(YFVI^W>Al--0F$PDh@0m*suG^ulY z3Q8nOmlH&%5QcYJYdD5VD^akEhoFC$O(I436cc<-Iti_bYfMi0oDYL8ny4dWK5R<% z$g)ftNv#-Hic*f%I!}q6(02;I!uMioi*!%B{nW;7@IXVR4eP933H(GmrAnqnaDvtT+^Xh*}_tYn@s5{A@$p0oXCpX5{|^UcZ% zTK$sJs%K5+5nC&Tln$xKLK)w2(DQ$Iak)wpu2|ESB|yBEBvr{uN0th-DZ;*n(%pM+HL1_zrZeuKtTZ(OTysOKnd2# zP69d$Kz((N@7m*JAbBnx=kYX#duQSIfQ{~}I;*x3FnyYo{BM7M|8!1rM6YXjS`VGo zuajmSaOLr$DBlE;k=z8&GoTnh3D1qS-VJ3rhbJ+UYL_oiiFE->5Ee+vlgIsk>12(J z*o&fm3Qu@ks>294o3g>TS1Jo8RD=eV_ig}?rX2}8mQ#KLgc~k8_02M{3KY4>H6zJg zNv|SrN7$O^)Q~0B*X1gkiL4KvoN=lh5xQe)pncEf`C7yc?*BC_=tzOOkeC?}WRt9%9k-NFw^DN`)!EkB9K4O{-BoEfK z*1%nq14QLQx{KhQk0cT&H!Otl@bk}J^Bc>U>d3e*0KFxDK_Q98q^H76ep)5N8r7~p zlOAcAiX(Iz^^L+T$cI&kB@O)~5?of8N$&g>q=;v!v6nL%J{sN29*NU;+Y>Lx?_wUS zg|}IWPi9?6&a(al6(dVflV?Kn`$eq)eQ*OexTg*1=fWc?L@+6d%sBeuoOoSD`J#k& zxM0IEZiikXH4FJ7gass$HaQAZhRS(nz|mhtL^18aN4{JMfm=;)!AAKw*7?EjViE$n zXibk{tBeyol(FDDPASic*WoK%{#TrUOrQ6X(@u8I3#Cw~qMT=~JVTI6*cz+G}PJsB}xNM|MZ> z)~r;dKQ3Rs6}=17Flq~L9JrDY_Z@OGEZ26na!BK2y`8FG_F z)nj@b1r5nAdU18#`lNPQE1V9w|jzpF};dULd!JHNo8?rYIum52)^8Rbq`% z>4p+ac)~YJ2R0jLl2$7SM zCYSF^zDzl|y7w$iJ>)C-XO7mpQEqf}UMt}1==QYbhe(Ae-if$4Z^oxGMYYkQa3)td z!r0yS>c3M;c;u$BmlIsd?VvS=$1fM6ocP!=7WA64CKZ9J>j&}nEHGi(XR;gL`oIjP zLg2Th{yQ3S;ipUeANr{P&gRW)4Z-~n(z7)OiCJY~b~w^Es^$S{7w+AHpL_`-v&snx z9>5n6oIc^*RXGydZF}(4-cWvc6&nAoF??v{mr;od%&m3zzuj6TTRl=FqCK>q&S-?x zkr2s^1XuIY^FH5}Ux?xpg{<>!_h@K$!WOq4b7SOd6}mHNE0Hy*r|M3wiBzF*>J7Px zsh2j}bCX%wXLH^#8UJE)GRct1wuorQTXHX-JA>f{&60Jj`^`gmUBprz_^8^@<;e7l zByR*9KYN8!7)TE13?YWC>MK2cK-Mb!39gs0fmuM6IU~e?_Thw`KAxa#jqt5}&rwe%je)rOSoZj5fMrDpHc0l$ znt|YP+W8IN75|$M+n;SgMW&D9e8g7^56@Ys4xi>@`)zwzo0N~^-z~0CsK55}_Hich z9^}!ncW#&?YK_dJbypXHScD!@nJdqT!L5coZH>R?@WUQsaJ~Sqj^=G``Oz=4qSjmr z^IPs4&umY=JV#3d&eNqY1-kR=JWFy!mv?7pt-%z0lB%-N9k=4s!OWHY#Hqd$L{2YUqoJ7c;l}PuruO*Rcb7qSwP?++1RW9z%$X5&g4*tc3oRVM6 zLh=Iw*$Us-*E0#-7k6h*PY(t8G*$HyT-`hw$LM~LK#MDFH|#0e+1N}6l7fZTE|F)0 z2(YQYFr12O#=xC17$KNkZ0b?4S`Wh2#4F!OhGHS${6nO8#VYr75(W`y+O`y0q)ENP z_ZHuo^)yn)Wlql+7l)U=tcUEWJ&wiA3;t&A&4LE)Pw;h#ykuo$iN>AlvpnF6+^Gt3 z+p4VULO%qRcsjCs%MspJce+e1`8Tp(g42E!$a8T3^g){d>#QdPS;!60~k5?7I1C@zRnincRUhhKuTiAz_>S z?|ibt*g{Ak8rk5tvUZ!fzF#LM3u;oUX zI2TZ&>DH%$`>85wbQ{d|{Qr>nr-*$D6b2a_a@dm-+t-Uj{lxIU`2ECG*%XRgra(B^(re#A?$eGYOiy1$;tDtZIzi9Fp};Zo_Ec{D;_HZtbrDv8RZD~6wpo%FG&VJCE?+)5dQdO~1!N*P3W3lb3JbbVkDJLY39{ea52%m1(nHy>FUZ^uGcs9r-A_mXs_@3X zsH0u+bo1*VSNxB%cEX$+S;lyGxqtlrg26Ep@I>`MZ2P31d3U6_;Wi(^N!WCey=s0h zzVo79tt>^3|71TogC_?}Muc|qKbc;YiQ?V#yoez|boV_+drM*5_9?GT{1r(*-Ba%N zH$<8Dz1-V9lu`p7%n_$f56Z`0+btRfn`ho-rjoVr=3S(eG%TfCQcDf!&k72A_Q;_Q%f9z}xX$xK8 z|4yJG7XZlxXwpci!3%ssG*6t}?rsHFWHiuQW^*b%aqCW+#AQUl)I&)vco*^R8+XUw z;4}P_)|{_D%m2X$i+nxU*!w`l98?`eIIstSrYbVz@4bB&>k~=ub(=ZLm_9F0&_~Q$ z)uhwA*`-G5F5{EHc~Npbry;F3FwY_^RW(;DRr*@+M{zuc|+hmwL|Dd`-%XEi^ zI{mIO>U{!uk|FJX{XXF0^1!FDv(tS69hJIAQ4Z)PeQ|L`JHu|C%m7H3cNp*C*|>c< zj+Y7hkr7Exwb`*{`R{%X8^)u(n{mr>wQaBMi*i?@7?YE4z$+eQX4EY%x&X{E-t>u#p2uDdy8{J*M}jVII?KB#CK!M0R)7w|O$^t^whPh}Bp zej|H6H;T&bc&Wm6O03AC9Od`Al3gdSOK81osI8IC)`kXT(Gol9`_=!#PjnHL*lw-O zZ7Dwc8lrto3rEUj8`hDU!u8`J>p@)&BAZ^MEwOG+)5P(Q>Hf>w%=WW~r;TMLZn~TR z(eqW0tvk30T5J0SUogY`v@$^8pti&3&k>QZtU!40N-)Z{%oJ?e$-j&08ZIy{RDLew zWPP?_n(O@jc&B*vBS0T2ce;Ht!W~@xn#kC!LBaAQv81Gjchwm@h#PW*CiB2U-6)e0 z>#&NQg;Hgh!c?HOoue2Lujnx&HWd-OB?XREIkk{)eW;`&>zms8VeRN!Z;HpIwNKX4!1f=tsJ5aAH7DqMT5K*u}xRAYPHqLJul%~ zCjoj!b*nm8x2evXy1>zM3iNtj`!z34s1E;v(-I+U$QfF@lFEnC)ZlejH0_zc!@8B$ z>>ZMZbC0{syFcU7Olv(qr8$bc{=yzLptzg!jNR?$u|8tZs_)eF=#h8<>V3lIbQxDx z$w{gk@6rHWw=(=>fHg&7q}Mz+(4Zgdx+y?#Hh$qVo?yuRRW0MzZF{MVTY*3`E)dJD zb6#>1&*&nF;bPg;m9j5anE-u8rPD%gvD<1xCiUam@P4vmAUJ0Cf2NwTmbJIZ@H6kd zjTwz3Nx%Ku%dUG+X(QpkOD^72zYtWpb>!=dHd2STu>?MamJzq0gMPpmVT^ixpQ%74 z+o>qL{D0_r%cv}~uwk2!8d6ZYK|&hoPU#Q?M7p~>1p%eI8!08FySqdhZn{Cb8{U08 z^L+2~{`h{*nl-Z)*L_`kpLrY#-Ew#SpN-uN)5^U!89Lk^#kEk3h+?5Cs1fQoc|)Mn zw!Px+d7*kO8qgME2V2|AOqc?8u!o>v+Yb8!Uvnf?DwAqIt*S{Cxdz7lcMZL-)l4V9 zzbg|u=&vi|!=-O}$=dsmq>=wK(@5SeR#hcImkDzY64dvc(<|mcGrLi$*F=g3jD!oGPD_!#E$(Gb56D;*!pG7r?PJhyOE91)6tJgC}wBZ$%ldPX6bn0 z$)H6Nf8IahK%m!C(bC-}sQ7N$m92QS;ZgLjrs*QLb}`Fid~B>b^iq<6Tw9o0fCCie z8hv>{Lf^RT@wCFf+=&tW<@$VGplIB*M8$N!^UK|roO3N3RgX=DBLGkvfxVTn7MQ(G z+e^*I)tfZoh1!Km`u>Nie6{q{PV9A>0;MXGtovt~-e&Ny&H@SoV^Ljg9G=VO-b_wW zrUh+ZucBePHFW0^b$6xTi9d!Fx*MHhQIL|pw3Q_FR2#=<)KRWj_tq>OAnh*pe6LKp z?ob#THe!1Z|8PwA$F)?xRWIEBHZP8&z!6gsXJ;gerHS7FC?h2mFuWR49=%h9w&@s_ zQHE@n?#g`(R`#6J-@gSkc%837DOb9E#h0p9$Zv3e+5#jEZeMxxaDPB+ zm<`OG*gHznvu{u*5fGLL;772A8x8XlBo(AP4t}v8)+|W1e0>#O9XcFEg#GXz4yYTt=7yuTcpWjNJy zhEwu=?jJ4UI#-;|#~UwGt;LX70@WZzZ|-wFXS?a=5YExxn-X||StUcPcCY1zk2Kp1 z6@`HWEFoeEs}&FI!N76fuwfl=ybo+VMNfDo2#|qcP^^REMp*0T2pAunG@7$VMHPZO zbq13z#IGZ$h9k`rx1O{fiQ|uCNPJ_DVW+jfnu~W>^v!-}{VcA9T#jk}5UzjyQ({pB z=ooTuy2u{&OH^TuxVuaxD`~O#(Bcqu2>1Fay?&u5Q*M=j(tS;e+mc6>oBl$Hn|{^G zXVg>$uDR|~7XP$Lq6Tezdx@QFS8*NOuW8_Po}5KDRBT%Wo6dwwn-6|TY~iB1&6G!t z76*Bug2_B!@t9J8j_^x^;Fk4h?v(OO4u=lDe+ zer{}tnst|RP7M`(H+)7+?WlZjU{IUxAj81Jgx#%kQ1&9A62?4P55qt=32lx z4S4%MZt`7hsSjnYT_GYJHtsQ3^%7d~^i#r$EYL8I)=Q8=uQw-X?45biN` z!Kp87aR`RMon>VeRMRpVI@`K@y3HI&2i_+4?iK7B}9?c9y_UQU{-l9#yYCYp)r3NjP#pR8AZ)= zUM5r44Qcwdu(dPYQX`Uaal)>UgvQg-YHdo9csdoED4uwQ!CN02S8anCHCw>hi&}c^ z{krrA;6Ppg4rFN-=~0%oVMnn*Ezu76mz*ZJl#MmE;y<*ZJUx#1R`(*SHIb|Th>DA6 z2r4p-8UGO#FOOmdxvQb%9spF#xo}anX-a?s<@wGIr;py5HSokl$Hj92M$9k{(l;gjT;3h+G6DmBXDW0B_=Dc-F^9zT-{K413Ij=sxW>;|q{J zym*r^ZsJk~P)8z1{qXjVng~9!T%^b)o}!7=5X7q7=2#Z@o3hkDLB*#f7%MQ@rmi<4 z#M^ftSWbZr+@LRt?m*r5+_E87 z`)G|+>ZYApHTmk-%6N;LA zw=|gcL#bnJPY-r=qFa9QAkx_QvO5F?Ha%Vx4O?mbV%A^1s0$Z77YDnfIDqi z`^4f=YtaBuvc7nssr9n9IpOlS2k^XO{&F$F@b4V=6@7W#;h-5P)*+e z@8X%@+-F)ijX-ouV1l;Rmqf;NhNAPJ3j+AMlt6~!fZy-=E)yPKMyjkjAAn`WgNul?1538G4+7O+-0v!VvOEsG121wK*u&_9;%lJ4=)g5X z^!sP@Fvtp(#U=oy$F_Xk%U!7f;{$t7>b~M{TJ)n}Fmo^M-?L7s-Cw;v33{-B4oz0Xh%rsOjV02K3H^fJW$)R7#8Flz|EQorF_CIVBB9x^V0l1$GB?Xd04?d zKF?dIaQ5AoK$yB2ZKsHdH@t6s&v(X{nbW#KnlR|Qs~>N$eNGw1Xb5r`vMMP3-wTBY ztZx#Y&or}3&vtwAV11iqkq+=6F;HAc9Ha^3B(_#dw}W5Yz2-yxgsUn;Xsys$X^0bl6z}2o$D2@)I4efEzE|ss6K(FgnCWdiXII*7gX*cz;dEP|Oyu`N?{Z z@87$iH{)EuA^YxM#`(O@vW0X)@FFP;p*rBhS3xX`IVT@}6lSv5dm#}sblc*%=Ge=# zQZqve(`@;wz#hN!&;47#_e}<2`jkh{2q}cfwPJ-g={)eT_0AUR>*e)t0#?JJbzcxn z{lWXb7T^kl1Va!1x*+{ue(?zJb~*-@O2r3w+=$#{3mkU=Ksk&+VqA`YwV$f;2C)CjK=K4~7mtPO^H=EN~Wkkio6g-dC1RFmiKoYI?Dg?6b z?DZ*lAO=F9Q3>PW=mRAX)-Ud3Ky80j@lx_ znn`NiR;AhRwvuA9_>sDO!soh#;Fr>=0=+4d>}t^`HmaBMmu<*KmfqU64|P@FLAd$L z6D_gYe(OF1)Tt{R9|wTdW9RY%wYY&{s2NR-_Xe*Bnx}oqNpiJ$3l55We_O6LXY@lAlTRA>;>U2_5gq6it(^{nL_WR?np5Kbn% z1gms>IUn)t2s$4c`lX$DO|y(>FJ_RV8angm48MZgj+fa?z~BP`%)mu=f4mck3w!bi zuY+xVC}4Yj6hvpwF{=P<-BE-?q+D|6smhI1KWTFE2~)C>QH{RR&(9AT^)ts1HA2ZHcS$z<^JQ^FLqDB7o`s}SaNDsT{90(ZYULe0 zYklKJb0Ht=|6I$Z4Se;h2_2GO!D+G0Hn`- z~Y3RPuT9RJa4r^cJ-calPVUSLb+VMMe4Y6qH>#pAC`TAEV5UR*uk%D4glvWKi9Q@)g{W6%K%Iv zWvIyf?8TwYZ7+9gPNcx8bPY(cF;;U)$_DOuMlE9R0y65#N8h#|=zltE{k{lt5=#M= zFM;|WUqNYV>$~Q_5EN4Qqxv|<&5!@2gb&=?MF5<^^I}-w$|Y|S89_G@0fT%P%6$$R z&w9(avY zsHiI%!mM)yF?PBKy165>^n)I3bBdh+P*`l;ow`s2%>NGyKpXPm*+M6}i6Y|-aN(J^ z*Q&uFf%p`*2I!m9s)0#dwFVqL-{0lF-TX63qmuQs-i zINPcjgsG;YoTI>WH)^YpqN$0wIl6ng7a_R_Q;pp|RM2b? zqPt{GA~X3UHK&~D#HL&BlpSnc+Q^*K47;ER_@Oec9tT$G<8FiWPehoX&U499cqL<{ z6}W}k4*(+A2nNaT2f&6Bf|WI^sdz8>S|Va(;5s4e3ji6D}hcif)38M?fUcB;}rsn=O%OU!;I!HnzOPh-G}r` zkRKRMcRSSAfg}B8(Lbb)4!_yJX?CUnrn{rjSN&$pH#*tRI~A8_>iny#7AZBo`r7Ix~zEo-!%zEqvQW^v4(;f>}Zl?O7`KSPB0C;sZwfIzt{qsC(iVr3dti#`kN`h9m1 z?Pisg4%}PFOl!exdOI9{Tm(RDj{3FtMv_>y*ZJ9}pk2E@q&!<|gYbfP_Rj}-=sWx8 zdhUq6f`I@YOzQ%<7bO})x2VRSK;N^pfVY-GLtPPSH)JAu z5(_jl^s5&0`|i$_lDH~1w!)l#z3c**>Z)pRwsTkwU@s!M`{bXfU+n2SP=M{e@RKrFbm2I-_lfpa(6Cx)rm+= zGDELsm3jB$B9SMkR}$}kz&G}R%Wr5@+Gp5bnZLA2Hplzm(cjI4x0WCc^_Ly^J5hR0 zhGr#l>;M?i6o;Zu)J;~i(XMc}>E!EO^VDXa{XNMaB$qQv=#*bDIM2dZ@DD!e9e>j} ztb}~Z*tBLp;@g`#vM>ts0OJ_L7NhCz8A&jS(4g%PlJK>tK|7;IIsi~3YEc(zY>p(^ zSLa7ZK-b#lUx^!ng2{{_G#>6x0Y$kZ1QMzl3@M_Epy5Z2_C6x1YB}*tFzc1Qb;XVC&#d z=#5?>2Ew<{(IVJ~h2H~B!T9sS+>VwEA2l!}m{T2UH>ErNc%6WxKTF1GQ4p`N`)rcS zZizPC{_|QjY5Rj++e0lZF_agPQh4}c^ZR+eDAEG%rrgwO6<8wPo{{jhaBQJ(x2gWh zIfiYR83Vt#EuuU3QEEWUW8P0}Km+FJbiSpMV(Bt{ieqJ(N$-BK?eAe=^Jw|@vX6gYWbML&$ zjyQF-}xx^DQ;9PN$! z;rVly-VEVPZypst&(&QFNdsUyBE&{8`K&YGE?`v1$pOU9!yzFZ(QroI%MPZ z!AIKjtoXqX*IfgxZeAi74OnsO2wMjf9wUL?3c8ig7v)Wdd@dlMF9yW{W#}xuB`{;W z17z;x6a3vvUN3F^D-NG~kma*4Il-=2gV1*1#5o)E8%6O7f}Jl-EmFt!BM+ZgrGWt8AGSR1OiG)2vq;l3A@FH;P;TF;KY6R}kTK z9DfzA2O!O%C+fpv5O)?`P}K@lu$iGW^3dvry%B{TWw1BN6@>5|{<`sTCNOpBf&Q%n z1B4pd4nZ+G-r0-+UMXxTMtzz;y*6T`UP$p!5XG3e7ec>B)EZP6Z*VPCjvc|`tzVGp z;HNZ$nm4*kaqvAcwx%#LtgVfQ5Qwx>5T-y~XR)7agO}C?hAUbBGm3mAV?X;>cc4ic zK2dY8)dA?|ktRTPsKV@GJf5;^Z4`OtD^YoiFxl2svQyQ zz`*Ej;6p0lt&lwb38WzJ9QIk3SWocLR+;=7=bUKI=@mmMBDyez7XquEDxRMKB{G}m z1gKsaiDc}k^6&o)NCgd`gY4cW?gKbOTPf|WcRLEdK_nngwjy2On^ORUS#jKUtt6Qo z$(U{6bom47;c6fOtUM`MJxx)l^5zeY^JVpGf^wsNe0tc^`vW`@4JVPq_XPS;O*|b>{%TIE?R4+B7v{iYX5X&8BR{h`HC!+Xr)0Uk6}sEcEl4)}N42Hs zwhLMyy@hxAOm?0REpQ%yiB(JRh+H*On%b~qaFX!teh_sJP|iw_TcghEiaB;a8-EIo zoRREP8z`KxO4YXe$6hN)u;kYz?C6j;ixzGUUbfQ$D38Bgs>n(7Bm<>6OOUeKWN}gx z4aSRN7x=I%E`lV;bXW`*n&g?H8KieSe#P)BdqMA*&HVRH*dQC6M|>gMdj9gf9xG%& z>58J=CdK2~isb(JEF8hiPI14Q^-2lCipiwT3#ljZEYrw9U0a;Y;@?%8PVE?@+J+zu zXRpLb^UhmZ6ZxJotuv_H>iPs;4SKEODfUYp2vau-7V)n2gd9tY@mBv%VTqPQCz2+Gg@{-#zBVGMeG2Jotc|LR+axOve?M~iJ!IY6`Y&&ENWMD4ue^Om}ug>feH=bCAz zPhnPr%w|nz{G|^wI-fzX(`3u`a0nb_lX8Aq&N#d`pE(hDWo9=2p%tif^|$G)(<}%a;e;rtgC zOy_wh$$VChSBJO>FpHrsaJP(}q_^JFPsGO;nlN?pmY?$?<~!U@BsbdafoRDviS2Ic zG^uyAy7jw%Et8-`if~JGTw?fDhVFNTH90=VDb#mNO#P6xU6}-was&&jDK!n7uwn!w zxd78RGf4XkZW0+`$?x&Ed^m4eu&9q}{JRAvI^THoj)02#!nhc-jOrkbMho(?;~7Qd zC4?Y67mr=*V|MLkE;urd@4_aqxG8s3vijanaRQ&%hn=-&S!=SLe%Qt@9ei z>(U+fPAtKHBn*e(9zhEm2Am@F1Xjk)zx{}DYBm1g6JA|2tC%jU5yeCP3`c!4x`}>< zxFVWbQc~rqu&HI1VF-zVSF_K?+oblSS$};>#j+cLIgnhU6e;~}cZ6iC;ZiY0ATEvF z=+w69AaP?o@?mGOEIq#2TVsRWVZnK$j!U^_zcKnP>CNttTxJNyw+_eCer?Ijt~=$F zb3+SksQ{^f&FSnw>U1vqyg!HWQY`v3s|^FHeSFS@KJV@1;9q>c_$J8y$v@d^z|FBd zk0OtIGud7!Ly1T-z#_T;(OQ;$3m84JXjU%_Z5)rb%DIJWdiFNS6b82hJgkmoJGY^6 zY`%Z?fSpEN&}bh0vN%ypONp7TJbp{XRI@NJr^oVOYm|X6(=8V9A#{5JIQGS3(c1DV};gt`|bLd8yO0g%wNH z&GJTf$Ze3nELQ2I1V7qbmu=g687|k$$9+~z!TawXT#pGF^O^Go^-8(bLQ_8kOAaqZ zTLz(rhefvb&y0rJpV8KIs)&P+$6c71DXMZ>Ga{|izIO*^g9W1A&!S%NDia}%_xeNF z9|TsFmv+X-$+~SLNFG3K?F?52{-3yGL#HYit&sPoq&eKj)%{w7MtT*CR^^RLt*=+l zX;=o9v?r|Hx;so?{;1=DX5UHd@#Txc9ITu*_=MHb)jE(&g=!m%!d8Z}k2%eacJFkQ z#@)(2wo54kxR<@pC|t%?(BrIA8cItU-kXHE?csmgUKjaJwh^Wy^!{Tj`^@Pa>H@L2 zm4sm%@9j>m7W<6zT@K>MhJl*Ub1lkwn}*;eEoWN`yz1{I=yOkNsg)yBhf9SuPmOZp z#!D_UOa;q27{3#>=cU!!CM>ZnyH?zc)6H6_ILcA-b$S((^Jzm`gXFPW27c+;L8J#u zxH(>x=aC)?NbzH$l__CK@e9g~M-%)7@yA8kGEL@hsqH-1bZ&ncTiw;~Q>Vo`5mY9ZU|T`}s*e6RxTWc28&7QhpLOEe`o}^=_k> ze?;GEKl=$|d4X|5ow+a@rXb%MDArz;8_DSA-$2!}tNX z%oL5wF9TD<9$=a!be*Pj6}9~CeoxuxW244$ZN_A|x?kzyI*a*fZQ$L)pCKNIPQ~|e zsSlWvwg>JUFlJ&S9h0=(Opr#zTEpHRX9^FN2_Dt3rlMSb-8OL!1YbHVhYC$gz|xMi zA7xFUUmnJ=2lC42{%m+r&q8^B%0@ep+* zWE3_T;n5a75>@gjOAHe-DLRh*cp{GrZ%q{3GMBUOZZjHp8eXhYr&wOy75z{Qk_NTQ zpN$YC0hY5CZOv!oqy&AlHuL>3<8v=!(M<+L?rOGA&pnJeUB$O%$F~~ZwwFGrdhkhb9b7f`~p=2inQe!r2GPWS?2>#%^-oI-plOLW~aL% zfjYczF(Iev>_1o2D!w)Zgrn@B-qt%d?VPk4U<5)e7JL5Lw7QC7Y-ciwugMd~;H9Q# zk5rP-6IVhE4_oTF?{yjj_NR^%937+mTwR)?uha<(XGP0%9LsadQC91nj5EN$ zCBcK#ZfbeV-Xk)2yi?4AH7V7;6J@i8S2liK9BK)Xu;?&2tg)BX zF0$&%;ME;${`olI(BcVa80k=_OW%TAb`IzN&D(R8-lJ#ii1;DbA8X6qL)YA1+c6xg z@0kO20WtTGS0@hU8uIh&W6;77Q)2vj;U9tm`O*T4(<1opFctyEL*yf9aE@h zvH@q*^$m{HNtryaBZtRDmTTQk`i?jKMqRws7I-$VsXoiZ96`;28!d<##lUnsE-=&E zw-O^HPWcg&=a(xe0JAA^(CK72kIPJJ;>p0>#HR*$Q z$g4zYUnj<%;OA7a%fzb1c+~QZpd%}BdJkGvt>dIsBX%~E%AN+~9(@srRCEU!LjqKo zy)S~zRZkNO& z@G?`N8$Y@pxG{e$0(Rv?~^gzvb>2 z>?*jM7nkZ4`Omb7sH7Lp=daLen=r46Hj(zG+Nf^YIEucs`Vs`D1lq8lIJ_{`oDd48 zUH3!8{SFEMU!+iC3Wl{V)_lK})54yQ0Ia6XcsKJ;KvkwLAHT)+|6KuU1>QJIS3da> zeqGVgR?`$QkD)?m$#I4{Ub z+%3<;TN6GKbIjX!*KyU(XUxDlV5Od!(evW0nWcQHB0J!|?59q%saud3xwzn+{NLr) zlp7WcXG6?A^*g$=7HiG!iV$Kqa~vm!6ueG&-be^7QLsh<8q~})PGql83n~aYhF)=w z`ZHavNNka;X3)3?52@1FO6Mllmdj zAECX~xnpKhhLpYW9>`{;ux&2A&P1Lj^vQ!VFdXlSW@ibUBxb}%dzpWE2l58Z5`>g< zqol5DH<$@_)Lxu0syO|v-pKu}-t0u}#8?C#7IEMI0BW-xbt$Q(;Jz2H-(|7<61PR&v^>0kk2Q|&q3p*-+eu}ifbk|CpHLS z!j51T1k;gLnO&c5`So-#-8eAJs2OFAlheEr&H&RFv9YaSgw3*-z>K3UMT#x!^WeEw z6BFK;*U&K2(BQ`kwuZe$_D>fBkM#xCsS-9%Vh3%tXr+Mz{3;tFYQ)HMANUm7N+J-n z2we4iZq>D(w?EG*&zTqj8M)2T^}A_kC>2v1UL!ONXT>$U&<+=}Bu%_5AayL$?B>G0 z|C;dLYKv#KS2OLaZR?F`K+c-3-Dh=(3_=|W)TbtEC;iUTD0I9Kr*^d@R^-G~pQru$ z=yHy&$-0=Ezamz4)SyVnQnfVfK*XQWWfu zAB;s~de(uSR2j6Ayk*y5DBVFb3|l#HBj9(sZR756XDT{1V#yFCoLEecg&%$lCDJ(0 z3Qmc|YFINvF4~?B2cn;h5X8&c@EJ?&(PomKZFpL@2QXR1A;9uS0DG7yEXGgKv&;IG zy<*VjO@dp&u-84psET`&?b8c)%jkzq@vfRc7$&10hRR1E2=;kS|K1{Gz%UD6Yo`n1 zl|-GS?e!zF)d4d)EW8gtqK12!>$jXr%&6U9E9b@W!sM*_Tua7 z$LjEOYCPC#lTC9wcVyUnZ^Wxgqfs9IDj3fra23%*L;m z=eg%6s#|KAeA77-(hc4kEon=`A==R<1nmdlbuKW?a8Zv_FgHlM83iRW%T5?)L_c$Q zTc5OaWX3PDUXRAuyJMd~@$@GZgWXm+5Pqkw62qi}`K*owqkROJf5yt7B}S)F;qiFi zy@?tW960ZSi&tx7+^`FVA58BZLeSlJa)H3hPQ+w;VH`=b+N5lC9E>IuRc~+CHY2MR z2+yvwwNv1V>WCegrt7n%RJ;xodq{AncsygKmKuzlG3iqq97h?$5QmmynJ#uGN!8u{ zJ5au%6EWF{DQUW|28~ep5Qe5gg|XyNm~>D|fd-@StTExOx*t?7o+?->jP|&lNPA5m=AlY;79Ux)q~TQPSn2YcC&D zcC1yn4{Uz(REZpch-=3!oENS>!M(NkviAp!b__1+kYUwTP{e5C(BInq3ux{Bd1}(E z369nq7|g8Uimt&H7~~X-2aC423toHfJ$%XRppxi}~AC zVv1H`LXFTJ*+r<;;N{H0q0jdRx7-&SB%r|b8Y9q}F{41w^&rrDZuZ#{vKP5$o1C9r z$};lh*DI5QKuu3a!)7 zxc(RajAIF+dryHr(%xIPcI_-1Q|b0=ee!>g0&Tx}n)V?0j*|}|{u?5yvf4}Du+@KZ z-=gcs>)^Tj)SzHifWB6#hcnP|QS-AUvxd|$^9%4>&sCH~)x2AS9ms@<(F>N4hUl_t z^1NV)zg(lVxb`#Ke`^q0)I@3`Y6Bq^Q5{B;8tw;u zSUvWWIo54IrJw3OvFwAap)9B^%9^YanL=M@KKMM-B@*GX(vH?K#n!=Jq0T* zYYwuVz^uwOE3%tQ2=Qw+w000Ql4;g0%C%dV=;KRcQ{qzkDP0BX!LOUc*hmMs6K~^5 zhF(3A>zoY^7VRy(Z&jP2D!}7a=0x&TP*f2nvfn$DPP{dGFBCE{ zHj}$N?{QLwwlaN)>8{^dY_Izoq9?=M{b}iDLz;HIX7*!fWN~~x&Nq_AFD5eOGVP`D zIl+P@X$QH(SCuBuvtP~c@m$m>1yuT@!2Mb8esSWfc+GBtbu?X8h(C_gi9=x&h`JVc zbwbFi{1O@hsNGzTqiov1{{v1H{zPA+fVlk#eZ!@ZXpR%Kh5-NJ+Qr2ql!RML%;dPJr z*V9tNh~RPL6|U-E)a29}wODo1Z8d*OpTi54B_$VgPv6b7RllH)C__I;4u!47h}#~4 z#y()l?C%}7pdZvnTM!_Kt1vUrYWIL~eF265K?~NklTk3F+F|k)?Q=+^EX)WyQYQt{ z8E)EwM`UT*V91>7_3xG)iP~xArmF=#?zC) zK$F7Yn4%rrDh^VXBU%vcq4{*Xqkgt~EQWydwJJ^h(8BuU_W!CVQSCVgo& zwt4ChGV;b}-|AG}wwlQEOi?L*p2lGO^xe^0m2QK>X*JhBBci78 z5Zd!o>)5z+9syL$0m(z8Z$CaRWed(o;8+@5EV-vamjLQi&fi?(doZHttMx2FTnD9x zYJc7zc5@X1GWveDmU2IGW-70hG! zf8A;*-E(E9v4U5Z3-}$|Y=>)g%_{j#;<~<^v+`tJ5sOW zHKfli=v5(8nNDUGqCSnkqMQ4x${xutD#}f68BWCSw=Xya*S?4ZR+ zqnDp9iEnbgl5vjqww+qeJMp7kS;S8lj<0Rje9g~aZDp7c8uTt_)Xd|KPHPog27hl} zvd~=n5W9)U6Zr#&X0bmmO*rC5YLj5@7Qv-N{UP~VpLm4^ z>JykLPI(EEkP5`yIs~Ib3O@DkOqT67TIr07b>WP5L+v*)33`cWiH(H=TFVPuavF3- zVQxjZpSCujg~)JSz7HQ;Gs>R7qmv2XO^rI=vY=wn7W`@6HexwM(Ng#KYs^;+7p;9z za>t&D55ie&Dfs^>K&sTDSJ{>dUecaDb0*ID`!ULl&nULbx9YfcS2=&^F2W*AEUVu_N%tIuHY*ub?7jA~TVVCcGSr`ZW{I&Mg> zD-3Nr$hopty@|ARWdUVm}mjd2o`vCz*Z%|cAWSG6+( zS+VUkUeaKrSwA@k+-L5}gvE6+&#qM7Oc~$1GBTg@m{i9>`VofnS+LbVhR1lKZs|2Q z5Sz6WSn^eq)b;}I+X=)%lC5rE!c3|Wk(kc?b^I2+Ihea;FSO6TQne)u+1A#g9aQZr zav^NSVrPk=s;9$jT89d8tN62yp4lOTQJhg~HTw0jI9{|&af(PxQ;hA{gO@RJ@`)b| zQ6|c0Gn`d$;xAjF+Yw{oGhAEFo;fnR2sIQ(UI(IamAp(xAo14%TW+omvq6Vn%aCIV z+-Wd8>R%qAhZChwQpQgwA$MJMca`p`X{_nFOsR#QNU_ut9t{hy@NfV66QH5zQ^RY~ z`z!2z@El2TCx%TKK7DwXI4|L?$sL0QF2EZPxHFyQeOtHuxOmo_OY)_;{QUFRd1Vp_ z-80>NgGFmHlU9vH#~$g7`3OR?L1xJlVo};Mxu0?Q`{g5`{H;u4)`8NMv#7I* z;?3v%h6u#P*8-eY%3pYU0&4pQf~prONp1PZF2tIL$7`z2{VJX28FfT^5z&!<`9QS) zpLluVG{MzuUOaS*j?{MSV&@a{LF?V2`Rc+Lm7kOr=o?m-Fqx97pcg`3^+QKFCzNe`S*p zACoMd9{L{+U936YQ&5;fs-kEmB^%D#m+nUWA~4Zjs;_+|IUOm^e-C!#Y)^UakGr%8 z!O;0!g07LfytSxq8lDdc#F%9n(ycDO5I^C%1TP8kF=b?Hn#YP48d=q>w{R4K4v*%eLn>PCTJhv8$2Ql`v}7^&^wT$<%auv4!88>U_rf;y8r?YW8t z8DDbWf{O?~hS~S6F4Ob{B)rN9NS^N$Ed!bfq-@FyHC-+|Xs9E1(rX1uJmq`iUfpJe zKkWDZqBQ1TtY%ANkcx+z``1(=dByb-M4z>FD@5 z+zGS7yovS6!)}D#77?4?i}BvcjiwMhL65$v%k+74%sTeRml@C-yO$b5yPm9IatmJz zGA}}73)-XwtAMJCSN1`Jml|uGsHaXhqfODo^!&O**S*)PRK0?OhF*&2K@7Ky3T51@ ztF<^@AGqhGQjQW{g^6Xh7MSz6YGDxeNauu=h5JLq%M}(9j8A+ZX~$oJ>3#`nwXZIWR@+~B#RT$+MS*E! zY$+Ivt)A^CAuwe-4b>a{d4)O#gQ^4uDsd69af@`sSVQbxmv4N5sD6N^*=L`B6)aAq zQX|9VAP-W3Us-4K(KlI`)&40;aG?HVP8sk2M zMb>9@yyI$q1hsSQ$D!m8pq6jPEj<%mQqmL&Mh4tk3~yuLGaSM7ZM^6=4{BM^I$N(V z+FNEpa3Y0}BAYXWu?~_GX)<2fIO4Ek82ru;s@y0HMAd0RsZWqp_|xv)@rr1n_gj&2 zCZBrgggHy+z?G3|rUHJ`GwoeC+Zw4+YSP9qxl$7^Md9rT&BY27q)vf7C5>gRxwL0V9sNZL8&}Jp76Mo_c}(Hee?P#!ifw~)J(sB5f4^u zsak$kq9UDLuhT9(*UEIQ+7OQtS@i%C_;jM$dk+}CZWJn|$SpPbsI3i%afA(@%4eZb z%23aM{SXR|tXkxBiC}IW(0K;~K7RiV_@od)=a*#C#!0Q_Lm5Q0y;`YYXOmwyCZX0V zO!$CXliKd;wUes#vd~~`2X=77<@?mCRkkJs}4X^J0p#BF9X zxp!3kKg;Ngi`$9fb=ATp)Zm!z%D7S(V+1{@oTo>J$MQxDJ4s8WKU1;g!fK*+9I5?e zxE@yxqu$t!C};ov-oL4zlGrMy^*|z=2h7yTqLzHw2ns)o;ZdOwMn((P7nIiE%8Q8% zdl=XKtZ=IzNtv(?zRtJpHoUsMAG(s^DJb4^%Z;C!^fjZkLx(%|4x5e?ac49o;5cZH z4p3lCgx15~#Jb^gB4e^qtk-o{;T2WUh|u_tKFx*U8$Np;T}%?`rFoBlY%sw!Zygs8 zugn?+~kn8+J|sd;$KUfk281iste7SIcL zbK~pxusP3GJ3H7Sgve)Ll2RcMA|S%8>62Sl#Fb#Da}l!p7UO*nbX3s=-gZ?dh0O!3 z>w=*GXOA%*-VQ@Be9mr!~#6tDWDja|=NO0;dzd`daXOYKTZ} ze}uU&uZ5NcMEVK&DN=e0^1*oqfKMA+@0#{x-|Ah)+jHV^fsJVKkGJMtal~(Vw8$I) z$S28hA2d*yV0C3R#j;;}9ri68KU^(yze`>=FpuM~iGJ3YDewuP4XDFv8JellP!%3T zz|fEK()ie?YM* zaz+ys+gq-ccez$pHg0ci^%8`Dc3P~SJF8M7^;g}hN_B#6+XEJxXczQr|6lK`()b;+ zI~KI}@5fBZ9(5_vWEg<;$#6Ngq6gt5-)Hoi*%5$&!GsU{?#mDyXi*yCr!`)S$G1yc zyVT>Q$>`c=p`|fuRfxyWaWm`5#s|mcpe1F0S9EURMe)&krQfhg*Y=}r#&?apt$zo6 z=%52W_VQvpkH2GnidR`kJJUiaL}1;VD9>aqa%U?|bia}^9>iZAHghRl9Z1Zeo~Xc7 z^~;l)46OVcUmLqW*J>`mKhfkuGM`saR)=QSAv&*~nPTh5GHDH-&zIB^k9!UMVjAlI zxKAF=9S+dmW%P2XC#hNRng_z4WP8NH0Q1RsFMi7~EF{*7=*J(ok1gUh_(YY0Zus1` z+F|I&m5Ln&W)<9QG>2dW-)1hp;_p#`Sc@KUKe1ojygiz^JsXK-J--N=y#~ZN(!?8S zShqh){tsJU9n|&qtxZXYw9=i@Arg{;NP~1qhjdAYf`CYOrwB-QcXyX`cXtZD`=h^m z-#d5i%=zccaq#f{?zQ(?&wAoDIebSh1qTcrJ)F}9LtS3Sh4!d-FH(Ibrt#CJ{vDbg z9yP8$>mPAF@v#YDlZsYRzEZRrZ@x!w?_G;-Z-aj{7#}U)I4T_#=gcGc$@1GW#*2(=bF}P^j z!frNJomB)k7PrJSG_7pHRK14L=Lxa)yLqEo-yUVk0!s!_ zBpVllQS&aA9@vk)^GrWy=pxI{ABDkAq^i9E2yA6yzC0@oCd<;o1>17Jiq|WAFTalQ z0uQyjz(uB=dM~X8>S_JjZcIjmY5xymAQgFY{_lI7RRCIL4`*+0>(6?NO!wcT9?V%^ zAvYVRlETd^7IUms4n(>2wjadbqnnY~Uzai$Rh_t|`8*8sSEt<^u84i}@RVwE`mZhY z|F1-tFby8tyVMFBxdzzv4jUpY273?+MxkqkTf2o z1sEF=QFAa{>KX%X2vvpJTKxhbiT!vkp3A@50|CmcS8lETd)A z70xy63N|A;KJX@GExn8=b<%)!fYgGb2narcs5~+Qme|92nQ8v}Yh>&X{t~#)!gyA{ zQM`sJphS4z>Mz{=ZHMZ~%Za%VAGRhCwCY%E=Cde#*u~1#LBB?@coxWJmZ>o1LT;y!*@4Mo zrBMWPaDs?O$#1kQJNWDK`{T!EMj@yf2zM||FyEfzxy~3d&StWTvq+P`q(B0Br>7rT z`RYVc%c(_JC)ha;^(C-7)pq-11Z~_KW9n>~U&YSZA#DiSEalWSfs%6+FmMBe+K*6o zOwhvIg-#G;)d(mqtX#ve#dXRiGF?hxUaT}iMLi?oO?#Ube>S)2@Th%=SEl7~3AOte zg%(^+wP30(Z%ZXp{k`-v_UK1pj}aBX$Rg@*K`|cUFs)` zVSdNI`^uSG3T+lO9EMURkvjL{S&Pf=yZPc7mc8PLf)sg3v-9OV|dzd++gPs2h zLIZp<)+#;vGuHCf)h=g)>{IHX=khJI*)21|vXbsXo}0pho=oxs1b1RRN-wv8Q36I7 z9dZkg)In;U2GFAP!lqdka@<$^E7e~n1Mh{;O8_|zT~Y@~ER0qZ0f*kKgy(SgVY|0y z*f30BDwv?CiFpm#&PqgFOs>zpXqzaxhPbEDuLWuxG&t z%u?icSoG)zZzgd++&o8GMecuL(NVR=3J@jUuux;4hC|Mdxh&iAjCBz(Y8NllSSt;_ zCl1uBOB!zLZ2fm%y-+@DYZ~&U6fFsl&aNlG+*%Nfy{;G3y<5Pt!k9x`l5a<&%g{Mh z^cB!s{B)j2{NRVDOUC{)a!@C-3OJBGPGC*Fmsuw`ZKd6%Sl$3kz_OXxdOiR5^|WUF zZeQ*SOT!ec@xEEa(JlJ(F7K6ZALC$(y_k}oEh*lNH$*?Gzh<-7!)} zusuT`MAI0@@J_SI9$x{yvF-wZt+PGHhbYi66*a#rxV65Q6}(yhp5vFstN+Va4;J4&Ul~4og?VTc6Qj((fS|uI2l8wx9{FJ2Uyz&ux4t1bif(njclX?()T= zdYcnKo0wB}^xkAho9j&O&PQ;kZ6Kh;Ia6WgA@E_S`g`%$ec10F?w$?VR#&ILtCigG z*NhhqsLl`WE^ag}3bW4Hm!xcPRS5UziYLEq9KxedFl&vgj~FeAZDCEoyK{0`O~D85 zhH#O+S< zu93zeus~&USr+P&7ZKb zCe{d>ra+$3pVGLM-D_PvS42@-r8yoekQlRcEM<2^!e(+{Q^d3Pr}Np2@)M#}vbO-zl_R--^%y)MX4 z%c?R45{y4_A@nlNbc5JSDjUi)Ae(^0k>70+ID?8*Cj zSFR@wQ>c*KeBi+W0Qfc9VYlKF2BeJlWD~4=#c`JiKc;j)d!8wh#pRz%%38r*n5jy+ zk8=(W0bXDw;5Ae=h6zzZZBJBLWp6|Ny1tA>2`~8OtQeMB9}-KQ?z_CRZ(l3jT+Uqu zY>>#HbIv>@4Y;#4Zypyuv&xNwt!}^SpHMnuEUFPPJF40Rl(v{LI%L-uSii$CZ1d&I zm2RUc)}qPYk`>Za3m_R^l?M!dc>*>u_Kp}s7p!hth}WC}fADuIBxR*Q zWu==gd7Wfz1qE}y!V9))%JxYC3V;+tpHJ`)E1tzjKk+yF#<*s=3*+|jCc&bS>C|JBasVh1*)ZMah^|e> zMx~Iq@dLSoImmA-Y{F#k?C~Dv9m%w`;y9Xyp+q_b*QL{}GO!%NZWlv$0N>7qPxk2n zqP!t#1iS{ZY1ut@f-|n}>fHmhYk;%9+e>m()RcQf_`)Rk7I-VB$7(xi*eIHL&8etr zh^@rLT??*GbO5uoLA_uA`Vm(G1tJE@<jpc~2qWG<(kyKC|k_`eF=9sVF2 zDx|Nr>GWcGxgP#(kORFM!X` zfqeLFT{;l~@6+N>$Z=a6{Y~v+{Ze*OqyPXn&4FN_EnQ2Ol=xuK?kjNL zIBg6arbJ>``*#Q#4fSM9m;ZAJz5k?_e(~)5&mo-b4)7yU|IZ=R6WV4g#D_jT|KaYf z^>o1g>Y9EBnO50!ih9ifqZeW5h50Kh1j_ke;Wf$Wjjf18&$-@`xvoc;15Aem`zsQp z`d&TXXRewS(FSfYK;oz$|L-%@|I`VV-8$%;SrRW}isMjD^cj#~T35g0u5gXM!EtQ| z7DGWSbvcPZB{>21tX$NK0CD=@)UeFE4iqBq@{8(r!`V)~NSJ_8&Cw(z?sv-TIddtD zg-)dkI+ktz1Vq7`j(7=7`^0Q`RbCdr%KxO-m{D$mf8aH|K=guFkV9_~4_5g`ysd=J zNuQK7P%kf}#^jV{OWt=Oc=PTVUKB5{I2rW!?gA@01spk^?{KC;_vRq4UJ*y0->#Fl zYn>A5t9`oU%&gI(C@)spU&=L9-?~D0tK&W1Cg7eHGG$mYsUiLtLTtJv9Cgs#+b~y) z`T2qm$y6H4cJ4@*{qqe#qtJcMP`phf=|L$1wI*Q90bABL%oQUdRtXP)$o^7z5fq3# ziNnb2K&28<2k`Oc(!{+VQ~tJ!PfCJKM-u=?49$4bk3g8mQ_rp=K>6 z$MqI+Tkx688!h@A9~h9h#lb5ST^&{j&;$|VJAhAG3tVy|%@ze9#o9D41;ApC$wBm> zkca*qM5m$Bc#(DCt^XAA7Wj|n*#AB)Y2D1lvIbx?Xbw4708MV=D}XpQB!IggY$)>W zrmnh(Y;sU&)56qL;jQ^!;nx9Pr6?r@Drz2Hu6=XMwNCGdO3^ zPFVz11G9=;$Y{<5O9L1>%q^Z6#%Vh#fUm09^#QE;@*rm*mzGW(>&)AKuMRG3wTc}_ z_KRemk>~n0Ab27Ya)gSO+C4c2C3gLGlIdn83fPwz=Zr znddiMJ2i}(Hr6U>9mCMfLY7Z|L)mhKOo z16mru$2tK{z9*G~Gq987HvO#)v}Ru_^Vahb<{z5>T>Y52^Zxi~5NK8#UjZYW3DD7RDAh_RpsF!q0jJPRV; zcKufa^;<$ROnSq%{~j}e_Uo^Y+jatBXjI?Zb&4$ZsuN8E9|f6Qd0_wX@?t`XTiK_z zuPXP`h;oz91rTQ5#{Bz|oto8557;YI?Ez~$PxpRTZP!BgE)mY<*ItKY6T}JqvQmnOJbih;n&DfL71>9mBsphSZWq3EDMR(7Djx`tZzsUX!IUsJ{N68E3Ld4G_ zlxgtYrrsXdeCDGjaXkhmIs*lFy+_Yf)n7yJO}0GLv!C+le1uFAq+zZ9TKVm}4tdCy zfCf1pgBx7u&jPr@^>;8Go*>MIfp5sWV2xZYFcd+raBf1mX`yH^zXd6U)(vcGB{qu~}=jAG+;5PpWR{4VM@{(te z3ox25hBa+9)6Y{hDGMX4X=ZaP83A$A`LelZl!ZT=*#&HJ5@M1W#%KDZe& zkJ%%7ywQ0_jP5WtQfTkycUSf80WfM$hIgA%b&0RZ$P0Sn31GXH)pRpx#V*OGqPj=%@3}sat3w>GkY50PQnsyfGH5LYPprW1t4b+cm?Wuq*3#?eIk+j}Z zDL8;K(V*kl^s_?1rxCf_t(WV1-%^N`RvNyq_)o}zq3RqD$ zFb@_|s@WTi;tuQj&OdRo`CXNtWy|Oq{m!*OA7wODR{4FP`Uu&JZoS6T&J)vUVMf=4;S&YryU_jk!e`h1_$Mfyhp~>I zz&~XJbQVI<&R8>BZYfOdjTM#MBbt(g;L~@LPq44I8=I0?a@`_3I;KyaGKAno*EyANv+Mpi zHmgqaGS~^m!p%og>k%RN%kFp70AbA}=+kyC)+@nN0Q8rpKQ*@Qp&wRGw92=16IuuO z5qkr9%m>IdR)*qB_sH~$j%t~?9(zT<$bWurL!o;fYAy(jNI3Fcfp;1a1@MUa=|H{y zUtUC_Aw=9Pap6Nu>QBP^KnEfl@^0Cf&P&VbW~CK()fCf-v9#6*KqU(MZV2H5PW$Tc zO~$X&s2+pPy(rT`u!Wfwc#?ary>tabs&t#v-KM|L@9%Y>i$IHy*G_cJoir!F{0+&* zGL{{m(mYG}4YWuEV$V`h$ZsaqbX9;7O?q+NXNBhw!KMy+oF>6&DnR{Ssjesd%ab0T zzxM`QO{Y%>FfB{$+wsHIl(^_O!!*7#Ncs3p2mgnnkS#_N@F^kv{k#-h01@ypw&b#0 zYLTy{D8DxxbmDD#Lc+A%^q-IoP@rslvM-G12BWTm?&k{iVz?t$(d|Hcx(Q4I5#2V)MMI0u*Av_I>%;O6{Z&DtY5+T&dtg5o2J3z5QGZaS1W^aEsS#>q;W%BW>bk&i^)nF08q6M8on2(x zZK$lu!2akaT=P9J*6IBix&gIq{=W3L!hJ-urL)m2iWQ{y*iG~r39-d6);nQL$7yTEr8 zfAuv1)dC2fD1fZ;*0Q|Ta>L_*!(2J!m^0Vca-y<7Pf2D(6U84YQUf}5G@f`D;HsBS z2;wZT!zxfd9yMMO`Yb~8 z>!PV{o|_fi{fTb`R6xoE)-v^?4?SZY+M>PHD=?i+fM1h#sVIxM3@W}f-fb91&QuYx` zX$Q7Bz-M1}uHcLQDt~#Ox|V?NKC*P8I_Rw5)KVj&``)^CW8m8KSHK zlhpR#h&DaInlLIseA!QHlNkR{PUzlYZSVomMU|jn6HUv~&WX1~R-8t}W&Q1&s13_X z7@KbfjN{|jVmWX{2ST7^89vSKD3f3ani&^Jui*$ZhwRQ_V=cXLK}iGrU6)y zRHvYxSEoG|)l^K%oWK7VbpCO)0~1yq57BrCXyAHQg(a#?I`daOqg>S#9^$)>mxYxM zIHPTJ8u8{HJLxacUSwQi%oTmX0WK`}3bdFP+$T+uiO!CuHp4G6m1WHGP5DlMI(6uns?uTS}k!W>u&i zbbL8U0{>k%uArHO`aQMFnG3`BCd|kNDM;>(vOQ?F3dD36ivg7l1(o9a58o@XjabU? zX6V%O_$`XXEES=E#gKU;65KiLy`1FzoMxro7MRnmYFRi#2_h)>W5|i2h`1{Y3_GuGRr>Ufsd1-m+LStaa zXqYUM**R$T2@O{eaAfpo%_)C?-7fCpqlrNNKVxxC(bQ<$Xu>dWdC5w@ccng86zuDL zgUVV)Azw)>z}ijEmJ7$U^#jbIEU@FZi)RCuwx~Q|l15k=12D59jtEa(f1h;IdBBGI ze;*gOthoUWLoabZ^>_Lal$>u%C1JdpQDx$;&zXZY!clpQ=V5aGfKFH9c)f4_QORM1 zIH?)#tNn3-z5$9%`8Cg^n{ZkDJyZB-pHfcFC9pm6oKO%a$-*D^o0jmxLKnP24qF;% zB(HvGIu=X2$Vg_=^v4&3YETHUUO^2i{Hww5BPs`v!uiX>-BQ2?sdeyGLpS=CHHWzM zcjvP2?c&o5(YkJtMK!i8t#J@QP|0GDw$PU?u9(8I?_|Gp0{t0 z{)jpc>@%g55(q4ir6ZWK71aVbFCjirR4{Q)06&z+^d8h*x2;vWB`8Y`iP4o>h%NexWkm;RE74XVi5$6+;58u zaU>ZWYt}*r8)^WO&8q`$I0FJO?H~n6cV!ZXitek}$#2Ofiejxuq;wdkV)8NhHdsiRx}X;y0?>6$duWsB6*J!#D`D$|qtQ3I6?+s{uCUeE zsj@cb`k_tjRLp!oL=B&&rc07#G_PSLm3|wv34X~zd%TF4T*j9u`^nb_W~xlVtJGHv z$4MA>i>`ROBYPvP zK&s+s_&KAYXyCF}WM8%i2bu5bPZ~WN(JiAhzaGx33M4rf%=@Ge5~l5vQ6Jeom(O?t zX@j-^(W#Ye4lZCcsHTd_SdndAZPw()+;A)04+#(lZXubrH_*TU(nIM7PG3dCjJE9 z(0N9&w|}fKRh)pM$7-le1aShVpUQqYNm~Joor%HJ|Gw(~GrbH^-FY~+e@9QEDjA>S z@WXliNG~vij0h{b@)G$u_kWkBVN{z5HK}Q-hTZKB(9@X6!Q*N4*CGA9v4hjsX;4MB z)lz=j&R0$9I+Y!uhBq1u<|UTHE(gF@g1G5ih&5uiY}0FYQ?v=;Pan+(iVJCBO4fPF zs=w1?*YTomF#Mj}nrg^**!<@ciggk4OJ1FrfG8$G333=Npf-!Txv6fxA7nB(7Ht@{ zJ7Up<*U=Yo>}Re%eg$WZhIf0U3$?wp>qPX>6??@qBHhQL`hu_3hOskmr=$H2; zWe4fS)5vZE+)a-Ew=QsNKtvwogTX99LcICJf$}q0hPYNy4OSt^_oCT2R-+5Q+RCdO ztp;t!(zvN{UE^1!B!N{mYW*j;nhp1x(5R>qCKhD9qz@T$bxHLu{?%sZrsqoR$8k5L zvKL~zdQs;%cr^_A`}TDQ+HKdt62W8;ZZ4ws=g_&?LT(&WezC(Ha12AL1z}TW>-bQ~ zT$21ebSkXUBeW08J|es8LqZx-`*m(q+F&J29r2tn*)kkbTmB0@_D4remgstG@OoMe zII|yFxgNKXo!lDyT9T`ea$iEIh&tb|(I8UVFFAo8Ha!=6a_XeL&9@R{z2(*Nqs z`tZR<5a~(q0~*+u7+VI?wq6f|gfNU<6O5a;fyDSj#HJ#Ltw-(lW3R0#Kk|r0 zT_|hhZ<74K>BE1JoL6mZ@H%+~no&)^L ziU}=GnWJF1tf&l4zaXjyNs@73%xpyxqki$o_6QfqJ%MfD=^_~p9Rc3#mQJq|$!>LL zGv(VdwNFyRUdIJwg~d0(tyjJ-R}^nJU4tE<>H5&%{~DTlPMpZ~%b-FEM@+?;&M|Z! zHZI3JnSRzMp!cB#TZZ4Nou2Q_sA1W+wXvM)#+hEk`L7OKE7B1*X)3XDOWgE7JUt_C zf$BZq+A9Mv;-RH!*V&7uIPGRQekA_DCKPC$g7W<5z?EqktCT>klu)U6{-t|;ve)bh z_CcggaGC4IrEGw_5O#XG0BPw+d+D4@=cAlm>{RO$544sk7Uvo0dGdql#P`BSf*FKt z&#mpEZRU-t>yM$mA6KgV!Z!#7hYWcJ4C^1PYs#8;qGWq}%Zx)$Ab1lI!Ylz_QS|m( zekzrXO$+h#1uO-&Uo!m%@tTnwA++)O{i5d!AG@?`BZnmW1oej2cEsS?$u* zD-%i9?8oB>+rpA6H7!GD7dYD=2-Qj4X_tj3#0(Hz?24uWe@_`$`M)1#(SCx(JHn5Y zxJ~7Ht|Kgd>BdYKuiqXq*zBVJ=$wHlvwvD>xoKME(`i&%e3a|~Yn!B4*;fm`ca%>^ zElS~)NG&s`jmhbeHr$U}k#JhVTyy_mVQ4Yz*d>mEYtCB73amf74rM;smocy!9n1+9 z_Pvp~*(#sGCgz&}P`l0MlWE_B!O4aXpS-P7(5AWGq1IyfDc1NmI8!MCW>F^1aZYIUo)f%&AXInh8}$bvlZX{Nxei` zPT5;9R2q{QXoA&2ePsin7T(K40=EiOJ$j6MQwlBHk-8hwv8EjP=`1+FmcIkfSV zq)m7;6Gdo5Cq6Z6j$Fgx*%>%%oza?LpldMk&H zZ&XWM%fO|K3~qa zk=k^el^=*rhjup>&l_)IX40UFf{-6eIIoS`aId2i<^F8pI7n62u~%JzcV}wXa0393 zb8F5u6s$1+aP2=7u+oCtFL^b}2-!9NwsZD>+qsl?i&cZq^Pd!n7cgn`C^Yo2e3M;U z73d%Gx9_E8chEL^oO%k2Y&%@eudF)tta9!dTH4Qjc9{=Qg}iv^oQ5#T4PGF8+E5xG zEAMSMi{to8eE1)HG5>1S%n7vC)@NVTx*l4u@ap^Qx=DUs0!2&}tsO|xAtYkhYn+~Y z-^S7=iN&?7+V@&BbLR(8PphVYoHQ$^IcPiFi=vkNK&z)dBhw{mzCF(MtaJuj9;SNQ z=!ABgsxKr8;m!edPQeGpx_|bmrz`re404V$I#Pd^$<{Cv1uq--tWOWh0YP!h|%efTO0YOABZt13ynoAe8I9!>Y7~i+}e{^ zcy6V1wYFql{w+Tmh5ZT(@3pGXn{p}SRW935F3{HqGOmrcDhAmJ&7_~$BI z%NT8hYaiz0b_7g}Mj5^DP(x2_Ve*SzwhEPJ_+_F=47V)acVali4)THZr{Ir#9W`TH zUJZ$p74l+B=m^4l)SwDC@eD3HsCx)7SrkdpY61PF$!*SqAToT*+rxc0UyAG{g!DaY zDMSk&)Y<_XDn)Hz&9pgp8uA^iDd%0_N*hVz?nxWR@UqgB(P}CMZf?2=uL zjWlNTap5KEh7}mF`@B+v`Gql3z~Xc6i&5`BzoB5#63;9KHfs%K^>I~yIX|`CsqZuQ z1Yc(JYDPkx(|})YJYd2Q@CeC$3x1l>M=)WO8#<9@^fvIZddle6K+A8!zF$-Br729n zD53XfO9a-kD*rV^-$o%IUig0zV z-NY(U!BoI~ee^VF9AO5Nj%Z1S_EuLRiTMP<7S#q?pG)Q)NY%nF%>Ep@0gaDUpj86e z85wj~wf>L8YVfgF36Jjy-IKzqS@TUS3tAUbjEI8VbC7;PCx}Gi5dI1fcSXdwhV%a( zN{y<@ipre{sTdDQXu6La2pXkCB3$;e`F+IK!W@OgYchLj%lO-fo3z^$K7Iw+M3_>9 zi_QCk895#TT&e|Z8jOh~l@m+}d?eLnM;4!Jam{MrqN&TTHdK9tdAFJIGYn6XTp~Yf zh9&C>=1uSv76U(7WA)%57r{m_Y)h4Lu`b7w#JPC;9ZR&Zmz%vwn4Vnf&7`%$PKb3* zb%v}P*kQ`;#Q8f;EuqP4blj-kGTW|E>F=SWP!hHWIona}W2>FGVGYC~w2Opnn`Pc+ z01Z~f58IfV>C%D$qxUu`=8`u_Is|o|q)Rojwc*0f$KGFN!@T^r8=XU0#!ZQ>>Y+ps z7i$KawXS#QK=w57F$Y|*F-_0!I}nQ!13e#D^OF%ow~&IL=+C#_aovk?%|n?2o8N?S zT5hiZ1A%6-*2?P-*wlRJVvwuj0TjSOeBJpnoRkn0r`rAj3JHa-!x51oMQLVZT>WF~ z`q8&Uo(jmrB;7AV0cCmt3`QoF=kI9qah|mpwH! z=umJ==dga7y7bcNnO;w9~Uw}m? zfx7#n=SE5dcStAW`wRfyQ$%;rC4O}y!DUeIMN|b#3d3gT~;kwf{`y{ zbYSNL_kR>vKL0=hU&{^RPxC;iIIYIdTsT`T)wdsJrYM)EevPe`_jvcfu0SW2x24b} z<1xvB9TZ{pa!S2@0w`!>`ubwT&Vf1Lyo*D*^XZ8o+Bzl6Bt25m5M8_;oFvBugK*r4 z0k2*F*!@ptV!>AD7VOW&HHA)uv;l4x_b%=kU`D8+kFdI1T_p(Q!UhMZ4PvgKSX?bQ za~Gc^_hlksYs7A>Orcwl)f!_<-u(J^dLy%50oKbT6e-Yx0B%}GwjAO|CSA18r!`0Aa9B1`Z+w|9bC6n##tMK51orhz4ZPUSsnAA(^ar}BM zz!lINRUyoU2&vyAjP}+*>$}h&3g}4Bu9Wpjs*^2Wg2k_*Ww6gSAMw%__G0?gtOe`Y zG-9$;bNlmi;5$xtFS$B?bfPY@RNk-cgdR}^jMG*d-M~AnIuLh?xpoUp^j~iIRnFjs zy^oOmAD3q_; z=~#jq0-s)Q+HUW6iz!S^M!ju-twwPY7}V5~Z5y}0X0?H=q4ArJsZ5qDamH>`d>R4q zIsQGc(kdUXI2zw~a^k6FCDd7k=!cu8Z@EtHcIj8jiaf+ydM&M6sXpmMx=ho~Tu+6) znLDh!u@O3DkL86R3m$00=_1u>2=>vCB(WXPlAyz{;dTUIQ^S2u4^{`xWHjWMe>b@z zqAlZwIzSenJt1SKMZHvNa$;9vNw`%Q>_{N<7T8@Wfv7Mgh|Y)bLht=lF~#{kKbKaU zfj^vW5c3r@@*9*>KH1wY_-O-}$h%)qS(YPs7u{1`H`%W^$d<(kk}@QzA6`Hv33W5$ zz|GTIYxIe^}dbg-i#+t9=BBl#cRAkwvsMX=upW0aR;>dE2hHsZ;k1={_@v^^@ z+p0hf)CqFh)MyJUxPPF>9}R9%H;?7I&L&lM1z^4JGdHYa9WudMhegAbD7P%>H}`-TYZL|KsLQ*S(zmLUn2h*pJ-gY_x{> zXKz7*t8XX%ZTZ%&sDHLVG?;SG3o%$I*2G3(Cr9# zv9kP2vl}dY{^4SYBiW6BwIB5tbOex zE*fg@yMH@p=4_uvOZOiK-XAijcOe2Cy(V+a+zKB(J<%^7goNIS->*im*Sh1tRNJCi!tf=aV-jlXLsFa<18hFr z^leLk=CE78bZ>26_UsJR3*RfYlrIwfBSS-CZveT+=Y~x~x~B{CNv|=4WTN&`aQXT! z61U_ZYsPw^DcS^#UeS8&e zX}Za6H1~bF*4k=LaJbLSm6^7!s} z!*YNZXyiG+wGzu_5VuD|#JaJI2Z&2`{Y(ExQ5Nb{b$=vYU*^?bm+Qd_4_;`h6xVv& zYv#3%k@~nG=D=2>FQ)1;(Krg55814g)Cq{xrOGw~alS*e{rUdeB7`1Is%PCI(XY9( zqhm%jF2Epr!vH)EF?pBQz|)3=_l2EDVz!3VW2h35yNVM6^W()GKfhSSw0LJXk&!V}B*|Gf%89YX`+<7E z4ia!33R$F&%=}3wz>Jn*V(KqPBWP_Yh}TjmKfw_GI%b!7NLCloQvpStXoGMwk=d z@#B!tm+g(Ny6Z+v6x%kk$gD&H|DRTjPvJdIjn9|Hl58TK-9CoBku1s}+L5$59cbzu z6GOfO+*vx;7Q9A{9=VJx*jlTj%I?0ZtK03W^~OuDt-?|89fg$T4}5kKYRHBTY<$ zp$*gQ>@@&F=f;At3IPv)^jNWru;|jIeLABxNAf+Ii}h&rb=0ZU`)X)jC%m>k1)4Up zAkE-hLUQ9aQy+C{pA;FM&DXQ=HbIwSt~KUsI+0(QF*v{FWyv419aUfzXT83ayq~|N zLve5sb;s!Koja=O4;CNT`A_7C;D1MsQ2nzVW^3RbS?9s*BO=i>Lb}z!>Z3vhMC*NO z&qmv{;2W?UvzCS@03Vy(4`vHA7zuEmLUCWQlp);3BF4}j=>UcYwT{BSyTC)Sqy^29 zfX`_^+;tfAT$ZV4az6T6fYcCwQ;7FXbGuLQi@2{im*_Ue?@f%xFo*Rku)Uq+(vA52 zTwX{q@xAkg!|0OPZ{&;I3Z4^f064Vh*`@b_e;SbX7`tXCdcCt}&7LpuyA?a(hi@lL zSNQhL3XK7W>TSc*w(LzR4biv5I3jeod{5N&N2Vu7l|~0UKZS;LRkcfaloCYIeS|>^ zj8W^Y3?7W_ar@!e#;4Jo{UkcfUaFR!%3@q(yO4t{qSARWrj%YP@nqKA4`5>rW(-Sp zd(Xzhh$H~3xuvZyZ$j&3ca*fOYz9czqy zjDV<6N}=!4axz6+xI)z+`W_^ZZ^pRPY#`mth`(9$h9Aau)8o{?5Vq!bwmr`e*I|0+ zwn`y1IJx+!jlII<{zZ<_eJm$A|5xNvc!h@9-g5934(=01FI_%kwI`C;Dr-6wn!UG18JoTaMwRykY4(1JSe6D-@I2z@H6J zN%(2djPemN`sCMmRpgBZPWJfsjqoVC+ty?kX|0l#-IPM^d)#f@(ZXShnp!?KpqsXQ zL10&FR4*FA@*P33^z^NQ@amH+mzNJV7+(Y#2JIp zhE$gQ@@s__y)<#0I)WSD??aAP1G)j6phE15xG^~s_{qJuxyVAPjDuM>PTb6~+EI&d z9tf?i`9B;#5je|?k}K1tyRz1~bf(2zs=>Q8P+T6i`3tUT7$WxiI$50!{kn3M6EYEh z$=5~EcpOgLJ!rEDbB@7(Q|n7-#y{MTA42FWN>(C<`6U`lK$+AO5m; ztPey22|o<|-lseZ+nS!}5Jg@&&Ma$t%=nx?#1DBvo&O_NHrR|psD+@iQ|b%Ww)z7Q zk{q6F?MJT+Z#ihD0rA*Q)TPxM@=Z$$6Y9y2v?OUN9Li+cYt9@09gKU2j9ZLUVk#-ain8 zJ8aQn?#*c2`PZFwLx6i^&ZtleI2c;murSwcXP6A)3fO{MKtczY^A}3-=}LU6=gt(L zg*-3s`nG+lJY$u5r@)w0WlPAG88~Yx33EpPocaXle>9?7&*fia+f@R27PYIvRVx=V zR(F*lUL`$kKo`+7Fie(b|Lwv(1zYM3}J5p;iin-(6y#2u_4bcw2CR3w(JqcyNolzc8b+<23s}mD6ljxgg-a(3B3lPt;QneaEX0s_ zUoU6SZ2wE3uV=f!?F~lt>7&(`V2Ehx1^}LJkiQoHhwJBI)tsxPJ_=+fvHQ^@G3%5EMmTgg~`>Euizf0TO7bW$(Tl3RE^h4X~qmFEd?!(;RxgDT{{ng>bMeGxW z0bM2{FSXsbV%Sz@W@Sy6LmIS(J+WOO^y~1wg&eW}f$_oIgQln~V`a=G60GFo8e9aP zCOlVbs4ZJt5T|Um#He=5i0k2WGOzQ+lXMc3y0!0Q%-kc{4dpwOXsg{hCSrY$t;@(D z`o+{sE6HDn|8kRtUu(BlJF;oL{h7`VRZApErgb8)rJM_|*`JyqvcbksvrYzrxVCk_ z4>Op?JCq&mbFtAX{K~UC0eDDOnU!R8SKIQl$Vr*6HC-yQngAC)$aTo(d&4WDl^_py zNl<@_O$v?=W;e5Z5gSBbi?&k)$HdpEmqHhM%^;rN4Bo-39_#%PV#@sF%$S#N*%uE$ z8ZmR1AX>&tQtKJlZ$H&;NL_Ai1C+SV?Y?dzVB8WI5*kwJh;m-fbWEa>SXZcy^7;;l z1G7LHc+Yd^ASKSs0ee4xV59a8!J@uw%^k!^SS1a!Es_AGUp8svTTMP|>5>+Vu_wLF z+bdNtRE8ta#oI=lV<^+F^$h^s)i~$pl+oh2k))@RWJGf&VFt+`=C_P~Vp1F(o2e;z!n_F;QCRRU7KJ zGlJF?P-i>`*t?(bdc%Zq`8sYfMEh(}@EJ$iVk~C%UW7Lc-|-jLeHV1+RPH>W^U}FbTBeNk6tC0Y^n;j6@BqwrfE%u{nuGr&17JC z1ZwJY-s>#j%<82^zmftU&9?Z%1aOV#%`C_R$KV*ioAPE1yX6jtPYg_u5ia#5?R$us zAgkJ@VH|RJGY3JoRk}z=CxPDLbHIt9e9%XNO~hmLjQE)1SG~eEklVgpFaUDf`##uP zV^+5s$D3Td_Caegry`(_A21K)-Fye(ibMsGOFc@3@1OG*t z7l5L&-;LeoxLlm}vl0!z|C84E(R;}z=kgD=y?k45*1PB0>khjPQ7q5>s1@JTMfl8P z#1i04LA#`Wyz9%9kc4D}v0FRghv?eQ(m+|9TPxeML7rXCgi z+Phl-|7tQdF#E!yP@~)g4XZI{3n(1c9YYu{#B|B?@LYQ5aG#8c&9=a!-!j)r12}w# zD{!D6f3kWQ>#g-|WQ^xZNI3at&b%Y`0rdgKxiz%N;NBeMkKF;n@_1Uhm&|*>mX#VmRXlw(r>5erp zn-a8>zfzMew1|T9yckzlwler*8db%B+8BznP{R0wZWu7h-6s1S{~uX@9aZJ`eSyM+ zfYL}y3P^`^cXxMlKv23vQo6gOyQI63Zjf%IyZcc0Iexyscf5Dpza0bhVeh%unrqIv zw9>41_jeQ-OG|r_)jiZW`f7OOrdpLF{PFm~-2`Q_9!b=nzad^PzApDh%6(*EtO6QN zF*Bs18>ofrtovRn@FU}^@q|UotxWr1Gy@_pDiyT4wxjy@7(ufa9T{AM)}%ilI~u&F zlf&i|g8E{u=zCN??vPS>)${(6B3SUvwD z)f??~40>Q)T>(VEFVrR#*U&g)3+c(?=bG<*0JBNwQB4SFP1%3Tm+GB`=FeA!DO_1+ zd8`y-;IGqt?B(Y-{9K=JiFiG$_y}Z4^Q%6D!Z=e;&U5V}*%B?~*M-99D`!u-^Ga;@J<=62<)kka(T zgLhQgixOeHhK4)N6^>l3YV{#Yo|gd{!YdXcEnfz_w4MpJ>2{$i1Ez1e00sCe(D-bf zJp{*(0y~ABBu(vdVF0CF)M+1+clG+JyxQ_{h-Fq1+q}W|a$R6S^i|uzE(sQOeEiVH zEs2wiYbZ=8%!z8Y;^GR`=`9WS!zW_r8RaNU!5R>s@Fo%2EMKKjeFE+wlsllh0Bp8==FQJPC5Ipyuj$WKp9l0ble7 zMaI)Hk}XxFbRZ?7+&j297QRm;EbO3f)RW1-j*-r0JeyDnx`l}$6H?yGL2{((V?ZY_ zV509v_!nZJYCLT@@+ex?`Vz(d6Tj*IvH%KSfL-sqb9#y?01!M6RSX|?P#&_=fcvIvX;2CUz*M zUp!4A48aVdp$!);#KNagm}z<7@3zcpDtas{oU51i>i~Z>bX(5Xr=?Ri(n7puM+JBD z(zmMsUz>w^(){%d)0Lo3)+_=IZeJGo8J-=IrP8@wr2idCBC+~w0cFx`AuCciX`Y8g z+%<&{@rb~=e~(CE<|ZRx`mKLPDVs?f_=A!MJ93M`n|Z@C;N_xs1@4!JBwm!8fmxz@ zTl^RxqSesy4<_+m@VY58ypa@yaA>GSdW6=YF5&*;PgfI$DV*(6!1qIge7|eS|GwX2 z-u=DF3n0NiA@x0*{V0ushrah|f7c6962n zt&qj)yhAzztN8e1(U5()M?`?!Fa5C#K_I5{cPwu3S|5(?C?s0+;YzwG$F`_1Tl!w5 zBntR`kiQ%9{mx_yah%2f`+lvtAX-l4Yyh_)XV6+CFM&!q+ZqC<0M>92sk%R__;w^% z(La0p2ki>(x_vU|6S^o|G!J^YoD61A^q%8vNkQ{*I{aA=vH(=P{<*V z3qi9mJ6`>Do_b1UqZR7OBCAu(yC$z-`(njd5ageG6!HZ!+JkV+HWKP+Tz{be|8sOR zq|;>p+#)ZlRDuuEjeupQ1qcbIQ+yl{eE9>JQQM@NCD{Xh`=hJ9l}R)O-V?S??!7#c zXN#9pK&I{lSyHC!vS_vnP)J#VSpft~3A>%~=LIT6z$+9DbDjlcFEl3y-GsI#!&BvB z{_j{(U6L2bC^G!_RWg>)Qa^Ag|93IJ=L)El9t$B(CdWmZk*2Er5c8|f5sG-F3SO>$ z;42}E7x7yV`XIjg*v%W(@QE-KCSJxbA6fA*S@tGV1M&J39q&*3*9@I*dRPjA0 z*PeSbabkY<`2a#RE3RzaGk_~FV-G`}UZ3^^*V|95ZAZ$k{`#Y}kVo@P@o&6SwBtQ( z%G32YD0pr?^E&%}iXeFJrwb4YtH3qi$hwfX&-A*j%{pmVaTsZfczwuvwTFzAUm;-s zJ&1Jyh{!qgzH41?h6Jw!#aA3&we9gwSOaPockTb-)@yZ^cY0K{!&FL`@+W>-tQ1|W z{dlzN(C;>0J2Okh)RUTmCrD?X>tx(9;g$-847aiYFq>vdOs1X$9>?2P0ej9I^Ef2Cc-HS(e@M3`E>=a~*e zq+C)V%5lPh6Ux0dGfyjj>daHZfe(v-yA9J?DV=o!{-WmB`{-9Y$V%*G zpV#MLT1&N5=5wF>9+KPrD4s*=yKO4L=J$t&ui*I?JYF0)fE+g^>C02;=l)3zd3eMA zcSl>X+<+A)tH2dI+Gho}tfuRNBH5S3V`N5Xpd!N)HpFrDdl`O;v%+}$oO!ute#&fX z5)4ZqmpOavd49M$FN}s8kWTRWxH@&#EdRgzePBuT!YXfgMPf}8A0K~g_kF=QxETUW zC#`24Ho$b@QPO`}AA|^bd7|;DS%I|V}V;WGdki>szI6aUh?-xw$F-T8A>l84~vv*220;U(|{nnrJF7nji zDYgeZC;3V>?_8mEtdNV>e$+<1VEf64-+;C67_J}5@Lr@5sPbF(`1ZJ~P3yDT_xR5) zB%6M-F(yUtdxzi>VvG7j7@LoIkFNSx6f5FoP-LFiN9RME-v z+AxjWD`;sFlD<5zzw&$XQF;3SXybfT+1X)BCkfhgO3NldOrYuU;(qT1xbGQPsDJ1Q zQFb24+g`%=0%e2+yfLNn?U;oSn0b#ziIT3BLIHoRhWYDJz{{wK`X87?dEUso&{w%F zO|O-EZBw>GS%n&A=H1VIctF9zzKUdU4l}^#63)?S0_jlIollef93t>#=MTEHdbSG*Ssw)faLmw ztXaV7IgMvUX1>2akjNE?T%!Jk_$P{U!3g%1*j&l=OT0~ z=G1Tp3Ng|zj-Wh|y*X%8kXUeal5SorzUsqqUgZMwuoXzJc?uZnGL=6m^e;M1%eP0A zec-c|fCioWyR+8-m*1xqVo}XyH;HFHoAgU1sCmZ|@cK0I>I6Ih1wIik6#BGsocpfJ zS4+b8OCE}bv^CY&^)5g3U*cpLLpd%|Cp-%cIo;=5*LK#C?K6z9_%?GjkDZGfxpa4qb5wGV^5e$jMt`vp31)t}6pBwn)NhyPp4RVD5W0E|6 zrGbrG;I?)E!Mx6%rV!a@a#RTHyD%Db0;#@|$m$X?VD3byZ$g4EU=B+M_J9rtUg6%s-LHuR0roa%OaZ$!_r2yw&b5UOg*yfn zBf>;uH)uX%biT*MiQ7wSfJPsUSI9jcq06#)561$$lf#Vf)PfohQ}VsJER1|pBvK?+ zzklddUA8VIqayLxXFBcbi5^$BZ5>OpNi;7%wrSl`xLd?j9LWmilqYg5jgsD`@VEm0 zl~d^T-?s?X_dBjK&YJA!IqmN~0C{seCY@xmreB&(%Mkxv^TdsG=(Rs|)7uvyzGt5Q zrbN-1i|`mY8>gySU^V3_zX__@&pcJe*qBBE!9h^5om^4g@2$|W)8=JsSQb~D1Hrwk z&dZebp1ITAd6}09MNRrHiv=32jIGBk!KxS-wuW~t^RvSQlmdVtZUq*N?{CH-D2=E4 zdh51Tt^!SWo?{z)WcccF2RRinKEp54`t~)%E_utO&n{X&BglNxE|ZHJ&c3fd5{5sS zRoyOG{wtSWwn+*sr*|t^rkz_LRcPdf#H;ltsh@Q#^_1grxU=zA-vu^5$tr6D2D1hl ze>`Tiw_{%_vB%qcFQ7kfPSntmj^;B23VLpCp61Y-X$5q+K%5Pfd3&weDGw{9-iR!S z8Jri8(LdL^c0R7cnhi&cqWJU@+R%Jc*?mSy%c!ZB^2@cKBnz`pHghw31Sk7E;Bt=c z?o)4aKb@14JcOWms|UaFMB>PcM5HKNoZ&A|)5|u~em(m+=WmBOh$a|8RwOpoy38Snrap!MEbaWYH`>;{c6w*I=)+`I!y+XM0;M_a$HuU6296}-Id0XDsU{?PYTZ;6xf zCIls4d8QosOwXywY`&U*llck$7`=?(D=9rF-N)zDG3)A&^8(iS7RjrdhC1^%d#6I@ z!t_LHe!QOmr(&-fWG44pd7ohYUSh2u(D6-R1j6Kj6}>MpU(+q-H%@z`4L`T-q4 zH(MCI{;PM=#f>`8(C+poOgMXZc1fvDQcRg2fjj~yO+EWSK@1TtZlX#RD>cl^BcNE*Ch&bS*au@yFI&%?R12j>hLtYKYw% zDzRPxt!^*FzPp9T_YE7;0B#+dL2UkCpxY!!Bp%LDq$U z)A>)NaluivjS`_SyQ8OtDnHe~S7F3Qp;!;*dBc}2w!ylGpWj`1AEss-B4Q1NR#>VB zY2NO~khtm>ePtq9-Z%r=5d5)TPEnrE&@mKriEoQ~fK*EbLEg@BxKt#J5wOp^7-NsT z-47s0>7h9?y5si>0)houTQ0dLkY92kpjJv1RmhdD@LtdRVW-&^&m{>^On6D$xEIE^ zxm5$9Fp{w1?e~35E(;0Ojp$v~GIBBoy%+;^8U(f`M4qlA^e?;FX;@%xeUaq-|~vJTcXhv^5?n4S}-29GD5z9vFWGq)J#z>Gk=7w%G6 z$&XP}asWNc033ou{f27fvux%?v-bXy{{D+*TRE&Z9KCPLuW;TxDc* zspjmVM(kDu!DH()8@Kmc(XOwzwy(Q?fb^N?K!T=}tu4MeiJ1s#_6XF+$U&c*SKG)B0#(-)nEiGAx!91&}Z1!`343>q2pMBC%gE*J>Vjq9IENWwJuV97s zuwm{dq&U87_!{+ws>(l5lEiDKyt@B`_XT&IcpXq&a7{m7D*+^$4nkwPb{QA$?TxeA zKnrRk&`{`g zullcX`b*Ey*RE{UInUfUAM0^T*~z+>unsmG0eFX|RiLn21$KP#l#PuZ8D4~Gx)m)O zlVeWM^6^Un$yyLxEJAIZ^v^RvKdpw7r_={ZxjmwR+UjYdLU3GiTW>pr_Of;BA@~wo zJ9^(A8%{5!j1x)5!k}zobUufF&)NA9xfOy=)iy;l5peVeR*&O*0Bip zc^9nt><*wdJcne#fH2}L1ZFbw4!Cm1VOq7Zu-^%X|G|LW2HXvz zY70Q#cyDEQVAkk(>`-WEPr>xZ;1p0PP7Qj`DXGqGB-#J|1K&lNX0^$&?&+w$YKY%C zvje1@wl155GqjQCzW*E*5+xGAljO9U`T;0je&vT$RDA6c6qotRrbq$qXyR2Ck zpimx+oyZ{?uME(4D3|d*7q9mh+88{LcDr##MfTzPV0|T9DD~HI9E_P;S;SD44WWAk zad3KmC6IBQ%No}e%pH_?H~5B5canJmi18(P)&oN(?t9LgF`Z>fWLKXJVq6DtolMBi zs{Da1f|}|qKA(s@KF2On^jN_R(WDdNgFKU|TLMs)WpYl?M?yKbYseI#;-yYMC4VoL!6sg{ej3^9q~ zJrf4-%zr`DW2bOTZhnFne$D9_{x(2c8#Q=4x(5|?Di#e3Nm*&s!qIL*4q5o^`GNF3 z5s%ed2ue7v1&m5$H7J>P$aSO`C%6v*dZ8V~@-8I;n05R%LjAsU5sZXmKAa4^_T;lJ z7$!%bsJ0(I*{?vILYDkRp@Q&xxH85btgK>qrzKP)Pm@HLcrm4$ha{K*z$6e(H*q7c>K ze8eY`Gs2qd`JE$CY9Q^{D$tZ1?{$b};3DUt;U0WqexUOlmFD_{z&#?8W;O0XVi1ca z*5ZDoyMEYlTVEMi`D|4|$YQ(X7>TfXGHc?MLg8vQUE21e{&`gxwk z#ll8R(Z1N+g)0{Lr>!1%o(IAoIopk-){olfDr5!5FcVbPXQ|iEnr!uFBKZVpvYaK4 zrCeA%$RERQeuiQ4H8)mlba`7~j{3uZ&Y<5Dt}Ey_&&Mk_!g##e^G{B8_na-C8q9Kc zg1Vae`Y(Xl$REj4a}?-~^I^@7sb%`^Y}UD;P(o^*@5RGcJ>V(<_~_uMbBbezUz|dU zW6f1%0SyUN=?y;f2SwJKjF84JAi7?2?n^k-+L%Xh_TWatkmrXYVlbs;+Gr@3{F@Bl z8xUBqh$d)@gX2td^>CpzkxIWP8Ag07`v@m_gP}%J_xn2@Djr-OmLjYkU3^?FZ3e)O zQ(KBA*v}#A;YP{_sjY7~aGWgr-&-;-*uv>wn)b8Tpga;am>hErvLDkfTy@u%wj9g` z3D1`TI9xg2^6Q*Tw_ah))kGe-o#2^tR~BT(NPtmU zNS0cLhzD7BL++tS5%6W9cns)ySdIz++P+EgYKO^(yK&+&J8E_6(m#@8X>j?aDt5{i zPt)J22hw|0Vj7!^E7l6RFEHST{{lf@o3$EPW<*ts>ym`F)U1tLUbx0ogpLkyCwQQ* zWLtQR&Uq!=T^EoMjC`?O>}uZ@w*()0x^?%JCQ&@(r;+BM9}$t>5Fi5^3#1Ny0hn}L?->mJb-ep zHRyiRgw8^4a;?9c&B|mM_Bukip8M4;h1(6xmJ0KkTz+?(n@RV6WJF23y= z1me{3-D~uT-NADBV`sA(`mDQb8DTsTGUW+3v(P zEPMHU4D0GKfv$HGwbFZSRv%dv^BkJKz$dvcn$*^ehFbnf*>AZpb7KY7y$VE>2nz{L zHzG~X9oTMLvqS;&JL_m4$SiZVh(%ORs{p^V>@ovCwT2|Mnsp$N`|Y?}J1`k|aE&Ok z!VvJ0?A%Q~IlC2b{5d#%7*xXwk~hwj`<vZuD-D0&a8KR3ir`y(v$Pe^X%^=F@kP!)Bi5Gj=`X=)-9T`j zPqLm%U)yNN>8sUGOK~NeN0R0&SIU-CkXd7IPg1Wc zXHMld2Y29(o86>eFjPG=rZas(!jakCQxLC7cp;i*#$QiWuCgP{X42uO=TNw&??<>C zPEE7=v#>RS9JhNQXj3}~>+bc7c-gc=t|V9bOUy{Dse%--WN{_6-wxBh9?Tdh)wb6P zbrOl_lWxG!GAY;&j%0mWM3vZbBxKcJ670R3!p^iz9s3$}12Sj35VYU;UNU}20kj|a%p?7{iIroWM96VX*4XBxSoJXU|#*Vlm1oR4% zd$*aSa{2 zkn6YRKuBU#n}f;JErSGf=STX$Vnbbm%42h9t9qan)HX;Oo?&06$1Sh)vap^41np5? z?B@c@Z9Den>t-AT6Sc#IqCZdjCc3#P6&Yv^2nr zT3%?&0?*XD23t#Y7DfMq;G`r71k0k05pM5R>4kJ6-Z`{5~e=! zo-#P~#p4Ip6!acqElnR4Hd^C3Wm$)f9K4SQZQIr`$_i|^U*Bl)Uiegd6Kz+sB(F~+ znmu=OSFa+px@tW4VfT03pH z>%40>LZLQpz9B*s{_-K@vuQ-)VpOrac0l$Mceoplsb?)fo=YjeP=`xnV(O-2jRSdz z_~Sfs3%;YRo(2ue0-9Wd!IOh7a1Wtz=h)mt8|Qf*tY0OKzF?5;eZ0X*9?A??H0CMH{c23rzRfNV<6OLj>Y|GCsX>WA~Vz z^5I@PnfBU!m@D)r58|X`O$!-Y6WFg<@(ex8K|R*1FA`~K5ukUJV6^8H<~|tM@S~h~ zFDXsS;&-^8y6bLT8%92zy@##FeyvmORrd)nLTQjD=87->L;d};N3?@c$wRgbm z4{R@kWz1T$fFxj*fM1^_1kUjq&dCdzZASYnM*2r#OXFpc<#$LKEPh#gcvYj*z)l$} zdNSrF9vvk++jT(m)Im3n`23>on(ma(q|>1+ z(L*1m280$whzoFI3LzoM?~ZKG>($E#>n=qb_~xPWFg+=G{IKZRWCA0Nm%G%WAz|VC zJl9I=++Um0Zh&Ht3a(SfcYcI@_<8<44Iv}KJA%&$wrGEF<*fiy@qdt3syA{kl=#$> ze}H-S`9=X4rNS#4rSG)t2Jipgyf|k@O4`$ER`_5!fp1z=k-J{=Tl}WVgSJUaX{J?4 zFu4}Sqaqu{i>okM$y@GaxL=B>L{WW^%w^{!SMP_gDaHexS@IZ3`XJr``L}mrWYf0j{|C$lbG9;zRT?Ma6rT+p5icM zJ$;FbTkOWjoF`g=eeosZLPCuV?i;f;49gFqfN<;KZ}RztQf07@ZWV{zy|mRy4(f#F z;#@TpQHnd#(`rR)NhF}d$OIZw{^PdXL1<|ZY$nsdmrQL7maP8YxVmwNBIt-<^eySA z1`k{aj&+8%FE@N#RiuJD91P{4Q3`4tB(^^3z4khu7=-B$Ouu*Y24;<8#ig_5QV4?m zLFwX)qXW1Plh6<-Q)l!f7C>hB%dTPD%fVQjX7Es|SH`t6oQW1$S~0?s6>}0u=fUlO zz)OA^S96av|C@sM#4}fhmy$sqpjulP#GA0sBhI?p@(?X-Ear9UUf#pQ<@2>FXFVik zhpw`0Bk&$q`QHV18Ric2p?1Ez5iNVPSd;JUt0d=TUnmki)lpiG9s5C9liBujzEt4+ zvzr=DiK_w57;mMyOKzT0WM5*3S{)9{IBMhE7o+(PKd*aQo|`;#=eJ=Jq0Ez~ZZr8K zJS*K@%BS}|uxl`K+HN8{le9uQ3pMT_1xc48X$$mEO!tA&zbUKw`6#!NE@Jw5o^xgp z#RTCiS0g9BM+9@7GQY!$%nm%S)xzUpVo9C-o^A!FPH2;3t3~Xr?mlT*0Vrl7b5G3N zJ}uOBDQS?_$WQ@M8q=AWa~OLMrvWc>;0H`+4| z+0+%(7RM`fzO3yo9*drUfz()lINSa$mzYJHspQA|c~4dTvO~Kv2W)FZo?amcG|ALt z2J;S4i()cQEv#D3g;gKL3G^4^~G`1Oq=u|UnCM`{YTRQw4JlsErut{YaV>|&s~de zk132a3*97K+LR4Ur$fJDuBP#PGY)7OPE|_G8IRk+V}z4;w%t*jzoqV4ppJ|05nw7a zOJtT_|M14814KU9kF#dg36cwp;`{q87qkXQ#~$v@o&p_N%GS*!{l+Zf`l~o>#@x97 zBAh6{#0Y9rkr4#eA9$vg4t`#0=&^ROI*mwL>LYdg1?LvwR#MN+wo%=%QuCeL%;*VQ zOP|Wg#b$~G0HDi3d{})I4usi160Q_1m0iPav>XvF2Z2Sy^$}=lLxOT2?20TzeQRneww3r2Lg!}#B7ljF-0F$_vW z5xk!a641*BaERK+`2(smvSKW$7yf6T>NHIX)jwN+4cqYS4aOlets;ldrPgxOT6mHR zE23ErfpKjESTtq82K7wF5Odt=BnrmNGn@BUbg~{oqf_goeRSN9(aHF12NM4FaE$I1KRba^zsv>vkeT|iNlQj(};_djGjxn@cE_BAWJlP zHv#8vMp2?>9efdj$;G~TX;6m3On*hCGx%$oGtIw|rtHWfrBi7kV_f7UYH%}I@G|Aq zSMl^BD_&a+6e~f*0c)$Z_1-lGy#tqxwH#PKm#r*w3)6R(*Dv>3*qG(( zC)Zr!Ku`SG9V9t+f=Ns!v=NWJt=zanhd*H5AXGd9X>$87bp_5bh7e8uxDk(e z6;W+1*g@E!3C1!1!~d*wC4GeZ(VaoJh=W1<#n(3JK8Rmh*Il~o_MK0x5B!-r+Hf6D z?WGLbhL_v>nyG910w(N5ss7oGxl1+z(+X)ptM06{%l^WnpZ?n^z_g#RSg`NO|L3Tr znnBC0EHD?f?c2cV!N>gcT>aOYDuvqVxCuS`xNFkNNuz!1TlAm$aWg8r-m? zY?(26Q?dUc9>9-95VaM41XDl52_g#Z;g&c!kbw&FI^o583E{8Ng5qA}#D1cGp8ARm znoRJHge`}Qa-<+Si%tAkb)Vlh#a<2~L_%jKtzmQsA2a?@h&fH!!datyVopW^tKhBl zfg6Q$wjH!nWZt6;bZIz46QvU)-!#nRg2GX&FJr_H4e>! z>%eWu{nehMmg)narv$n3v+ORTgx0fBqt(}H=p12Y`-r!~6&O7}OV(z$#8iIsvFJXt zCMLk{pZiq!I-8+7CvSU!*21&}>wk&*NW5~u^v6i&v8!q;Pukl;`^{ASj-4zInP6yV zZYyFKp$)hkpfM@|8b>B!`bx5c8z8#)8;kUZu z#Xx7~I&Dbk3{$k^uHlx8#*V`%qz{8`HiiFzhGjx`-&YsrDuPFob&8~-F>@f*hx&ZU znXn@?f9JMiy!FkTg$>Xirz?`Vv+MhOV!p3U%&Pt;p!7-`>^LM+b zaQ)U#!tMuyIVZAUVjd%86U!_PD6xI0A{GkWZim*tL%+~Msr=`c{MAUlm#3}mmOI$) zyZgG*l@aIA8?k=IT)R|cyZ>^V>R%nY*zEOu$tP_Sw&3iXGCCU55m7T%hv0Ah$lIgUBZJ`^a51oky&v)P3ePXW118q|>SeOX;r_SF7gdp@iA# zZqHK?8x9Ccxrc!*V^K;cI)2&-D*T5O8geWyI~Mqq3^;5bgE!veGe1qA!VT9(6|!{n z5!!@i{@9{!Jxg8L^c_4kKzXt|*Mg%ijQAR7-cvuKR2rIP9e-L+{Wcy$3uHjA0&~zy z_)B=22k-s!Nj4u%g()nwMOV;K$K5cFRr?IkkiXhhI)X9!O9%4xKtKcK%=Eto zYR-w!@&~p=Mumu|WwEjS4{yC|sv-hi#x^NFVNl;`IvIn4v_~)u#wC@vFrw3dU)ItBOqj)g6qGy2FhwPMeQu3Io3}4qGpj4Uh5teld=zgq+QVoCHEfw^1IN z1-TUV2Wf?XmikK^dAYRxwT38hczrrq?Jnq_hil(NTN;4&id&mPus5@HWS>f2IrmZ}tEkf*wU(J>yKAA(ql`5U&>iz2eRo&Y*+Ut{u zq+COG@EfRR^aut=H<+PA&jQO zr`#(h3)WqfIb141IB1N^J9o#4gCb*BVY1?Lpq~1|V>zEF`g3PP{$?Y^V3RKXIsQqU z>3zGM4G~UC3O2Q##W2e)-N#X>#qhfvNu(VFV9Vc4m6 zhlQFQw3@tBAw!>sGI)+^lJ@#I%1R6XCLea6DP|PqMA}1;VZP>N-I*ZVPSzXyfVbKs zhxG!b+&a?fL)k5NgXn=C2bVNZRoE?r%vJLw@lW%~dyC9f&%%RZ81VH`yL=*C$o=6O z*5@xKNIQ4yjbkVi#}Xd|xB%I{&|}m5cYvhPky-~x`O}mFD5Glj6OjGhvut*28*E0Hx0+)!1A67t?(I=EV@sZw~wC8f;qb zHm>-C_c%N&KU84~i+@ehbp0zTcJkG>trZ@*YE+zo4N?f6@#V~w)I7*xXb%?Qa8s6( zC3+Qa8K-mxbS+b6V{aPhPXW|Vs-Gtwf{9N<0@PS}7OwaP+$%})ZfcSz5~ia8N=2RQ zL<8^T#9QOLc^22_lt78nXqu$woV@5o`TXj@M&aj*lBkjkB1d9|Jm@nDe^Gu1C4onSE6Ip2zU=8i1oLY1H4h-G z4!LHQh=v0@f-*_ zx0g}eL4iDuGMBURw)Tmu$rpY#p4M$gfbrr+(ToBSOF6r;LqABf#bw_vJW}PB%8iyF zFr3iFj1Ir|%ni*43wg@cp6tCK6@!8cII^9PTP8J5)2e%`apxk51j*LTx)e<{YP-^! zH$2S&9o3%wIr6D5)97N*Mj=(4!)JpR(D8a199nJwa%p2?nuR3mGvJ5E3Vvjpo$q#- zI=iI-YJ;T#j@n+Hrk&9bJf|hSEx=_zoB%F6?Xtm$RekAJ6>1|62_J5-7Wa#i`F9xd zTj5M>?$;Gy7V6GhUi<#m!7blH$*JDO`Qn9);0tD^VIb}uQB1CaVEwwy!XsIm3y~zC znjmk}JNkJmrN0=qU1fSQD*sU1;i~MD{ftO~@sE$ac0O6%mj1l@U;oeoAfRdMxTM#% z5!Ey6FLDlixANI$ry5&j;^7eP!^<|LOu6R$sW;T|Hr6|^pwzK;oWsIKcZAhtZofq1 zVa-6az<<}=Nh7g564@ovHfB_PO}Y~zrCins(5)*Hlo>}U4d+Sq~{+@gTDhR%0wSa%QBqupSL|cPm8y)Ep62Y zErsB3v5YkTl?cP&#x>@`_kah-~n@9V&l<88)f>wi{yzH_=cDGutLDnkG%+-6ho>|S zY~=?oNPnxT*=FjB$`85@UoN_8d^AE1#3W6pVe4NoR`1Vp3nqiIFi{=Q8sfxew8X2s znSGp8&Xo?(^|%zq^D%QjNpuho>{5R35F&@0|Y4J!Rjt_|zw3O~qURhWKY;WEQ3-?Foe)~xaT zHEJZsb0N?#`!>wZlE^0Qe4%RPoHO=bEm~MJDjAdQ08ReBUH`tnN|RD|VG_@u)=?&{ z(#9i=)5WkK!Q^1sa}Fp8mScxyu-?*4YOXW((CIIaTdLb$h7N3!8gY7Qt*SVVw747! zgBfmOP{ODi;&gRPd;33WM|zj+H*$!mCxbuV#6J}fPhI7t&e}`O<5X!C*^00^`yFE% z$Dp)FbFbvehI=Q35*@K-Jw!y?1f7Zo;AhGP=lrU;W}ju%Z_N|JC)r0m+WIvAo56hU z|Hn0qM%4B&+`Ku4ceh^HYVP+Y3fAQy8CgR`NkRLa#>MRK3=N09kx^fUR%6Vu@u0!k zaOvOhZh^4ec6Mg1yymAKFsh;4!QJ^sENt6_|H53Sj6v(7MBA58qVn4{9E2C1eqehJ zx*VAkWjjNIPz$y@EY>A0#N{seM@}l)7KBc#ODt_uvCDQ%474K+(d-}kbu0vreo*PQ zS^YJs<+BvYfyIm+5G_s<7$teM-g~p*!Fuq?b@*PXi81_FteoE&7PJTBftA{wFiT_c zFX`_FbFZy7vKXg;B$WQuW(5tVwSm}iE}l4G9W(nu2aiG9p>});eJ62I(cKUmD+J^5 zV@-lUi7JkI(2eotHqMQ$lccb!wxai#B{qYh*^*^qwZ(MwW+sHYoNDZ0ppwz@^^u7V z7ninOLJQ18^dS!7{Pxs4r&;1Z$JfoCBJ3cyRTt$G12)koNU%u!Z#=_m-&7FF69gNC z&qx`*xCHu87W3(gr)tVqcrIAxHz&R*2+``k$D8Sw1L;v%U!n9iVxxztHcTTC{3G1A ziMH*^E}Kn+jG&de-`aY2A<_jnA?JJk!SUm#ojnav*0r#W{b&q`l&)@knMeN*1(+l# zZxCAZs5F=&QLM~2P5X_k|2IkfZ)gv$-jExaTxtnQ!dR^?o( zw5(kxIrR5_iEQ#BhWanmxUAe^!2)aZ7kju5I@$W3>kVYtQF$zSeNZs+b<4;)?*OjS z^$=H_x5)&xQGWX>yQ9#JbkoIecIZ0Hw7I} zoH|(Rj$_y799{uEhN)aBP-dW7M@V~7btLLP!P;7Fl*@El=7Od=*--QE0<4P^Su}bs zm=^I4V~t;G)<+ovNF+aAkh$r;mERjlAYam2jUoT`Tb|d%Xiq4q(t?;^+8wCYfF`3F zykx%LTo>u`3M~KlIgrlxH2nkVWS%fr8p1-9TW^4mDjU^poebHE=xKl1fVH^IJV}!} z#>~AoZEA@ieybS3OMU`eq5AOSxFp+QV))m37lr@pFecBgrxov>i1}60w5+g5h(e&(cuf#Q7&x@FF;dfdkVBkQsGCIHSdY*_5P?*EnZBHE1G~hd&Ef=3lD|nI zC5J6hX!tIeMHd8hfeMGCMS1E!O^&U}S%bCI-L&+-Cc_faWZ3j<%ndUs@Q3;JhtJMR&BG~1ZS3K5 z=v-@F5Swb?&&V69C1qd&vh`1{VfW}eVG0^9VSCj%^ze{PPFD>&?H)0sk%{b~6A-=4 z2~D>((ffHIq0?`6vd{-?Wp%Ozr1e~`r_@yOj*LInW<6U;EP{92(5!n{-@^+I9~TKv zO=Tf=b+yDE;#o$gZx$d0Ji$;L-Z}4?4C8|ROEz7mCuoY&a|hZD4`jtHKW^>XAyr55 zT@I$71wi8g1;>IU_0|M<&eNA?;*`63*LYZu1|!tZ$3)8eXFz&dTnI?i#u$%(8s~AetbE3Z~iE|p-xmsDbf17 zJ}rtPa35Tz7wde~+WXGX5c36(+$Kb{bFn?jF%B->Xs1_^=zvbViRzrE46+)RvF6n6 z6g(dM(=*lt{?jw&ws<|glIgM-yxtE8?(zmaSabf=CYt3jEY(9s9Hci*jv(UN4@K)m z_8z3>eq0idf<@)(y3*~}rS@5fq3n^~w_6swYZ$+#e;E*h*T=beqtSuG5Y*>nyA!R? zZ2H?)#N6BxuP0Qrh2yJzZn$5B_EMLo_{)%RfGy68wwG92H3K(pnNNnfnM2KBirS64 zHh&ONJlAq5Q=V$o)!GkmhW>r|)Y;Gd6pr`b=$HJQ3&n_aVgyXdcNXu|&$vax1j_eC zS7fv5&9n^E0Adt>Q_>~2OCl)5OBKJUSTPy3u|Z$m{a1mk8`_!LckAn=&l%6REGA3l z>W`wB-V=mU&qWroh`|=yVY#Zxum6Y+(GQ8wQ8%eI*VY|C6-^ zRkKn~LOef00voukx!*UwWpgdEO2>S|oYuK!pC}&*M%?a_)1Eu+`MzH$FS5V)1E^^d zvnp1Vvm?-)f^RP3j{f3wz9YJ$E|JdqMB zSssJ?@aRlv!;LLr9W5SO>v#d2XJBMv`~_Y5|FQraT@U)J1MSmcOa*hslO_iCXZmV+ zp6leF#NAGKqJUF;r5TxQhXQB!SVn3)tQ#9<{k_Kvyr6w>BFx^9Kb& zf4KHr`pn!4$Qw88Ad6S_w%)8GxMji}V{Zcax8!5lH-9PlQc>^+@#dt;6)Jg#T>9|f z0d|91z0#l1Caq#5Y>!z`C>TZ9(tVP6jTVo>G0|qK5+XrqNZgn!6zm8mo9;h!1bmHq zTa<;mF_JFc!?ceT@+V0;c_HN}eTRD2qlX1E*cmk2nA?5u!{49#jw1oUG37V2G>~1a zj)dkqN3`9ql6&d!{WqG8LT&uT`puDOeQ^98FrKA+()P+{w6$uf;FgMFzd-v&_6R=A zdv_-HzmaVAoQ)tJo`e*%#Ag%<%0-r{>hl2d5**IvCBF{<;Dq6DEi~s}BY)!^LLsuT z-^K>*6#Lm>sE5hy4_dl{L0E}#Jrp`0^JsA4KNg#ehBJVVs4<6oek&@7aiJcjFu!?= ziU;Mal(yv3RG^0ii$~)tS|35*rkbGt>M;D;2Z0>Ex0UQHAFb^4aL-qNu?TkxE7vMD zLO2fpH}U1FkTT~jxrNF#t^`zk9-^nPr%1d4xJqBFDx7li{hpXFM;5Tb@_`G)8R6TK zqo;&(E&e;8NEt2N%q#&3CH%wVx!669(6g4D67m1T)maBs^}T&t5u_W*14uVWcS#9I zNk|9?h=|gSbazQhmxvRnsEzvqv4m~otO#&g(vt-J5*(}MweJQHhz zUJ!q^@ayzPvxrhHTm;H~TE?Fvv2X>dJmqZM)5Wx&WoHyq*_kJ7O^SE{uPEZGsZ779J9e{ zX2$Tm)aBUNewmOrxZ(7J0Xr@$Uj;i5?WIm_i?S#rYlk=)6;<=*c?UU}42AOwum>Xt zHwQ)+@SU*U6MgPx5XBFQH6rwQWUl3a%CF?3H~^;b3^uctoJFL9aFq%9csorS$U&j( zQh3N=(?(GrOs5?EYPRwnS)0@rO7H$+6tS-a2S&|$J!(U{%%j=s@`tqv|JL9Bj-hn^ z#4(o`j^g}UxtMMBWTb{xwgligz@118x=*=40YH+@ti8T)Z)~KI_gT}Un>X9{_&??# z39fuI$h!Glp}*M{$5y9(iT;y!z1itCKRhNMC0OgLQ)abEZ^F*P`)S;%jyK56Xn=WB zQyH@-o^GiT$KLE*3P-WTaVRK8m8)}-^5GI2!0hmf13M;!-ffpcdAytDE5kKqd~=d# zTs}xqU$p&JoR;z=f5}zgEP#V>QR~d`i1Y4+ z>%?P+BOQ!!5K^h9djXxWb<1T9-bwne^?XWS#oB)Vl#Z<%2ZqgR(sVNnbb3+;2IFsO zbZsloU^b5gXZVs;Ozsk&mv2-3&M!^dBtJ#@uP>}G+jL?j1TDMPS?NQot`h{T7BzWQEoF}SV3mT_@^`5zKFqega@BcKQ#eT-v~Idq?79Iz?W#EKTDB>;43R&x&- zd=BUd`|J`tN`?Dx-z;7mMgRUW^hN%eI>_RRyhyCBev;t3Q^Ki%zanR zH<*3;xr8DIu4Krp%M#PJ`_%)ZLX9|$;UV9aD{;ug**Nn}396S>4;kJ3294twFLHM& z2(OgZX-fBF(jyX}0&YRukJ-~VG`K?+shzCqmEo#?e&G6ua4x6J@+ykaKVuGabDB94 z(GXz#LnX$GY%*x0;Ub zJ5DaIOE3N&Lxxs1hce45$80PastT!@;Ui&yG8n9qbTR4|F!@Spx2k6@GO=#tz_(>s z-4v7GEkHq=#8{0|nAK6m;A9>3YY5TLA#?{BD^4N;^_^MTb6zUVN#ZvSf8yP_P6`^O zbFeyt`r1StsxoE#o{%?X#UBJ>RVOqt7h9I62LS3&v2!WQDRvYgWk>Lb>2Gf2tNxNN zGC!KPq}L7J5@-4!8+5YvERc|{uf)Na13u1ml;WE998gf+UNl5ex=e@^X&KF3nIK=R zpXuy~jX8<3EF&AuM|hZtqUU^j)ZHk#%(rIq!4&U;ReVW|J_Grbx6<%sy&EZPEJoFQ z$k9qI)55|*K7^~mu_G75U*O&|u>je7scXD}A?;MJ%U^yi4&agxlwCC%4j@F-e4B)v z&gO@686BU6^`qexZvhs$RX5q%_iQ&ml`vQ<{upj*RU{Zi*&=>$$Q?OQ;XT7}ls{Y3 z?8euo_Hv5MH3>9ElUeiTMgvnSuE*bFeoVq?UNHJTSOmLp$sjH6R zJlXwx67=QTU@$_ayrhXbX9xCeFSX3-<6vG-<#WE5U~1*Fm@T&YejGmpMuKlmgOQ|{ zy)Y|tqBHeFuA;HUgma}Gy%m;WYgg=zV5Nhl+(*8AFAvgR<54-}Vf*DjyEOo7^MXHZ zzLli(x5791`O;OD2fnBVNhX?6jXwRoW|{P*%j>bN@E1cf3o z3E!kJSYm)2KX=+Fi2UtBScL7Ck>!b>MN-_f|2hqSYbDX3_xCh6fJ||{9g!GhaHy#~ zdvzhyF!?m5jm@0)T(fEyUnHzAA41@f+&puw^)+-Vw3+ExyD7siz<@WtVLIn@tG3ju z%TPueiNUvgk%>{xSF**BVm;3OqnZIDDVTF0;SLz^F;F8HuEi=kY>zj_HMuMeroTv zO+$3YLqq(=zdh&E=tg%8u>D|6hVv(&W6J*_c?uM0)uLKU(|?`Y(mP}Jc=Bqzkh=5p z1u}1P)XC&a{Jl;lz)491-62A3TSqOYD!pbM1$>;m#ZaTCF%*^`sjUyiW_Fd|WZ0DT zB8XA7n2v;l?Fz$4!?@nZ`0t!i>jR&@en}e>^;A}g+!#&mkx4qD^}BFyEG`^fQXh1x z50YwC&+>l>T&24ST6YyhmCTOIR5lu)T z-5yRXF>g~CjXYJpP5)3pMaQ#M)IHj^kdsVk<^>kIY&L^H;c@O1!IAz^%Z1~0%#dxs zxIZqTd@)K{Zpi&p4Z*XGPujZaE&K0skm862@`Gi ztV?>Z<)VTUj1#4XNvo zz(|eih|COi#~e~^=8TRI1=li!3R zl?V-6jX-}w@y;<2SJLW*L6)^bMgifb^)VC~Uv8#z7k5McDI|;5lk%bY?(Ki;+KN8e+-q?S+ zPAV6#k!n`+t#$oM_AT;YX#$?4{QK*YO)pI6USpIQZlR{wOPhVL8JKRkCFt-7qs)j| zA3t5i!)B%Am}Li#72cMwnIQx=tVzzMkd?Py`H%OzJq^-ZBmN`~61w@qFCUaUWPcI! zB&%?HCJAqo*_wLzd)j~*-OKeXePO=+d@;}nE9J{I8_87(`bt_X}if_V=4q_(EVU?|YsO6pVZ9&#-flMc@rRT9j2etSEJui3>Tu}Lk zsp`0uU@&FeBHFypJb@d+(XSexEyIc$ctbwNs6Kwd z=f*;PQx9$T`rkpVR`05|X%-5nu~UxL>l$L}29a~;3%oFN#|cD3uW1;G-Yrp%yb(JR zs5)ulKx^;7I=VsCVBFSF>!Po*0@_EBjUTp+_*(3AWM)9BysxEggj5X%U3i&=OcvP5 z7}--+>HwW9*N!B)w9gb>%L*uw*sFXTie+A>F{+AfU)ML!i+{iV!;caFccUfAuwV*F7Z{Fd?|j08G#A4Y_5>YrE;?I zev@X^!ft0f#IUQK=h?Kjj9Av54suOkV-@begeaOdU@6{O%l6>jJ&Kcd1~J>QD~q8e z*AWQtabA%x+Lxaa&*&0OGWn{*;bs_+lx!b+d1IQP<45lQstz6HmWa8_^_(=0(K8OA z1L9x!5BWzp?Moa7P$;yJ%~Um3Gb->!bWTVT$@R37_EA+_e0%A4+4Yh>#{|}~11>SU zo~muK{YJR+8M4Ste6f38FMWM_(E+Q^g~uA=E>}LIsFj21D+W;H;U*zZH?XeY~Au=y~bR+W$=Tz=Rk~ z`ciY4zkFN5+&r+ioD(V3V~Rz}&P`jx->`@|*jik>Mw$qgDCPlmO@9q>2Y{7G64{R2 z$bY|`0FV0>;ozWYip|dQwHWPS z7a`_jA>(C&C5*B_bV9aP2e6YHnJYgUtv@tAC)-dtaa?Qj0Bcp#nrYi-$XjZO^ResL zUKf7*ZX2UrC>NR}Bhb*EVPJ~$Nn(+uj*R05zB3pmKmH3!d^u0SJ4b)^!{}tXZvG3l zM~xNvpfFdbZfEs_k}%QZOL%b;b&am`i@ezK3I-X#q)aD{p=Of zt8B^~ew#AbaFe+=@jI32C)+)@d&}fEskV`pndsgeW?>U^vIrdJ_@58l`;fI2H@@{b zPNQJ&NS*JZbDWsBW|T9gd8WmCYB;kAT+{1M)=PD>y1-R|%vv>#v-nuLld)t|?BFLT0lknp>~w37$ckE{(!=H_zI`tu)i+VEgF+H>ec^(? zx0=2o#&h(Iez}5S!8WCIvZJYC{Ks6LSyixJRO)fMXEUv2uU^ph;_;e|utoB4v^bQS z6#b*DbF2C;ttDFOZC*NHkCcYWp{u>7C8jJP)aA!Df ztk)-x+$?qoBj-Gkr~G^kKoP~8%{D3LFY!)KyRX-}Is8#j>u+b?~Il-EpF6nBZ zhC%p=X3a+081}B*q|N=!A@#b#Tr9gV-V{Wa8tnQBJ>*$ns}^$v2(+?W!*VfRK7P?F z9}H`cG|#47cEN<%by2Yk>(-e*FQ}0RsMfMFj)vHa2>Q}~GV6xY-pC1ugN$qxM$n;8 zi`tPoIRjb>y*GfrXA5|D^}UgwyHl?HD6g9#jOX5vB8OwKYu|^X^)q_;d_?3fI}!*4G6M>%xUuFC`DQ&Xs(d>&98 zPPnNL{p&lX0S3wq{PTAOsU=EW|8Rq8E7tK_Vjct=A7J5l`w4nhoBblk&+iWB0MzSJ zy+%MXWVpE>fHJOm*vDoJPQSfWnwL{%BNavqFS`qh0I*c;#1pqNCJ93Ytm@bsO!eJ$ z!hgWV{vTqh-z&kBS1y{62+g-Rhp4NTGR&4m>i6=goZ9So_?2U2aO?%B*etiVvR5@clHwM>#l7bskFiJu@UDht zX8@am=qvWHxrH`6VaiV_7xX;jyV`c*Nyr@*ep)+~)|`MFmu;E@>J)oo0LN7a*m6Q}G12D)?@|zQcJ7R3uiDAS=x)+204a26s{4&s zo5oeG449Ku!K$|Zjy>{z7eZP=vhH5e)s9x*G`k4sBcZ|fa*l?acY3Xy&Wzr%gHO@f zR_0E=@IMmjdm53{hI{=E0#ria#%VA&Vurg5RNEbQil8UF5ArLKYVh>`D6~DuzPFTG z3y@b=j0JO$@0#5vO%nyFcf|l7EG;IC%L|Z5UDxLzaB|ZJ_5MDIu?4wLv6#ULWe^Rw;^{yB zqaKw3Ab@6iL#^A!1Hx!3QDuT>1RFjG9!EZ6w&xOC{&r9Q_a;2QXzViOL2qKjWxX$D zoxSnG*m@hW8UagWAFQEAR%KZ_D2O}1A4^hwJ#sV8SFbWtMX~95^xw(8BUeWUL)m{p z%Kd5k8M;$=z@QZ5fq9WlbZhgxp_6 z1N7)$%5I5+;@^eoe-@mCZK(dQ1%L6M1%DxEl=9|33*J4?Jn8}ek4|~w(K3<^EZ|>a zY3#+17inStp5m_)d22kRjtEc&%z#;S?y}^;!$rYkG$)APL*HkdO0fCOhGtRH@^Fsn z%-ZWJMGwSSIT2BUu%CA~`_7OcY&`%So2^hC&9fLBqTTK2?|&RG49@@KzQ#QZ#M;u= zsT3AI7+&d~7pQpj0Cu#&w%#KBhd(-xFO2>OsCjc={2u% z1;@w1Fn5Q^Y5)rbpAUdI2a&Z9RnzT%oQ}&AK)6es0UBe=5C~V$QluN5i=Xo{sNofW zbGg&%W!E%8G#?0+lOqPPAKR#008p|^(OkWMHGr={-mZ*l@jqko-!mTYS45&ki~G-* z;JwIw38BVm0QTEGQ)PyR-u@|n3$WrDX93Q>;+o&!1TX%@H%!<51@id7=3IGY)G!>V z=P@U$0^qVch5|~Q0XRM+|Bh z8*v{?PT-g4-PQbgu^>eXjd|6qlb&-suH5e~yPeX`I?z;c?clyzHoRRmoKf+D4_^=Z zfVJe?W%1iKeMqPsP^P;w_-o~RZ1BJ3iG(14mf~MCyvLZVP(|PZs^+r*sk~!w;7fFo zGrS}GrW>$_C7pjgdO6X#Cq)U5o(4V3S?Vy>r3`$M#ENksgBb3x7^QlS`QH$#V zzWJn!t?^=M?`uxv=SQ5?N`i?rA6#Nr-bl6PSwN3W>OVSr7Ak)S(i1NcAksMtq28UF z?<0rXD&<$d2S%dkkOKVHd(bdP9RyV5`$_qvl2z@sFVg@oB_oZJ{tVDGEzUUSBwFz= za%guVaU8C%VpOfpP!^i20<-Ay1n>M1%&#jYf1UMQKsd90z~bq2mL#;dTLTH%JcX~u zkT!UiwsOngm);W z;=0rc<98h1bKZY%UHOzjC1Tqbq10ytDZS)(<3Zr*GXPHx%xeZL=p`+EN6q4Qzz}DA z*MMP_bGUXZ&HyJ$ejdo*ko6*6JKObm&2oqH7@WcLuQ+-#>e#fy*N29^VYO}brA*!I^7u}!l)@A;hmui zSR{R1L^s?}d7%9+E8s+^=@u|u?G#x{{qJrH%|t(pg$TK}0%BV<;{Xd%&xOSJqwl^~ z00{p53d|5~sR&;JvaNWI0)%)akGz3McjRQO_<&_E>BD^E@cF=LFhS#OwuCxb`1FN| zJ+)mv77Q@i#hxjri7Y3b0e#gB$8W1SQDR$!+OK_V3$4Bl2ALyCz!OlQWF`6l1sI|FK`OVA{k(X5Z_ zD0HL}H@Mk)Da2 z@2Q<(7c z-BDuG${<1;kEW*=AbTFjxz7W>>Ym^qSLJxtJo64U680Z9ACnoMtp3X|oO{IAwRy3Z zckDB+UIiTwn~5DK>pIpS^{~u-2hrnD*Ip$WtNct=DvPA%rsk*Ef8Gu}R0u6-k81_9 z+La9fLx;b~^1?nxwR}d|l79YDIyk#RGrj5j=e{Ed0*eg2!vz_&m~#H`e3qgQn!as( zsy4q@Cu{0r%lJAR0|7SIc#_9an+X0a|I~OGVSSR~CYZGlErpeQDh8-*AVSE1O7YuM zn5{Q}5Z&_=0AkM>KF5s)@R+6A2D&ZbXJ{uB4m(4}p9bZA^B1*xwF>oiqyUvVs}}=> z1{By^`TCmQI2!aT8RAp^vdbgx`8S9d#zn*sV~j}p3qfxl)d5L>G>D_pXMFqwwEp4<&b_wl*JWDbB2BZ z;@I+w%7X969_BMJE89>&%~T}suM!wexF0zw@U9q26`H`u9OX`E2GgT+bR0T?lVcC* zPW?1|*k2?~L3z6Q6bvbv>~@hQTdmRl7r=BEMU#qRK%O`0=-b*Zy7eeL&jC{CXkKwn z)OWIlLcD44o{`_)Kw1M`Z3q)jnxFD^B0@0kHiFo7aye6h;#YO@1WA7Xy>~3nC4-dT zxLg9vwkv&rN2guO4l(36q3F^Xc#(daif^wZBK$3TYe~Q6$j7FJf1(3XFM#CT2N0`1 znHs5}>3s2<&B$NqGUFKCLse~Tkzx=5h5w@oP6iJEr`~v#W;f0{_Vpa}ED{Dy0ZCWx z;vUM|17v5QSPYcR;6J^ussZ;No@}Uda+&W1&%bsC-w=EP2Q*(-^Z`8jt|}OI;nyl4 zhL8{GZyayPr%nVs7zVkHsG-svzDF@f4KO_JBi0A_i)6^rVn#!bv0~;#OYGbEMpJxV zAeZXn%PqqLrW8bynJ63|pZHj@F1$nhgH)m>woLM;q<9vnx^4r5T}$$Zei!*fg8l)- znRg~mt>DXrYvoI*-4z==J&u#95p=Zzs6}U>Ra4H9>S(EK;Q^WEXWc?m;JGKvVjCuG$dOhcUubP zAqgu@R^nAqIs^ZUv(}DtL!YDljk6s0|HWCfXwR9Ez~xQX(Eaj}0j)yvAC!GMQ-_&G zEmIMVR&bKeQGF6}tRRVmj56p97Tmeb9aA_14JO%?PcSR9PjrGa{kd|KO`&k7aYv>$ zmLR>zmG)A$hZdewfDV4sO0QfA$%M^=VfU1DIuN*rGyFBQyzFh3QAJ{_aq2K!J*mgu z&BF7S%1xUA&P|tn)-xbffYFn6?*n!}9@n{VZefO#PFCZA)8rQor)&v*NU>vUq4JtC zKSxtbC(nwzQ|zZDO$_-tP^G*9(8csMtM6Rx8OEb zp1wM!ZGstkTU<}LkNXj4Fu~iuOM>W9+;DL zhNLgtK;pawT9Vd3Pqn;A(Og=%H#@V|{9)xO&>iIMJK#QTiJ6k$z?~2pLy1>)A0~0zGQDJURpV4udlBvry9Nyq@9J zX#EG|H2i<~1zb0PtG+8V*%QC)R)HU)tGI$7V}%BVo89*H0wWxv97oEmf^=ZInoZ8w z3NV(j|746AdU-(L^CbRFKDA7+2X!Iw^V3#7Ai!xa1nWnle2Mb9nx1E8O+~3u0f7E% zHy1RMwpOs=vmQNufXRp5{2_WaZU#VLdi;nxmZ0&@-+9`r3J3>;muTGm6#5Jqx=`@-9<1*x}<@M6nd` zT|(jJKVNL+gSy$x=Py7D1O(K@wyMa*j$Jr*?h`K1H z`7{_&av zz-`k#fclSd+fvWivV`rsbPB)S^q&xS_}GiekhYW+jknnLHxiKgVzJ&{ zY@c)-)9K7UIzONH^0HdLgrckxO+aI_gs7yBP}bCD5Fpz5H1?9cuEatAbcRLxlGd_0&IHpLnK zDyKgcOoO#4hwYjHx}YOSG3#d_RS)ZZo%aQK4NBcryt7fr|K(Sm)$)}|KpY6ZA@f#t{RGsk2Qt(@mEFs(2vpZ#q>DBkncv9^NG}OXX}+!|D79 zZs)S+;R(Q1pI}M#gtcK|d4T;kf$2t|IdRh8UO^H>6F!VO1svAA73J`604UZ1pl)fn z5PGygS!poifIWN>WX_zTXM>E6CswxuGYgE7G<8U@J`!x1W*4Ku;nvbl3SpC(N#~jA zugOl&%W%S^tWX60d|C(K#9G7VMbZ9B)-tey8)9U4M`qSi4B*V%kxm5ItyCEw^}I7c zGc&`EwWqaBpw0zIdz8pGsPCb%6fR_V9H-2m^m}mQ9$Q3iLYi^F=JJe{qhSFWGM6!ca@RiI@$g6c zr%145L`MgVBh|a{pL>q!)p&WknSNL=)VPZT%-$LO47K8-v4?X;Bgou1yzZdFKM8Q| zdY``&g75>%$5oN7!ID~c0`)9*C!K@Znn71Q@e{KK5cH;r1{$nt#p^H=1&OcabH0{B zc8M;q;4^6?elRo(syDZqMDP;Fwa`VCKXo}0X}9xEY@s&ODAg7N?JX5pB`x;Hef-Wc zRdFEfpSFg1wBn~PgqaRkz-A_4eK1vTdp5F6n-wW!Qv}n*Su-CRn_EMHIMkvRFAXC##z_AwE@h(`Q~JF)B_fKI+!BTR{e?6_PxlT z_pgj`+u>d0&NGYas$IUs3nI$%iAv>Ni-cx+Fb60Ecb$HC`ilg{_+C!Ewu9ItT)h}4 z`sGAOa+}WNqc4h0SI`7KP`L4Il5Z9BA%M2&cyj)gCSw?%6c7;0nYz3%Pu@yn9C-Mz z8e{4Awjf;Ehn*>UTXHuJMy%9`tnS zZ0!RfO!`bM_WG-Aew<$kj4ak3+j_I(0K*C!uWmeLs|IScD@`G15*pOrU92<9D^e6k z2)YA{=^ycv_aP{;HD!m%<93=Ly*sWeIojvhF?c#5!IjcTU|Pg@gq9h@@mYUWwt@3F zaFgU6or>&jdYy}76!RhF%}{*<7c54QaED{w>(tEV9_q9qUQRy@$k_z1H-*D)s#HD> zZ!6HABhp3S=PZ!;XcU1_5M%{()rC9WLq>vmE~2wOm} zMH6-L&QN-WcBmH^(@vA7C+NlZg6+Bw&%o))Xu~BmbG{ce1N9o`k5xo~+Kj@R*VL!2 zy>ozsEYOH9g814t^jR(8N`;(3wlh~cNO5`cz@FPX-M6FeGBtFGj6t@8?VEupDl9)L zJ|)hE$3u!z!pp6CHs8!1V0x>w*}Zz*$$(zQ`mil0dN|x%@VyNkT-1(uoe?G(%!*W! z6@W5<&e2ff21*Xw89HKGGM$fOVOAdZC&e$Y1|1hmr30RJ-Wzb7utC%qRB~@UDdvJa z;3@(sJ&3E?w!VM@Pa0HJ0rw1S)&&y`-z0tKN~Eo0^X6vddWcNTS4s8#p7JLNYl4w@ zot3sl`F`yM>8dB^v`Y+R{R566UwgYTp%8hzJjOmNT#Ao|^8VInl^AGlQOLvjxzI*7 z?<`+_L*ZARmA3k2OW5oaecR(+rogkp57I|0J=|uO))<(X#M(Qvbk{Fl{cpFRn)bY2 zkRHVo{x+t>OWMd9>DtQ3@bE`&a8y?wqPL!1?j(%BQ-3rby(|*N^@ZEwq2pR+4FZc3 zFT7t)l~8;9>H&P{l{3KXW~x{O4IX^*+4 z+Jz*TQSO77ZwK0jdTSPn>5^a?tbmJ%hP+u;p<5w!rGU}|uO5dX5amOCrH^yD8v>27;6&$V@u;(}RFp$e#LzjnRG9<;eD27mV?~3SsnrfEoA>_R{7v{sfAX z^!FLyd`^1gc)-$&{WY}-u}9<~xZ%)VEgv#&zdWsntDsXK(W9+-f zs5(+z-*(~BZR)ZuFvDeKGw{$NSB8yi2>a3Em~2tIq!Rk+N}iZPkO^5#C2@)XtVBSb z@)t=n`$Jq0q#(Wy+~v@B@hdG^Ff-lkVsHFT{`=_J(poKQFL6U%%(maAEx4Mct%T%u zCpA;)%S|qyu&?tEJrFnzIWJMojJUTXnM;M{yz^BhTX)IAEaz1$g{mjaUFWL;c&r#8 zglvAYs@1LMPj<=L`H_sbULje*PYQ1^+Xo8I`nT8*Pza4S&yYL+`1}>J;;fob4 zCCUwP5!`;wLa%IT1y<2MZxMrhL1yI%DV1DNsF|JrHwTOZJj)-?_|<+6RgywCqjIKC z-G^TiyeIFJmL@rwD52%KBd^p*Ex-lU8LfcgLn;Ov_tnsH7To)64O^PUM`~uf57FnQ z?Y{T0ZeDaTIp~mao=?x;Rykv|C!ejvs`Rh7RYhclZ@-|d;(2zS^UoLk=&>;bA-Cso z$uD{Fw?J;lNa`5moR)@HZhTCK6pyJ3`E;(3C&iVe9``UPf1fZed7uNvdNO~@R2FDl zCV7d0aQsaCM>#w80EwwoOI7;>5*T9)zp6Xd?^%*2*ijL{vHKiza2Tmn0`il(>dp4G z*xY2NOpen^C*yVUg#ORV%l9l*R!htsqGli5DtP7112m9krF@HQ&9BHVdd~|Hd!lUu zWm;{%(+5+}x_(x=xr2-^^%40?Nu+0rH;^oq4j5znfb!5gR@fv?5VJ}KU1s+k^>|6; zvokL7VVLSg@JJX83EY~mT+pqd+yJ+x?-{r?P@M?+Ntz~*$Yg;277RuUP~SK3ZJL7z zFA;P2MX~4q(qu?8$pPUjK6m4x2-qI87fi9SCgL+~t^{{yoDJv`(w>Gr7T6AusKBRQ z3P2}pmD0!Lf(yzY5!eD4Vk2Rtg(t3gzSb2jiyAu_-8I}Qzv5is3EXye(V%xtWFBI-_?G%e`3-pFPf3B-ENuSKSa3*)}15S-r%A#ymF&u zbhYs|S&TjUk<;jcv+Bq2@ZbTpPN3;@RSUWUtw~|{39DKr8kA%~=t`zmB?8emvGIP6 zhYMYi>Y{^P!90`*HLHl$mkAvVYIn+_rz1~NqTC6Gk$O^NSSi~EpNb3+QVeqzwy|M7 zws>0dI_hO0Hh!ss>X#Hor8=z~2{rK_3H7eb2lUXJvN2hI^2igv_YO?PCv18e)t*&H zel}}72gN>SuTkl@xQA&ji!8*tb|YF3WXAxf6A?jwCPDZ z@$2s`^f?h4xiM@qF)3~CoE|+wGgEzoMh2UO7F}-}83rEOq+U%t{x(bs&b5|Gq0l^1 zl!HEui1$lC#x^L~uZw|F&PO?8Wr?H@5{6rCPC8>jfHttM=YO0xRRQJxGKCodUKP*n$HTT%=F5!)J)IAKiZ$ z#>Yyq`A!)|EDyEt;W-FQ{D^{x#*Ce>vAP!d!UNwNmuVv@WBh?BMU_)w)v=09GBWY0 z)L8=#yhpu0Yq=uJ-x!J=hKH%!N!S6iqI6xsr5q)c6Yy^ASVD=MW2I+Oh<^VeCk9%5 z^OTg^4=v(T8T3WBOe{}x3>;4?T}~CkuMPOcxZV7H*`B0H;Pe;NLOm1-eikQ9h0yM2 zBT&^zHg%0Hc9FS`DPppN&qUTNPbr2c^y(sU6Ue>2erk}>3hAHIr# z?^g}{-|F?B0V?Nct8A_z$0xv`Z!V;^^eCXabOa*i|3x#^P@kI&oKqlK&2MfVjS# zqL0|BissCTR0m?e`+AylIwgNL9-QV_I4zV~4~^k_SAnW|?UKaTh+(^@)mYVh@ch2c z8!#u~VNJP|{Vk)qW&CXw`r;BlqPOpUR-q@nnvP?d5{HWSKqjTk`*0FdD z&56A?evom0RRh_Ijh-2M6$t0+A(6e_5=yWsN+6CdaA}dB=A?jYWv2Glo#L-BG7Q z&usFr`t<{=BinX$fQtO_z547L_yr^L7e^CguTTVA37;8tdK8_kOyaC)lU2d+a9^+@*b7 z6E_3GYOhC;lQ~UfZ8VGs776*aFTvj2pbU|%9(9~a;kRH->Lx3@nYX0!%Rw@7f=|a8 z2H~`bT^1v9k>dds6jgj-j$2cp+)!3K9@sd`3L2s8c& zZ5M{3RC}gquv>4VJy4rCgp$gw6Ni6t4xx5_P(Ta;*wR*b*#F)d#mM;_NUlD0VdR&2fjq8xMPf-)A<;j_v^!8buTR?Er@2Tj;1j#Oz{QZ;$79D9-7 zis9=_Vf`zAy#fxXQ7Dp(b(a7dWfHF)X^*mG7+d<8n4JSB5k%g8eR)xeNWKFIzp{( z^d-)o2i3V~(oQ>nJ%mpt-%A@1Hv1VyJ|#dxxrI%)@ctvVFz#yzMkGmEA`wP6MXOl( z6wkLI?1;3$-v*seyUUNKV(Z&?p*!ti3CX$24==aIGE$o%w!5aaQVi(Ik^^iPHPjRou4{eB*zdT7&bO_rN2tU%hlw0eYrk11Je7JMV`;fmp@6-udR z2qxHq6auyNSzUCUf@of22dZ4a(-JxlR_#G$Bbo5N``WXbYKZTBBwh%sh8@JV28Ue% zj1(t2Yl-)99f-}6KxLMjk9ezF_rs4>zR+u+cH#u z4g&JJZM#!$^hLgHVky+>y;y=<4(N!M{QpPv=@1#8MUr1&l~=R(eYz)uiGz0|pKZ3~ zj)1UOXM`e^0o8uPab!xHU0Ou}?f&7D!|x+RKGatkH8qfK)G_!~>+!tI)Ug)qOYxMG#93fmX@3<8_RV%;qpHgz?k)fKFt~B zDg8_+1($^kVPTR~NY?!f8y3edh95ztt5?)Z^BLRT!fy=1(Iq_18c)G+Bq`tHs~3u` zKjwpm5=(XHShG`Jv|17;chp9`zl*n-7MPb)2eY)$+08`Befs#Dl*+0aITHd~qy&w! zsvgX)FP%C%_@B|F_s!yXbYCX32#i?JKaRDvR26Jx^DG^KgLELYSHiuO%}8RedRnvNOk!DjfE*YGXbe*VKs^fnZhNrB^zPPSD?oNR34oXb!{0!ZGvT> z{y}-D@2F}FC~*z!fVrK$Gax7ENNB%G-gMiFNvPRwP3N!YrPd=p_5=%C-1BDiULE24E=~dD#N>2PV9}&`c`0(^DVVtT) zJ~@%kSM#?gl%l$R8W{gEfO1GuAeyKMtPF^gIWhGf~(xlfnraGnA}R_+EmiMr*&5-~LYGq+8_dSfkCgZoKTUv`Yj3QyPVLM1h*G zTcKIGkDl`PEOMh^Mk5CYhnjP}Qr=F`7_or?)e6o2GrFLf||Fdbw#c zb%s=xaQ|sVj-Naw%@0sLfZ(=Mn5A|~`?qq|KzL_YZ)qxG=#}kqhhQsvn81iAp$1My z+&Tw=T4F&HE5?fqApF?X9Mx2_f^d0A>94iL6jq1hyj=JOzNZbF0ggrgCa4{KkODz; ziDNH8Pa4jNx`*8R94d+5b$M&@5(X(C45w7dJuV>cB1_G!DR9|MZ>($KBxaz&NvvpsLiXlaanpUO zUg8|mR?E+&A&P~!EMXEa1lhK0(U4_+>B)Q={Z6fF4}#@gi5k#7aGRCoy|;pLAcZYD z5+S*%SM!!Ne8ktL_pKnGHI<6Up}(-GZ{zXJ`MfjPPkN=#D=0zQ^r@hlomvk9NUS3Y z?0V^qraCGh5spv9zXBR2>ev&%QPrYqnOi%gm3eAFUN$S5D=|rn*@7=_kuGc43d1&L z&(D?6FjXhYWe=|T%`up#p->ZVoBo?ThcEO~31chUpYq?%H+=>;;mIjd-gHf=k*#m7 z{4crTsdfmpc*fK#i%NWxv^L7xIL^3y4>G;{Xn%Ke`IF0d(u+;S4d%!Ri{tSbEkyAJ zJ;7P4vv^KqWTi6QsZA(St^hd`+8JLm|F?Yf#}SVu?8^v!BYo8?-=wc@OJ6j)Eir6T(^D}Nj-xXRg63f!md|>iM6_HsMYOYxjZQ4aJkcd)1i0;yOq;X zIsI4}wK{Vk32*e4WwDC0DgKKB2+IG)=D{++$wWC8auE3NJ%z4~C1TTCP23Ite@?~; zL4p#xTtEd%;lM znJn!&P&;2416$=pExvTvrOYdO4-VPbU*Fsxve2gZxIraHiYA`uMo3daJk;dn<@)9u z)r>DPA&2&BN$r)RHZ1DFuy44*EYq6EujsvVT>@0z1&G5}R4-x#ID+oc6cH9V| z0Fr|P^e8+_h?Pp2;}*;aF(?G1hL0Xu)1tst!Rben%>2rEKRM!qpL^?%re}Ca1A5j! zAHk?L^kxaFwFO&@DZFkGFhb2)>0hIAxNA^)LUAUy?Na;etfO?dJ=8)1`3Y!otem;U zn0ZXnLsC#={FQyJoc0GQOEurJ7#@j-Cjm0rtS3g814M*EC>;H*XjZ>IhgxSnZM^_$ z#j~Z^(UC3pdO4wHX2aM#>EE=Iz}@1B{9z!`{{;pyPZYc>)rUeW`q=# zkA61&+@%<7o=hgJRi!w1MP{sLMuI5cd!JhUqVz05loe`~>nMK`oJUEB?Xe_+Ud~F3 zMJe_wd+!8YFcK~;e9x5v&m+|xJm*N&-ly?RjK4S=qJvsmh;-hW#QZD@AjnV zFEksKQJx$OrN-L|Ic|gEpD0^aHjCi?F$~VniMJCqRWOGs<|H&X$dCyF@x=3RhTBc* zVk50dFAg^}M~m%Z9e)99X3765uq@%ST?n(aGky zmJR7Z)MaAy5F6qaafQ7i&X}rji$XQVFUjKWvRJxz;3G~8%`V2$oUFXYV~KlQUhE}N zfz>UONtJ@mZk_vn!k#!ZV)(j?Di_lLp{bd~i}U^XQQcF@C}0pJ|2E_u`-wt*XFgeM z0U#h4*;r+Wj+ky}$o}zQeM^A-AoksNXNM}aREG$oW=3I*%}g#bdOE{(Tv;E{`^(No zmfa^E;We3;jFe|f`}AZT8;XnPd}SeiVFa<2rx-XX)On~UyyA+&1d+bQn}r3x$%gN6S%``m?ZTpgI=SFGQ<3; zu?_O}Td?2X#ib2;H7jsfD6Ly5Z!^s)c9AWX56^o=E8kPruSS#?WR7#Ig7et-$O;}V zQH!C5OOfTEZ%5O14F-N2>1KM=Lh7|QZSvkRg>A)}MZ$dvV2JdnxXoL7!{+W86_UR= zYHh^yYk!|!d=SwD2cS39BQ{fTJTKj}7i^5&(H|oh#g*Ug1CS}N2W{^nX`B-la zB!kKdY#*S%R*QJ<`s3!!j&Z`J2!O|^_Q!X90er*{JKI#FJ|w^LIhW*&$H_?~&= zdymg0Tjt~_bXV1QksemZ(PfdB%3q>{*CSO;(8l?sQZ&j zeevmK{)U|)RM^5J8(mwh&N2->SCXQ?P_c|Vg%f0$R^n~y-(qQp#&`T|bQ~(HaYOf6 zx_C@N7P9Wk%$h_dss3QPeru9u1CNE^L53~hi?R44rqSNqa@!QIaC&6*jV=VcNP`2k z>&1>QP(y58+V6wbi4KZ6Oa*olg;2%RH>|9v5n>w@%J3Pv?8Ar3HSwiSJ4 zN7AO35LIin)5iN?DVuBZ?-QBiKJ9J;It5eUYUQbh6rjX9aQbfYWxei5Xe9i~{hmwL z$hWrIXR6#tyc)P!5W09YUD4DwUdO+zkAZk`-m~XuxhG)&)c19jIEsfRK_c~??hZhP z-k`}rcP4c_z_9(zU*gT1#7i&+wMn)Mv{KkHlh{^2pAPkNoAb1ku9pN5j6Ebl9m$u& zb-uYe$pBWtNj=lm*`*k9dq}CwsZDV=;Qg@?W*zo%9IwzHqyy?Og`f}Vx2VIZdJQ`Ja8Kk^vuOlJnl2713dF%opG`F{@w; zawvEZAxCMCc)Kf8P8^U9ZlQ>p*$m%pRb*={@ZpPOJElo!wRt9a!L3eonC8t@M2si?reS2A5f8Ei?>ls=2SLbP}S5I6EPV*Uq4z$|F-qry0D z_sDn;15Ce)2#)JUt2_TYf#G&fg=LffWDAy;W)jV9_st(2lwq!YQ}J?Qp}9VzH29KOxI@W?`jL zSSd05J$=cSq3Ol%WM6sZ22H=a@=5>AA`6w&ZbZhR^BB`4#2r9v4Xe^8@V1Ag@!O@7 z3p(WL0W3*r(ZrdJLCc~Xypk@FlrwB{VcPs;F{~0{yk9orl-7uvbp!b!}TGi?2gn? z35HfAgqg=V>fY7D@(g7hhq75#S5l1lfp0RE{Go}ALbR&z1`{;8X2dbdr30p}>ocTr zR|a)z0OVomEGB1w%Kr^-2z-yVk|~o}eibm`nt{FahShUkTWP>f$2O?9=)5gXu<$)4 zT%wI0@6U9%AeO))|KD^c{}_T0kKeu|4mg&O0GP;L7GKH$u(m<03;$5c_r!Zhr7;rf zrbw}4{O^zYbQ@PI-d7oFHEo|~@y&-zFf#nTK2fI}yvk8w66z~8?>#6F?puABBEG#D zKwv+8v}MyA0m?0O3L;t?@fSY>3Sl6TU9%r}fUVx#B`09oI2aNa0DrzuB6jBBMGyda z(z)Iz;BTMalfashbM?z|6_}VDhfdv~iLF3;imT;v_zA#iFXwNra?Zxe{meg2z4%BM z{T^$PX$Oe3J7CrQ-0CX5Vk6i2Fd3*NVf!}+jIs{5|3gpNkXG=)#YpgRG;3?QKH@sK zzSzx}`|RD=0-zXb5L0+iUy!`XA)BGB+P~t{Yd{7O4%0<#EbfxmS@V&=Y7O3zSz{zO_Z6U2*N!Cv% zR1u^fde3VsOGk=gg&s~u7@JmO_YFXjrgMH5b_a9byJ_GNnvX(%;p+mgZ!oZrwhXOsU5%CFGkAvfvV z_fAi>nxf8qw;ndX9Bt|<#Oiz9FLZvgJKwYaJTu3_TSb)3WT*J3d{Qy|U0pH;k=}Jg zWMeWJzdjrSUOWNFFpw9)`QjM-T=B~hNBZMb7suN+>oN15Yt(BN;G93WIzMurfQ&$% zz!5Z1VceD}A|4BXiHw&mSL68ZfV6*hlhil|LOPVj!+|zNt8Gf;{D9N2!NnYDg!Lijz4jCF%LQDtm0KbfzIs4zjomeA zChFIT`;okSQfTI*E?3cA%%T>+Xo|tTLHHF6BnTO^rtSCxk99rufDa*ktoZLQ z$QED+H_(bQQpCq8x}gjo>rR@69;Xp;WuOh?$+Noyqe}8L6CSmajkuv@mTTZ%8$d>9 zD-BAsOa}}<(yNW8-l9sFqVrVE@dw&^_rNT%&`P>--WT)=uJtoy+as#td=NJ(qM3*kZW=ArY30uzS~KyozAB59LbfAA*N@i#^!e|p0vM(P7?#SY*pI#gQbAi~X;FE2 zuVUj8*kuc=)w+H_>IR$hAvByLig^J_`1(u*QYg+2bk9F67b$Yhi$^<5=XYhk3*i$B z@Hzc{NY~`KdYvXROqG9kMEsh`gQi(F+RqM`3 za(nC$*AB*L!MubzsI4Qh^aH%s2D?T95FtqlGJUvl$h6@Omz?d1`&x>Py z4+W%53vI0ld{6cucM!4mtt<5#u>UEvnwoFR|MhMkS#w@NNf8U$+L;c5kAQeEL9+!ANkJ7#9dy$k}+{@_)y=uKpQCl^CwAB8?#+TEYVGdpEIlr4(=M&|>5Nu4vrI!HAz z14KO)OY@FT|Z(=BiJT3xf0l)vGuyhwJlhmmqnB#eu zCn0s=U9tys@|qOl0ZaEdfrJ1BQ_}HmFv&g4tg7&pJ3&j&fc<(tv8nt>IbTH$RbXE! zD_>>*ibT&0-~HF!`GkDSc8Xef%tt=4D5~rhGG{<%p{`Imoz+;6^n(V``U~pYOk)ng zO{*NmeKJ`@hq$$ImrH5PQ5ln6>Eb7FMs&pz7KvN8fpW{n9*Ei6nV!3{ZpEpE-4^KX z1Cod7C{#hGXRy)>g$v-g=?6#hha2TBpSy<*o_{)R69D*nv=Nci2>`3MzXm_dCZBB^m-dxi`;Q}P? z@IncwdGM^e=pC}*cb}@ky-t}N1dH48N^$?3+ z7%2A?ZqDJnNDDf{i#N?+9N$S5%pPmgFaxaZq)>#c5!x)?Wd+Jiqx(x*7C;^d%p<5P zAzfZ$mlGAq@|5gl2N~=Klxvq&wNs~Gl<5>MwBOArQeV6*Nwx4P{=ujnHpLqZQN978=H_EGRHGANqXPyL?N+<-s{CuB049{h z^BgAeS}$F*nc7}yo{+Zm6KKc)V^vFd$&zzC(PM+(6Q%lf{dmCBee)nj{2D>dYZWUJ z%p3-#MdUPgXooV)$aQ;a?78)GAWItLNJgUp+Dd0Youvc5`-@&CRN7xVR7g31IfH_Q z4BlgCk!Ie%`LTQlHVj4W1&G`r*`PuW=QH4Dx1RIA@wE&f#R{a-Z5&p-kE#+zct4j4 z7Ys7xf**5DsFO^Ef%!7#3kNA2@AJh@V-~T2n^1go05W>I=*bLEf@>=nz`JGu7Y+9N zWCqQtTo;9yY6kW*FEHsF zh%RRD$CwKRt$|*N8+1|?`mb{BHCS^z7BQu>NF&A(D{PIRqnH^}Ai{|CWp4qbX-wFM z6qtPz5IC-a6>C`Xr$LOZ_OnIVUiVHvJvteY_FbKx2W)%U=Ug#~)uJY*T5*Er%XfN_ zUpaIH={ay|9{qrb$i>+!o%9pIRt`J5vsbD0;NzyWe|7#{G&d|pcfSmgHwi{4YW8sM z=x_Fz^r_shYWFIh*JkX7{2qXUC@K=(wWw~E@An&MH0fc~{mQhYw~H29ec+=SUAVsj z{!qNJE1s&eNlvdaU{{248tN?TSnKF1PhYUh4d<5^C?BJ`*Bnuas*2)992V7}YRp;b zzf;ZGnbMsBJ^WOe@4`8tWcWZ(Ns5grC*miPZZkb1q;UA$4KO2(!aPpP@|Lq1vf7c&lW&x<0y+YkWTiZW0zxN6vNXDl|a04bGVB66U#o=S7X=FfI4$ z^T;TfqZGXn_ArZ?uJ1nmrdARBK%GT81cW)}Q2x?d|@LBHqT z%*0d zs8=MyM*h{G`h7>%ER>#=8dx5`^~!f_j@JLmdSzQ+~Cl`LI&74U5#gd>`1_j!Y? zJAbe9e8bA?TBCeR+1C3|7$JD|lA?ri68nfQ`T?H@CE#xM>qct$xR4yLR7IV%%w~?d zb2`<JB&m*x(_>S3!fg@Z%X~w%t5oCu!{nnobhD` zO++Q|xuwd{`fAb0T}!2!#rXlDlj9xP#4wPwyD!K2(eHp5wF&J6UQ`s46p9Ldf$_`t;@EYtcx2R$ zepF(HIG~+{$vbD}{_d4guWM=vG}wr=W*FW0h?~srgfd2BbbH0q^tOWs$=ZRCxnS)T zGES)1*oNLz2ic~GjDPoQDoM6@=G{?p5;)t$vUCtXK79@{+TGZ$H~F7ISJ?HOp3P%# zse{6%WC0@xF9@hd7WnV{4nI6Eu-Ze%&v2=$DjX}gR&?lI5@4T$1?kVfP)3Lb8a(!u zrK{1mqnPGIx2H1EK1Gr03~CSmKsHtel*@I@j;{Qi`F`^eWBT;p zLT0PKVCzXR8Khk8r6A&r$n))LzCSJ#Pgny1M5~FP+IP9C-yK}+wzy|Rz~9FZbmQ6D zOVX(a3DC-%eYdQY1M-Xsv3J9G5#e>b#9q)4E&C4Tcw1 z5%VNEf!72Yj25ZV%C!gkfWaY0XiF~^$x|FCqb>Dr-FJ;OmNh;DV+xuMwcaIZA3XLs zk7n%(I4sw~y%CWcGpDrUDmynzY3+f@9rXL8U z-!N{(i0lYvib(AMaC)h%@2V}FcKmCsaoZaq8*jXr3NwYdZk|1!R|Hrg)(@1zCs=1p zd?jFKcQ$%XB3zZ5QQ^|rGR9$J&vPzcU4W}YJAV#xuGWV2c!Mw7_0V=o>o zkW|sj==BETJ)(DiO`c3!`63d@1B45?cm@<;VfK;Uyk7$03Ueh@z4xxSy0<{>yYp7N zyE_h(>p-ph{$ivsisxs`q3pp{%JH}KRgzZHaH?CHy?2fs>#OW3s>7PJKog{B_o0_QB7Ojm{Q zt*$^$osL+h*3$MI{;W(NI!cc($V%`U|45_mjOULLiU?wtts6?+PX{Ur>U*nMT-Zk7 z%^qg_izsg3You&P|8HJAv(L+rO7Xtj>uT%*F=@3T_<^1e&fft@?CVA{Ic=VM+`xLQ zY1+`cG3E%)PRQHJQxR_X*Z4N4{xfXcMqP}j61rL_=-0e@}J~gNT0f` z!z>3gtwBZeDykz{|6&LY5lQ>GEfA{*?$Owrj81=00u^!^tZ7i#lz?tMd$*8X`!AgM zqW*sZ_H@8m;AFvaLx~936iY#JT>WC^*|K`K7?tIKR5KTRBY6GhP^rq)Rr~Rc5oR`AB9y)1~PCC!#dS)g3K@$lJ+%~=gi}n zqk{EGoY1f-mNopKRG_MHY;ugP5ez#*Gppk1N8SJeq#8G1gwv5aU4d7aw#Hn%$u8^0 z@k)D6=t;Ql6m@Tj&+GSx4w3b$L2sC%YIR8t=)wWNRc+6Rk<5a>nF4PZ7#3Gg)?3e? zFMK8n09= z(i8L=^}4ona`O?96nwn{A+u3e=t4xum>6%6J-Ffvlq^*G-aPOl_wU2Jv*-?xcW3A8 z-z@x|v_~1PKC19q6&t>#P1v~~e|z;qnuVbHEVrp1!#;8OVX0i5*3yS^R5#L|XgN>y z5X2=%y7*RdDBto(8LIN9Rywm0Hg2S9xi+B<6FCp(qNQ6l4hs%(=^@%nvKtQit4Q9f1JW)*D zoY%)m&}mV9-vx{yKM-+wEBt07?+7$Y94>FK{Jh6;3rdEHR-hbKsXRo8p6&m9s;&>bQdt~^l$8@#E3KYf34&FdMjoRx<`ZMOHfXcZ~Dgu6WID0yA zZF1KxW;s9>Pkx!oCS;$s3fncf;kIORdXugcB6tP`lZJtbi5X^nu@44+6cTrOM^1nR zGwWnl(uJdH;A6(1(!iEKeP}<@^;{DGO3;~PCFBT)nv>>JR|*X_N|E=fhuXGUcs;}7 zXBo^ta;reLjDo{gE;}?r5B`i$*)1;uut)l(6e3FBjBso0+9Hc?$?GkKnFOT8P*8sH z+9QU~qr}27UOG_?_s0wi6VlA7X#iVmv43W1OHaOhtKF2#aM{uJ^n|1%#MlD)VgVt{ zq%?z6eZg%%7uN}(jgy1S8kB5%AO4UlczkPR==Y}3#*odU@<}k3-{L9>4`%afisx;< zD_;s5(LD1c@wFMnlx!Bc@d5#lyz6moMW2~A;(c$_Cu|)oVbLnd551rEa5uC5dRkPQ z?pV8SeE<82={nM9jEs1ptS9`-nD%6=5-pK)Oe&;w_8Dg>UU<4UXfJuX5B0Z0G^YV? z+i#>dG8c*=19~C(qG;@`0H=#~br4R+JtMZFc0UiR`5tcrYuJwn z#0OrE`(3Wm&6J{EE_fmSw|lSyvtP!I`|lc=@&zo}s1ry%4UM-c|2(euiO30N-)l@l z9DM_Og6J5|fn#^xVId*LH?qFd32%-1b6UYJPm>CY^hE!XYbn1{;)P_Nup^AnBES$c z#3+`O8IP&Ma2r!FZ{mqEG3PWsD?T*~{g}X(9Q=bqn>D}Wxx9%F!#mZgfL9bGF#AA8 zq%(uwnB8dJ@FdG#fq8OpQX|HMx(kgxf%bCX-p9*awRgW1XN=vQcDXvcs}V*y%lgW5 z_vvS(u06qBQ-Vcw77qDyjz7ATW%TE{)!zU0HTuP~r<=lM_RCp4kn}P__T|)P!GO!) z!j1|kkP$8ZBL)e3CEgYn%zPu~vWiN#oJr-TE;~qHJSyoEA2{_g9w2D-RL@}oo?J8p zNXuDMh0v@=8_2SBw{K4cAY_M7UKT%Nj>5#CE5_bue4alBUV|N2-aHt-?4>iBESD&* zY9kphDN3WK zX(_V73uX2X!m4I`CpL|JyVsh=biQQinNe558;ARpmk&!`+5bp^Sf~w5u*AT;Ele>_ zX_e@~p)!CD$o#*gqA;mPa>}QI%|elsIl7=_IMm^8?otJ!WoGLE;j+OGyInuf9nXtE z@WFlrvGJ;~B4VJc)h_jr9-YEUayAw-lyr4vCB_DLgFfi zSyy_J#V7Yq`2egPS|OZzotxAsn%!b1)S7dJXGcBxR5k+-kD8kxFsa1me79`^5i%-+ zz`G}OPgvm|{Y)?CdBN{xLy8Dbf^1b6qMQA#`<(QhCTVq47K;Kq0^rlf%O!@X^U_RD2=PPErX>57Ui&~sR29E44mbjREeWXN+L#&v_( z4-Kap=Ai=7m4;0Do5Xi8xnONoASmbUtOaK;syew1iJD{}$$|1H=}3eou}tG_Ic-XF=FRzf>~c#3rG|Y${8y2cl;A+_o?LAR z+_{v%KFLAJQw_MUf+Y-YG(Q6O6+8D%fy+kYDqw7@w6vNAPJ($m!X?=Mo}@yujeiyS z6~njRknlC$ioV7cs32BBq-8=^v43BjoNq)H9)s>P&z1HHg|1BJ!Hw<&lg~s*oFrHk z6+P-ZUPvn6B-N+HX@<_XMyyv9@U9Nf79#O$&Z!WTfM zNLyd27O+*|NwQym>7PV0%t-Zj$HzcPJPWCbHvpm>{RPDPe9SW@3-IVC*ARrN1M=D! zyHbPuq))wrc8e)JVGr~h>+27Tq>Ruqf5C_u*)F|BjY;x#^G(308-+@B)A`c zcptt#Yg;{_I42u-_@VeEw^*2dsAj7j=B1Y=@}JXpSit|@U>x{2Z3IYK7n8-^eqYS7 zX}sVev^PH>|M9%`NoTN_&h?KUtV9>~hr<3SAK0hI3d-Jld{n4DhiofT|4@foS#@a} za}>5B&-J!=7vrDgy5c_6s=)V^0SDJv_QbQSVe?)!0Q>80{I7d1$&`u#K-VlXhH1$C z7?X@KWNlf2Nyo)>Judi5#7-DtlpwnaFo`>|Qa-eVicn;G)UK!QR*eO*Wk;SP;VhG{}%Ml3|H6h2MAH05HbM;o)`l&C&04 z@Yf?Hv}QreXqkB!_Md?8+qXaG^SOM5l&v|bD9Pm_ijpfjtxtt_6me(G_|uN?9RP>^ z>P~T7xEKl^MXx-DQX!3m7B>OQvXdQ*nXC{lS3(6sS81XX+rJxKJI*oV7c|vFVItT_eT=8qdJi28gm~(jd_m@9k$7?SaraW_Mf3cH*VV399 z!KLFH+)pA$lk~f-Wi;v$30WwsbsT-MN;I{|IF;ve9A`0A*IbMLjYHLI?+1ovak4X4 zkgDVhD!W{jCs2DMe=Mi+Cza(anlq**U${8_H92CaGz;~u{b00N%09cnz+$LTbLf~L8zE+`$@m8Nn5!?%R0Pv zx}@B)YsUv>*`F(HTG1J^fB+DYd>wqIp8vRhO%bt;qB={{p0wRW2+R?lYf5dp;1(PL znH~<1>3Ic>nl~~^2n|TnCcDn)hecZg8Gt<@+dQ-<_u+am9{*+a9<3H^tHrmPpy?N#Co-7@Cxh|hFFMEc4zFVKp>;)s z?!6QTB>YR&X?WCB=UX+c#ZtDvx#|L13_SX&#ja163BbcZtm3BzcQhjj(lTnkI@U*KPkj{E#YT{~JBN!KNYxc_hGdP$OsRuMHzesG zHT--vgs?f9aYhO;1G+Zq9uidAcFr3sm2qL=+%T)jv!k>X#?d9U@jH zpolScZXp$_MZs{_Vf8RIfqnRMI&3}SO!%vnP`*tn6iS#X7qBa5RiW0S2i}t*3~EwK ziF0D2EaAWkO9)0zoHfSR;3at{bWg>s4O_rvL357%q*GVdu%yKRxd=sC`8u3LMUQxzPtGGJ&=n6-j++rQGRmBC{W6NU>vw0 z!ye@5ezG&mENqE~WGLKF^6$zRY}M%Sl$B}CtDX-Dtx*+`E~N7zRciH%wl)OWzWW&D z5D`t$(vRORzVLQQq8yT{wY@QmG{<8VP81{;u+N-Ez&i21mF5;n3Mi71{r(vg1?064 zQ*+e)x?*T|TT}K4NX3SV(H)PthUzU1u9Or%0?FP})BuJ)fY{abo{achz5?=caB+?r z?;{O>HhNYvWGD|2{$IVx#o)z68o%?*M6q-q@RCnwa;8=;&I%&(7a9NEIZMf@i zgP9rsn=45V9Y^9vbs{~l*RF$WpHd(yWnSSle%XDdFKZscjD@xfGv@wn!Li-2mJI)9 zOziO0S!r~uqTuzH7-nLWT|@=br=MBOO|EbPyB=?)D%V}i*A*ou-#^!39Z)A@ke$}* zoGD&*%)+Zoes;x^ha{1fvlZDB*Ot*EYWoD;K==wmvl{ z;Mf>{KdbHSj9=5+m%OEKTPYhWXTv_RLi@xBDB9z>+uRRjFZHnMu9t9>GBH}KN$i#8 z&IEMgCM8ofSk8Pwo%CTXE-R))r*e|v^jE-S(`79^`bqaP`S+A@OvhFQiajZl>+rpJ zkrEAY2WKD;N|LcG9YNbweC8pL45LI;_Ws1NIhy=jE63yh3n-SpHabvWfBDd_`Y!nvzGf0Wn@XiS`^bgjeQ$Z&cI9jW<&XVp7S3B zRyH3$J5vcyaSMO>9PoUgJQc@+5ZTB4T{CQ?&kXbTN)B+h zp2YvIHJecJ;u%Nz#co3F#^{3XMeQ9Q)3^#kO3GvI4%)wRxBq4udU_p-eseiFFiE{E z*G>`QF!UWYiLlqrz_-tNN1+KAL4e`Q?2LQjpgCLHwZ9+<>) zR`PrQ*#y9pgMuNmox7JXz-e1DTS+)gszl(Nd~j(=HNdPx>1j`#XMe&!K{Y!HJPw>9 zVQ`E@Qusj4GE=>4@~vNi-p}!qOv`++Y6?)5(BKST;)!)6CQ*q#IoM!Izp3!uQ}9ZBpRRi90U z#hmI4&LCfK^|o^CRxKm@gILON5tF_lt|8e93P&iWg!)E@oFgU*u3CFXRrh!~SbMx- zx9>A^Ey}#y+(kPhVj}lPOb!4gvm0LRKc)4 zc<;m%T0V{SpvOY?4kE# zwEgjchon&GF@EK8#g{5YFg|?>^a>~TjB^m}+&|OSH6$K21(6Xwm3PURgP;uukDnq| z-anaQF@p6>=(&egIYcx9;)-MDoNWsfM|lduWoz@$CgxhnW^InI0eiPhjY}3Hf;fgQ zd|xKsDF;PSF+0CvfqI+HIS7=q8KGJkY{(B4A#hd7h@@aHGGsh zeS%BRdfs>Evja<`A`W5B#TB9qUIM;1$~*wcY#OFWVp+T|P=>Rm`U zd`RZoO@5smYXA<;R?SL#yc;&_Tl@*&g`*N&bKy|>#1Cl$BvZa_h-Fd)W+$9|2RdZi zRnW)j2F>(&l!6ib_&5@Ko!-ot(;9B4jmJ$^|Bo`ae&Z}05 zFF0p)9wO&y<}P}YN`_KBVK0)=taQY`t8x`n|8w|b;Mzh&fiRiwO{+0PC5QhLbrZLk zi>wv@K^L|!OZj$713)b`jsg~)(mh{3(tmdkn7)AII>|NE9i7@mja7=)zVrxY>i$xM zIe)i~V4qF#e)M2q!A3-_hNYU!TdjkYhOIK^I}dZ7+zLxvs-~N8G}8qRMgK%wH}u8; zt5*(*3A0fvbX$hNn-h)rMfejl!}JU| zpEy;N{1kw9x1s-`7h9(K8+{w5${>BBVZ5nge~mhJ*4S#HvH|hAW~Sk9Q7vSU6+5?T z*%#=_A3}baw*!F&Y^{z?7%2KSlTU%yFS?fHWum(gow3GsX)wu+ql5A_kUHI-c=w89 zzJ{8~&R^RG7QcwiMaSH61t@%SlB-MX+lc{Sh<^0@aTXP@-srFA|C%-|lhjWs^k;a~ z%Y2oo+RbWf6VPQBkMGpL6u88zS8&+JoT0bQr56j~f=mm^hu>Rdw1F_g6Y)A+Io_z!OXu1r2Q)bBkFVKnhRTsMY9vTIK;>jHJI{QJP9 zr~$w+&lR~g2rudVXLaa})1ciBzqP`P>kA)uEH7We^e0^XWJ>`p45q>-XhU~I(j%b0 z`Mo`Up|kwvB24$(dIJ)f~FYc9^d{@)eNZTHy%(eDzc4I?eK}rk-O5@oVVD zo=?_QUJLx5f^_!Yb@mp2M(jM!_)WUKLn5o=uG zdbqi5pLU!=Z&~i)MgnrHu>?~(aC9;D^5wzZ8|Lb-2^&l6<)8*m^EVO0Cpm;$w8c% zXzp!W!#JX@qrRL!T3RSkkY9!`MgkkgP&C7sfJbdvBsDt{SeoPJEdV6wSsq>t7UK|T zil13~Rk%ok*awsl%-DtBRv~K{FU3yC2zZi3rzG!fm%j*BC|xQP4KfR_wdnPLv*E)1 zWC27(;kR8!}1wYSDh5cfU4f@{1z!df2hkXmVEi?eD{xE7bjM=nFC%tN_)G4%S62e zn0#U?I^P4(*zq55K}B^U{bScsFozl_YMf<5T&rhV<%CsLn~(hVu#{aqv2r9cEezj9;rjhO|>7!8PtiFH;c*dvRb` zYpr&(0)94sV2IrheUAlxn)g781=$r1xqSGtSLI$grH6>Y!hWH@cq&d&{)_hjAsh{l zki4yeWb*n!(e_!OV>Iv~H4Y4AsxY-Gynq% zKr|^XcQSd}6uZkF=>qqv2CXVjJ_fH45`fj9=!-7%+fWH{#9V5B4W;Mn zX_y;$KpRRmZ+i&2{emxX6$m_2c`70+dsGho_bDSy=OPT=f8T4?z(_$;p9v{(*?3qgc4Z<;{0eoB)D ztwl{5LdFrK8xMS_6E-BcboVviJV7%a`6|2qJjpNwACiv1(YZf5yH{v*rYfF5MdL~rz04JHz3 zdo#$n%|iP)dbNlOoceW1Fy2GFLM(~4!}XzTqQeCtiGnV?3R2Y|vx2EKLi4n4M1A4U zXQcG8{S4GS0j>C;#RQVl-$Ntpx8c<$>Q@lhe5gY6;Bh8EKhl6WcO~w6oE*4mC-N3c zd73C7zJ=+Ztr#``dA-4c!8A~@XCb)wkyGm%_qns7<*dtW0NGlAB4`2Z;7;f3zaL4LthsHC zb2uLOfKTSaGA3E-zt4PBM-9r`AMns`OJ~se4+f%trvGAY3i&U1czk-CuJj*x2&Krq zeEZ8uwp|CB!*E-?@P}qY+cTY6XQIqsFk&ZQErE^<1IkTq+%s#Z!~?GqR{;T9Fv}IP&7(p_4B-=@c+jLe7OQ1#pi}p{J(>!Id{O z4HQ>@(8RVnyP`*b8>KApcY4cap&}3uS!ys9Ua#F{o$+xpxLf zb0n$nA>Bs$`>L23a6xG)4u8J`$K`<)Qu@EYzTNOpL5~i~Q-Xgdz9*(QtrzuwPY3z; z^SHh>+bxN%C`wBUAX>?yw)+D7~$pO05w#JdoYT8OT=z>);v2drGqS-GsL{ zU1m}xFzY-S%8l!|k&=$fYg_Z)d)OphKgL-Dt9f3ZfwGYqTn9vxW3b|*Z?f%CLQI4T z2Sko-Gi#uM;ZLj-+BU#fa$8pd3k<~5K<%8Omh}beu|u7&IPm@+2~NEIQFUo~Z_sq~ ze+fVy`1V#>^FlMER`!(>g}`ws%R5kE7G7MvM>9O448G;n4y9FIo=>#!gSZRhummtp zbmTV5gfIr~SU^5|NR<%-N{Z)e;%OtWRn_8S=_dlqof9zdI+=f3e(OF`s6;w()0baq z+9kYIA42668jwrL3Ob!dr4O$M)Na6CeCQ0e8K*+kd=>1L3V&TOasbs3@XLxt!=vWv zNrZ(vn;?(!8SoDpczx65zSgu>K?#T5ST9|J_=|ohW39v)(mboogMCdp!&VLBPq%Wm zL_4A9$?yg|*ACSHGMw1tVSbbF3C4^TzhFM)aRXKa4<#A(K0H{4tk|%sZicLqE=zf- zvS+;;cbuY{TE86Fv)+3WEzI@$Z_7pg?XdPgMx!732 z@@v6rU_~mH`ilOzTptNMW;00A*~{q#!k9hEB-Sqx3usU1SA%NT@Lc`5biz%iDHV%ZhqYQA-#raEb2uo$C`j$6Ihwta(CrAj5YiJ2z$%0s<*%0cUgoq zC?Vb5NOyNBT}lWDOu9>8(%mJXq)K;#)TE_5rgRBNH=Hro^M9VbuXCNf&#U!jUCV1t ze`Abq-1q0^KxmK@Du8;dPGT&CHt|F1|G3hXhh#qs)0Pci0@JG2VCF4sp<~tEH9q9dNeFpyC z_a2jXlretkm7TyJWZ(+f`yLra>?}{Wy2*H)P5li^=nqGuYdg!(`+Z23>$KxWc&P4V zaj#(s4W-uvYCyi*m&CPKVquY)(fcg?)QG66+%u^~gs47dyX$ji@U84iloOB|o+5$u zXa&R6E8&aSr*2pa)8VkM!j9F2d(uQhrTyz!n)o{uzB0eJctzKC_D?CYDS2SAZC@qTLey902pP42=ErFDtstQusKbO^H0_LKvWHIDKuWg#rHVYnxx7< z{JCW5qNvWszyTp0O<~;Uw@%q zdEh1ASe2ynYM^IOu)jMTZ}{?PO{g^e3*1s_065fUD!Lb(ngUxKN@*6oYVnfu6_!%| zFRrBs#}^k2+zC)pFN7Pk`cL|L+4LcQN_f^bi!CXz0@Y#~ci8|QCb1(Lx(p6vuGJrr zT+SXOxiR8@?>txDoy#WlAfukm0wQ#sG8gOt7ZD+=WsuPe>y_+A*u}da5UidOpyfCq z+W^|F!$0^qz}V<`0R$_&+`!e*4nRjyEAkCqgTNTIc;tvppKcynuzealF%fa`uRB2n z?+`&73&9}PPC(}^fQHutSz37`2rqx79q=|GAT3j$S=cPsF?MYpy(F+B;ZO`4A%>9TMZ5O?{RMyud5dz39Hz&|ycbCb+ehSMN7n-0!L&U8+>7%}_${pU2G}!yEPom>C0SF3CXywvkevKL z!UroM{FX!p8lWfYx=*%VD8Y^uB*oA?TX1LNn?5u531V{sjuzZLpVl z{>NTxr2y(2Fy;nMMN>aO)o3zcv35HB_36=*&u3&wo1ltLuNDpnqLO#WkLKY$erH%Q z3E!0Z)Pz(2a})(?fUP2xZGl{)Ca<GzBZ;4}jvXT@I#aeocipX^NG2T`XL!&t|OgPXf}wK4=4W zuN7I|YAg#J$CyDWbt!;c)>I+O1uJtqXFatktv=Y`UHC`tS1PEB(m860890b}!c3WS zTFxA`M0<_z!ch7HhUxa0nd-z6nT#N!^03q(P>9TKV4p#f3I0CvBH#lMO;=^TC|9HV zN2(7;mnRZeuVKrG6>RQ@5Ru_78a>g$dE;a9BhY{PbieAO)yr&C<-$mQ8$hxp({UfK zbYY2+U{~JRcR6+e%+0$u_D#np6MtqD_QjVyBO{x&Q0u|)JkCbxnGXJVVwjDid6>2p z^|PRS_O>o`--;EcF}No-chYF4eq26N1`4 z{rU{8$r{BGF`P(#i@bJCe;eG}XYDfRxt$mM_m#y8J~PbL>j6QT;fTP-?`r^^6RVO3 z=1t-aLID+~fx^NCIOGyoHg&oSJ%P=q_PWF%O3|{X_{J{jyp=}73y&i1?fnxu0i*7o zVWe(QFfF%$$C~W}i%K;m8WlY;Pr5sY&Py|_sqFl*|9aWiU}*xr+80@qz+mv-GCPtX zYPlGmAY?4JA`^~__ruV}fRgmlm_m^;?(#!?0?6kwieJ91**XiV`FbZMI>z&y+5Zy4 z_H}U)2*;RjEjYCfna?E7 z-Y|j&I8d?cd9#}SX}6sw@e52PKsWgy`R}J>pQijzHp`dD0!?xgAo;Mmbud!uw4>gk zGAG04Q#%U(6!#Hf3jg(cJ26BOL0K01>gZTcwSut9yApq(3=~&1WviLgR3btl1uzsP znn_1oXZJwOHQ>KY*wb?dnvFEDuA7qa zMy75*exeP_({FeklK4*d;T>BA2tyKlV*GyA zCzlVt4d5^+LSr{ipZ>6;m!A1*lZ{HTb;&~5%^_LuM-fPWo?WUT_L&Nn^Ke`NV1 z{nm|L`9_b=i{s{hSTms-LcQ6n$NU~8C1kea3ZbRT#dz)=){bHwXSTESqXp-S}t3CwP;0KUD<7&?6 zR+Jb6{!f3gc4887b?ZIK1`7?v&dJP8Ko&z>g$z)G5^K}UnBMUTkg2emdW92okJ^aCwl?KYKiGo8! z)&po2GP(#O#X!NpuKHMFjN{`Z!xQTOo?P|9()Tm$nZ#CI6=@k~C^Zzhbj|Vz-@T${ z%b(E?MZCC{GE(E4%yA5FPU%sg2y9mG>F(6vm!DW@M{ltB{nG9oL934PS^azmUIs`^ zC*be=l{{I}8c4QizOMxq%m4#6D?D|>%HOSkiq&Kz-+9^yQZCg;{Sh35GL_#%cejYN zK3?F#*2$?He}qccG6p*oQ=qn{wH=3UJhPV5rI15a_Qht#nAF)Z>&o=*v_rc3TM2Z^ zfsC%m1$akh@gc(8Y^Y|E9zcK~faujXZd1H-YPQ4S2%+xmH7G{R|Em~zp8iP`^J{E? zd4J2qp}(gNNSlGxN3u2bMZXpx4GE@$&460nte@nnw0@b(_HEbhG$K55Lh8A#;uj?(0tmNC~B^fm@~)h5sq3*Owaslr|V<+#|;PwkdJnH)DT2qvBrTd zCbk28TnG^}x7da`{(wlP!&suki(C>}R4>*67Bm0N-pLM7iwq7+RVDNh9p)ijcn^erfp{ z8ec2EwbSdL>_hAyLs~1^(I3>^v#2-ia@)`#`uo!pbo@L$gZxE`_eKHUmuq6z&~QBZ zrbdE2x^0RI)mCs_HVHHyYL`_{5*+P4e6XX>&rUKpNouGnvl}m}EJSOE)CB@hOi6dcntP=Q1%ec32k_jgC=Tq;UUXOH1^ItTj6lcG`qlXh`H!2 zA>3_Ez$H}jxFFG_`S<*L7{jjINXdLIvhJGQyTj^UA#sX9NV|T}$YP2HKlo}G^5Tn~a z70;(ANZ3kN=Nh-NXyv-EeF2zF>9+P-1>r9^R5(&3&3jO!b~~!;!gUrZ!R2;_ z8$_0Na6fc11q5=5XRaw}lFO0fmmLD4bs*Ycf|?Kmm=V-NAp|vAA+GYC=Wyp}@@9|2 z+cBgos=FG{4$gtyeOSp&! zJ!CzVCzO-%s06_E&=IAJ1G&kLuX0ky8t}+Cgudlfy>R*ctdI0MHI-B zvS5z5?C>r!%Rl2UvqP^O>u+2^r^mYP{@o%EAwICQAF1D7-; z$GutiFz_Xx-sWcV(A4;@0P~K?(^QuBqzT2|8tcVWB_+cyLn2eW3u3>t+q zHCSKmxSZuw&|EZSS!tbg69u#10%=={D|z!HTC26v__Uw)v;=K_m*8<$*ne$z!q+RK_raaf-*~rkEyb=jrRJ7+vMjZPJXJN~rK6%>7bGj9idF6S=>Nfh4wA^+*oiXy|FeH8MC_kZ(Px+BI({ce zP~)*SH)|XB-d{g|OsD$3Qs~yOL6maFgrR2IUXUVTj(SZH7DGy$-=SacAi=p^E7TJx zql}->ur;E;h@N|Lms?VwBKVnDj4e!{t?$$40NQnWeAZHneoQ3TN&x*%<+QjEA>qK& z=X}$qIpq1qe2o8g13|f{_0vpmDjLY-PV-0<(+ePdu4%S(Pd%64@Rii2W70)bsSi50 zmmLeFlicJxqwHRqbuvmDgoETG<`E00=K)!#5>6YWXR5o^OTz?7WR(BpR{WJgiM_Po zgzGQtSERTo%9klu$msUbU@lgB$b0v6p8^#myPi2UNw+?6qzZYWS$xB3r8>PQ9cdh& z6<k?^z6?ir7MR}Zd*G5&sseFze z2k-dTk`x6T1ywI=b~U*&B&PhWvW=zyDMizHp#(Q9Y3nXz%uwa2`)A$nW)wv0xS%Hm-1@*{XZfp zeEgLqGiJY7v0gWwUQ2KPE#&KvIerVt?kp5-dox*of*JvQV%?d%SuD@5;iy^2R}{lh zdo)pSb^rMvicrob=-@4WWlGZ$_xR6MyQDrJ36y&4dHK%%gxJ3=nYRxQdeBgvh_PUH)L|2FJj?qm=39gKOU*p{&E&lM!kK1- zkvBG~r&(kRyG|3Mw)%XN_=2BxqZ#LbQTy^S2ZBaU zh%p+QAa~wEU7H=Q!j()??AO*t>QT$pDwY}Gzp{Pi7(b>rzxh>w)e(P*WAtd`Hx)MW z;iXLIBjiV|$S~DzHIIo(6TZQn$S`_^syaOD8DX2sI)$9*ws65tpHcf6pVl{;q6TM1 zKyJutgU@A)7Wcoa_a8mhpxdLJb36XPPZw`i<-0PAEwsYr_HH|d36;FZivHmP@FKby z^IwmP-7op~9yyWp$2cs0B`s-M+vGR?Nf5JI`GnowWpKyo@P!lwc$eW@^5~vgM!vCZNSL%NlumDFLZ6$+Jyg_i$(LHBw=PY z*!v=*&Km3^4(8cVUKM*V9nlf~jpGf-TQAL>7^R~?pxqGM4iGi?=dp#u&@dQP9xM+I zvg~96g_oXfWsf1YTl_GviVEO1crDruWDU^xDNO<0gn?3s3@8We@TLA;|CK20#JPmiYoU znXV)HhV817`Q(*o5-?nI3||pB_xWhsGJlZ!smL)>OT%KuSJrsC@Qj)p?4X-$VyG>% zqh>MQbdZdRR6MwW)E=`^A3`Pl*HME7VpVASA=G9#?d|SZpg5x64~!C8joUh}A)Fzf zIOH5D#HuIm?2bf?R?y8}Y>v7~MeYUNob7FGPDeHFKTg~M;OgJYkbj(e`w~r#Kk#KY zxliM!?abE}H`hhd9`t$k+y9<3=6EQ4NWQ8NBdgSQ9tO+16(O~jU*OVI_gC(`Fb0$4 zpoTxWY0b#&&FOu!;3G1cObbfg*nG6nmbLV4FXr)Pn8rY~e2R-P&>D24C7O|Lr0Jn1 z9!B{+MIGttj=l#QB>b`aPrd-NHNwiWGGSZQPZyq}xSLtKy0JONU#R-#7q-$h=KPC; zaGlM#A>JmCAD&Dq|UfaSkz$A{T$)^bgq4pp)XSO#t@VQ;AD2{_8zNN836mNM~M>Z86Lu zuO4aq@1^_s#RUL7o9iwd1y?4$ruz+pB(**xFdX&YFRLy~4=YQqH5n)viba`JL$l!< zqK{`;OZ<2`g4k?N?CGyzz;OQlL&qE4djPL zV%HkWnMmYxH0731uFCBOwu^SO04FGJ44N;J&G(vxZO^n!O1<64leE7h<(aE2DnbDZ zG)8i))4V(79pamx9!8eaKPhP#+P52GKYM~pgQG!{8!sJAtPyYZmZMwb`GMjp87HKH zoq-O*@Cqlj;+tbMjFkF-MxwjhYEgZ1dn@SX@vB9%`;c<~&Ngu@ZynxO~N zw8!Sw^c)P4oGn+6C9DA0)h%IbxhpLMm*zOi`X!PRRv^oBBqUuzlpY7jVufbCpyNZox7=&y9R5KhAP zHL)!Q>3w@2g&mVzJj$)tS`Har}letLb4J=19p!bky^6Fmat^qf)+#(269qB$!a zIX}Kz{2Sbeu=rZDOXk`P+C}m|}0v0tdp(NPkGNZgD}HeC!-0oT@L$xt3Ssvhf_1Z8d_-YPX7KIdQn5>>+;RN&||$A zF>EPh+s87Lvg0WAr^=3szmlDjB+t^p(&kygXCc&?C`V0?u>q0lgw@=z(=2Le+aa#l z4&gqb1!AyUY-Tw|cFsm~n8r~)%<|o~)P?o*ex^BF&vWhbBTe!{|AfD7U`nM|iHFnK zm-ZDmGrZU)c$@W?IE@-UfB62hJ5JsgeC0KjM&q~jukM^dn4sr^)WiKkR-l3*|^*U-|GP^3|H^J{HB+?-EIQx$H3oV+%Y8)f+KGA@+Y%3iM zn_?+BD!7g97hwaaK-;YLWmZ13u37Z!lKWr*0@W^`4hX^if#m{*Gt+onot}dC(S*u% z)|QZjASJkpY%{GRSt>2e{ACO+InO1LuTv-8fI2O}_@B}r|B=_)fB^Te^ixr&FOh`% zDoQ#d>gpI#c`XKBbeYR_8~F}?Y62tp^ArXGLfs}~;w7!dr_gVM&-q$lKx3JaVB4=T zu6XRgoNc7;f?%D~9<3uYQ*cT*X46`TV}@S>RZGg3^DuW|ZTAE^<4_-*pg>%RuX)A^ zpB?q^zf*qqv)qMW(vFPF=DBw7@KEbLh9xBWntuu9(ByWDe+@Oo3ec4&CI|S=EEf8n zE^k^mDtt7PM}XGP%Bk0v@~V*xQgHj#37b!WLzdeyo7*zRNQ=lW&s1cw$}3Yr1#BKA zqa1W9uPx#&H~e%A^Nh!#C&0BF6CS4^D<&4JePsmk*V?--+(4@|6qaj7Df_Z@gG z(4_d%6WJ&CJJeM~iPp0vNFD8ccJitZGD?sn@&;{!bVC8Vb8DZXaold69ZXT%cu+(j zmqaQ)Nw(pvRZ2-%z?9_^`cpk}s-_x|-M^z!SjjRCDklzmOriZ)T+g4g!f-u!`}TUI z2g-V5BE_wg)mfP+^XRRMe1m=r>#Tu1Z4k}V{JfTt67SMnHfpy@UDnN7;lzP??G4P| z6x+S>g9IUxMz;}3g3Nq=PCmQYki36vB%#q#8!i=jwk>K6XE;LEO5+bk~Mt%F`17-Y=K_XzM*BEyj=R8gr63v!=yHqQPQWEi<|2 zn5C*~;`JfM+WWb1#og_LNf#g?p^HgQC!aVlDxU#&;5M$JFBSU^XT4n7Ohl@P0yEYM zuf52kCm%eW#<6QXJyVBEhuYt|9TX}pcS@SARb@xng*#nUt04z_4Sdj;FxH~Fx3QP8Tl99&kK|(k++Y0Z$CtrDB_DApNjme>4Y9`;c z@oC|#Wo2WZN9^%RcUWWQ_IHaR_3+{DEU_vZ#RMrDO2R7s2u?aGPc5#8QrQQVIwrWA z85-VQad($p_W4f_hwlX`RdYuq4m2B)N~+qO`#Rg7NS&X!Fy?k$?m~7jNj-=D)$d>Q6JC1^`J9t&T!oz(Q`H15{Sya-zI-1p^gH&wHAEtG!^EF$%-Lp5DGs)?Km@+m{)i zrDb8fJMv!l@fB3-J-)k}N<63)7gW?m{)6{1NUP_5>sQ=IZN|22PpybUV?;TR>|r_N z`qIR|M=(yh6V(=gI_qAx-<1!2ixRcAKg{+cyi#7lGBK=0lr`c7lihN27|pwK8CiE? zw)v*9`^}{o6l=$GT)rLORB^N3m|92AcA0^2g7{s#mcDm%V}CT}P0SmZ8p#-?Y%jy) z)t!v|q{$lo_;O&!J4rK}Z)ocE%8ylsxv^L%2+AsECe$1!skKSrG*;2DUdZLAMGsQK z)!W=P>G(=M%b`76y*W5Zx+(QSuZ{Ma7Dy^Tb;i-iRl%WBQ;N*hYN7QXJ9j#tlQ9_X zS)rzFX_b9QrHSw4@muzBmZsXcr&?z9)ESR~;)U0_)vZh{_d6}mSp_$$1T{6|?uyYG z)`(o>_Hp2{RL2HQ4&HtEyFBPRAH*EL3el)p()Tgxl!;iCsksZ|Sx1_22Hn(CNwdf8 zvE`@k+K(jRUrHLhO#a=aebo8NOKWBa8!wZFCCQABaE9c^#^UGn_^Q;P&||W#z1i`X zluM__6X4?S-f6sRr5U=_hm}Ju$SB(T#kkt$FUNc3WYupnIcrd^6g<~6{G;#-dfrp9 zH=MgkuSS-SjTDAQMbco!j7jPnOxN&xmIbNF6HtyY*~Q>_QdOOWqtw&RDK#!}B0s9y ze55xL)A-z)8`FhWO@L@5PFsITUd)bcb8~5IL<%0@WtN!2x39b00rtLp)r8~AREOfU z@AG6lBF&ZAclzTS#cP5sNtW;E{Mpm7r9Gr^E3+0`RFxo zbR_p#>_w_Jm)3J$(%C_>Ez4y6C`Bxn?}J^KlfBNy^fu&e$n}m+K|-7&%4G4~>jY83 zax(NROy8$ov?k_;QFpM^z6JBeiv~eTmv-wrvYEs`I)3xFAIh*<2MlP|cviV|9B5B{ zElWrRqEJ(Uc`CEQ<&BeLP$yt03jEl0dGa8GYPluvS^5!4@>VaunlubOc~)7nNn1h3 zwtncf3{82ydtW=GRvrAFB=XY`6@Ri6tyO0x@k6yx(EKHGzt|CQWqLFTcCmWp(@=jj#;?ARrn}0 zR+bTo|0Hg^04VeSC*_PzoWlB<3T;nHa!+@M*)O_GTU@zbDJ14EN7~+Cqd8y7esqkd z!aD?*-Q@ON*m7a2R8qM{w8I}&gzc+VRcKyqXMi53LzPVVcRW0n@U|=uv6mM@X<|6PS#g8C7Da_44Tl>ky_E?vf9lqL=V^Ru|{m=VZ z)G`XIyfYpbUq;Ydt37Hg4GR1E>_sLM*uX{57>mq&ZGLp!!56Hx1czisRA#>==y_h_e4Uo=)@{Zx0j-jqSR{eb<}d=>bS+ZMd0pjLg-lS zHv_APrOeanN7zeQ%H(Kgy3&ZVeP*+svs(d^nWZpNEQ;VXGsQBbaRk3iUiwqmiTgyn zbDLunyc+6tx--#xK$rXyU(IUB)lkA;JnNR#OA2v^SSfw=F(5hAL}I2#5MhDKViE43o=Oj$I~&-(|7BP zW@2Lj&MHtp3}3u!ayJ#1;3MWHTc~5{X+6#uZEd?LAL<_&lEIfQdVup@(Q$;{7xR?r z>md*(jtznlee9Q5>GsgF3{IL=uZCeEx*;3x>StCf{$DTJm#50;?A_#lqH!-njFw!; zG8F`xrfIP1Jz?}y+d0+3iv!wcL$%aY=C_v#ur$wksr6adE-)?{odb>gn(!jt6`e)& z-V*;*w$2HgR-$|D)oP>R=EiaKuM^vEQqv>`yNpdZe~5wbp>TyUmfX^@cq~`Fcb+8L*ZH3*qF#-oxI1BL)@AbMqi(yc(lM`8#t+xIz z@-D)rk&Z2|FClf6r@G|T^X?@cna?=%a!kDMUPd-6;hpo=ujoUWh2Ja@FVN22Ye=OP z8b)KSm@}7-IG5^-3R54QER+#Lv!(|%wj&>IsRx--- zXn3|{B{bWRHJtIsg)j93uov_;bob`qf7n#BzMV&i=>z5xJ9^F^*Ee#Y)aD8)`@Hc-A_=AYYpS=Wis3`c3CWr z7sPh3V{d$f3>6~Y#LPV7!{CVHMA@l)-bxbw0up&yc8pP~om=`1e>k1HsKgv)kWjI} z5gR2MbsYA5!+7L}#Wr!$OPxdJ$I&1xYM*JcaQn>;y$@D>V4lYs75egSL2M^?L0D8d zSjo6IzMbY=Z`Ht!YfBPkou?Yx93j+#3Nzx7)pqY`)r@LE*dwC8Ii?@EB+!&?86Q!Z zd=E7s+LB(_fnCW!+w=e6mTMJ9_Pt8vsSY(rAN)-^Ps>_G23!4Z{m$qu~>56E45E zzZNVd$ayQwH@`i+ojA6b!CYPeGICMfr#d54hsMj6i3MnJfq(6ixBA>g^y6%D(wmvT zLN^#jCTgww>V@>*tsq5@T*1b-;!@=irG8?}ln=c;yZK2;uwCL3W+IK#D8AY5?nFXo z-EnPxT~MgO#6a?N)Bl7nm4<-no+|0qNDeuc$E>EPiuv!sPZK&xc%k7K7gXitj$RBo zMgd_kUnFt3!xI#^*(`Ou|v5utx$AkwP2?=^1-(z;@UD~|1* z^StaUy~22udSO(JT$G)}^T7A=G|>*scubx2@y&+8`Gmg|66>h#xWdJG?dEGP+rU)L z15D+33Rv2>px$AV!?XmdS%R;Bg;rhTdd5Z{=J7~Ul?$KiC*a~)gfUq8cG}gs5K4-6x@MyiCJ|}80`?QsTarD8DLpDsfF)8l6@wM~jkW9QzqfAun zCEbyVviCW(s1z@yGKLv=>gw09+t|wtfic#NnSYr*8HO0#$rCdtd5aW>D8PeD_z`70 z(BmV@cF_7i)8R}}^6wjajopWzVkoC^FxcXG@~1vWG{o*yn(8pxQLKlMOCg{9!)>2# zim-Woe{{{T+R3mrByv>)7T) zC+qA$bMMJ{59yQZ6Am$3xqDJXYo4mUT;-8s`T3mmoiXKpj>CaR{IgF(#fdKOx)aaY z7tqZ9NwKk}F_G8sDd&htp_WW5*e^mou}+t|Lh=Yd#7mZh_qCk$Ww^h&FX2#t{{J6O zn@(1bttq*!v7q>z*{_DClruOxBbVCOtGo3l*boIZSPd{;TA+Fk3^N~dy^5XKjx|!a zX_M+ps3g6nHyI`F_f18d&F$SEi7+&4Uha0o((~rNdwSMGt5EctKc4kVo_UcXC#-Y1 z%eC>FmFerWiMvqtH@)!XNF{9^IAys@bbV>xj@mG`Hs8$~0o?xzUhOu>F^fvm08f6x; za1<^cd{$nqQV;Sd!=P33jz3L^IWF6{QjIh2+uRWiYN;EhdCYy6JsXg4eUk50w+qfE zzz=Hs&g--PN5PRIL-AcIb)f38CQ`!K`ONenF^m_QC*-I^OxP%GFfPfs5?O2;YIOpX zeLWH!1L3JyQT}Dp3m&iyvx1~{CLQ5hj@j<&kj38WEaeD>L>m+gjJ{-ty&iOFds z)^dcaR*8fu-6*m*DgA6aoB{bp@u|eI95t^Sdwt=fgRk!w`x&h_DHn5Tl9Q*BlDXcv z?J9XEJ2k-R^){4={?^c*nLcKOzdE>r8n{o<7FYOMM8x44N^+bfg!5UOzDTuaP%Hsv z!d^H>>L&#elo68z8ltm=&f57}^@VSiM%BlzB0OVcxvb%)s~G#JYWw5$f0gw(_n#ZD zZ+J?fq$V#is2Hieh2nJXBXSLTSC;TJSr2KY)fHm%7OB;azJ1=z%HTL=!@B_T*SbR% zINp3%4c|fI0M)7j>4f%0bGDb7(0)w=8$xB2BhV{vL7M&RZ6gU-NrnYQhP4=RKG%WEsFb({fjp1=MKWYIL2W=eWd7>)3A%W zoZW(5P{{3yHjJlF9^?EL`hBrcd!40KT4JxR?bBM0!o&1frnXo;GojKgBh;V*iq2$a zzLRIz$r`C>?lVmI7QcW?*5W9X@E?Hz{v?;Hb0sgZO|CNTYB-1_yg^lZRfa;TGk(-t z4Rzi6J9I?AW@wf8&i2uY>S`0xT?^Cz7s;L|aiW)gpW{8+@4I4Ig80{T*5LS?5pyCP zmwZD*i@7}M|9vk!6x1N~fbNUDi=oV5@A7`!m|qg=7%t&aLdI*WyQmt>&uoz`?CIna z8@z{`T3KYX7>v!-NhM@`5oKf1HozAEcN#JJ#O!!S4aY-0OdZBzK5=R*I;dAiKM-Bv z-6KvfBGWs8419h`XAQ}A|KIxZm&+6S(XLA_RRcI5$@Lr&Z3+{jHy^{7!u<%0W@X9$ zKHgO(L^w0smWCqbli@atW+aDf@@sxzSnI)&B#N2!N|4RnFmhQAb_I2Ibxfi>^(FA- z@y*?v?VPD>UONGz4Nuz-lV6i*5!3l)YtOuyB=;E47jDnsklh%xr5+7WTRQ6|?fUy% z0ymMxP12n8DY0hrlSEZP#=5c5P3SBpWCI)W-5~q?6Br6&oI~)ZsAlthj6~t3=Lt0+ zOY^E|V{lP?llOOU5GwvycpKSL#L#f#i2Hc5@V~c3;Rq%`TnlJw!#C+yXbm%bJNLb3 zH`Hyjx`RBJ6Y5*#eI9g&-2-c?Y_rRT>0<2?uk$QT{h+@qx@+N!ASLwNOYZK!M)4YO zq|*BTjN&J#z$jkHf{-wxQXMIYL?(c8hA@mvT@`mm2xBF&r2>0|mIVj%S+GqX4VH;U zz_`Q!gNN7=Kd;>cH zGY27+U7&h@IHlJ?;6g0hlJvyX+A?qh0H?D9T?_`P~s4N7iB_Jv}Mh@xqK5q;Ht;}i**njTB+4RI=t6U}& zb^Q%m18e75hGrz}vK*^AQVq1C%eFM^D9<7AfjgS-{~lqSJhE<4o&2c#>i&!(Xk8P% zZ&+yl{$WLY{b#~=x9&0nzsiWXv`@g)-AL%#6H#{CRvm{ZQ;)of@sYZ98;}%9{ifJR z#CLry_+ZqLn8=*JlJL53B1`9Q=CeINW5_F~U#23A)!10;+5RpB7~l}`bg~}ZH8sHd zgb@#XqNR2kFw`9#4^4%o79dt@ac;Dl2Z6VXba@^6EL; zj=T2kcNv*g0@<}Wg|fav;QJJ=O9NT@;3=Ev z*njNu@TD{Ic_eGGYWw2?@nk}4i2ZT5fGMEjrt>wr8?H%AjS-!ZbtiOA#~}_g+ub~O zi`j?9F11AV+9P@++lI&aq=$dx4q0+P<97j`N8h1$3Jmep*XrQQBD8Rqca8)AZY_BcVH2c{MB~K(hCm$Ic(iV;a$LWmt z3OxZ|Dva=;GP+#x2ob~eWpl$XC_+v_=?lu+kpJq6%}e(2s1rYKdVN5gw?_0>wiMg)?q=f*coG;{C zZXxBgblA^B#xJL%*|#J&x3Y$Cg(OT=CwY|O~K1pf%()|j(xLe z(A~Eq@Y&JyLatoGDgP!Zp7uv>=M&qW6U3(M`ol&v+jM<9Lw``B*VOF}=!VUyaNz#O`?kl=p)lrNU z)8qVIa+*38-ZT1PVGPmNyDHq-ea7uJB|l;G_S&{;a~9Gl&>J4oBE|Ac9uIYGo}PvU z$iy?TTb`37&?;n~CnUuf7H^5QGvy{96!IjJ!^4b1{>sDKe244X&RDBK=2e<-PA4E5L1!v*vJ+c^aUw49Es zkFX5`=ZGqqW|*z{f;*UyFPY|N%XO0pSsJ|$e))&r1%yp2VHiwCJGI3}YsR)X z*E*ek_PkDY%F%1R-i~97s?r)49Vm?qdGj;_1MzY?pwxEc&XdErj?1L6@VyH2duQW0 zU1rLRq$Hf-k@C&j4^fyIEu#WoLyZBrkb45%7v9+0@cBMRH0Mf6zGCY8zt7PZ#H%E3 zL-_?D?!B`0iT|5YCHG}{AgM1eCtRCY|3%(QQ#yUU+10R*XZp_`&CBAfXL!~3YkP|7 z$Hs(;YuM#|^ATFcgM5Bf&5wdxtyU5(oDPEZ)+J`7v+)$43tNxVD19Upbomx8?Am() z4CjJMNntJ9dV$hDYyR}sPy=)p0%MP_0ckHit&j3{4&7uCNm)~q_Ub}nw!>vh0HR@J zo%yj|u7qgnQ9xf_3?e2+B|TU?UT!SG5CmqVdqm-Se&z-`|RG{)F_zfP* zEie%O1+{>m`0!}+NsN~Q{OA&i3L zR>5i|9fNoF=fP!=&H{o{@M5sOehyu_-Nu=B@w_?Yw}j+3%k;J;GE{?A{A@jwzHZv_!ifZuvHV*>xZ zQwIdPtRQHlJQ?w;FpH>^DlvmU?4AiNGxvCyDRsG={BfK)aBMs8=}j+P6USD2WG?}A z?GWG?C_d)^M5PlzHcdmM5!g0vq?|9)=lGZ^G)4Ji3T}T%_=LNyjmA>#YB@t0f6wIMky7dJ8q|`4S0Az8iCDl7-XL& zx)_wppuD&uW#F>+y^IiVMERRNZPr`#fA~I5TD1W8=B|B{xh6&Tf5{*MQ5aTuQDT?> zC&=s-T7Vbho9=4X{KPij8(!^#TAm1TB9w1|)#!0NVN|0rpkZwv_#vrr^&wg5a0V*? zEJfiyz6Gp+5v2q{k?s(r8|e;7L2}d0U7zQi|F|#rj{9<-&eIt~zP;95bN=QpK)U(> zU96C?zTdS=1^Cs-!m8aH%#4PBC+IYGp5+4TKWF4ngp19?i|*eu5(Cc2rM$IobQp9- zT(F=s5`D%O)R!AH%PHci@!torltBR$uqYL!zHk3_xJGbQGlfu}BW(mG%FC9tyKxKZ zC^L{_Ut!LHt%Wnp5_= zRXlFL8}B!eJs*I5lY>&Jtb%4any*Hn97#S(#H$Ets8m!<*sGTP)PDmGnRFG4?Tcft z&+p4=hgkplsrSr5p&DEUjSCe8?d5Z8TdEFGFE()m1S34JP$e5X(YUH8sRTZ0MGv^J zpirs5wSY$i2{@-+S>!VO&kt>k@-huiGMh0%3?1p~FIIm^KPIGLaP<6My=)3bUhv0w z+f@s?!3oIS#T;yhx$rQE*mm{`m|v=mgov zez&K7u3iTohwIa9J<~bf5ZzbmFal2j)@V6QD_IZOvz)K!*53#i`rf(p{iOsh*5sgGJJ4&*egIJcd^f<$j&)en&6q%n^{d{i zna__363`&;;)mi{-Fss39=|<=Sg$Ui>?~~Hap?Xbo$({>${a8(SO-Wi7v$ki;YFmC zlG{i^L;)f*UHe_ZN}G%jLBN(RQg1!U{(0-R(|)gsUzGjzsht7$M?tsh2H$>zeP8c+ zVRYcXG-BAHc$k6%L8iBBw9Dobh~d#Z7xNbHo%C`#Ctj+}JqZbBVU zKLbRTxE)H&4R6{rpy38?8E=4*q_z(ZMiuxlc89e2i2r%VI;DYKTJ)t&rRje!ofsL4 zMDGL4Vw27&EBsIl$hrfvZ5RL#^y_LMV{7O1d=9rXM|m&ZGTl#XJx$=RfD1d;NX~s> zHI;KvRQZ9l$rT2bv2|dS%=z)DON6|o-JisVO64*Pbs=4|z}I5V2IPJ@_2>ctL&{4S zO)=8Dxnzw}@E3cjM|hMMDSlX1?Izgo1~rb=>DdoYOT5=zbDs?*hBz-t?E!2(V#U ztNar2D90c2r{Bb7IuKNqU#OXLikt>3P_`z>_Ho*IRB4vNny`C_e-2notuu$jV5BLhS{j+T*WTnr6fgc7Qs2$l zUI zK2f3k-jxpt_+Wnb59%bor&8VYOZo`-tnvci8(w00>iK%4I=D)VU$ysyYk|;kz1Lsz@cLE^Aj8NVWAW=dYe2mvkp0VMQ=yJyQg|tNSOEM@^Km;6ms+i7_`lJp!$Dh zi0LGGul(*8nZL5jxj`~a}N(ts0F(*Ui2sP1=Px2=f* zcD?{Htn(3~?pjdh`9J_;rC(v(Vq<=^LhbkcR*Yw^gowMwZugpZ&Ws|?2F?=7>qanl z`q)Y`YHYcHoH}2`4rR5&rvqcKq873J3 zAK;mwQH%&NZrY)O`-A4~YM_xDL-JSkdlh*!I>Pj5vGQQ!_(bwf;MrW=n*qR?Q5!x( zveIDLS~R&@>urAm2vYfbYQZ z#ynApuPj#wvj&=V1vQYDKIZTN;QFaQO6&Td)mBNoFJ6;yiBC4cCA!sXrU3lrgnr`$xuo>PDD9+g zrvl`IW(=yv2cFfMx#5Lvlb7LhH6Nj`CfR~$K-b?725~^@N1OL6sYN$&3E?^4;Gm5E zVNOK6jRkenN9yR`9Sk@}KVU&g*IGe3UxRB3#RJi%NtZkBm*5fa%0>|zm1Ju|*_m~~ zICWdSK=f(}XJF6o*2^o_j~E*=P!?X3_|q{I!~PZqMge>F`VHExop5)S zZ>0ewApYVUlmffzDPs)L+Uw}MS_j6-ygK;_L>ZqZfUu+eNgOh#m@0quECV(Q=`!&C zDOCEP&{iWa#=(P$6kYJkhS;H!IzsF&IPQg>g!u*DTUv}tI-ue|0tu&Fck>i4(U#Wi zfZt-JjEYbeq{qd=do>-7bbw83;yOsO7!mrivuC*~%&T|~#I*5IhP-P0W#02mtD^sN zy4~x*vSjWIx6vREq{uT|p*l6H)hO;k&RF4-cLO+h7l4atShJGX?|!3W9L`|#MCkhs z=-{{@T__tiZrD9+a!c^Q*8K8DlH@uz?t3BBiv=8~pa;}^{FO$Pj%DH#(=qU{53JMO zK1zFWc9;W=zIKe)Kag>zR>8AN0r|$Zhgh)(+@t)|O@<^IWLEuN28cns-bMZN4nIn( zIA8T$w~RZ5jPBB*W^l0VT|R}+(XctN(<-;>5lvMs3epjmj)h7>FD&=CXy^HFr^C)b zVV^sK&wy*M&N^t=xZ6UoDkAHzoXXv$34iGVyv3C!n#vp`Up>zBJ_tYdRPj@_Gg!gP z9jem<9fT_!%jdyGC6E+$f$Bu*>x$R|-SR-G7xJ~>!cMrPUmq>iW)}lz#x6)MQYd^g z`{t+cz}S};w)z`aL({`Vlt38+!E}7U%DvGTQUM3LO^IG_s+^GOpMmHS`PtM!3MZ(~ zfwEtB?>hkZtQqUwW@s+%<7l4y!|;V@<&MzNsKtfJo#iEI$buGf^!94(yYtifa;Jv> z9=XHY&_8#Bf@}>rp0@2GN1-~rb^wpx?7{4v+sm#g|AXutS3$)`pu(4VPD4i6F+@}FrF_wAD~GvmubKNnI-O6t$lpYDkneqn zir)QxsvpTvZ_=qIxLq13{r)t_qSt4E#?^}$SYeJMH~b7dR9Lv%T5;I}={nI5*{v3A z4Mfj-RA66oVDF$8F$1i!3EeWh4|@16fg$S@`#VJzjKe1I-6jW(_Ss`j?b>}7S$0&` z2huHexcg71T;Q>5-nSdiuI4r7Tw|5)*_T6xpYwIWb*$GzP#XBf$&QX%u)<|lLiaFE z)9{heHkv$1Pv{=(&F|g$hEx>>?>jx@1j}lNz+&U?y)<*i zKg{|}R{=1<3l^4%=gW~C#%8?`!$9>cGK*Ta$3F|V3pd7yUw&$VFppkmxjw+y;`c{4 z<>-4PgwkJGh_9z9`Pn$+eh^RTi7#P&;g?q(QpMId*S9*$bw1W!p&kmmKiDZQ`z!|r zK+)`*uNisFj}|>AE<5eCaGlachOtbzkpc?k2xp%i+;{@Xm=*1QKDv@kWiPZiu_ z;%sOn#VCz1aawrfsn^BMTnG-vAS1Y{poQEgxG$)2X+)N)M+AZeIgEXsHnKw>nppu) zvOiB$+#1wH_rX=M#+uSieae+@{QMIPO`Ew{_f70gBS`ROf9eVC*C_7#S2k4%|It@o zh;!Yi4*PXZAyLFClfBs1m&KBMUS#jnr|$`rrOUo!SSwzdY&9kDfU#P~6`SU8H%S9( z{GJ@jx_fmeptr8UkXwE46(khZrLT3=_8pjrrLF@9y9ys-lY1BZ2K(JNtBEQz^NiFv z-o{ zn^P87nwLRNQ^i%RNG5o0(xR|<_rTDIgx)O!on9YqWq>=H?7&j6!8LaCRhp4wDaBRF zOW`8s!Yt?Kdx1BfKNgnawlL1A&t#Tv;U13hERk)_*w49&I<3kfYdw+Iv}rL$k5{;) z4)1#2*wHY#`azn!((!^J9&C1fSg|cf)~i`9&G;F#+;c!dd>I=dc1Zg}Gun|S@{YrL zZbHuSH^ja96^PUSsPLQdcPFE;uKn0hGIr(8}n`DXhv~Q_DNHTa(gjVwMRp zc1y=4;1XW}bsh1<;+{iJ!5jhq+T5lH(Kj7r|aofcdP?xCp&EPiVD zY~lv*aO6G2YJScoH7EP8p z?M;d$XU#lKDK z@CLUEH=3#}r9oh=H_&CwpMM^*A3hBu(rLzYM_&LHa+^QA>4n4ZbmiuVe}5#_oA!M#eAtnCH>h-Wv#6!5 zqG%->wMv(CjVABC12 z!bp+aDU&6KYGFe6DenbJgyfGMmYKo_-WbpmCLsnCDjVXC#`(k1Xn!(5B7GzJOs&Sp)aR?oB(=i-A=w@Q=Z{v)p4Vo2t zbKgy0%9qvH6q^Q#ORl>-Dfl-vZAQZW>vyK^^0adjXGW9ob#`Ja8jA4#cU*0lz&P~A zS)Pv~-ht)a#&hs>pRyxK_p^uz78#^6w&dVp?jA`dGOAQd(d>o~hD#H3H0}qW)X0u} zOLAaAH$CQ+h?B^aX#!C{AEbB>fB)nMm{NH&4J?*YcqZeMBpoFX{aJLaKJ=owxEGIz zlf*6)rNNM&)+@&kl6C#!BrU{xLC*{;J1Ps?V3>E82aZTFac09BIW?w^-&v(-*iGnQ z4MO++NMDB`J4VuBxOvCsZVTPn?Bk%?Jf{q)dk93t46**m_p}2DSMJFD0G2LMQe0Gi zS7i(c35hpucywC%yEttyJbg=GM^Xkgk`mORojF%Nrc`c@p=_Hz{kMF3Ry8%4a{a%`S_rjcsO@|SuR-_G;!t0b9~oWppYb2qirqXF2`OaB3aFp&G1l*N&@S zpaWkJgNY`B25ikXe@}@g2z+F5{}EK#hlIQRIt&!3 zh=Gx~2ti&&_%HfNf#T0&c7NQB;DYI`v}$D|0Np3>J0NRN4(?$h+HcmH$}idtyJfhd ze(N-`pe5Y+V_cPj!B3;C1QURn&w}E8v(29ZT%j zvJ?h$1xc=A$>%LeT5W#s6#IKesI&4^QAlz8c|I9bF$_F@`ZB$#6ADsam!IaAP&!WJ-hNmlr|geWmQ_>NJ~6xIYuBx{{u_rIe`GYhc0g@Tdr^Cs14f3C zUjze0G=udrnysesS@e`LW;8n&Rt?QGWRgkC=Mqv2W~qAHwtu<>{lyaS4wAmBcKJP> zD5k4@UkSi5Q`#ZR>-q=8_CD^Fl2dnI1C+bwH>(glXV@fGn9xgc?cw5!;Y{%dO0;yJ z;UX0mq?#2tvrV6~4ss(P_#Oh?Zp zOvBTO?mJf-9io=h;0D5{6DE0u-cZ=TV3MQe{iP({`%^e~WdAlg@0N_jU*?4a-(z)c zKItrB+#$YcN+xSca6jUL#4H;>JZMUp962!8F={-l#pod*iq23VUs@CPvtMfSF_5f*D~tJ%37^hZiZ&sni8;88HEiFAi8JQD_k znDVm@2DftJ%=s_WkIJVQl#+LNksE( zuYJ#!Ldo_mB3Nv<;7KPwY3(KEeigZ zO?*%M4ukUh7OqH#KGV!1E5uWV*}XgIpiXMfZ+WID)N>5=x!NoXPeyl57~mRIv_~fr zq+AB2j<+%OsXX1JZwP)zmU?L@Ij<+Jkhe6?bKHo)wd6sySfR;fP(zs^x@()b6Irtk z4Z{XBxTG9@1YbogtUMy)V{}Qp8caqi6EI16x=AmoAA}LrSC%?a*c%d4O=l1pWmBw< zvyuon<$|TF_4dSjfJ>^V@3&t{5X;ZzNi-%f$egf87@dZY*@e}JE79uXvh~2y-IU{b zIcP{VlGC;ZTHiP_NH97)E61}lVLFn6TWX_}gC?}gL8Rj>P}+Q3qyd-{r2)H|F1#Z%)(vDaq0T|p zW#f3w--92EL}DG6fe74~LN)%OXRGkZR9mbag;6%YaW=A_18hid35CUK2_FM($|FVZ z^U%Fz%gCd&W@lhkhe^!&BSu&f^C?YuG6?%Y0`=w9Wt zQZ_)z;#~ozb&+skveLZ2hSyQ$0Jxh)e@h0V-2w7*%n0oR0*F*J|47BRuWV!=PbD@w zSd8w`6EX}MwrJX+CYWWqjX@(XKd8=U_x*?5&kI$L1)lYhF&u%gDamx^S*08voN#MR zD4H9~6i71w_*T`ayqqMtPcVX+OIa#>Q2JJNwgf7nM)dty082!$EZii3E-QAi_B#jL+(wylaj z9bS3pUh4yP_$GR*P=t|uf3}lTEULhmyqv)X4x&0Xza8LQvmF<#cwbSMQfy}tN0GVF z8gr-;xTJhDmULty)>pYfIv9!98ef3Wau57U&8@mW%i+J$7c7Hx&Wrcw(?xtdT^aBs zRyS4V>}d`a2z|wbI=1-VkTvF-lrTp)c!7^Jjr#dzDr!cybZNg}3l2IQ2(fn`jZu_r zP7Rv2V4YI`rtsXz{-C|rbdoD`yAQ+UDj{d&x6)Emhq=+Pjx7Iiklk^KEJXsHe`lz9GDt`Xqe(A?-V+~8c7y%OovZ8FlLjsN9snC* zVvqyxtnl`OhaJP#V1Ysh9&vMDPi@!#9`R5yxoHkcI{<+CG%#4z{Yo;?BxJzQCz!(S zCqg@9Qp0syI|LZ6jmG3h00z63FLjx$Q7WKEp_iM*t?~li+*b5t?2Dc~C|S&Iv1|3N z$MLuZmYG7LLff;ahTSMgpTfV@r+BTA{|30Ga7Nft&W9&KG?Y5r3`J_J{L$*@lK|#Z zZ&BaMhOLT=&6-k<@x*{~4z@c(?sbHlp(ApAWF3MiYI0P&CrMUT*}1av(WOrmJHwbp zNUS9vh$B8eoYeO!0tlzi_72#8PlELU3tPeWT~b*v{73}eYvl0&{a;Zi*6s>{B;iW9 z5&uA2QQTWDT*F_ivij~zs9RcrrNqbp$e(&hsviuwpnB=SYOcDu^O-F4Up{Ls>QCPH zJ_5_pvRu3V`1bwjjiA|Ly@q$iw{()tmkU?5l=BTf1D;QfSbm>lEX0;vGJ1S>JKx-} z2cOtd31#GB;-tWq$$okby_Gq4oW7-xYE=PqyjWkMacS8M)gc!e@6AzSHkf&SA>VpQX_vTcNH+r@)FL;R$rpBP!gCVU!oXaf6&;7;*q18x zCHpNPpwTQLY|Y^D{leD{7tr#iNrGCcc8#o?7P6b80U$$lnV_y%XR61YMQWk82(}NU ztTMGA!B3#dQ)-Go9rEeI;SFSDkgQ0F#xWfJD@{(Fji6>f&mo36>v4JJ*26!9;U&u@;R#j4z!P z3^fxN!iq)z+R2J-(E-e2GSMLtPG-V~?DL?foFIcb#^__R6Ab?@V!}V0Do`}S3+)_p zNDsai)zI-_HF$(($gI|Tx+NiWj zZ2(km@Cc37QTv!!%|Ttqg5mDV$gIx2Fi`rp!&LOPzQK6Vkg^d@-=7ip>V#1w86B+l ze9=d!c1kvhc{@EqQ@~7yMR?QLO<@d*R!21b`C7P5{Gmgu`0*mTx>N6jJ+2yY4Yzsc zWe7){7;~a~`CBp8l}pyvZV;nH>UC-)vgCDaNbUo`=^0j%!^fhAmuB6qt1BkrVqv^d zJJYS$j^L=RKN!cgGZVSv8<$6YSxdWcKlrGvRT9D3Dil*B2aLfP(Bfqn=dc$Y$+#W9 zyVxL9$h};3qmgBHjV?-NezIQe)4dr)CF+{I#;35p4EuYD9H5n{U9IPb{I#6~SKYlT zUlLu8T8Jc}e>2wvTB_o*TylO&G`kD&cE&mLV_pxK+D78kI-!v`=5-N^ds(ZYN*#$? zH*FSJ!5n#)rxRQ}^()jK=BST+PV5I+XyCm{6#ApaC$z~;c}KAOdEDLoli)0S9k6#^ zejQJ#Pedab3abHIt8fzD*DuLq@d@vUD@$|}ePq~NYKceOr)SA1+svS{Ez!@x{Nj0#j@;L{ zHYQ}L7c^1wBmyHiO(12-72W~pMyB=*aJ#g8r;q1M3!|5(dwUN}Hbe^;TN`n{5G(Nr;PV(DM3YIAZ#TYjFZ!)4$)g1 zxPorGHueocIyMvAPBa(HNTrtO9M#=`#jnLcV8k~bZ!dVMe;lH1gvEX#iQds zYy2_42(d_r?oH^GrA_hgLp32otu(Dtv?X8b11y}4OUP^zJ5k6v^q3a7(4YlAp}U4r zE9xYy4ADuZlgF)3Mf`5jbE~LqnY4roa}KU?K4?fK{RiSUid=4UH&AqeWJk-kY)!Gv zSkBE_@a=X4deIv749CnbOCcguX*u?%YtXq_GO{Lz)S%~INjl=R5M!!#MgWoynfYpW zyelg8q_XJsk$VEI(US^o*RVzTcXaDV^fZ78Q*h*Zl-|6{w3wxQ>;6a++x zWtG;Al1A9ik?Ck!r*Lyv7Z7sDk8yh4y1&B&Uv$@f$2~ipY`z)i)R(1Z;q(Ps*LT9d zNi#f&HB6+Wsi|vC7FklP{@!L{@{T+4>(9ZX$+nPLfE*AXbRLr1!JFyO$1C?NE|9oy zg;%PP+?dH|DM!cxw0+3zkXgz`)?aFhWI{?!oYE$T*42*h-u&Z%Oi@ujiH3$J@&*!_ z*w1lCm~#iLMn98uKRdWSMX%BFQKAfZur?2R9h+uFAL_{R+E8B%ygN^sE*RSNIO&M# z;fCnYAW7D(aOAjg2k>p4E2BJSsaNd&N(;cq-MWR#;d{%Q%|MLk+W*$gw_66bf^=a* zW9SrJhOCTKKz05`*;5WUhi1eUc2)X+@`L`T;nNjcT>p(e3DQm$+(l|lx$`-ZkEL2G z`Py(h(VH{;H|uAS-6IjK5gs68a3JqRaY7$M7Z5wVwc0^eOMmkEt@A^SFa^BZMI1R& zsJ(C2Olq$sga^F8Ml|~+1KXQRfYwY%>;0_2&7$BTT}pY}@P?`B4Qr?AZVT<*Z7dt5 z!5Um0bSD7aX)hOC!>{{BGs*p~5NMZZNIgXN==wJ`r&{b7%jHI@sLZOoE;KLT?H{++ zb^<;C*3Oa&5josfd)ZX&r7>kgE}yPT|?udv}{3Z9z{Z{0NDH!XJ$7D`riFQ~lFv zy>7G}wP;=P8(%axs8>{*Y{RxJzeBe@1;wQhSmDD8w}K(_1Jc zUljW993Lu1t&}Fe2JSk8Ptr7IyR_=dNcdZ8CJNPrT9%pGL01CY*V0$+Obnd+4YQc? zdi2=$F=!YaqMs-ds@hPycNjWwtkK}8?}U$paTYHZjO@3o;3L#S9-D!f$I=#6T|?(A zA>uwRO|a|X%HrhmJm_IGDWOeBb?2A{C4;SwCfuQq{vJc5`(AP_#SZk=MoM>gcu5RX`0)E01)_sPRz9t}ul=scX3 zAbX6lP=ZUSh(jeZheeqAX|@%gVDmC)_FL0K9Px-KsBP~emq1G>3!FV&VSDLXO{=V5 zj_-&lz_|O&bpKaNS$-2ZF14c;<(Db2HRrzWGZZxvA9fQWPPaoxm&iDO8qU#t2~7uS zx#C@3SIoCjaWb{RoLIwm6Y|3hM0#T@?vUW)vRhx#o56p6PpJ07JRbfi$YIt*xWjky zoagfyC~jLlaZnB+S0C&5%CzQRKKx%24xt+;zZ1B{zLc^^Bzcqo9qETD(w+xtvxrcg)UduY zZh8K8V3j}ZJ#UbXZ1+c8@b zKy-{pDr#U<`pc0VqQRAWVXo%E#Z=OKbFq%-qT(Qnb;9gRAXb1!%@ntiN@FS59=O#2 z3KBVDsP`*hs_qY$2VL%-hHrNhG4n%>Rb$NWiDfV$Rh2X@a{xwqBBmqSf z-4&5Z7A%zy^x}6>wWeMTaepzM#fn-{4BKyoe!!@xG79^~;t`6KUT8Y(`)LZx5yx91 zWWYB2MZ!6~S%3%K8u|a*tw~Mf&#-&0zS7gm5DxpZz5f<3lgsseZnOz{tP#$hg!|Nw z3hlhscP9YRj&jp>jcHB_6~@el!ut_ zfIitVWtHWf(NOLO-PCe1)jvcYn67yV0@4D9vk0uO$cE|rc7+_ON=_? z$`ND5GaCHyK@PJ*_Z|k}!V)}ur&zC*Z2@(f3k7}kU$*aexyRxk3yXT71w1mf zs`8?CiSfg=Xn*fd(R}4v##u5N_;|1!!0;@@lJJakfnUIds-88=+(wsCs?_32Yl-dR z+l3STu^ytyeik72esxWu`i`4h6s?jenEO&xpJmdSEkAwAdtnjQR{U%J{$mYbr-5L< zACIn5SIkNHmh}!A%tsVs1>QLRIL6S8?a!b43oXQ=!!`Bo44sPZWgUU3?&=Jbv-=}N zeKDH4Cai&j*utb9^l-bDfE#lA(175hx(%HULE;s($v~0|(Pc4*6@f5LbAQ#l0=-1t znAwO#_b7-)vtwuC>+O4}pXV{9c;8^RDvn+8;J8aqwM2 zsu%x}1T2B+e+p95dk`ws#W0r7q^^GHiU|f+khc~1$#GTRJ56U+3F8Z73l`~0{dOu` zB$^!?q`JkPV!9hBNqF&aTNW767S2l&;&W__`Rk#@zrLVu99_mr5Ou?rF$fq4Kd4)D zC2TF1uHRZx-*4p>=A&9%@9>WCm3QT&@gCuhb3PzvVVHk3&4<%VDht@9)S!a%2O~@w z4nX|&`@B!VD()jPzuVl1=T+Zlkp=wN!_(B;tF=PRZ5^R{H^71E%cAjiCVfKwv)Z)} zd#+5BRuGGio!YrCJt`LMiXm)OQ1u>vXr?$1krmZ2}oGCBmcJi2|H zgH{6<1{r#LuZQ4jtok+kuxhaL3=JSHUDlHL+HD+LE0phjv=ik> z{Av6}fsQtno>CKy9`R;^J>5n@-xrewx2zA9yoy~ifHgsC6?Fx&uSdo90}OlJ5~~|P z-1pedk`Z@{NLxT4yI%bmTjpzg{Zd1Jy$^Q@k8sN6%14~f*Iz6SeiWP)c%zo74osfR zSW}$~O=lG{3qmwd65w*Qb0gTpzr#(ZKb>G0gkn;+Ydv3vJAUXDWQ#e6m`PK zrK(sxy@{NxM<&A*38@Z!v=TN$+w~pAcvb=V4$dF#JVsj~cyJmH8lVbMakl3F8X$?R zw4^kOrIu39v~h3uOT%E-gdkW=9PzuTvX9iW)8SCi=?VXW#6B&b*U2{Zk}F7Vab=)i z;5m2{LceD&9P;49_yn`5=@6e5TRmy>D>zu4eN|E4%7X#T7&so%>+@$SGS8;^L7RRo zLyOPD-T4<1l#|KoZmQ~TOdK96j1bd7k??Vz9a=L$-)xnWo|QeYD;nDQkv{P9fWVPSp5FCIDM)4W2^a)36>9J1Ia9;>)hSVvWuXpTsB5c&ZxJjWiKPl{>`+xgRE)4iQhl%6mz=$wb zEZ)aD-h=-paTt&9J`zw*y?-3yY?NEL^NG}%*RBxS%RZH{OU~C#_Z*9Kc(zGBPwD>4 ze|;&GDh4BxXaFc;NnionD9o+w5idR~mMyriy{ClKJVGb{4uEK~0}wkIB*~k(v9WRR znoxIwKOl|o4A4((KeC@YPNTYj17~hlos({UgW=LtDb7jNIe8!QvHt#B}nxv zZLm2%HySlRRc~i2p;Gn(33CC^reaP0weY{2il-<@U;AyobzN;4+|DSwP9d2BcA(1N zPpD4KBo)Tt)QZmd&T*wP4ak&c9jJO}=ax}VA(kNv2|!Glj zQc9l#)zG{rUUDaEL7+wV~D&gO8ECC zZ_#G;_IG+#e-ncq)&cNueErUlULK$8XOd{Uh4a&Z@Gp}zU1S!1A{5J9I zpAVb<--k^D(Ak#4L(6r>LNgG>M&(a?IYE19cg6UL!R7&UyLrtp!QIxFmF3-dJ*N(F z%)s4#q*BLsT)@ASq81`oqflKm@Mi4gQ$8d>W|>)tqmk^_vHxy%H$WF-({(d1l@GW; zRO#nY0SxAhl20GLU7s6Sy2Y$--HeE~f2U#KGp-9Hdx&Eo>!`)@KL(8Zay}CzNIJ0& z(Q4cEdJ$75u_SWUFq9=xAQ=LnTS{5;A)Z}0X14mDav+*|FNrPC{;hIEVLe$xzl`rs z8n?xa&>7H_fTggN5!4j7;%F59$5Hl#6+Ese%V17?AT(Q^pdwe{iw+jce?@U1W3C^9 zVX3ERYvx_krvUHS8&Mx?7ZA^rheSsX5!c{OUE`S^D(QnYiX4yVw zEFdjfgUaYZtR@Q}N3i}|MoV#|FedOo83pB`vYl>1fe8r$a6;amdF*lI}$?4Yi3@v zNY+h_k8_j+L7FKAh@h98@pTm}y#Ri;*WyR@wz z5_}wjbn&iPyM6E5qkPdS`FlUBRyw0A@RNW{kpx!#&FKNKy=aC=;M*zmPDP(6B<~Nt zE`yPfR4S=Q7I)geLa9`${*yTF$^1|CeDh!R1k_evy&jZ-E7Pj&2(cA9RntXn(}n0; z)5@Ue0I`DD;?GggyZ-vJ08KA?_7N;-CNm~pXN`ICGv$tSZC)iiG=)`p_`Z*zy@Ld5 zDHr5{bxeE-VmPYrt^p{L%f05Ku$L=3qS}73DJ7}_$QaTXQgzFfgxG(XhC_k_O_fSA zyV`6LA@@=(m+@BvVQ@M;^qK_R47)Ow6|)HfSF;Yf9Uw=vJuMfwJ{lc>im-fboMU28 zEs*e5LaNIFz{gj^Tg|+^%0K=b`GPqfNX&FfnsDF7idHdfGK9f{Ro z$^UnPd;QO0-AFa?wPKWWuQTh=PXMR{M2_8BIsqb*XA$a7wiDm9%z<|&FOi;eynn&g z{reB99~wpCJ>;TzB>_G&7yAF-&n#b?*FF^m5mRjCfmp0qiGc^g_?R&K|BB&(ZkiL4 zkZ1vukbb~Z(NJ%!6a!8OF%0`Lfl{qIkRk(IY;I)7Q=pBm zqpE7V!Upd?DvhaWfm^yasA2t3M3Tk;6sEmyZE*R%Xb|ZA4P$^1?eG)TbvKl(HLhN^ zdgz!u5VFuH)=1V&jz_c(R%b zlFjpy)yq9K(Z?|NwCDyFQTc_<>Hc;QK>*F z1Bm=nRzvQs0>l~hO*+uD0d!))TIV^#2 za-PS#X3vDeJRS`MiWL}eL@54PPU14@qz~w}qhv<5zi!+;g}%2OPEw%`XFcY zr|(Hcf4k(Obf>X9!pMkf_BkMCadUrnLZTlqdT$n`rhKi(a4O8);pu4qf(UNmXuKO75b_0?CU?pHw%`O*Z=a}43$4{NSM63-t*&! zq^DZ?`}+#Lu4F)LW%w%C2ef~X61tD?wR*Bvpe$54*gOHO^_cV5I5CbL@udg9#4@Sp z^lOl97naMc6e=2X*fgXulsnXo`+t|Lzq z@u`Op=RWkABqQq3EJgorAt-w7Y3_Fn27l5GS-P4YC&Sjj3f#6{bc0Av)(<~Manvwc z*$NjB?=HbVcoEMY$P*B?@3P(4uwO2r`z%40CFq4BcV7eJGFQj@$Mv8d_G1ffs~Y_| z#=%C&hE*AcXxt4GA+~ZUCQFrfs?ivICX(D>u(naNGJP3A@x?ld=);6AWrmv4MYjjLrC%*2Q@%6j`ON@ot!PFEW@Via9 zDW*XJfo6Tz?B#9u7Jg5U=V{BoZ{ukr&YSV%_qzHkgGx@RxxHD=b^%M}LDmsKMm1*# z)(T|1K!^9mpIozO%tSZy)n{<9(*0p+!Lq}rl2Ffzar_fHPV_&4aY+lix4$JN9$}YQ zcTuo@VLW;bt3v!naP=}uNp4x0qPZa=M%uqpqkLddQPyaOXfO1Oa&uV7A8^mk;3YNv`uj|pz)up*- zn%zD{8DuL#P4?>9lX|cj#4_yw^tuAp9Qy*@0bdRXsz0 z`8l1nhp0rONla19Lo>EW^1AWhYW-u!C{t?yF`-}q4@PR$M_w8)#in|L$!5lxYg>X4YJ!3 zKOgw-i7IQN3Pm2@kIlcX&$LJ6t4wS!TnN3xeksMClVFVfBjDc_;_^JQM9=AZO09|o zXtc`^MNQ{X<5eT1Rs~ZsU-Q)(#}02332qHYsjK^{kii#fb;PCcD%sAz+sen<>m?hT zeT_jrd7KPlmmF_$RB-9FbZt>rt;kE9I*r1*FL-vS!&hCZR3AlOnMho7Z+@=A*&Qb0 zu1P3k!|0sG)*^gY&U6jAqMR=JiMH$nIJuI2Q726U)K)ZMZH1B(E6Z*ctY z=mf^3v_rCWcGAB>K6a!h>H(^K*s1IY$XaRwc^6a_>9DpdkNjxzgKR}Y8rm^2Scbb(=O zklhrCyIZtqL!dtFl!o~y*g07(c1%}Tbm@B!3LPp!PDc!8dM8!dgGRlBFOk)w#k3c- zU0TiP<5Fs7OP)QJNJ?D1aqLZEc12X_+Pk(EjeVN=glAVMz2DqEiNI&n$c#&skRy^A zsyt~C?ydmAk*xWDJyo_tmN77Xo&auagJq(ZP5xYofvBjabaVPg2c73;ydVu+Ot3)q z@{?0G9}wna-Hjs5!Gipcki+#MIywppwAg=EFYOkKPYLy>mNrnqpZY2L?B8x16nyHe z-Xy#yN1?R1bdbCh5L>n8@1LW!{s3(kxz}UgU;g*D)svv+73%a&$e*O~+h^1PHTSnu zlOzxK8eI@W*ne}mmnpX&-wn-_b>NeIV=RSa+226c>jW~@`Q<{cMCTt!*K0`Lb+}vW zxMGa+Fd^2jALyT$ZW|V_2OqjXs0tveH_&S}A}N1(GOSM~=xQTR0>xZz`M_fT7gJvy z74`PLt>hpg1IW?bULmNw$iyoo|icEqO+)vik8v?Uy1>c~z@2>>tOT*t}IjC;eF9dLqLk(W4&!-RXCW6w zZSih@#%<0{th|`la8{tg&y}USnFFs=F@ZG&Gss)Y8v*X!1Mpl||8QuyoOEBR+pa(F z0hA+avBHO1Qe7V7St?~rd*`6}us>nlQJas$-3H0&kre%>wMHCmuby@9}=Q@QJsGhTcyd%ihz z>NGaZp5>6)Xp)xof!sYeddZn!XwRECrv$DZ7ITVg8N@Y7pUs(o4D?xhp16$O?AAGZ z^#BE(>xkxFX|JZjx-(Olqw+hYr{3V#O2a5L@mT0D?=QNKuNie#W$=9KAwT8(X_4r` z?LywxSCGi(OVq1+`bi}X+3UHU3P#vV?bvn<7kriEDpMMm)~>CJ6#nbIHdJ;b^=ANJ z&^2EDMJCNXV#m`7dOWkLgFeh2A6I?8n%_!)?WnIVMj~TcPo%i7y3*$@0zEVIyV}BX z1KZq52W(H;GuF24HSAjw7d!FA!cG_Ubwj)5X@wb~7-L$daSa+38^8IXUo(sturO}T zX7+!xZn&fmh6&;0IQsZMN270;7wg;iuVEF}FiseGxbv{Rtk}_dV3Fr;V+DB|i-adh zPLnpi50(;B1$`d3GOg=2#?DOp^iSH{MOz*1JF|(i1-NmBO|(@Iib!rS2(PZC557B)*89XeW?I+)>=CXXWb3&|a)Fv=h^ktu+u z2+iIYj8XRFEQT@SEwP9uNjvV~KEz*w%T$mg?wy*Pau|WUBHSiP(rI9xsMX!!((XR` z<$eG?HE1$Em|!h6>qzUC5@$S|X~Izrxa4Ozpwj_3cKAk3hJr9(R7Rbt4idrOo% zA1{l1YPk%+v-a(@k=PeH=RCaVQPuVweE=O{z-J){qJTI^_b}ZI5$PzN4*VRNxL-h` zHfz?GfU`%mM2!<4UXxTwL;sOs7MG+m?f6MW)QV@uH-fe@{+m}>>x6bYAOfZ5;8};j z?Etg*qToXS=$bh!-@CgUkf<&kOMOBgwv#UkrorVLdK2EVwH@LIjjDd1XrNp_Rc?E8mcm~hZ6)|**Xo?bk%@3%wM){MU! z3&SUFr~T4UVMrWkOw=F~#*yaYnegA)8MwM_Cj4Ou+wY8y(nDKk$htgtbZa(cwOU7S zeMCoC)^e8bp#<5c{8|h!k5HV`k#di^acXisH3}E9PXfOfh~c^7=9I_9B61-l==M3o zMtdiQ31Mdrn~7pLxEF_O64M)lE9C?739Mz#h7qIZaF8giKi3KoTF zrO`J$aeY{`EIdEeLC058Q zxCR0X(6C`om1m&bI5)39{0@E2hE?%qNJEgL_?Gm0atgsT)v8ui&MpGEegp^#$I2+8*kr9v|A3|$-JXSf+Vd$POua6vD<1-#?A^UXMhocHK=b`?Kr;|&a20!7B`gVGb^s#^7! z!WDulh}J{h@D`}ed4s$e$iiCg{Vu7sDRV8BRMz)@d@C#zDf3S9T~kfSa&OAB)Xq8p zG|cJ|Z&Pd&D!Ew29MGA<^%btO?efnf)n_s(hhug{H4vs&sKhwS43AHh-0W{!=-?d# z4nqa4qxZCfil6oHWg9YhblnTW?W7Qe-<1A@0pQpXxXP3wV=~4|XTe<{^8=d%_eDzSxN{UI&vE&~zf#e)*{B6V}XZI($m&71ndEEwJ?B!VR+_Mz* z&9HCcxFT^)qDaHy`@VubfAcfOmD{n*>oIG5aDupg06T5O1T{NT(4f{5pl8yMEnDU$ zQ??}nl3(V);(}?e*s$Go#iM5inld~h+()8Q$+Uut>80Kg4rEv~6D<~?D)U%GU4&L3 zkbMnRr0F7^izLp%y-nqy;^yk@`ZbPqU+#eRTY)$hC-% z-uOHM=FOR~GeicTkNpdyg61C{U}N4kRsg5*W4Y&Wd9~-mp*?XbZmvd6-UdgE^Aayj zMMddoHsuGwIp-?919yFTyx+Ou32l}QH*Low_B}7@hbyR#i;>;5ivX%T*nc`?ft`l3 z=;QTMJwuY0Fj);*6443{6vEep@b^vZb|3#z{i7&httA31Ne8XWC6rP|#1FhA_2age z^lXw>&z1Ma%$QDD>nwXwcNc2jI;c+C9(a}N6dKLyiCaXT`>uY=b8_m#6F$2oT3m#b z5_x7|Vt1YQo%>Q)^rr6W_>zeh4RCRlP>LJFOPG9Wmt8r~EAt&v*()=($NTSX=Eg}4 zd_`iP7FfD$`tOZ5hCINz4tt~mE;|Fgzvil2c^B+XNky&)gg}JX z3KA@%ct-ZVCJu8k`0RWWEkz|G+axMh{=s!s{Yz;RVolZCeL=F-cgOBIDPr86T&g2V zsIlHd12nE8NE`7B_SDJjTcf-TZr@(2A{_~ERdDK7`UB~dL-@?6QbfFmEGae17DB?q_@JPFxIS+V*Fi4xkHvN}{^JVwWgbe#5H5IjzN1KOSReNWNsA z!EZ-tA>4lkBszx$??P`6jEO$$>FsxD=LD{>-1G^)!ZGQbZ$Au8eB+`t z^}6cdx@qwp!i-5_mR+l<5|aG5AbrGS0DDu2aDCz4Si%Eq`1H!@t${iI$zR+ai*}M{ zPwN}mA{3FBD{5Q3L70?SNk0zXExi}jP$e!s$;oD^nH*PpePniE#TqthZ>6vVGk7&)u{zYW#*bCs*=C=huhvn-2*1 z!XWo{f1~L9Guzh6%DI)2M#RneUcQ+AYLxH=zUS-LS?L68;@B+E-H;hUYkaByuWy&Atgd&NjdaQhAerym7qX$&WhK-l_hBcoc{g6Zt=CrB*cjXwwCDx%{zlP-ER}}1^et(r&jdU0Q}ejZ|j8{_C(1DvzzmW&YMa44!MGSax0g#9!6r9>n-4ZPqitx*E80wuPg z!WfxVzG|)$41U|9=rzu)GEIVe9cJ^zYvj_FzR7MDbjGpxMW3n2r=Jatn{-B4zLp)j z{obSd3jrZ?mI7t$kB}|qc4d_OlQ2R&lJa77P0_=~R1Ma&33eD8=Wsg~p6wIHO_shr zVY3EQSzsc16v4skW{gcpqXo_X9`opeOwPf)F{vDNl`B`Jnkui*kR#Aqq={A)r)JuN znULK|Q(RL|XcH!|Y5xT&+pFrU=@nJPDI`9)wABEnB8*v&2@+nYP_ItBz$;F33a-vA zOUrs;P1OHMsLc^M$}J(!Fg1MiCX`p_Rm&%V(++RUZe>5sq)3#@B|6JD1PSI@k<$aJ z?&8OVQwRLx28(#a^uM<^{4h}MJIm*Lb@hJ$86lXSB!05^R)6&tMd#}%HwX^f%GLp0 zEN*KPf7;xMcBj7j5Ui)@O~kS)$+{V3W$;ffm*08-O7L5Ad-F$@!@Ju6i+6dm667FF z@nB;qn%RVWcEwlh(r*AZrYSLIu5^QArl%Y(&I%5;LoItR5*?MR9+(Wn=4hSFJitYo zHS3Z*k5ZaW7Xtn2`qYEe`m20`1JBJyNF{Z)_v-&@S?Y-R#4Dm*{%9Gst?-9Vm~C}Nw?H@hL5+_>f%G~>4MkW<|BOrEyt)UPdm5ASb0 zpFFA&#uPDUHJiXCn;|0z<$Oh5#_Oc9zYS?e04QLk@6ApAX-`3y>JO7*u;M9|4YzFN z#!-6sz6ZCDSt};?90jFd|Dt%Uc!x8n&y%1Ms-i&LdWVxu0-$lB!TN|G$&TS5ea)?i zJ+3d_gBzK7a;N^}95}f;p|s8l51x4PK=8mA$+Y^zE*6p&nHBC5NKw-{)C8nWNj*|@hf0~9@jS=ZR5N% z19&z*P+(6N_84*PS5@q1h8r@5Z+~%Ht>#a&!aIK^^C&VTL4;I78)dl*0%VJlZ^8|4 zKXEqfu(R4!N}Nhn$S|LW#Xrzq1oOM&HlFt0puCgGO@Deu1ZhrDf}quQYS4$d@1_jP z3kGMT#lEAEf3Ht!5n_1-l9F=87#5q`+~tvq^}s=h-{d-0oT3Yq&80paJgbl5(T>z~ z@K3*xZ{57(jxuM8m5rcVYs65665E2o09Rq83n1$bx5=;5@W<)=l1*Wtg{MN_cUFI+ zm8KjDx?X%FPu1Gg5ZzpDi^JVycROX$uX3--C?ARPwH%JCI8sX2YZJ25OsPT@w~+Gh z2U{fThA5M3*|>MeKrM=%DOXSQuw*%}P@`Id-ruG1IY_@Az~jnva}z5C61U6>VQP8pAQitWDmlQgnIwbmYr@ ziY(y-qjWU6dL7j(A(3R+b(clNetWjr_$S8L2Nh~Wn$x;kvuAYkUWvYvZ7j3b>xD?_ zcy2lH_WS_6oLDD@u?FBbn_+Nw-{A}mJm$+-oAR%;v-%gN#O|ZogLa~eQe1)Qn49iO zq0`(aVLM29BGsOd4>hdqN1i9h^gcC~s~UYi>Sr`U`Bv`e;|LH15Ha`kTK~A9l!b2} z>u>m-==i?hpo;2ZRQ5%Arq!bp%TWqM)o**PX3PoNN#VR-Gs^ys0|%?SS4G1 zO_S8ZKK^;rCLn6Aa=5m|ImR!z7$%Mi-&7L4-H~ZKemvC2KMxDo$t&$kg^3xHA*k%q?7BDy%%J`SS%No1XY0Q$|TY`jfJ8M^RL2e%oGKpaHw)dMl6q)&WiovD#6nqHeld&#iEt-E*i{NEvuB*in| znFnIG5N1)&BkzeRDwCa>^C{}hv8BmJI&RDtZaii0FHg9SNA(h5XD=~?w~fJ%@|1{e z!O)~?u)6F^m~UzcAcNGE@gat+zOaa9iLQJvQ(OtJ-8a?DaKJ`Z#l`e+6ab-g!#$<` z`9p63s|5U@Z&c6TG*Ub|%e1x=-tgv&rYzh=XKeWLc*e}xDw)=I(aP7}bQE(C3uB+- z9)(nX>nr!hk8N-GbGbdhjz(3!KD}nnhPW-)IoHCcD92!Bs~SC6C8FrDajXNW+_UHX z6ZE{RP2ut_*PJg9kU_Sgn^YnR%v&^kRz`($i&+N;u1&*ROFqj+T2D!j?UdXR8fIY> z5kIX=gQgz5ux`-#_n;;!ZekPT)OMr2H_q;1psTxFZ+RL z{p$7>Eeh~Di(a+1KUF2-z(rwpNbDFBLLlMy8CgMwwD;|GO_&5JG?$v;Wym)pSJv!x z!S<{GWUynMOn&{hD;l819Aw&b4vN2r`#l_Uk{=qE$p}OJwGDpSBIjXlB`7Z$jgbEYM2!hEa>C^l*69pjRc92IZ`g0)Ats}%Djw@tbOAz;CH+wmBg$2+UnyXx=JTY= zhHTf0`#^e9ttePO8ra8W*%~Enoi&K*FPkB@E(OgSNyB{iZ zs|Ja&lQ&dJ=U)O<*Us2${$0-0jMy%Bx9x8moPHu)^G7XY>Ng2|*=CB16l(&2Hk>gi zQx3S4jHz;~X^A2+vqHKqgmBQ(s$oO^eb1@0)@(LmCTzeo)zY^U( zi61li#WHQmf1A+UiO~gj+W4Wn47Fm_jBy~*MeVbRB9qx04hB>c6X5?GQt7ld@-jbZ zbuv;DB{tgR&1pr3nstgkD5mU8r%_JmseAJ-3>bQ}(K&v<#k?QdOv~QD)8J|SBe9D)de6J0QuehdKe)C#$*M0%I9| zo6e*S0A#(V%P3w8&d{Zc`3#UcB8GG~K&4ga+;tDtmqq?NapmE-Pi zNz?a;Oqf5mv%Q-~VlVZ<_Z~RlCI1}oUxjhm8n>}Z>_I|Wa>3sN4yNoopz%lEap@lX z`+9dofyRF+q>u5XAXa|W_aC-kvW87Rmj2mn$kZap0m!W7l@C5D21w7sX}ey)-~4h% zOnel5xXZEiK~`7Q8xgwsZKGgzkAAo48TJR(TyWOKmSP`H1M=uu6TeS} zp;>t`!6^1%y`QZAMZP#Alt#ipTOQZoJ3jc!f1n1_gRU}cUA(9TXft0+juEiN=_(Zj zuigw`lzlDTTTNyD(1~k7YVUQNF?e_@vAQEPL3~gC>M+IP*?6g?dMNv7467flQB20t z6XB5|){h>UMbhh`!9t0KY`5YB7s6tvo=33tYZ}Ne1NpWKU_z<|FQ_!+Og3!-BHES) zEo+>zqJGBR^~^~5JyQGSx=>U^$z#Ip8t52}R8_COK%*c*f*jeuZ@ko^&1#g?-+S>W z$`LbZh(L@Wi$Zp!og(#F<*z}vhiVcBTV$Wp1Bo;4w!1RN2~o_`UA6cnECrPo(TvN+ z7ij=5yR3Z=Mg>sYmoV`@m0*L(OnSu}V=a#+kHy0fSgfVkx5#3IsK!S0WG8(J@|}7_ z`qm#TT>!$f8=&z-R4UvX+g>u7=Ha*iERD@!Q$89Q{>d?13WJ|T_Mt!XuiJQ|N&?G5 zaC-rYA&k_9*H)Smz;w2ND4?XF;Exq)Vh?{wth0H2=X5}|+~Xo^A)p#K?e>6Fj-JWB zeLCwIA2RZ=KdhSb5`Xas?CjcE=8glLIOeX4o9=9@`<*3Bf!*DuD6un=hGE?S&Ioqs zsiZy8R3r-2`h0SQ>?jO6P0_?bMF&C!?ZGnDmkF`m2r@_3_Qy>YAeBQ`1bK50?+Bf= zSJKlffC-#bXV#6s#RmV$a64Ijh6W(A)O+0k-uWt;*Q(>N+;<+%v_dV-_RxH3!|? z_+!?8x*z?^OTz}89%M>S8i*Fc=V0ZFXfEy=Gd2ukTPM6{O zD^ATi5OhO3sy2a&n}r#xrcM#E0NZL^u=zrRL9Q{Qv;~84&=jvmr6>^wxyFnJ>6j{_ z_7kDk&NL8Cm|hONOf87);_j=(wKlg1-&#^KSQZB?<*U;hQg@@7LrJ|mSzaH68>v>w zDmH-L1hbM_OT_o{&nw z+3mjCag@qeG zbZYYbmg3~4WyMayhBOz@3+OpezU}f=7Fg;CV|g8QBU!W{kjWA*r{EWzLJ>76O6j2Y zDKhDjA0kXCL^btB?_1e954`G~xzC>eGlAB3sDpdGF68D*5cm>%{(GNm+R8GDpio|Y z?>?QiRl=ZXEA@l^GjLoFH;D~SqBe|G9Vvn-tR(T;zox(vYh3z-avHJ-O7!OMGE-vh z)|-+Lh1uwz%|J;-O_qPO9}<`bbDkAQF;Yal`Wd`o%Mp8R-6oc8{$(iLOGu#;*L^4R z0Ec0^TUJ`TX^%drFo4-<%(2@o#dJSmarjw-Z5DL z7-Sw@!si<<+bc(EAB<9`N8tt^d=8G{1=jT68XkkEy*~1E5NIT6>_3?>bztUYjG@28 zcq5%?7Q8J4tgvM*X)?^#V;ya;nKD7K8qup=wJ|(YrZ|g&W}GfWBmf3l@UbQz-%qp{ zIW@~h6Nw>R4Ep){e89fem$Sv|RjcB(fsF~m!Z#|`H-Dam0~swvx@!0er;TzCcxVKh z^ZsBH03NHM{30v9Rj(-g%a~i#Cb2ge?+@X*P9w5tMJ+M8HomjXa@UXwR*iuH2Zm>9 zQlViPmg^KBolf3@@g&N(*^wwL?c>tvtrMQ|JBFV72`B%6hT~KrLP}j)kcbu%d-*78a(mF}zWA^r;L({0qjuCd>S#^icnPYw38z!DMGsUMtzOh%at})iIKo&K=Xw103 z$akn@eP=qs!J&_;wCITTuB~)Z6s@fW3Q&iAifZScdVd^Vwcfi&z)R8M5_ENCzamUx z@t&y53)>`J)l6@pe$Hcj0w+XrVGhtyfb{nazHd9LgY=A~J6|;5=$A$jPY5Kf>BEsCjwv6F>JRI8Scjl4FOLE5F3nphl80Lw0f zc>bY*v~@Nry(HE0dy_EXCEI~Ul@)1bKf}s9fI}y+<(LI{n);*STfgGL>KItVhj8MX z0XJkVDJbzeyQwsm^zQcn39KKuxhAoXG;bM;si1>Xi#`*?qWFWWuECE3iN$y9rGs(4 z7zSDE)Kx9Ze8H|J4W{p6R?Pr;RkHIR_DN|M5>uy#3)%%{-OUPvbb+k_t<0Ug4+?KT z_ScD!*=x>9j;WE}ZZpk};*PB>{uYSVq8LJ~@6^kO8A#jjlLYwHdc`7(oICcLr0F(E z2gleC&p#1ViYn(ZNkc*z0vGCmP$6R^P>a-=a$fU(W>o?bAP@T~cz=dw`4z;={Ln8@ zgG`73=Lk;?OJ=32Y`VQ@CX70%T_r(jiI$}v71Iq$d6jO^RPAz)G-~J7kA@INjTLX9 zdk(5SjjdIvfKZvh1tOcrY=i4e&@+m}y;R2pH*ZB7t};u=3FI<9_S!}8&v&tA48Jkb zovRYpsP2n+A)G}XEFqc& zg2fe>zU@52$T+ppYa*?v9ujx;2^AK`AcIr7w^L4Ug~VLEf~q<9^(O_lM}W!6;_BJ- zu$g-@^7E>6Pq|e@j{v-*h(x2`!BvE%ka_UZbVx2JtIFe-qMp+nw?RzW$2E_XjI`zVq#V-uN1O2ZIQvX=^Sv!0pKt0hDC1 z(+uBGmwHW-GX~_jRUD62Lyq%PvI~Z5`!gZ{kQGF`M7l;=L6!vbelq@xZt%X0!@Gpf zNkW$yiiXsSjNqB$umyB1Dd#%GgUr@^pJ)Cv*=4$Sj7(Txe6ss1#gd`^XVmatZMv4h z&@Q(j(7H2s4#oTn6yAS3B3{*g5#nHd`qJDda@PvTBvvZsVsRU_&}luvClyIog8w!M zU4wb9jC%`jEoh}t%2;G|S4jt#oHUZ?_SD<^&MT3TkIL@omM(grpKKz`Y7Xdh+cyEL z{G?h876~}>+Tn{B-kpToidV?X#_9A!1!k*KuQDPn?G@Na;DZV7n@$;Sp>sXu%o0O( zh>@|!{e2@exWKECPazfI@ZZ*q5X&>s2QEZ+b)1xp46rcVG@ z!ncoKyQo%eI`cXE%etXkAk3zT_YmJ7xxsIKc-4~172r&2BL&G~MT-N{bK##}i4M|O zN?DE1Gay9`ZW6ZehdNjWyf*^iNNLDY5$N_a1Gp%Z{XLl6U!t=e6^WH3y#G!PkYhRzuk#!wO(R8Ei03 zGJ=E~kTrHuXbZyeCFNeJXs9wM@_aH&(plkJsLwbv)>KFCp`Q$|O)z*!4h2uN2=>WA zibv%BuqR8Vq}c-e*4OvtxS^X6@)w%BUa}*qw1~?j)x-9=oG`8v}m8w^x$P?23Je=ox0?ljI6i=A|{l~Dw{_=c2?db`?c{kWp@V^ zYk7d{SQHZZz$<`nozF_C*hq9TdU2wHJuykc;3U;e^O3_J|5yqpf?iy9z)b( zi=)Ii-L>xlqGzPLKWG^txeBTl!hJzN+}LQO0(Q9zkWV!QD(XPcxzhI5nY@==%9vaU9aGdF)Uw z;R<;U152tYunFK@{Sadu-PmSNf=mDb3G}j0n=f=7)W(v}Sk%gh;^{Y&8-RsgkJt2k zwd8~Pt#2FO+=;CJxtiF8Wk^*1CBf`VTRNNi-+G;KtEc(wqnrxlkOW{OFp3~%+Ihbi5Gl$&lw*&u#? zM94|Wr+}D_CdvCPyyQyksv|)L`0Mgyk`NHVyYH3x6?MLp+5xrzn*>-FY9-W6CPHJ< zRph+k71wY&i31{GjTtt^9ek2Sf_R<55^x1aI$5?B$|91;YR-T?{8~84bE)bu^0(k0 zVEFWCNhWUr&2D3#Y1@KDZH`-*=qvDS^pHrfx$!kpjv zTm_44=JCuQt|=O22l{elTFLpDNl}%gRak${A0(y6vS{$V6xF} z0jD=7bd>kcl~ph_NLVe{E*0z-2@g;r?6R4xs?~8;pLQ`lrDUJf1C_sNzAOD$zmg2? zI)WeZq^c|mC}cx3iEWZiPc;+#gL(p_<9rpB^IgeWjex_|8D#S9%gX%y$PAkj@hmue zbltH$nM|NuniJWSFIO_L&%4_F&knEb=-^K5T9NM!U7TRgc*%}0u9!vu>|{o@e-tsE z65eC$Y~t7_TA}Yz&YB^6-OF--uc>@&dguVA+zp1>9-DUP$J!TJ)^5$aOR5=N*qu<^gZS3iagE7vdc!XjvsRyPh?Xy1`2N zLWr2PRmwSU`_FVY4aoil>=Z}`E)3#5KF^}sE&@;Mp(D)R$w)Sn;#Z1Zu`l2k8h&Tj z&Inf6oHidXY<%3Juwj{wSIa+SRvQvfnWW7g+rG9Z_4&>mTxotMb-X%v99wFkEpS_@;q1oOmNbh5lRuS+(9h02yz0D5`9qlq) zy2L;MyD4YP<-~?Mv+APs9o`CaW;Yv2&oSEvf~>QQ^zpMxSHS%~^I&5(5>-HF0q%?5 z-AshHONQsKFK~KK`jn%~Tk}c$)Q*Yej6-H-V!JKf*yFJXGq1^uv-ZcIt|;O+07w4! zYL2r!a(K75x3Utlnd00UwLOUJz~f(0$+P9| zw^!9@Bq5W@GFn7s`sf2&%eQv$rv-!ee=2ckJa9dj zJ78welpITx48+PQ?<@h8^J@q%oiu*GaCBs^SI55elHqOMNY+47JYI_Jw3nf8a#WVW zu--Wjs^!*&T6tvE*_1I&>wILE-3<S>FwPh&b0TItQ4~%j>fG={ zezsC`HHL$Es-y$Qqg|*?cIC&=RoQZv;45pQJFn$tZI*gbeV=I2s!{Pk>h@i~%+P&4 zn6LK(O_GC_ubbFCK2w@C3v4tu@At1IUOB~(F=^4{+m?cALk z7UN#vl7w2wUwOvUk}QR;bxK= zDo_1a=D0Cs&RCM8I$G+z2!~_I`#N9a%Uc4yP=N(R@Qa?n^6)YaEGxT`x8T&!OVR>z zp)jl+{OLV77`v)_YWF`p@ycUvvfI2jN`c*78i+@<7iNqL+nCa0C^F^0*@(p%{^tQn zW-lPvY#@J_CrrGrl51n6*KRIW5(Fr&u)?)in{or^P8NH>Vf|86-!4bpQ4R&f7fDJ+ z&N03(7$rhh0z{Eg(fnQbch!?PWWjh^T^zwL*@1;hMy%N7exTe@fAMMVvn!c7``DK} z-Xx)l6ZBG=w11}QT7$OmTguTMa( zIsX`{+3VufbA^eL?9V*HcHW=*#>BgP_j<>qzOw$$P`z1rve^EwV z%ya-tL`44mFawMjlrcgS!YHFCP@Q!%mMA&p~%*BGfT@@`+br!NlMxIA( zdXLt|(L#B$%E;kIq>2Vt0IcB&^t&m1tPFm0upkah3cWSg9g=t}%!ImV^}&A=-Mc4) z7Hy^i8P5QSCD5*?5D)hLy6TN@#pr#??nVRR{1`?_Y7gS3ee)_>OQ4_k+=5{%`Z=50m^3 zd!+Xhjv~<`_1`M_UJXpQJtC|{gD}yzQPlih`bJirp{BvV#vobcAR_+dhEDT+2gvPc z3`drCpObdt9q)7UCXQBr%F;nO8jm46gUe#k2=W?oZ4`X#WotQbMwujYh4;wLEGS9l ztw<-gew_sgOxqd0XI2t-M1UlV8GXKz=3r20R7X432b8)eJ7;TyA7_B3ZC()q4c0br zl062A?WZ1eUE^R|HirqXGjUfNGjua_xK6R4{v#gT3VkFK*+|6uRtIvNBJe@aX2_wf1BiUAS84DfA_eWMRnjX)Ld0xI$wlE%FY zAWU2jA-=OE7fCtKrNcBGE>E^{JvXl;ocYOQ@xQmDWK3MiYe}_V@QdntfH&|uum^>P zc(oF22}0{P`xhtQ<20p>18i<}b+RX7cjXX-iMw+_7e=L7oL658vf zIE)+;&#sLB?}mg((t@Wd>S1dE)!$3Q5sqQGtpygFCPhoS>HhQv%>3FXVPI1-aJW94 z^I|&xT8Jbm=B*kA%Nv!Z62gK&{&hwI_8NOIaYxBw_B|;c0F?!k zzS-%Y=7_(11>Tt@#Ui$4r|VISm>~C;m^938r57~3=4hSYX4T62<4Rw#S{A|LW-h@8 zKHmq*t~eWxzwhOlht4oi{_9ct49Zd*T6lmwL3ZwDQcgkXo@T597~PeaQW484&Y&IAtqGd-S$99IosUQ5yvzGEcj`==eA|7# zUr((=UG

    +$+3CtctYr+K3+|yB1&#eXI$DP7m?pic+7)bD9({cmTqFdD>=cu*WPHnG1+W!GC;# zOI8h-QeT9%h43qc1CJ)F;6eX?i}!a>yvMG-)pBz90csq_A9UWUzr;_;UJMZZtOF77 zw`ge4gW9b{f0XQE!(>dDo`30`_hN?FzYGb=+19Z*DvHSe83r5$RXQ!q>Fx@qOZH?h z9XD`^q7ij>M9Cti=zz7+7T}n=eUyv3QE1lb43M-Vdxzrh!TfqSdx)SJux8}Fc@A30 zDx*5jYK&Yux@c0_AGL7~qKG#$fO`mc-;_hcCJbeKy%Io7H6Z3MWV~Bgk!E~@BjMjN zO@s9|N;1XFCdI?;=uz)ek-ToE$OJ`F`6@9GGB*uEi+;}f{qbq{!C^neWHr1t50ZrN z9AnnJk%Q7hEZoeJd5fQtJ}7768nJ;jJI%W<(d98%cdR2=FnY?f(>0(9SYOTg=H3$r zP6|T6c7odt(5g1{$yc51Vy^)W=0UO(5MaKn1j5Z=r#BRZzzAq|uWYtM?$y6P`>&KS zy!=al4X-c~`>72NU911Le+clSBMFsY{}22p!9e{N`2OS(7!r>i2$kOg@g|%Nl6G2H z9k`ffUveV~ZCCc93+ryzJD>>ka_36>Jh_k^nLOXh@mM72_S% z9DD-&(3a!#8XhcC>CzuE8M_3W@gNw3!6a+3Vu+JGb59j9RRG-O>Ys{(fcoaI!%qu= zY1A!tcktWSRen7NJ8)riHAqzm$H<&Of3xWAp7~OI#GWeei0dvaDi?5iMcN=k?8s+Bi(kQQ^I=P55W;b%Xmx8))jj zR^Errff{;4^8G*W6XB~8ruZJyAH30ygqp8iMG?a~WW~TY|NAvJ@GNWN^jlk0GHNwS zgj0VUZnOMqzWMPd{*-hl-_rn%bMTy119CqX;s*u;3Asi0%kK`bkb|cfVqpL^`v{JT z9f^d=pTN6f6$us*>Un?*XE+1if=x`xY^O~*6-b*?(9as3G}hdVIr~&DW#cDNPXa8G zoPbxC|8~p-v>NQ3J+!LaspF16kw=54Dmcg3;(wesZXD_e&;-y#Y*+@QS@kB>+KU~EsZcCe&@g-;$`kS}%aGNr74 z$Jb!DRluk^Fbnq1SwFXUOEX`ASmJp4UmX*~%u%!z$t8bZ-T_CPA=o1|q2=3!JH7EB zyTX_HK1FE|7heyCjACDZ`pn_Sy=XRaoeID+YS(`kUi12eDp%Xx;CW%fU=)KP@R7O9 z90d(T0&IE<^!9Fm*l3pkwRO51c>#Q!oParhl|&4a%?Zs>KlC{^&QRhla9nJx5_Ak* zlQyO*9hzg?q$9E_F+jcBa;$eNi*+-vbzsmx6^JTFPxIr}Xl^jqVtp?`mt>u1hSmP^ zFQ9+Wd^UTSG;JFA9b?Av&ua}#PT4E`+9o;rtANqNZ2YDQU+?4V(|{7WY4}9qaO4sB z_#rX6F3aC$x_UKZilgdh0H?J-fwC&Nqi^(m4oCUyAS3G(u4*arZzU>Xm-gccsCfz; zDt0l)(LoPBL5t^+;Hs>!S+0{uzo1oO~T zzOgB&p2ldrK7mro`Qv|Ie-}`x#;y)%sWuwd6ypylY_Tj$`S!rGS03ySt4{)q4PrM? z;m@7#UYb2>!?^$CoLeJ}ccOxK>?kfXl$CNx#-kjkAh$V){yPWdn6b@9jF>&@??H$S zmrQQG-Qfi`0EX7Wz@MZRL-MqKqg@@gF-GH1JD6Y~A4wVa1%>!t`ihjiLj;ois`zq7oc{8$kFasVro*^$jghdra_&;Xt&v41X#C^d!~1lZcFrIc#l9(sU{>qKViaT* zqoTOT+d$V?Pct#1Mw%Do+{oe60r=tD%#9^o@yeVjFKR3brqbVA(95D?%TApsKfg}^ zBh6Ci z?4lq4u@sVR^3Nw%#rbz2LNa()SPPF_08 zn1*i#cu;9`xDRhpfR#a1|Kq+%`C)n|W%Hm9*XsM*qiA$Wb*k0uF$5lZPd$vzJk?QI z7{ut-ACEP9Jf4hm?AD_@V>HJU4|+LpfW;i%{=-&CV=Js$Xy=zLEl`r?8AFZP7P`4+z+*^}{KajX%CL~? znd2SRE5TZrn^xfvJYN+P6Eb`D8?eOYI|a%V+oC;}!7+Y;GF9xZnH8O6sfXH!649(+ zf;e8@t4J!1f-0nOQ5Z&n5A@A`hUF6DTk17_0(`hoCPZKKE`L05{q-g18+h-(*~cT& zu&KO;kSvec)jw|MfRes48V#Ou*NPL+P{z{v^R|!i?)OD&9217I^Z+Pe0wYzO9}-su zS&I0T{o>~*y$@_Ze~~X}xbi#(9byfz9xIG+J@XvO7qI{LUZ&*xjGQk`a*5LnT>%S= zZy?+P=`t@;hrvFs3FZ@hDsNz$PcFmE7y}d74YJ@HDL2Gq_#f`SHuC(^EkKjT1|Th= zW8l4Z=2{1kI?1mak&ZOdCU^h#yszK`*D$o+Yfuh?|8Ai!#9UXUQ)%TCT-sGf{8mOB z!qEkBg>hV+oT@b`l!`uhU7M%+CH~Ylf5o;h`SGC!BrVl|)~^?nW>%p7PTWLLO+)gI zQwzzh*BY_WMRNWYVVH8o>>IXi2KDrBQ5Cm}lo^hF9xg|XWyhDHa?x)RFVMMldKs6xlcl(B(do;!u z@#%pj#j$N^?~1mr1$iYvB?J)=8QffbfP6*zsa35sQS;hA?j+MuGCi#td(nv>0Uw#i zh=jIr?XN!LCrf}XUAGX@=$UA=7M{$ty{&EZvuBd^ix)p(r2H2Y$J^QkRDe z>{y%Atn1BdHF2N$Z+`I`S zC#qQpXa5GKzv&vun22UdHQE(eq=lA~;11x*WQ=kAQK^$45a zCAb7H0ge1t^9XOW&iONpXWRBFwCY#3y%R5(;v3Yy3t$8n6cjB05lQ)9%cb%Y#Q?m6 z-UCP`>Noz*nE3BQKAdnHKjXA9yy3}rK=m1jjYo${lWPy)lvL(#;@G&Iclfc{#L#Tg zD(BFKI?wV0AE{VCR+tfv4~fm)Jh4CP>VD2kjnv2t5fri6K7WSP-VGZ~Oibr^sj-ug z8cM)&D}vjvjgKUa3ZsJh2bJ1DwP%a>jALdmzbLgu@R9G88w;#MnH&@`r4kvlEn6QXk7zSP4NdXDL3m6kDnF!Kur zgjuYx)V-|k0CF7ryoYkZt9_ZUDyn&8xZ3hI$kO;fzTP@2>g^356&zqF8EQa~ZULo1 zK)MkSR2WLSq@|@1kZzC`5fCM$8M?bcQAz0rX(_$?<2mQMe(SgHz5ktc&T$Ddd%ydA zpZAG9Ho0d=m8IpJmp2ab0)T(naANvewzmUal)O^X3F8Z1!DlAVfx}dc=dv>x*WDRt zm8jeWU>_M;Jq0%}%fAGz)Ej}vV?d;jQr2JLPsr9o?&_$(C=caHBR^1!&I#G`3~gHm zEYq^@d!L({gzN`gzcDILFrtar2EfCDqdNVfX)=fU`n&HuxjpOvX_tc#CN#UB3;Zf% zkl6J4hsbKMeNDG&hI%Eh5V%}{$in@cQhu0rvOMd9)E~kO#tS0qxxSX;nb*D^*o{LD zQi}=udtU&4_PBiEZMGFvhO%&Ts*uqgs+7MkRf^xKLe8Tex0`zmaTU61at$AoZO_9@ z??2-p=4;>cI~AiTUd(j7+x)r;(hl&x(je(3o+)68vgOC3#Y6}h$n-|zWf+H50#L_W z3+wbSYUxY!%@L6$0?8H=rm^L|M4EXzy>GpLdC#hL5<#QJrtoEe_CYY(;iAQUJ>6fe z{QPW=-OjsLQaIU{-@P2r3nd9S1$4^>LP=)Z!Si}YRJ<-~YQeq$%Dk#~N|?i# zg)7h=vGS~bhKNr_uS~h4tG5e{(~upEAYMLVuK!4%Ylb9M993JyT8v-LdtZIjr2M8~ z@X)04meHWEuGLptOWm!gY}}@_@c&vyW4P-L0B!DMTGL3hUXC1Rrdf9Eud4g>}fywKue(8#6p2d!-M$-Ekvv~McG|Di@E>ivx*XfEf z1<5!lcghuhyf-ZFdM-J{dNV43Ebhfvu#@4sa|g^7&A$6H!}r#1Y2;eGlECx$UOnPX z-zoNeKepOB%!si{H|!fcG7~jUvhbH+E&1Im_Q^9+S$ZPOl493hK6Sp;a$bxvl~;N_ zQs>X7##aI@Jf;}!Z#=(^DeVRrDkp2zCk^SD%9yB%`ydsjG56&VCo1EWh=%_@7}?I5 z7OMC{_Jj8+6Ygu5FzoV#nq86G(lQ=V98tqF*iuQsSR`-*lQ04pi{CNRK=#R^hxm=& z`k`v&=_$=@vWH|5A2v9NH@ijH8O@l{CUx%M?w&01UU6l_A-M95m1&iMySz571+v|{ zGxOD2w0tT+TgI0LJ;PpIOY>gwEs!9+&iAO}v~Y(FaI*t^@4c|_#S62txn+oO#5 zQ)&2hJA&vJChWVbNqNd^=sY}CWAM$-PQ4NU~#V#h| zAs6ePMkjbi6pUQK(-bT}qG#o5$mf59Y5M=TWmSUUmf3IhScL$P0wVLTJHYd}E&F#Z zlJpi!MQ_l#3*s}x%3~_UD{?`g(7iH1Z0K1Pg<{mZ@?e?r%sd*CI<6c}{52U5)6xsiXms z`3rqmBvcf*P9rR|)X-lV3f?tTD8CM&DW?KoD%a6Z0))XUh1pOu++%?3{KUVv%r>IT zslle6iCQQ~syfKSPg8YIH2Z>^klTkQh}%^{V^Q-clVmFcz0&0lNXk-i;8JGz zt1TE`72Y8ce#(V6{+q#Bc3X5KFYz+S+I2tCL(^b-0tew2h=ru*aFkE0sz8wV!Y-`f z%=8bF#$&g~$^3P@`?&Ummu9GJix+I!CchrW1Tr&rCO*+I1V8l&?w_N(8ZAYAX>kE% z!7(AviOFyP&X@fsd|HZ(J1m=%ht+1Ql%0T{D)ELnZ8u?i*f?fLgk9WzIMyHf+=vY8 zZYc)Dz!mx(!a-Ajt9ItOv-G8)QU@X;PW+HOOhKF<-f3zw$A-LosT7&3?07VmsvvyZ zDRxK*O=A93CS7SJ^9NWUA7;3s=@jL0ESKdEch@xSaon-mN1!ZxK_yN_RtR-$LI0vZ1bS)8i996h`minG5U z*mJMq!3O04HMPa8BD|Jzt@ZHcp~_^T5g3vl(k02E(oEQkj2?*cTV3zmpb+9{iw8;fuTFr6J-Pb7k7tN4*#S~}3n@Dv=0%x)M*IeOD7o_GITPuZV!$O&x$Y z+iU%NVh2H7UakjDB#Nbh=2h#tk>|z`_jG>0WXb8qf>zit)%CCk>@rI;qQn}BsX!^b z$cH@7O@W8MWH!0oKf)~IobCFlVOLbx^QZBfyOX!7IXV1!f3fv%gOg8AkPxE>yn_O< z9t59aZuP^19gqs|b_cJ9e$e^8M9ePJ1V6z3KtOT__9ARsCMJ}i6_XixqpC=+9F7|( zg(PMn5~ISbrf(Jd{!!%>(DrsS7OOCg7aYU{=7I3wp^3d`&kJa&dsXF<@Lyafm@H># zq1WSJbk0>IV}=6deI!ZN_^9M@f@ziHfR~Wyc`ZBYs2Y7(xV59V%IUnZVY_&uuYdL% zaJAYAB|qOB=e@E@?;OId>bii4D2@W*1%ZOdRnzoIo~};Ptzzd zvm&H!?nDSBCw+>;J&4&7XFF4n*1RL9CsZEB;!^Bbjv?pxEL_6qzGQ1VMaFEdOu7&M z!A{R9<@^KCue>1&?fL~aV2o5;?J-BF^u}K2CsKOxxW&zGlhSCDWxa*P^11Y4{}qsb+zeu!Kz#gCs5n) zf~1{W2_i7gp)uDy^E<9zPmn_=yWL*>KDcJ?+oy>4+k`jem~6Gy^Q>clh;ex$@A!}8 z@BP?0d}``4hMZOM1FIqIpkmL2Q5#JmuJL|Ln>w9nC(eb%7({Z{Bdo10Pg%K&$?rg9 zS~w;6zhS?L7#vb>NlDJ8fBGjWVOe^$F?u{j_uB)EinqiOvekm0^Fqko@%{kJ_;{D8 z>#ET`IXq(kwAQ7n$nAjcptzdOceu4LaLVMmXKUgF1aBr^Sm>g=v@|n2<87<3bPVDm zz8KROky_=)82MjSX8?J)FHbpR@ltOcYV}LrM>V1EoeRy0hTjn{b7iJXiBX9k<-F3D z>p3*)7ezBFq-di_4Wi!_tLr&MMm`!4oKh&d5> z>1znp#nWc1S%PL({gHf6VDas23s>gNJJg%zcSd|QH@Eie`v(>7ht;LGX8dzn?@>O2 z<}R1b7F8glUK_C(CZ#dEQUfp8vJ`y@U2lA*JZPo^u^Ei*E2X9M`0S&v?c_Z9`VN$r zxc$sf9KmG(3A$a!CQt$*PEqn~Kl;+{aJv(kyMeFo%dLL!M0I97di=8t4G79^V?;b7 zmQA;nQ6u4`N5ZJQE_~P-`1khYZP2b>@t%AIi37vu3WrWnFlDZG$l z+BouFc*;t}w>AY1@*>5YXCl~ir&+G@umrO_?yr?Jwx)%^=-pzOWldrp6Gx zK~fF1%3K{LXEbdk{Prw+luA@G5@S#<-tvZr;645iMkomRT9hVr=p)L<2!1GJZyors z(;&!CW~$|APt;(%uEy>SS?HDwTCKv~?e_csya2vsk=3T0;n|d(;S6xI8znHSV7Gr^ z%s{qcj3*$u0$x&=V#x!kX^`$zYN7BZ&stE~;}QPkgKztau<_Lad9%lsbMjw@#`osn zNyiTFSM&!?9cR$Pq|r<>&uLghsg-|qhvV&WL`G(ulzz{Zjq=K=4#JUDQL z!uEfK9B0I3HEDEWk>BsZM{i64yEADVA-nRk)O$=B1JJnqX;uMU@t>G(Rg%Xv5VcLbJ?7j>-s3qOA`24Q5pX zzxBg?cyatiN36UN zSv}mXZo)Or5GN86N2(S(k8;=ni8d`?HiGrtHO(-H0@3XKI{pjq{ioa#<02B13Powx z7HgCf3no!!gc_`-6lcJG6%nnqPaX6cAymYnahL~aK0PmN>&LPV>k-@RJqUxonb6IuG+@Z&;jy$X>JB@{;P-z~D8u=i7HxJ&1~PRsl_Q;N$g zy4vYfTckQ)$H|j_F#jt~PfwP82%QXBsYo~tLo2W4WpLzVU21ygk zPSVjoo>I3HcRnspr^SxS{Ba-_IlT@t&?^Q+jRFJY(n16Vd|>$8s0pA1iQQAxyd{rY ztHr{VIs??sH}Lo4Qjf4HW`ZU@F#!(%@oPM6s??+wq%O5u0ZAD_Lqp0Axl)NZ4byQX$PS*IHw zDfhz)e49Q4e%>3Ls4!OHb&J=tV$7aLgDtN%T3R=I@&I5{{Z4jLquWz6GlF^4P zMmqqg?0`saMA;%MqK;Ygoya|~HKw7BMLD*)(1C2e$hOx2!)3ig{k2Hv?w&8>iDi2i zfX!wghpXRrZ09^5%8UcMniu;Ha-J|>Jjy_ddRkYB;tVDQ^fAvj$^X5@(@db8IsCz+ zy!LN}+X?=sob^~|0fQ0$24K=XZe;0;Q$ znpZlTA%k14b(dBJ%5>bK9q)50ubB!M#&++&+oD0V#uKsmk|B#mxcD0Y^d)K#<1cWw z^z+4$`QSS7nCilwLap*_cPq))GI&bSFF;$dy674$yC#`s9QY{d0t_UP)FMtfElhi? zr}X$`#vgI3**5^$$H+1HTI2xx=Gim=`Ezxde~13Ud7Fu))Ei!nXVH1(fXsbbUByr; z9oj+Cam!^;lN&vI7l8p44wUq0O-pCfijAhoRvNmG?&FssY-Kdy*vGs&3u{p_E z7&r-D=U2!Pml+GP=JW&d9SCc^I;m|r_T}qj>P{;RBZ=@L+anoYx1t)V6uVNV&WP-O zJJ=Xmnvp->^v~lgymjh04hm!muou$EQgZ@3*ch`)2F9mybDm3tuRJK^IFGJE-uyPn z&)PRnw<*}q;QF@Cn$7a<8mTY{9%{ppjWj!N2w+b8v_wn6XQmQfIlP4CcTOA9fj}Wu7nN);|QNS!~pzzXkE=G$J6w2_wGu4C)DOtv`AZ;4+&uGfjPeEYDogoSUiAn2RGHXHDR zGGzsXluh=X9R~E0&k@1X40nYWG3}QE-gcP%q4oSV#t~S}@#lSq_@8#w-&50jjnvc{ z?FGr7#_SV3WV3~LWP(rMYy~D4as;~R)!m|9X<~k09M0P~tSrTT=zP5>`FG(wQ#%P8 zis#72g_cW2yYtft6Ftef0A|or`B5nh$&k~i3LNI<2=8;noVe4y{ALCHZ-BVtI|CJm z^At%9m5j2Zz$0qb6;Rh$^X*se7knw66FLKXwgb_M2(s&y=I47wS2@_y#vaO;(t{(Gw5jVipBI|9-mTm2Hz6kQEHi zJHBp`6QmB%x}4j(6`=u&ImI4g-1A)XEjCM{ip_v$OlG7vMfqKn&L+0#D?+=Pa7kHRl|u!Y!YL4*9T#kGd@5RKh1pmiO8Fh1 z9&X}bz9ckhX3KKbN_9MvTkT2O2jv^j5hr+>N8-?&yN$K!=hGjvGV=#(AT#W-rzHJM z=xOETJ#~LlR@47;bDIK3*Kk#n|J$7a{H*{&xdYkd(0MJuIfV^*KP-VuCT#Jpjfq@4 zv5*r#O~Rjt=lfy~<@r?cg3(UYXd%1_ITI=rb_BP7N~BgTuy5%TD+B9vQcMlwW4C@V zSnP%?C44dl<6T_(is%A}WLQ}$=V4}kS~ns{43}d!s(bbP2{M+RQ6`;)}D>Agiv$WQ0WBYY%C){x`16z8ZRk+puv&4b0QZ>`p=?d!Ji| zIIyK^ka7hU8==l#*kck>l5}bkTL}*bv5;n71#P8&A{v&7Q8Rdl7W=&Fn5qU61f5RA zYUl48166tJR${-5-!Pay7r2gZM83bR=t2zGU&{7^TgO%DagGULTj ztREzB&^1>!de@I63%Gd?h+>oIB$3BWzXP{mNEJN`xKHh(kl)BcYCnn$RdaG`JpnOD zQG=}s^)17cjw??iA?Z#hdSjXY|tN_BR3Erf%*7lSiQjR?T-Zgu;uKnC%TFmiRYdlhYkl z$Kf|#yFpMz;RKzepAU-Y15t+R1A;&W2GA7=+$K_mWGK%RTc<2{Qgx$-Wdq#f+_;M- zoouZ0t0mKz-UHczqsflqs>3b8g_L8Z=)Sy3|}hl_yRiVtNpOMr-ibUqE?3d1Cfzk z{QvQu2?AH4#%R^d;okq~>vhCni^&*?ZKKE#zaCW9nzLkWk#nPm5f91XhSCj)w?#M| znX29o)=vsbD80onzD&$8Kn4jf2w>_=nG>rZS8TFf8G`YeMg8x+g5S0vz@KPMtil?0XPkkijs@>r?itK4 zfaTZWZG5vUT!7X}cMftr^tG5-%wjgdB+pWPy7cC(r+ZheU89Ysz1QFj* z6e=KzJs2pwo~;Yl8G(R91MKSmK(Cn zME7-wZL0y9X9`7|^z+s`8=lb3GvIxO)53o*D;W!=}LYC7AZk19N$A^Y7(u zS#EeZ{?m_>^9AnKE)7p~AB(i_fLcc4=db)?Z2t#fauj(o(9`#dYcI-O_^x)nIAmW6 zUw%V|Q&AlAjz8I}sq7G=Io*~J}w_goCcWv%;EBuap0 z8rz=n@fU}wV9P;(vLnzxTh(W(&AF6Vn5T@Bh5Yf z?k?ZQWn6i<(*9RlM(?Egu8{dwnPO@rh1%-v#`nVN%Q8gOzwJlst10y%UN}_`-LOQy zguMhj9oIRZLp6=UTLRW`8W~u($7S+%HQTvQ=|!KZ<|g3a%@^7-x8sk6uO+co7pUr? zXu$~SkJ9MJG{IACSxgBJ`N+s@A6N-wVj$?&U*@utFQt16d;ohg*WS(208-H-`qVC5 z{DOn0a@=DiPe~UOl|r32o<}#n3l=;GunzV1a^_8u`%4M;p+ey1Wg-F?vT-p0mQY#1 zol?%glaU0l$&6y1vpDT{jZ4gO#Jwp9_O5mVEs1J?-ZG_R9Lx9#TnM9PawJ? z-@PI4Ot#ZPFS&n1ZcVt8M#%145{UD8LdIdQ9>5~URnTdIe4-L>eSf4X_u+||3IIz5 z#6b~so#ndPjsB+y%CLq}D^|p8p_JKvgS^$-v^*K#%q2cdSow@oo7o`L#8Bz_V1Ald9_@11Q6t49$KV)*#Y(B-A+*L!EP4 zY`z6(W~(8fOQ?~{)rt{BM|nhZa`;i1+U#ho_71Ln4A0)%Jk|++rOs48Ig%MGm|ut^ zxS098pTkd`axFaUVlle#>D9HT>417oH7sdCds}hx)1vExq`+!nUWBwK9L>1ip-#}q ztSovf%@I(9#{5bimfE)4Pl{%Q=u3b9KLM_v{2xgkARz1ae=S9G2odn&33LcjuP|SQ z3YG2>C`coGI^)uCZ#A{!3Z$5G=J`C(#T;m~Lq3Nxk@5T9^~zm8c#9vVEP({9$Jh57 zZ}ch$$+IsNvLuCsc5^T?8lGtDwarsQR#t;gWw9INDRg^%PtGWIt17!8x}=#xY}ivg z|3t@|_IxOq8;0_9Z3wVF>>#Z$2(U=-}Qw|s@{oeR<|Kc*9y{e*-Sm_dzZ z#URB~_hUDQm{i%#wtWdcR$h%h#?SopU+ax4qcXsoIxBuSxCH)GI+vzd2ag6OfA?=d zN|q3cGPJveDZa^bswf4rq2)GJC zeBDfC4>G&Z!!3d05c#h*zp#yGvtA@TWeR?dov}$3pY(S?{C7^{h76nam!(m>{~feI zE+Ck+L?-p)R)YIn-)fqrZ-h(L*D?8l55|#e={2q2!-J=_J#Rs5Cw&nAYWPFzD^|mqS!9v| zI*Z372!F=6j+xO5$b+mBQcfUo0w(9@J7qjOP*5n%&~OH%(JZcom*lw?*53K6mZ18Z zqrrFRAfAwt%fLe(STVO#age3wB32Z7ZNA2?UHVrIVR7`6NYhioz;r~JUk)pptBhe( z09I@-MEGo=FoZaV#uW$Tu1f~haHIoq%BrTW^uOX16{(!Dd1SQuU0k3qWo0n?`ajVM zQZ7fAG#FX@Vt~SC`&+rgyzlAp%8XM7;cRQ*^(Hq#B{cANdN*%BGz45C>RSmlQE#Bv z;*OKyvOi8~2~DSgpR7VKTGaLCuP35W3TGdIxI^lm^Db}`U4)10LW&;d=7uA>bg(F6VHJYwArGIM*K z=3yoIq{#3)1lqn%cKq&HEBhO4$#PB=+6u;jE@jlaw)LaqOk*?6rkRDEA*`6rde+K} zWor%qVcXCf`G*O!>N?ZR)N~wHU~%v?xNdhXIBV|HdR#sQ4b+agVleiKouoWQhhfik|W1C%|soxf8|Y)A^_3$*V570#;D zy!@re2haxqfomNArRqy+rus?0E{)gPb}<^OyfWRd{tUh|`kR4&bv{{9VY2{ThNj4d zVxKL=;=@PAOPO|d7hQM#7Jd~#j;x|Bi`pFpOvYDI6AZNkgn)oKxaDk6k4w#U3aBf>| z0}>+t{~jc}^bXDeh{^zIXAe8aZxEHJ4Om}EWk`r{y7z#Nu5yX4{0YzXzbDA@T7Qt| z-m5rkav z^a1$J0zbe}l04-2Vt|N)i(#8lawJg9Wx*gN2DYZU>$N(~UR*Pan(dv4-iTJ)PfbW{ zL15Puk_EspDQbFzVp2)6EA?xIF?0PK@E@ofjkV?ed&i}KcJqOBdrYVl3#JWzCa|vR z{HWOia7gYRoB?2qwFJU!7r&V&!fSD8T;m!RLaAo}zw?bXVG(UR_Z@p25JCVL#Vu$c zE4o)>=U$G2jZc|3-2>8^r!ekjhEZ_s?-||stG?83sDNIPVj3szMMUs36Gmo#an{ReIHCHb9^eqcPNP2kvo@)GZSs&JCeE4*b0} zNwdJs8n$Eozx#~=-EVB7z6ccFKfew4YCNP4b%1!V+78Yf)NIPZ(+~!&kA~RSOSxyZ z#|Q@vpzv}0eiF`>{WHaZl)s!h1k9eSTSK4Wwa1Ls`-FkR3je5zfv~Z9D*0~%sC$+Y zUAqGH?~jPf{ETlS-7Vo&B;b|Q->^aH_R9pggJH2^)bW!K`01aH6w#>K22Z>DJkz!W zAN?r2lh~>#-eGA`Akt3td$d#0o1CowoiJ|TBw{)FCt$bv!odSjGrTJ3c30IzuLo9P zsWZ(WPoq4(ncz5nH~|;e6>y1n6UGilB=`J4X%~Z+Rf#Pp>pXQH;Hr#j0A!6>V5$oC ziTFSr=?cWZ85e*CHv>$;*j{&-8B9HQf#|nOJ+U5*6oBcNFyL;-`1kIaf}PWUU*PDU zGD@9L^PvlXwYh^0LxDGNI-h}v>d2>_Cc^xwba7_!pX${E_`RY*ynIngA+jbASOoOFsN`+8|4(E5SF&;V z%**8u2m*fD0CYVKWEK-@!fs3oQ9r4l)X&((}k{9w?@h1Q@T4HH`Uc+E z(Aq%^s71~8TbC$9iE9914HCe1g_cKlL5pcqr|QSR`9wW;yzhJ6{}A&N4e2rN@4JIN!UwdYc_kRZZr#$PV~L_SHFUE%S8|+?Ck+AaL-K1pYhSRvP~8Sy{!`(lD=2C zdU$n^zOs(waeT4bZJuq&`k|gaPRMAN1l>k4e&7dOtY`2ziyy`>0U7-^RFNZWp}^ZM zFwu5ZL;hiqP{c3h0_qnRpYr>IGoNN%tNqkw&pn=nn{%FV%iIQBN-29#d>>LjMNT2C zk(kQ%r0pfeUEo^MKnhlC?RcsbjiSLOYHbG9LLTrwgKf*uN2V#D^PB-G>1z*c>!L9c z?R$XHyXsK4f_&vsvC9mme|3$9%zC6e8qA)l4FE-<+0wDgQ|8NQPyY%+R5x*}K#ych zf%s|K8+y%E28wk@BWrpYBhetEcYs=57yKp-owmpL;7ffw?YR`~YZT!}a0b@-v)I&j z51mUUUz9m70@;-ZL}{J|v<7~8ATXMkg{*L)To7Rp)BeDjir5;k&>gzSb&izxx5Yx_ zXin{@17GLI69$UNl*BnK?Iugt3>IqR)|iZsttao=C#^>ItM<_zxu^Lra_~BoTR@)tww+-!WC0Rrfp@NDo~Jw4R2Re^RK(qtoX_)USWie!b{spd zID$Gl0L2rT_w>t9VGhaBf3SDQT&Q`nIydB#ouVTFodgxMyrL^0ZM`DDfGi+T9bJ$5 zz~SBbbZ8i{5Mt1Q`vNIBR?}@u4f+mZ#6gcUm$3@ytErsP;_<_hU?U#A9VdIk8GNq~QstPk z%~DgdmSyN;P?4vWs{(rcjMG}!Of#EoCTst#;iMv&;;K@W%K?8vpZ>e@*TpX!d7iqU zzcRNAPlF${LEge2F{hyiVbDH@37h5%Wzi>D2|5gzkKAVILq=2I)A_8vO{ zz6ysKTFgsmE6&sHZ{n~;rCQNbK2YX6K$*As_J5c8ZQ#u4Gg!vI3qA7Np51~WNca4G zhM}G|$QdL?;(Yz5P~>|^rZ#VX0tnwPD2RPV_rPB=r>8^7^PJD`(z6GLyrJ;yTBjkr zl-0?(94yzK1X~J!hg=(C#1EAAwDJ}$e_lVOgp7WtLHWFz2g=!nRK!wBSgZuB)&h-Y zqjPs;LN7G^2*PiaF9%*lUyLUHIQh!l)OGrG+VW>d5?codxgcNXdNA$C;2hHhL(

      =N;C|xDloHRId^$_5A9}bJ#7DC8sW3^auz9As@?gFD0 zH$)Sy=MRjQI|J#QE{|6~=|PL(mXrbL5#yR{+6SIH+u&K|JO%R1Id4_7;im&L`fFBe zv!obP(x9F4(n_c7S$(*V?7csA+kPirk=7X!6@D$rIn@RB$g{NG+hZ#Y2Q||UE>O?Z zr0Uk}b+6~@5}FL%n0+r!j!PGzq-8~vIVhP#;cw%lt?Sg=41=2SR+Sl+WKAe4ER)*%5H_N3ldDy zuHW?sg2-Rq^7&h&wf=R)*2smFQ>=vIMoul`*-v5lI=gSpx}WcWH~iKKE{S4{9gI@Q z4y9C;CE{#KVOSh&|LPrJN$R5Q!Du7aXgix9rJOfi(O2`s5!j;~AocG5iOnK7BbureQ`dpTv4V?OY4mzwQ$<7Bli z@VE4R736TVUpN825Uyy>0mi|*xO8lGDzY|#Ql(wzgb_6&-$6UyWI+)Iq$?>tem?PN&a!EMu8E@#zKuWph zt?yDf%5kREyu+sK88?weKF%67$fmSzgXSv+Wyh;O-^GZ^I3tQ;V?%Otj3XH%@Z38| zh`oD4yXVS0NL2;g%ddr#bz#;N8tViJhSA8qM46iIQTh5@qmBUouix0|^gOc_KQJI` zYVaPIdp>;FxHp?6@#lNmeX+wg{J_lNMVd;!eq8umoL*f-?ZxZIPP{OL^JDd>LqpeAfqt{D_>{oH$Os^z*kZ)fr% zpIC>jNw)=%$UP@`#EZ>H>CQ;I!CzW_BkF0JCob<}7|A8rxIgQu!@q-W740E*NKASy zXMkS|s$#hpI7C-!h$xJ!^J9K6Va1Sj{LTizK`3bjJCW^=(ua~lvc?2kIxXkPhICdl zyHnLg)LbX&yx7Ic*R=%d$-6PXJ^WIjMosXN*XLub&pe|v6*jHwQlMyED2$f0YPVSMxm!8Bzp&?9UMbmDO-!rz)7YId75_4xeUN1W_Kj8^@wO!2fq^Kn?03&8O# z!74#SKi>n;d1}61x_C4__kmj&0{wAu$PDoOP6b+>`B3?`O#LL(I;I;L;)?|%>A*rA*#van=~kM$Lk{rgkve| zfOYS4A`T)Fo#`5T!W3tQr{zy&MP;6wUjK;75B<@J8xnnIg>gov;3a&uMt>yxK6j|} zBA47WXDPZp3LuNd`IF>fRf8CEzSD`U!JqE7T#hG<%%GE1z7ENLnqYcp)6Q*MfB(f% z*`Zp}4a{4?O2pa9>b5eS?cCT=BF^D%nsZ-@@Au%o55tSU<(vEM8~vn9$GDt^Cm1HV zH8s0ARzHu@1j*EKNM7Mze-h`xpuu++$$IClV3Yy%s)DHUfGP@@W$?l#cp$qXdy##R zbSq;Xy51MAC;irtK2L#Id-ms`8ea_09au=6Y;R+jD%#>w1oXq)f9NS+y&%RJ=U_$& zxxl(;-u$3F+MAc8?3@FQ+75P5H5~S2a@8xlT@JovN+V8*ZAi+wqq);tNyMvjq#-PE zScPylv|TdIjM`5X#lnigI=^#>4znfTrc7B&w-WSZ)a5Z?npKRq&yVp+bO2&b?zb%w z0gO3tcFYJVn!k5r3^daTT#7@XPr`ADJbM0s?&H}cP-9>0)8p^^!1j5AP0s+%k#@2( zJ)MUNQ1nuG*qL_AZ3PI1%fyH@&wsVbN-r-(C{s(|Da9J1D_o+{>?Ls~XP(X;(*-Ou zD);Dj`f)Hx^Q9APDHl@s_%J#79iX@wWae zc<@gMdYUe4WAbITzv3ps^ip?9d5@hQ!8qy(U#?ys^;CKm4Q@C+H|B$y6$a;eQ6#}= zhoQ7a7ZvPWaFU}e7r|Ol7@FNL_l^@}D}^}T50W1RaWg%~H7Sm$BRSME>0%ogur1m8 z88C5{%Fv=9Xob4RaQR_-Nk|^YpRW7U$*^FbCx44b?^aW3FDLlC1TZ!0rAgZD)9*cg z?KIHH$9&zRlwvD&kn+2bHWEBFd&)9bo5W~4)YjdOi%Ft`BMV4lMV=@$_%g!`$8 zgY_nFx66eY{OUW$&6@&Bfg$V`Ft~H4^+sVlQB#f1&Yr2_GvdyYHOqLHXo1QG{P9aCeCI^xp#7jV zyaS2l7tB#koUn->mb-;hGNBeFRBt7A!&TcviWd%wnU*^;sU}@{e|NIF!hqG5Tco_z z3{Mj5twCpXyQ+U+ZBz1nzdHO8)|Y z^dw0_TTJwoObtr}$k`JWGDC{+;q+ZH$!T{pbj$t1`bpsF-ui&RXo2W`fE5AF9^?(t zH(Mnr4&z!o7>+NG=Pd$>A~m1$IvNlrexyvMQSVS|$&Z==_1<{GAM~Vzd*bjWl;o<{ zTi-U0Vj5s8WdDYL+-!!1*ECq|l@*2G^7h|=>Hu`X-Rnd34|oAzb>URTM^(`T8f=YIS3e^)S? zsg+s1yf4Z0iIg(_?zT*MB2(Q%xs`SNBsB@Nyt>4hx$PIE=`}o?hrhzs3UOc-)Z^O_ z5Tx;}UXiTMIqgy!L;eE=XXO{>nS*#nMXNB=t&~{X;_$v#R4UwgCa;~m0eUd49BnMF zSrC4=Cmz_(ZTF_NTZsCO3S zd=JXBKn&0e_oas( zAN`g_GpbEGVG~dq_v!t@T|gH3@mmhY{dn7=g5IHxh}`l7oxyo6Wsmes;!WR?F#IVv z-z}K#6rM@xH4+A76oZF}4dp;$u`@$lH~kEs5k@$ELT+ciA;aTrz&%Vc*A91$72Ral zzj38Qh53bXW_+ZK)~}6EbrumA}V=lm^5}% zvEIfv2ZI+cf>GbDJfzxlAeCin9vyjuVX~nGz>@REkDW>=b3Y;;f$*_G0w#;lx_s_W z;AxmOjC!DHxq3z~A?s>kCK*~0M-P$))o&7eyn~%aZBRzG~Yo`s9CARNZP%)8ua& zNSVO1N2e2Pz?o4xBNSxd4XkU>ZQOqXc*!HtsBU@6Qzc=MuQw-S;tb1?51I73`Xz+UEsnd|mWmGV1M>wap;*@}GqlXm-e zlHq!if7>y#z)%_bK65;}Huh}I_HsJufvVsYYkl|N@EmjO62tKJ$mb*Neh+`q2QdeP zVaB!(_Ym;eP8MT!O^GU87O^f&ax=+cxq~?BtioiXTd$p{E%#pw{BmmLbNFojoQJMy zBvgu9-N~{jyju%Kbsb|TF?uXU4_`iq7M$}-49){}8NBug1Zg7*{exZ6Rh}5xFe*4p z$^djTTyY>@q|UwK6r|B6nB)1~t4PE(N^5nypC)A~o&0Vz^;UtMU1mr9^`I6K2gA&LkHJ`{@R)2(Ie=Xi(!i1Fz-<}yN#JFNB_~0m0_kJP1X&!R`akQWLefb@?a)V z%IWvN51v+$z(^N@|IGYyd!Yt}Z_-3mF$vs*Okeibj{rJ`L!XYxKEs_^fXTWWu7h<; zjdU>3Lr8Jub%&EUR1!Pf)G1#bIu)Ii{9eeptIW zov~hFfbU)z;2PZkM@p4jh70x#XNg5tUX?tq$4XmQdj|U`kIpwn++;9fGUXKlm4DKS zAxOrKo3->tU>h5Oq&zM)e4T<)E8!kzdoE6y`;bimAp0hmND!F#BA*NAxhh37QU;j% zsYl5VWeATrMcigq?%j|{$+P>cuO8bK_UQE;LlRPli4;&XKg)OPbMUvUYeg-=nN7m_ zrQ5lE=?FU12N-E5tr+CZlvAQlH5oTdtMEC?rJaSb;0q~d%Ec}9)B-b}R+-MB)i1V4 z98Uz8nYyGS+X2J#S zZUy+P-DBK-z%I9*s6m1B+qIXHoz@Jw4bIeOqEQby z&GkQcpi;$^YE{t5NbrP1Qv~>Wb8aAvN!Xqd8@b=@p`jqtk=Nn1@Ian!+qq#?lx{n? z&32S_1tBAk0bEflEwae^;c=o#W4cRV92A=KyckZ%cBxAa7M5)@ahI;c+lHkDs60`hcIBoerGGBqCKcWny+V zOikYjmVw?&jx)=wf6rv8ApemKf#gF8mYI~wF2NEW(5h@kJ4G_2Kn#t96{MauLyKO; zt_#>gPdh%E@2ErINAI2|A{^eS%em(2=aOkZiPSB1T@vUQw0(vsi%?Dt(GO=*Fe~d1 zb5oF0e`~UHTZyZPjJHN>L*@RlFf}H4q<$X^+)XL&6{E7vX!QQx8_l96H}`eWCHmIA z@nGE(f+Ciy;Bt82&nDpW6oPd)OV1`_%IvRh>kEqbwxtX14 zcU>aI*VgmRO>)&+Kcb$Xj636#1?w*saC`zkYPWfDipTnB8#4SrI-T6K7*!nd zld76`z6Ag4xTUnmZU{Uhk4px<^Yzmknyrp;msyDM!wR}boo@UFONV1% zcgYv$l_=qomk2WJFZw>1M)hRa*XS0Rwvr+uoA~bFFQiD+Z+va9RsT_ zK4AFnDlIZMi{f7;GmP>PtOzEyc?nLKKMJ+F!jPt;n&hOk+xrYaU)w491*yT|F!jKmB z%sHr1TyWwsS>U;x)P=ckO-70yu{8{KK;_>W(+J#-!UxRHz)HxtWVT+heSty|-9>_l zBq|$U*zD}Y$Ft~=!6Ds1wHpUfN;_Hwl4)V$BkUT@p3`Z9R{HJ6pX39(*O*VAo~3A6 zMi+sxV?|!7C-7kL!v_w`6&X+_wG*7gJa!G<7%Wb9-1pN_VoUl&xu6Y4NFNww?(VD> zeT}#_qFX}Zpi39Oci)Bs_-z8g$8-IkoLdq;Ml!jCq+CBuxW}t4i-7DPPp={Qr4zK3 z(T|KM_J>xTLZo3jD1QR6r;S>j-&FFasRZ4WUrGt$)+TL%W6lHYxYM~A<(yZOgFt}y z8wFiz!pS}G5b&ZjVxermco;d#pHp*0^vPSAWAS3onU+x>vH=E+mwn z4Wq4UO1?OZ$VA4Ls1A zdE`&vc?jk5!l8mcIcN*w_L5EpJA*lKVY^WoKo}uqQx|}I*^gsYUtM#evW9jS-yBqo zU1UgzC;so4zNs$g!jyz zD-05l8t9H7*d7O{vuXS42d&b=kM1)I^-YFi;M1|}L;&X3E{vyvDp}h+H4NW2)z_$t zsi8v=-x*$3gc~$!)1@(-P^$zS)HO0G90s>*z<~%d0RevV?moD^tA;Rj(4?~k{@&g; zM>s&J>qy}-&vhr))6iGL%cNR5>M;~X1#!*V7*XRQIAv!1+%M&&GfUDPi!&V z82gx4TyAvWnZ;VpZ5LWJ42P^F+U0NOZz3kT_b85(a#4vNU!i;p6@N7kV_YPWBtIUP zXr)E|NRIb3kIU=IQHUliozi8XD#SyojKCI^_*Oam-YspI{mkc|IRyc-_R`H4?~}3| zzjToD>`qrzSkYB9UroE<8t8dV4Q0ps(2V_o#5hIDje9MzjrIQC-osx|s69<*I->_T zvQq`Xp9TvCps0sifILt(Zmq3qa?HNXWBlA=C|g2QzU*(+Qeb7flSpSz2kK%nc1G5I zghM_P<6C_#amWLYci_CnPx7t|K>OdV*d8;cIJKpTY!7Vwb(oglaFwjh%R<4Zk(|pL zEM;y4((ZJ?eIG7h7+0w4qVih-gzMn+C@P_8kGq~vx;kw((?^(#N$%nhY|KlO3{u2C zc-JY$9&0T@%vKM#fWnzmYIQ-UG0<#IEhJB}Hqk{P;k91q_8p*B%vO1H3b)Qjt{e2- zJSH*9a$6&x=ree!$wtpv-c66TT`#B6#*Roy(ze1Tr)R50TP^FNu1MEN$?c#eqc>A| zQR_4!ZPD=-G)ZNZ5Bzjt5)DS%;7We38v#leJG}3vvEN3qR^bM8O$3GS(*8F@1>qI8 zgO+j^n!S2~OC;s&SH^=?UhMG+`L!|n4B+IvwF=ImVASPKbpsqRZ66{x=T8z>Qis8L z4+|zgl>c&lj{xh*rBcp&N(ds2^>W;nsl*edp2j92 zHsc4SWxIp0kthv{C ztn!nmr%QfLQXq%0q*%7h+=he1;&Yyp z=gfMkMA#L*zWFGQP?Dvg!J!`MN#Bpe7)w0ApHPe*ShOm`o|Mu>EqCap^4n#$(xbVv zrguSqEXWDdu_~o@ksnPy_erfogt15fZor=d9;f&5!uKk*-@A{4y97xRl%t?Rwk zaM=Y2d<-HmXYYqoYzhF;v?C(#O$d_&pA+&@d0E1 z${I^Zjdm|QMwiyFw0KxVlpM`z>IAXnzRx{Brl;iVztxW*J03SBD znXW8zfIHdB$5hXN>AxS43#>ycg-t#^{HSIDNiPZc9H8$qJ5~cr|7ee3lT&17aAhQT zJ||DP)H}b7wO|EvvGFb-a#=UDcG<6jt=!3a{FHSy*j?7oIeAgZq$n#?Cx!**w^Dj_ z$k)vIe#t=qg#X}#PX4|Y?0n^Ub1O38U!aw)G!XW{@T+6z2I4#iK>L_izJ$5dTIBK)uAYXP9sCCr&zT8cGqGXL->{V9J)-n zi}ee?7Fp-gyUaG-g}qq!Ti3ZRiEscQak&}l&YqeT`wcF5p$=$8!L*p}L>*zaKgMXi(p9g~&Ps5H1tzXgaJEaO&% z4`T@zVK(1Y0fIqIHiZXau_*1Fzj?TeR2t11(7Bx7)-D)0Rw8yZ(vCtHE3wwaVpoe7 zhs(vkBC`1L=a!U_t{s}NKk$WZIOJ_AbJw`$>1?aiQ~w^vjc&QX|1m>paXU2fIt|MY zahb9F-!HS1kdkJOO)C5y(#PAB--Ki%ZF?z;`vctD1Cj!81iJ_K5ysoc%aUuRseNY= z+yMJ3O7%%{dp&#tp+P+i+nhu7J1zK%pG_k*AS)(d_AcCF_SapVk%8N((>CAovMT*D zfv8H(6^(;wWVet2Cr7BJcP2ib&up;hPr-ZJPhrFooKXu4jvR&D)4O3 zdJWIqOfAJC2h3r6an3JwJP~*|T1axqz-IG9kod55zGBjH-{BZGrNeLcqSz^2$i-IT zsJwYCs)NAS4SD!Diiz}#zo8|o-A_9|A^t>#n%6R0F_`xUeKo>w^24Bvr8RVLQC8|y zv1g1{?ZS$CSrkJI>DS&744JQWuJshj1|f0!UlJ~;-835Mee^Th^jivA5QKMc@64xP zG%ZUrl?-ywQMP%3lj`;$Ji`K|CwlNEO%{GUlH`!WtM#}61*hKZ@pp^YbQF`{5aff z8WCUQvQ&r;vnexC3A`y|VQniTn(K;fiI15zn5}mr-1j#GrlMBEdGgF}7n6K}3>{5wwgLBPmuef=XzdGuMjUPyf>n$pcIw>Z!{OeA@v8`}>5W_MBN7 zR;AOsxW__Ngay4sJ5bNg~6=9f=E6tNNa9$=X zoP~rVklBpQ*4&_5@n5J7Y)w7nKW$acp~R2m#yB=9)Jaek*rhbXk@DAy4vGET5%0E0 zO=gllexV&=8WIN@G)Je2r2yIpChQY26@NSoq1pSa6;Nb{jxoO`*Yeor)^R{O`3S&QFJ04^_BH^5vC zE;Y+l(yGC+lJ^44NRF6(!AX2Bw(Hjf8M#pjnXjsN_;{vbNQdUPfv}Cb=O&ME8 zT&k`qN!NC5X{Wq#7+~mw-txZ%gz`PAq|AEWM@T0Dg_j%d750i)#@ecE$RDd%ZlkK` z1l%*YEZN{;X0P~dqVJg}L5(pczS4cK(5WTnT1oL3FDRW04Plb*)Q1V7Ngp_O8Dk() zB_^x5qV27sACtOVCi1eYOm4#KDxS~G|F`z0#l@=8kRwN5nKSv;lYi?4Y~`@`?NdJ( zvn}T31E28zOwT8NsUO;q&T_&zo~XpOfX#FTi3Y|3KJV_;3g9Cdt40z~`5CHwdOsnq zy=?%3m2Vu&Vx~cM@gD;f><&LS?%p1q)6uUlZ@Ki|@Wx-30gxY_^*!Fb!9B1RAg9pU zM5Uix$07M=D6E^g+=J`C{y3DwWQD7a1M*rgcJa@4d+y~aKOC)_e7>VY%S<(F$}y}T z{79tCzOTxH>&F{)5{_YFrQX6#=tNq-=FZ-^Z>ab{q7p`;7vL zq<$1X1o@K8rAybgZJw3Y>@`G`+m>~Zp!uYFNTZu7B|5~9w6S2(lO2{|S;@A&NhB4< zTXR}uu%9mJ?$eoGc=dUI90NBHssZ}va?JH++866L#-hQ%7PV{m40c860~Xyxow zwj7r6D{ygQHdX0rN9Q;}aXZ?KO{-LCTSp<$b8?r31Q~vy7oX+Am~4ltwNx7Z>pG-d zQ!l__^6R4pOD18VqsHh!l4wfnK9Wj%#fJ&e8O{Xg;kER}zqOnjLxoy)WPTbKeL1;u zkPpcC042l+gAK0f~mrIDb~`axg_6k$rrcbdh+vDFQ7A7yG9Ey3eH$XqgdUV ze#w;0t~xyswbh;cE!_m4jh3SKf;UA6X>JAygmj?yX4DMv>sj4jZHy|?)ys+q|Kc4c zo{Q*pf9pcGzd%Mg5WOy~h7zZ^%LmnWc>1qTl+_lOsHDZhpOuzE(*l95}$a$ zTteMDH*n6_dg1KhSD)#!tb)wwd;alxqebLN!W+E1_i8o(JyXPFjmJm{S7 z+s!(!FeWTiDUzHN_6EDrfnc zz%;FpPw^VpN%f;IvXMI;+pi+sBWV%BbrR7g-jkbT3oA-UqF>1Ri6jF&LNvbOo-TIa5mM1I3piZVN4TMMnBWq$`qc#!QHlfIGud=>r9FAw9^bV8eeT}g^I1_-7w>a@ar@gJq)^R$B!Ro?`V5ce@4`i7Ue3T$i-u8mvD7=dEFBvTQR}0#;?<>`|_03sQ3U z71^s^NnF9ZZHEAC)#pm%U3^otiD#jnJ^H>dXhs8n^kN_cutLnOor){y)hHk_M=UUokiM82V6CerRt(x_|D!6@eIMNEhnPQ5#eXMIO*`%|FA+L(;>Pc*We~=bF z3dtzK(ZMA2IZt-&KYV}n^IcJ~<{Q)rY*J@^rE{F{T-$+wd$-x+Z15y3uR*TRDw&>h z*7>56(+!Q|1&V~bZg=Hi94ZCn5{{+hcOYh6Ka5v5y3v|l!#(g>LnaZheB^aYr-_iw z;efO~j)tnA@WIoJetsmraQN913hgwFWPAQa?W?0Mu_ToSo!Vopny;9#TwMF6Y#G39 zFAmMB7vv4ewWSmXxP8psfmZc%_e~0Lm0k5*Q*2jR!OA{bPL$|xhe+#{_7B3THcL5n zb!M6L_g0@3(#sROTCjf~4fZVimS(18zLUSRAsw-8n}La`y@D2Aae%~vo@5>mSzRYL z6P6eJL!MO9@76~CX0{>4%wSEmC)pxGF!+$N?MQyB6B?n?t7l(U&Zzvdt<}z#lrE|B zw_Am9Uz|blpQP)V9Qda6B3J;in2zfI4}X(D`Ib*R`erOWM-HKWTYOFvMS_!VZS21d zmO*@T91_57;5-Ep;^8W^-w%W+Q(G?<7XonkzBgZeW9mR_4X204Aw~!~)#RqikV;&H5aaSOFo;dKyu7&3(XA1%j+wgS6iv{5hAcdMzMRfy|Blqg#-kQb@%Xf$ego)U-_-A&$MtKq}UUgMK zV9Pr3G41^(csu~%7mON+@h7lN|D1SSoC^qQ9flvYz-L~Q5(jDaQ+qmA|8(Gff}r1v zPj$jnoh40QR;h-+SG4NjgK^_o3iJjuB-6Ic0Z!0aZ31wFn*c&mQSSr<`PjPoa_yu1 z=HKo+IUF$iHEqgX_2Em~3QrvEg8P?|{2CEzlKS=KmuV9@OyO^yg#4}A@6^Hn>;Lyp zNnuq6XzP`305>2QTLqitXW$6sp0TcobOQ-BH_t(!95-N#@qsNGzs*eb>Fg?fm_6%V z>pVh<1b7Lpu+lb6^Uerz)HwjjJgYDt2&?SX#jEw_cOd+fkJt(P-_A`tWfU5Wja>*3nQ25d>&}9eedOi3{9YR#L;NLoSLXm$#>;%Z>RhpJ% zrVSu_Z42av^@1N(RmT4Y4vnmJ(GMpgB0KhjtXuLUq+1^9$tA@6R?5lbDO z>iThQ{6cKR7*in)-Iy)05E=}SeL&=6mh<}f&80(P?!C7-p3U4w*Um=1{y>@L{Qiz5D>Fpo&pGr zSHHoT7cpxh_7AtEd(wd72}tzjlch%H7YB=L2px591hvRCCD1pn0c8&tkONojM^)+e zx&b!h^!saS0ljv_c}MwwKkvZjuv!)v(nuinYs}njJYwf`PfG(AV1mDI6mov{7qE)$ zrOWoJct82B_Y~Z1;B7q}F>p(Ig;C>{Gf#w2|FG-W zkOWi7u~cV0qR5`MAv7K1y}Mv;-kn$nkTe$}G?rg8utdTqbZ&w*~KLg+*vd#)~--zEB0pC$@9Z<^-06p-_b=42M zL}K49guZ)L&>Du`9R`ctv}T&NVK7=(!elK21*I16KrTTV*fGuTfYqBhP}Hlpjy6f5 zY*|vWlzn>$=5bb(;j;k*%`-Et3K)k^*L49oM^4FBQP69YHoR;amPNh?F5@f+$GfY9rUH=I-`79g!}pVtgIt z7Y>x@9XD4KE!B)qNg(=eATE_Hb_;x=XBiDH`?j=4lI8Esx?|{^{bFy9m?b)t?d#2c zz0XLr7Xl$aSuo0eQtoFqr6A{y6v~eCal}J9+W^0?L)2}`ESZV^#mUapNL>F9?~S3) zcdnk`i%JK3ok6}H#GbA=1VoKZmo3{gRU1O<==vil1FTrO_L*OjsIW36YQr+UjTk&R>X!QO_#%)W)rgd>0?6I^_3Ud+?GA6w+@jAk z)}^gz#ci)fjDUQN*XPgmyiF2N!iQ=DO=wZ7*T@PnKh863h>p5+HX6R%FuxB-B)b+7 zao&Mmi+(670{|=qpMpc&1QHh8g8OC_y&C^NXBq!MqLsu5o^7Iay46cwsWpXKn-KF+ zg?}iqpbZgx%gCPd&s*$EPYYp8?N2DZ(#?Xrk%*8Mf;~Zd^hw+E6Q50*(bMQ4MG{Id z5NvCm{JGoz10$9Rsf#hH=mi@b>*GssDk}pHOuqtau_=k3eXIY9j*bqjY6f8xt~1Sk z(7(uR>t8XtWXc3LJ|)v=JaYAdYRGknhf0fp;L2# zi^QWW@BN`gJm&t36~qBcCFIJ^)CgKC~$=GwrBtY!Shn%NB%*$%u}T#=Yu|XBZ4Mw z$Kaibr@bnIjEW#t%{>AkgruPk4bHo4Jui{^Q+c`;#+$u79Jm!~l|h#A$KV0&`^EDQ_YckY;B^H_(UinkrwOE3>7&w2Vt+60r*4lB zOhKU4u(~fNyk6yKY6=+DNb9qYfJ|77g3aKC{dJevox1O5xcKlNAgpDoxza^Li4&bM z>;6U?TI(5Pud7(^Tz4(2Q~vJ0EARXGY8;M5lD;eGh2*4X*x0+1V1#Q)O+xoqI%}xS zNP#j3?^?(SxS{LE%%}7)N3v5pBayLn%!-rf)kq=jr^;(hTm-%Z#;C zcOaVH3DpL+bR(ZPO?f3tbSNxT!1cOP=vy!bV1l^oJ~>YqR;To7zda_rrqZW zvrl)qpNJQ$ipA(v-KSq)>zOVwp`xhC&VRQm$7w^Q*S7ltSH#pAgoJ5!q=i0x7C!3MOkC1E0BK>|;7yA@ zy#_ZZ!RGH`f+qn1Tghhk%H-q0A_v%ER9RV(9ILck{+fXb_}rT~3y(2l~a~!0*YN)~ z83)>ro`=WYV<8<+;hS}QsoM@-t^pXhUe2xn>dVd9e37I7d`<2(%;CN85op;=qFIx3 z&!E}0Ab_g)wMiQ%$QUR93A3Q*sD6sD4PA-#M1(EWfoR5Jv*+DE5YnG2*v-uR-MBr9 zXUdz@m2X8Q<>M@6lA&gCAR>H7CpEnM{S9b7$YAHjemLPttgur5&5>Co8uKuh?1k&gYhA0=)S}qIAp85BDgw0{6Q>e#HY?kna4I+5sSLrkqkj6 zOmjky=#Ejqx*2<;eFOZvYm7Fjp6w8MssO?0+ADF1h}gm!&I_;V!#o{9CQHA5wR%cmD0mcoTlq5V0=Z6$8nPE(&^fQTXhZaI_%8YGY>QB8AhY| zOii#);qKeT1K@bK!~wnm$KZ;Xa&QGp_ZvHoKi8Llh5Eo|;5hvCR|VacKZd_94ORjC zWCi%NwfVR$p!+x@zXUfzKk%{ZR}tDZMNr|@4kp#4TV_CLueC=msW51gs=qsL4tLNP z0bIBn<$OL!rx#p#G+g090Ec4(t5R1U5 z1B9Fqxy=KJ5a8&~1eu18biHSw?MO#>1Z-h$yb!KH=-g-$)_s6s_?qFLtK<$G#o-9m zZt$O3Bor7DDtxrEO6w<3Jh!rhjvr9w12S+m_uKqAOs;{Ui(S3b_F8gr*br;ydd42CY50p~T5Nj(KQ-lk0kr2f*2I>y~ zFc#hCbtFOQTZ{-UVYD&nG&!LRY^GL1cX51B)+{IVCiaudQPqTjRaYJ0A>hHphw@$b zO$M^cux8%?ORYzelo=sF-^5QX4sZ4 z0T*r#q$Zz)4IB<%FW=qtBEXv71%y)V-{ZlJ9{fc3_eA6W8tDWCk+DEYCV&+QI~YOA zW~RF@&K8S03p@elcfhBqws|f{T;5F=OlgeBp7%d9UL@ltjlac{hx$SYgh-_ z7n=f5;?3Rt_Fm#>p&aoX;GO6$zBTi6%knx4jrb|q3Lp_JJakqj@N0ei(mj3}cY|8p z6UxWlmmLjHlgc)@HpNqd5X7|OheW>Da{#Vvuw|5yCF&g16;is1;2?)tghhyAU_c=` zGjymxwdNd_8`6Do2rkm!I>N~&!W~)jASrhmkvZtZjUd-m)eq2%tI__DTnUgv$M_Bh zE@nb87muwvP*@vGHic0)&mgXu9}r^NkQAdD~Me1K<66VuYs-U1Z?k&9j;!}kEAhliqI z%3|wjAOnu4#9pMSKvSA3@S$J|$f0*c(qGm)@4ov!>vOX1hm1abcmFrhk%yXnaA|V~ ziSC8Lu-4=Ok|p0(Q~$9W!qE4yHiRDj@l?Le=cwlqT24;Py#0qDLCKTd4Q)39i7r1b zGNux5KijsC8C4eZb}(A5If!1i3Xr`pRL=pbnjMcTzmE z*2=MUxJ=5i8krc<&pmm|_8pf-wDHY{utvk>|MRNEyrw%k@D6AsB4TSOzicP&u4)0c z-|X_hSH%jV1|2gn4rOZZVf<=H(j>Lzd-qbMjU6>uuKy!*Aht|pq+A+bfdMz4M4LH- zlG>1}E2&+14|CG1AhF$^wR_DCw2}=-b!h_;>TMTYo#a~JeXzZeX#&0F!>V68oInPE z7qXRZ-Ds>QRl9ae@Mt60(CakOhyf`bUwU{Ww7n;X^U)aRCCOUT(pG_niudob%QHc6 zpL%&c?K!7(sOYc3SIy`9J6~4wP3Md&eg++~9UZ$N8B!~6PAS(GqVWt9CqiniTPw6b z-2p6bcUuwmhJO)(5jvnnopKa^8$|4P52@;TYic0MLYyu1AQ{y}`=B5V@9i(qYilcP zjB<8OIJBQMhu8=Wm)e@$;TB91Nv7P^lU$$J{U(@<>XKySNLiI*ylEqi*zLeRosU{d zm?ROOAIDT;>CNw?4m1ddBuYC0OCU9hRdj}sOZ5bsg2^rR5qTg{NtvXn!Q*Ow6NFZ$|1mESxHwKeDP`E4y!$`GTdM_ma^;Nfh0v0*&hh_f*s8#F^G&#i( zvnTu@;yGGq@44cGHe#cmD)$a&u-jD>#f1ICgT{9omp;ODG^<|*FP<6{1U>S^9ArmuU&TUIlo z^L6JoH^`3WaLx?d7NduP11tGfw6}@DrhY|a10%Zt*iy88ALGo6UhaTI`wENvO;e1#{4(XADuE2U>u2u;MIcH&rE zNj{-*hDEBN0os$I=eAP?t*}NOsl(4j{WWrL%f1U=1`g@Q~p9Z=Ykp>`!c5 z22n0Jw2SESy4<1?^g$2`qGWO34ikv(Fh8WPwgTj$O~2i9Xyo`Ey&htpV}(bCB-U;Z zQv^VCNm7Ib;o%)d83*7MvW_5l9O`z!n@m&Fimt%;Ga(&kh}8zSHD;S6|83Utlys>h zngq$`{&KodkFtC6K5g}8YJlRdeacKK#`fw3mm_L;Zq7)yEYpSsF4@MW=Y2DKoi%FZ}SK;sD+|+UA>W!#_v!t9#eHg|dok!<=r;{+d%5 z@zpe#+QcHC$|U$IW5;3I71oAJ)4S&=tjvdB-h<}qC@s1~ulU)j0__hOmuAja|4mpxb>x7jhE)?elB7fU z@6g38?ki7;plm^8X`>bhsB;}B3Q^HCNC@t&kdx?1mu8-VP(ht=4N8Gvac)9-w)64@ zDjCL~G{flQwX|f7V1`A_qqr%nmuqIr!3FUt56HPuEEM5Eqr}c9Yp3q*p|oD* zWEvdu!q|%>@6pCz<1fk6*dON_N<4SK*edZ!vl96BTy7}-kRgnWLK7{7AJ3jP5`oeoA#t;7^M{_JfAo4JQ_vQTs4a((D?IBkTnAFf~Ela&VJ6{e`reE@nzKKfH$ z9TeeW*(rAv!2mbTsIZzSseTJ32^=LOs@cP{FJ0Rtu)e7T1971_G^b~YcEXyZIH~PaQyXBzFmaX|)L!?dTwgCq6*(uqF!_QZl<47q~ ztOeje->bUoe&Ps0w~K0j|JewZ8`AmWbaL0@@yTNXQ~P0C@di^2#s==5Ir8u=*m`(z zbGE;i>vCu_W^9+ddNC9SeJUvhR4u*9ns)CG16+HU>9kx8VIb^&9D@pzTP9bb%%VZ# zG^$T)Zrjqy#*KQi-yd}?TdJz45lk5$h995(QkcOFg7tQiLX;#B?(+l4xWaERD$7$t z23$dKUKZ6Ky5MTdkpfx}c?HQm;dH5xiMt|ZB&rP^MjY<+aB82M!|^S)FYkoGvZ(qM zNJw)CR#u288x3+M!QZao_)6Ns)mB^-Q2N#P{Da!X*`g4(^^e)em)KO?&`h0{XbSXq zO*=ZG(%G^2poKc}A`q_2(}PNF{w?a){}uJ4`7Fz|nckq>f|t~Pw`A)W&I*9W02WAPV^zQY{ee@s_^7G*tfm}R2_yl-uklJouUQg_MN=Bq3t;wTR1#dX zR*Lc`va0B2U?6=4u%+@Yl@BX=Dcx;cSbH(AX@6JR%#5R%86nPn+;Gi>PX9)>;R@&j zbtV>QliA_D#oE_L3#3b#l*wUcglrK;vGLNRW!)^6`PiI?CpFIa-5-9_VJz~!9Z-o0 zWJJ4^>b3^l?mhJ%F~)iOa?>})U(u~1OPF3xi0!1wyIm1TO{Vf#qzQajBa6xmOyGCg zdZk$6!fxDq;b-K5n%YNV8JRtlZUD%Uc2dv8-pnNKw;O><06z`R&O+3l~@ZDLVLAw2dp_*OWOvfM- zgW@P+sYWFbSKMYr&ldT1JUF&Jbv4;|4a`8hz9L;4dA$cy zvf&-mz+2GOWrrvEXMt_3j@V_8 zd=FfJtB&rrd@DnUS*uWQuXHrE2<&wpi%*(Bk8r!HQr%v}IcpI|z@2nwl{Gg&-CtZJ|_N`eIA*kueb8Q|uY zST2oKF6*W)1uCE-^Y;&jb=75t#HX#Kj@Av<$B-%JZ-iwbc3+`yV? z$_~2qNYHY+-uyRV#a3TJ@o?Zw>At}EH4ld9o~Lfy!NUT!%B%Z^J%wJ43FT;u!r>AVR@vz65C3Nlyz#W7xUiwGv(;#dl zXoa)9h{I|Z=i^0Z0BD(4jcHbNJx3oIlr-oaCeiMc`|3lvh;TsuyV}O?O?gPkaA;p_ z8g`nS2h_MG>Z$7#iYt_c>|LS9){Wpw6}=x(IzS8PoNpB8)RR5}6xJk4GEzg9Cxzl}v|2P|=G)pvMF$`MpLj{y%iKz^v6IOzb0Y*k{%Y^f-Q zJgGi5lBeG0Xx`MnBy zS#js?I{Lbq=$QgAl`ag5QPZC~pb8z^u7a;A^LG(tXcVYBw`%RaOr-`B;|4)M6puAq zVD9o|f|LCjKH#dbmfHg94Uq$`9ib29#`%~_A}sjf_5oBC9al~%K|5S+yDL55q-yq( z@AU+?^&J}7Hr^p;_#8p(s~3V@V5OpMRGdJs_6WiCX7e_AOc`sJUirE==aKnX@?+hv zfx3K6WtRhELE&D5i6+hL>?IGIZ$J^gv)L=UsTw8f^8*)ZpI=VF=l?huqhv^Pfn^AV z%D;4~Q4A!6>NF$aRrpuPE5LU^+_7_}V(Xu3TvwV$-yl3J`ATX+C>~BQv_gFbhxH4^ zqT)WfJgcJVWT>2UojdeyPWM=(!k<}U$EZWZsZ z#eQabyRnb3_6t6Z(zluN`E$G5k1)prQ6@cSW`3OptfyB*ED_ z{yQ78Xb3bW(ZXx2-otd7WG>R^J>WD=bLG)3oh1UG)!-ABw@6%dq^#J75rC--j4_0e zjXx4mgo9_0Oq#bl$Mvy(x$uO)Gc-FpSWc9BvHHg~P$E`&Q{$Ka(6?iDlZGDlu(ZJ{tID)pu+UxHbh(+{?~cLwk<#P7z(CH14^a@Mp7A zzR4-!S(l0pmI%_umUxA~a}eTO745`m{as;CflylTFuvbJc7r&Jv1pGsSFCnv+4n&^g$qVzBLc;T;QeSCq)X23#|oXZBT9 z@500f7yu;D0!$`-DB%F^Fy8k2)%A&dA5+Vv@1H_{^Ym7ucR6E$NQY+YM?)I}{OV4= zd3}XSJL;0J=K?GwY~0pTEp!@{MVAsT&k^D|H?UQC*|9F7a+i=x9_Sr&I#Uj9e14O2 zWvEAa+DGaK!Xdckk>2k8x5EO!fisHI)XPzn{|;<0VHra=C;;p z91wxdu25aHb0AwhFL|ASty^nPgf+i)fj!gAdtOYg_LMC~TkI+^W(!M~%A>8g&7JV12{tV$VEoNwhH4nDX75nc_W2 zP{|0I*{!3rEJjpxoHp2?pEr*RSThjryU>|G{Y9^RN z$?{~P^S`Pmu1EN z%eJh|F7<-aoqZ4FFf|VzKI`66>%V`1jn9PVj6osIy_Wv5@#4ceQ%~}ZgB{vun!MWr zrH7(8Ewy)~q^h?^FKBlf7+Qwk{x>OsLRP~;0T>w$5ij;XfB>jq1w;iW`i@&~;rvs< zX19h(oVkBpu z1|6E*TpTvjT$<6rse!*KyD;I6(Pd=Et5O2vPoq2$JFMR7EBSaEu$M^)z)K-rPC)hf zVjxK}OK6Lt49G9y(FHtUlfLc`_XTv9>f76Z*GKYOMR%hWvvf+ZrJ$F|pD7gBxRD;W z26jzWv#T^xTsL}1oZbX;yYXzWaAIpmyd&vHMxXCMTYlPwmt4sl$kW!~CH8!+_SXMK zKfDn*YM8JJo9Q`V{DW&9;eeqxASB_B=r`5amzw$%RGKGmGv#3k48j$NXR3IQii-Z8R#GTEQXtrlNY}?0Waw>`nX3=_|srfrX*W(8roY0f!Uxx#;1MXl8K6t zSDk_mrFvb)UTakyJUHkQxwByESm`jVmk_uUgjIe8$en{T4`oN1W_r5~Zw`reLk2zU=rtxFT8 zM-tr)VdB~+?XWBEOTfTcO(5H96H2}0?+r(VYT>FX)(&vb%edvPfW>twqxM{K34%mc z{~|lcu@8Mp7g5J%aMOsduk|8B79W}UXi^~ZnnkmF0yN1O;1D-XCTr& zV15ukUp_>6*0&@x`LqDq`Qc|nIBo5VlvEK9KJ5#7r&w1>jTn!m(l_*yo-TBs?DyzV z&Jjybl$y(YjK3ShzX$c(q3%H45CP!8@lt{Y>x?vngTwF9H+;HqlOSUZi6NKvH^EtsXm{Br zXM}s-9Co1&3R*U-plwda0qN5iCK2-{_Pb$XXDL9D%K{J%iMAo zc!R6Bm2t-_i7yHGiOsA~Ik7ntEhZhlf{`dp1zgYoqATkDEzCVUp)U6Cg1V$;Tp7R6 z2_@`wAlcBnZb84@wHwN^k4jFHiiK$l?f=^owAQ6~_k1LNYxC^|($LGi7;}TKC_e=zW6h^#y7wN6Jf; z_6eV$4`Ss#z00_eELoMHt~hbVp#k~PT;XIfYAPb9qnc(W4jonQtZx6{QGEE>c2exj zqlAk|xk>rawOGnv6<)P>5}I9F8#tD-AW46IV#%NJ2EHI7DzSS^I;61uKn=}}cnUR*&&~U}gxbe`u0hhO=B=F&7!$?|4f(w1pWU8l7`n`X zqXJAH>_{<4&(i;P3vW=|WO}ipO2nI6H4N?V6H5|l3I@bE`i)1f6V#PH8G{k<-$_L( z%Fl)yJuDzCy~jR?+TLJ{)cUIJMcRu%@q6US4ia*81X1e{)+7msP;cRvh>YOY$@bd7 zW`c3_vR=6>brRcI(Z`o6>3qenr{s_&Ig?xi+MpzqtaM)`>V55%;K1syXpz5V3V(38 zs>@qEi`KaM+{gorXJ+G>^A_;b-7L^UGbwB;V@2{M+j{K&MH3{BlIMZ5)-tL)hL>oM zYg%<={(~4pGi(2L8m9L|f>K4<;`VJZ+!X04Cg4DWoPC-jheav1$y`uNYQfO+_Wu<04}`nbY0iMGQ!r zqhI3@^N2=(uC8KKLorlq!*2TE zb7-N-9%P80qiO5o(EFVVS+Nn1fK%9fUBJgnqbLDb%jRz{GoJOC{r-c#?`N|Cq*{i2 z&o)-(Cls<0klgZ~E^ABkAgEu!wlaSJ@OfzszIt!Ej1DkZPC9Bx|H7LTLYs5VdsqS1 z!YS1@Gv;!i&vHyH5y!3rg5EJwX3{0MgXkL?8D8(EY_LB|#)ctM)?77ZA}vx!;lM%J zOtEH;AdJFCp;!@q@nU*KA47ju_ka)N9zCN@9aT!%DE%p!%)YjST3yx~7Idvflru*&qcrQ#$HR{?F+nB0)b= z;oc9-n;Cye`&4WxOB32I+)H$?4wul3^xRb3sNSgD_y)*AoSLv#cW$RI9y5CN3tde$ zrx(tH>6F7D)u*U9*_30$he5MGGCVQ*aG)aUEs!k6L8JR}YKT~6o36A>C=0c$E8$_{ znUK8A^bLc#HO6DWZXz`A*9|lj>&8gxP6mN%0|WG2!%VoW7M#>aS)j}TtdnX0KTJ^4sw=kPT z(9(AR)3{ma*nJMo-NUE%@s|`J`RFoUwE6hd>+0n2r^6zCfsMZV`JPSV04u6@q~iljup%lU-Q6gX0@A5;2`b$oAq~=vpoDZviIPe;A|WZMG|~+M0@4Bk z?>Sv-J$vsT@P2R%21As4&g(k!h}%^ej`rnE6ko=!2fdrle8LGR_xT&yq)fhF9(Iu4rgekPZnD8=5fP(0x9kuZo+ysrp zLc0l^3i`Yq!hj3fezZmZ>c3jt!#cCQA2|6HCQIiBg>73L+uek*9hka$SQE|x zh2__fT_xs;BBr8!d;q2rd5V5;G>;TLUG-#ACk$C2}%s<;B@*igf2iQ`fsHP-|hI_wzlWBx@y! zp?6uc&>w(9t>*24B*XXZUKr^m^L!O(tpo9T_+eY?%QeocU$0r$M%)JFf{!H+HzmXl25S(KO2>~n7PO!Z0HIv;R7NVqD=?84|VkxF;U=hGM(km*6&8#en9ND`BGbTNFeO<1+Ha~Ft!`)+ zPaMD~Y(FF749elDAeenRLN4f(4XtaWAixHD0dl_f$(b%_9Eci&HZ{|(quT&mRqV@E|1(};F_~oq2$_M$LF)(+&l^6idB9a- zE)ci0Pbe0;g(8oaKU|^Db^)9!jbh&O37nzK9Alz@Q8eBbf&MxT7>^H&qg0LZ!-V}{ z7XRY?UoGyHuj$r-i8jD|yLKwt4;qIR$1ABMkB<<5?<^^h9&6S{3X%>|d97j*KFuo% zUy$lY8a5uS0-#0Mp79D;Edy_y525S;yIH*#?&9{T4?x@!`zOmxWu3vD{d6nBRq~&h zQw%YuYV<;($eO23v&ELDvV2tSpB$Mvjtf}limKYte^v4_i}Cuq;_K|h*uAeJ4F{<1 zTzxy74L+^360;#X&){!s(~e3(dZk4PsNK0quVAtYCkbDzf%Z;3dFfZ&e|UC6*3|69 z^!@!nv+M8gD@Z6XMXj_S)mW6qv)=x+Ew%>$;gsbh!x>6I&t45aA9{0c2HBRx8Rmuv zr$)O85lik(x!ZFC7Wb7_LmhSc@KUbbbG}0+-~el`af>&15px`E@CoaMzHs{!|HRcZ z+NWCu!*v}#UQaJriKf@Tz-K+UGe-H}2rNK>0kE42425f;i1!b9?TM7c%}3p6xy&P~ z$npy`Mc%Bv1pbbg3Sx1za&f{#)Th_rv*r!o>tOectzN&HLtnUKP4o|yu4u%y z--!hUR=tr|`o6F0ta?gFoSNHK4I=$DVh%Y}Vey~>)Spg*Q{i@y!7UNpS%6g*7s3ZU zAW*DE_<(|&l|z4iMLP(pw^k_#!=Ckd`$Q&Oh3P*4Urv0CX?z3&i~Z+v9?+86BGKpg z|9!g?7YfofCp$nn_UXMV`@ea~AhM(xM6*8m_v4010M)lEo;&cp{9Qs6kAsN%UEBPQ zp>AHr{{jb}S)6qaVL*x`Ed+_GXvgr3>>^Le_h{CCbfjtjQrWDls4DfsBzWk-C;?$x zex%0jZ`9T;+6M|=GD0}!(638|$X}f4U~=XPTuna2kAP9Tv%C}hKb|5Pu>|ag^qoPX zu8MwB=UcQN7!&e=qx5^Ium0YDjC*n!2rzWqB%B@N5Bb^)kd!!5e=54zC|Y%q5N3C< z2!zCwWb6MjMVLem0@=^O8{PlkyXFRRCd(649_IJRem4!0GhbW2T2?QV7Ssef4Nos4 zf%EQOJAFHlac$lxk3E%QpL;+C3*wv3pbkySHIG&Yo2L}rF6)@pPP-BiWPZkc z_*X5ljolMJu^w1+%SOBnCC;e(leA5sZ{_n8CZ8*j!dqN`xp@oc+h_fc{Kx_;N<^qc z&X<4=DP`*%w8zw!H&YY72q9RR7;ucjG!Z3wR!Pg5$iDz%BG9XfX$!A=jN&n~ZE-(E1cu#&K9Le+~ zL+}E*k(fCI1D+xJ-1+}K+6h^hQdG^#=-m77pnaC5wc}n!Gys9aeAp_Z&jvb(D*z@g z|8ieC*vjzY#+~` z*D}1Yn_v-${u7;mnNUW_;|Mqg$&f?8YbpKgOTNSK1S0`Q%yB{L^i>?emtn~|bt?nZ z9~5fg*dBOx;}VXrlnvtR4r490M65njApy?*S>bO&$9jYldH*H$U2x^hU|$ClV*RQt zu=S{+o{;L%^7%_WvPv_+m0EzBj|Z3u*)9mPuP;&8j_k&}qdRCu&7f^`7=}JD5xzr3 zFR2sYUOMr#VBAu^32SggZDW2&WOBJsQLj;L+ojPBWJ^VXcDRuY!1^(2`zb_vqx}SY z2C=@-FhBy~hm2xez_pI7u8tXS`LUM_h1dh=`|HsxXA2vuX+YW3SmpFDQO@Q$(;tvM z=z|5|lT{Lg_6AjV0-}`q2dMvttAu(@ykkEe+gRT76Z?_*d{CQ3usdc9322%w?lTgdk801r|6bo^9}U2gEN>Ic5|(v;VmOn zzIe?X54;fFXSn}|N%j0$uko33)D~+h*&FYt#Z*28+tl@)b)dG!oow(cqn)Kter$0i z1feJVtvbp#f!|^Uga_h61L-Yz)AR`gQXA9(jEgu4B5wU$O~u^jy~l^bJb!ize2(U% zp&$A#&_J84fq1jR`F)x`9(~umH`xfcAxd%%QStmT)`4oZ+|GQfqo6W&d6L$ax{6w? zuR{N89n9wT8@|ePBav%F?Mu8foH9OeqpTG?{aMlXYreHd`pk{*5dgZ7+m?+lP(bs#Vc0>6{n@e&^z4&v+j0F;*VKPv4t@=A zsMrXq*H}m!Gq%^RR{d@=FywaO#N8A#?Z<9AFJG|%^`t2oh()Q0 z2CK;n;V%i$Vm07rZ~4uFk*u|7SeOyZ2OZhuPoLWlu=w>pmMp^EeWw?s+b!n2qErFw zp2Sb&p+l^rM}i!Y@+UxGrguysFTI1jTg$QHBJEz`hrfikwO@;0+@!e_>1o(jAwlAn zCLFMcW-oujxGnFN))B~?$SmNy12&;~>^PXph?A;ewP#&2q*O%iWQ3#|a(BjrOpgu~ z1YsJwKaXNX&}(c|F{p>SPahSIYhHhU^7YC2pW_$GhLV!o_XLg^EX&fAjZNP3k#cT{ z_0&k}c^>>AIr1$s^I6y>(ii@H*27#1#t2`O(uGDY&fmTAZh|x0SQOS{US@cWw`_jg$2pna_O&QIdGolxV7$K?0CmZbOqe1@Z&S*M z+10HvSAgz!&J5+)?J^;#XNE!Ob#$dMtdC{P(;0HxsIFX3-v6d@G{{tr#<}m`nhnm( zE4Y@qYyydKQzYvBo^NPFKP1&U{~?ZhC^u+o8aEg9WDry~C!QfjbQQ3|n%wZb04G=io+wzkY#CXXWcCCDm9;s&+Ljk0>}6W_zv6Oh%E#HI9(Zj z^x!Tsy%8mkFQxJOQ^tOsfd3_pZ>_dbz*UUF)fMnI{e(aX`ru00h+X_~t^geZt%5>; z|JP~5Kog?{38sM;@H3W(K3eM7e^kjpZ$pn|BCl71#KdLQAeljt0@cU&(V9njDp!qJ z7RfBqjEm9@Kt#6Mj`F1fIb7AEc4t5d);NB4gf-M*?c+$fn|ne2rrVg zU{c%BX(Mm!m`*h+96Pi9lL>+#`V8EE>&62+%E3dPqx6w#TU~3P3`g>CPOX}@!Fq~o zJ^i?C?iY7fOkeK+U$;zF$fO8|^-leBGDW(zf!Rnf2^L6WM*%@Ml;m6(T+h!6sA<$Ml+7Xbom6hGwn>9 zrx`~K#9Y++2A1BiI}}O<~<#P2=XOA<`8pEzaEaJ2F>aj!Vn#I6PY!v zUp(f+HSV2Dr8ow4cbkJNJ8`qX#qH38>Ez)dm}#<=rlcQe-xxAJ2fs%0{cNP)7rTgU zI_;6a>^;O?ZT#ecG+t*IB)sUm$`MFR%K?$Qif1?O2A|0K`>GZY+hw8EWK#1Twe#!8 z9*`~Myt9~_*$v8A z-NBNeIKz-jrX8IIAsbQkXIbO1iPh+UqX zEd{Y91VMjH^w_I|NKxqaa;`fFPl`UIL(+-$GLY#l&`s1_UK*{%-lj9WFXyy##Iw)Q ziHSlIq#x8ikLXw!T)$A$AU2jB9DT6BbQZBeAwSfK&%rU9ZxOgk5-7ZhBCp)pZFjDv zGRduV+d=xA8`QQ{5ylQgacWdaBqIFcr=z+t~k^^Jd=Bl>CEFO?r znHKu}rWgCq)nzobXy?x`juWvMBn4r}^V1}#_P%AXUf3@?VAw}AFzbgDsrlfx-1s7k zF(7XHJKwu2ZO6ZlPwN#<9HI$6s^6_Z+Kk+%#TJj7GU%rHHZq|YSz8B?7=Ay(1Ro`r zeOoiQUx?Y3c~%5p`OzyxJ*R4HOI)tR#woCuj2Y>rr*T(fyDK`3pO5?)$Z9PwYZGMK zDVLOB+;orOt6z%SuOXf1D{541RGYmPZ9DLdSvkeb@(Q1-q>9XEarQ**FJh_2!58go z^$EQ~f3HrVhATk4r<)VqRWd1KVqD z{99YmN69xNr_iakMfDr2!;g~$D*S8Z$Z|yI>oA2IaVau? zpOaXwaif{s1mz&eCRkc3sEgh0CEsWyVqQY=B7IRy0{^mKr(Pw0kT#vQ5ms^+eGD*% zlMzXsney5&@gNMg=?p+qovRgU-Cpm1`}`Of(Cll(CPi$hrVWJRk;Y$~=wowy`Aow6 z9DNw1x!*tUSf)5oLYvp%{sbAlXhh)TGAaq3i0LLaYX?2B*ecH=_NVxoA2L4)_V>T4 zkG8ShbkW#%2-&!FbT9Vs>{iPrq&$0e&A1*tF+lTZ*k-)#BLk%r4&{UDjc3&z6Sc0l^R3f zGp~5cVZwtRSp4}^rLCQ5?UedVY9BX5rv96|+q>%yeZukF(foD63X7m{a6XJOpXerx z>b1|a&%DpWC-K(M_%*)udr3*nxk~gPWs~Sly3PCX79tXwQhqBQ7B?iz+l=q0y+VI= zU8~6e__CWFB7#^~@L7Z!6!KQisQ6+*hK+t6GaU85?p=6A9+42+ z_Yn?RV}C!eBk$cl;kAcv`Iu{q+jc+}3`MSAu9k&TK}X=u_E4!>{rd zE`7L#qKyY7XL;`X9i;wzhFq}7x4EhpfGs6|vc=kUqLldG?Glvypj%^io<=Y`^kak+ zy%`tX^LC3KKgE#L-%BR>!0*4#3epU6$!PyyqeWwkXlINJ@RA^?0z|lTyP^E1E{=nWdx#)RL8>B@Rn+igd9Gw1rc~YKd2c*b2)- zwpD&a-)y7OMon=4Qy1QEbU9RZ39}EQ2lDIhh6ZZsGD3=Mg zx}-~;LR!!Z+lvIUmjU8Ga4qIYqGeC<7(Hrki#S|{KAM~EE*)^B{n+2iZ{-xdX?t)& zF~%308^f%J%v6FDc>^vrz|4Ea3@avOb+XCN?^LX_j|+S%4?B3~&oa|@l=4*4*W>!S zHXs1hm|2~m>NVfPzz?-P4T8fpcnwg>T0YXo^4=k`xY5y-0^^-0oX)706bZFIN?}Bs z0s}FfKiT4nLto`SQ&pIMO?$matV10gWc<@y&;J$!JtOVc=V$ebKLaWiF8rnN408<8 z@h3xhK*>r`rv0vHwo!KfFSX-XYE#Z#7)t+j8!+wS^twMS z=+Kx%eqEs?vqxWztT1U8RHiIctpPfad7n8c-ERf$@1;z3^RK_%yCH?K$%%o*d3^IM zf?+B*efwGy*7s~#zmqnC2j9=bJyNyUbJMKKl!lI&+HL8|5Nwm4)cP+`RU%Pb+sQqw{HMdhv%MkUN*df6jTVgTuz&HlDpSE?E%?C%( z#@Z)~J{|hSXsMRts?SRUs$Dilr9DWpR=5TecapC(j}mz#(QQ?{m6Zl3gmT&%ylZkDdt}prezAkq05O5_Mp5(MD)1jeGkj#p!6d@O z{y(e$Ecjw?J=zTj&Y>Xwt?#IB{w_YIT}E%B1O|3?s$P_Nw9QP+iR%u22)Su2B;4r= zrXQN!vogMo+s_>V?@b?ynPt!n-YclbycLUu?^$ z%%EIb>%E+g7JDg34x__}if~Gg%3~=eF&_K!1MoUc&29Mj4V7CcC?->aTow;)=Y{J{ z{INrH22|RaZ(=?t-z^`?IDFPA4~pR}d#32cAkKEz)B{^SJTAMSX`EhSGK9WDS>Y^@ zQ{2OC&WYa1@Kx+kWecK#HPI-FCD#Md5?|DXlQ)Hc>!QQ9?kS(^Sjcq0W>oldAnWBt zrj|pz;M4DEQU2MOk~k&UHrWNrlq)ZdITo}_gFeePE!v^5RyN(@t;dmSc`g73K*z=4 zLFs&HmfQ$iWB5@w~l#PA`9}qnowAy>vVvDOU`ftaBoOPzDb>aU}As*wR zIAUUz&!L6NpjjKMKMx_R6jH49IUN5o1$-;tc&;7|Cmt0^`q4+@f^18dLceSy{xAi# zCVhkIKWY=rr`;)g=y^3<+NX=4pDx5rJU>5b(hc|65-qGRckd1q{8EdttXa4N?s0Bv z4Uh>_Eq;+I(aOxP>$Fup4B6=Kh@j|Uzeq|Sn_JM~cS5hxlEdgm{MAA=YsrYM&G2Ph zohk&tT04W^OxEp7O%N;uab^hksgD-WYOFSHdN7|wSVM;+N5H{hXceahX7kFXf;_is zV_!y7F)o1-(@q+=m+0Dh8D;IVnQmn5J%}r6|eMdtVq=JM;ER>P`TKAJ<8+j3X^j=h5PcGq@)2H5; zY5V)#z07JMA2|YQs<%z1C|_)^X%y*<<1dOz^QG_l^toeq!FY7?eFpVylu*2ojqCU~ z-(7~XC-VoIc8bwe`e=3GkRHvI&f~co>y5ib--czr+}B=s*8R?nRm$zv5o!H( z`h~UjjHTlwX3p5hEw_)UxffbXnx`?Pppyh%j9O=EOWeTp=1S&Tj)$U7Jm-lIvF*38EezNDrl4$5|k zH39F2+3aMV+*PFa)fDoTaN9;oRLB9m%jjLL2y|{}p|5uqIQyUyF2nO8N?A0Ln zE%ss;`;^24+f0uk1UGMC=B$%@*m z@Q@juK(>}h@7;<~HXa;5^qN?lCS>J^2%}CZ9%}8rcVt)!1Ur;QPR8+fhGD6D#G*Vm zn`^zZRwh)QUG!IxN8SCA$gVr#1*|eVLT=%_7d0eznIezz|tbQ%GuvS8^iiXq*bZeGca7=D-piJYbFRDJ)|5SU2Ibl+y z+mul=s_`!dq6JUxof3NNX{?3^qNfFR@4udZLVbL(aDlx*$cU6eqgrK;Ly1ZRB=Jzl zZoauEJ1AFyCJGYVij4GFou%=ZnC`fCrJW3@3^k2g?>yfU+qM2mN*}_#<#2x^)~D2= z4r&CzX$?DdsXeqmwjFpET;$y(rcpMhU^IIjGDfWeSt@6-JhVO~hED8~Eqz7l50-U@EV6?~MEeN{c5R|Dz z-2Dby)9XRI76EmAY{_d4zlcJZ4pV=l&8w2^<*6)Su38Z1HePPUN!no@?y zxKV@(n(q|mBw;MC$eNKh72dmT*tY*9NYU$YNQ9pP8F0npSc!gwp% z>WKmAJ_0Lx!bTs@? zEI+HVK{hCOGyZr=`cF7Sb|fIKJ$Z6aUse6@2!|+A0{@9Z^i)!IH?mn^^28(FCB^h) zOPNpf0Jpu87^$>Cvx~E%8jKJajrT~9ygY{Xi~X`%$Ovkf z_30GkNd>a3bwv@Y$zqDlN`V-I_5rdub;|$P{ZoWn2p)z?3 z5I?2LD_6AsIlS>lLSOI6>LowKwR`U30|Ih=Fp=p4Ukc~K{Ohe<9*=*6ji@7SPMPDA z;e53f&+-i}`UOv<<_4o#Or;ia#dcgd;YO0@ zCl@x2y5qsn9)4JSE5-4(w+P*%_=J$OXphlqd?mJNpCTvu96FZ1+XaOtaem+>{KsCJ zU%XL2xR+`Q)e|;Tq;l0$7Iq(zxk(>WugmMzu=sWT`2966+V2m=_{RD*NZ(iM`4~ve;swj2k>wE+R`r{}rj)M}Nhy!9tk4 zF!oHwys^8c$lXaPHL17Y`3C)6?ugo7z$+RT^lGzh_`hf`M2JoX>#w&~G5?NM);Upf zRC6UbCIPKn)c!c0oNWu~%v>*fAhH30tKmyF| zhvxQWjh#I}jOUtobWr|M{>vapyhF(za!>t*Y9!CVQW^VJ%6TiFkjj9qlhbc`kWTO)Q zw92|gD7`QtW*n5(dODu>fQDid=vq9;%1|`pj_C_++p3YDWq+JQJ#m99S><%n7^h2T z5!^?tZm_#7X=iox<>Q>D&n}!n7^tj%fZ(qDvekqj6=Uy~PB7VC4S$Qv@WTyPuX3O! zOd_@=R)C`&uk)NknV`H|Mmz-*cPk5#3U5=5My_`Hsa?CFNV*VH zN2()_Vm-K(D-gIVlid9{@cNMD8OF*Pv)D7SC(;B&4QqQ+S{H;33<4-IPX7bmn$60w|DWPSmX0kXFuhDA1;7D)!Db zC*HMzVyXZ2b8T-aUn$ynlL6?4uBE8S{(*g;`0A#Q{eb=3nof&tkMJ-|1ka%>#*!!7 zQF&C~?j|l8Rk@f)B=Y^)kg}~nR3<_FlW(FM$%l=y`1{*li8nUyMt%R(&+y`8Oq71- z-UG75)eStmGp~#S_lvrk{4K*MVcb7moJ#eJX44l7@L^K;Qo39|K0b(a? zgFhY^jN%!mul|I84On&k-mw#6@^wV|Wt7-SeuM0p{tmI%S$(~C?NwTh3?By2A12e1XF6|7T zCpR)uEiar>4rR%ehb7bLIt`8}TF`m=dDK@-_s!ihqSZ_)ILI zF+i-9;e<2$!JKGrMq5@>v{*o=mE$fCHl_PgXt2>L-X*6kfBrF1?qYTVevj3zHyhM% z>28YLBw$u5JrWt4In0pFu38N`Vw;^Xjgr{-vKRjWQ#81y!51J<6SK$;_DJv&&hCC8 z_mW=8Fu_Cz-j_ETu}uO>gOy#i`?X2c>B|%qa>5+1YFOH;Ba94{MWi}v0QT!UaCKXJ zJG=6}eOa5q>U6B@N=zq-XEv31y=>so&^Uy+hru@=YBlN|6}~-P-qEu--Meve)y?J? zS`+FK6E+D-aKzD!46b-dK}nOT9`=2?c6g%R%d1(}M?&F_?)5g^0Ntc;J3)`wcyzEGcB>UcPF%DLzdsD9q)3Jee3bRC?1rNs_&yZcbO2e4Y}hC zq+vnlN~i_(-mxhWycE3cgSKo|%;xNE-#T^g^-G6YhW<(K^>=I(Hrie34ImXPzosXk6|#gMq%>@F)HCdcYNZ6(S#{OM|)cT#6^ z=QdzZbh2t+`Ajje$M7!7r+loEJvr=I^$^hdp`BPQJx9@>9`$MV{X-ewX}4EGzw~LC z?P?h}Q+RjbMvHlyeiCs0Y0K;U{6`tRDl4kxKdy z2zrd1e={Cg-XoO)Vb`W1k&+0FH;M)o7T*jyQ$l*xL^(Fb z&snaWVE+)#-1cw0a)Q0oc%@MDt?632fmhFb3T!MgUY+5eMKd5nP~@5*`eeYh-d zsjy!eUnmo0&~zgLlBc06h|n_KCoYP}Q@T_81CLDHw|@IjyV!$KWszNL;!#=m%_EU_ zQ7$|ztA9+6W!Q|E$0e21cs1UX=5DZa<4dO~D<_FBR&-HXUmz$}22OWDlj) zC?sx=Jbz<$RI9bbKvc+X3-A&?$*4l3QlovC8UH3T>Ow21rq`lqgedEMBs*6FaP`T_ zj9A&g<0h@nwguWmGRKXzZqPa~-&-8t!;QowsnVcZqYBI9OwkgwRhJxQ3*68siz*MMZntAj<^odA0)yuc{W`?ss zS^NB~Qs5XJ6}uEe&MVJ8%O}(*22-(jc&w^ZdD^297RPs~LuCRd4Nnvcrxx(jguIrt zhf0m_Tfe=bSf#b=%08t6{9c{LtfqG5TG{#!#`B3m@+9F;5Ui9oBt+-k!b*bD0%FV> zqc^#KZz?~>t0l6Z1)(pE^zjvksgJ)>I(5<=>cr=0+Z!Y5b8Ro?X|{zn1MXnc;S>%Q z!9w(~{_nmZS@s@3f@o7t@@sB<;o6*B4VbwT;{^x0=vR5gM0OL5n|84G_7!@yxAi?J z$LqxWpPt@oqB2ywrNVPB>*$sJAeR8JzilJmEgWBys+RYOeSTF<4c#z|+^OVdCK zxJbLwF@<1gJ@n)Gukg1Z%G??b4Oj0AyE=T+<>Cc(!yb>OX#vXX?A5uUi?)pw9P6(s z7%DZ}(lI?LWW9Tar~W2i5f4IoM`Anqn|WA|5PoRw`=-jb7(&$2rBH z@c*3VaLLG~Nh;~B+DmxuL9?B{;UTdQLZqF+uqVXWhb$EO`0@9=8vCRIO&RxG3fsFW zbz62eJgw&`3k=*D(G^%`+Ks5WZ_W!j+nz8GNoQ&SgZoN*_x&M653>cYzgkJ(}1+ zn!PW#{Xf*~lOUuoi(M!W=?n@E#WbTL;-hRY;-TLx^`wnU(ye7M;H7F zq=1T~=Ua}B6&QE+URz{1W@(p`1(C>cfi;^Dt`gnyT;N27-OYis*+(jZ?Q`5>wViHI z@@hFn;)aJ@TEmLPXEg3C0V{)=v4X<#Fy*ldF0<)Jr>~_b8P&{V{J@~Y79$#mZa&nV zSiC6JS}wp&kWL>2#@>%k*VO)C{+cZx=iTB2@L-aQAg2rq5hXqF;B#%=Ic<7aa+z2{~i(68(ZuY*RK}u z-@oP%251{wNq; z8Axv|_t;ypi!pJeGa7c^*1le4S438#2M)5|#3tQ|8=ScuTYoqn&_=6YTnRMZL-~eM z+0@lt@zaiJfmIkzD-n96#!KwF-?%%nS)sL^l00@_2b20+m7p|?mc$r z#W}rbL6M-jOu|7!+?xJh&3_iY20M5GLt@#c&UukgX!d|j?l{#caP}H5yW98^l286h z)Q@tNc2;|WP009}qg@}*erb59_#LvOh`cz5;cM%c3D37Dx28W$+T*WOs&#wP)mB{Y znWl_2M|#ASGvnt=(j@xv72~lHcY2kl`?#Au?|pxA-dn@4C&TwyM!sye-AK%vhU=Sb z?7nmJZ_i@1HagrfoVNBMFJx_}gIZ~uNNlLw!2RFlTY3nBTin6x?n_o3Yw_rh^0%}G z(?vYWN2aeG=-Z5no$U`Pr}Eh{=3nSq8h9I;L|>lf=&-^d+SLU%z^=@r7F&Z5UWpqh z(Y7^HnW;_J$OsDWB3v7(rdP?g( z@yl_L82P4A4(96?S8hhQUX~{;(2|e$lb>kRX+j)ph2V zooR#Ehmu5Z*aYvi_*!XdO_+YArBH2Y895~XhPIJ`yO``1#9lnihZAAg2u=NkKbpsN z&a)Lb#SJwt};GLt0~8mq<4WwiOc@`J*?nkanqX7t17G=1Z$L@2uxTo#{Ip`0h8G-BGC1Vt=F! ztq`@*&wd0`LAvZCYk0G^@_F$>V-tyw7XQZLIeJ`~Smpb5>>5ILnCZ>_1{Z`VIfZZ z8N(pT=p(pOqeItAM!rhY7Pv;MHwq?<#RcNZ-LFj_-T4u?+yD81B7i{CZ}vLSZ^Q^a zkzERrzl3d9c~yiVMFZR z)wZMn0{+s?d=M49O%hOeLW5fn?jgA>M#k>J#1K95DP6rW;ZNcEho2y| zQiyof^?oli?L*9(R)=hy!gswNX)X_Xf55rCdHuuo>!%SPu3WZF9oeC*BCfjs&jYBs zU*P)%-2Kjc&t25KfY)%fJLM&Oz<7*+%IxvVoiKGACOG)=%Ci5x=KL$Dk6%B$PHRm} z6e^)%o5iu)zI+M`S#y#yM2rUE;b|=KbeH$rH=R`@{(MUPvFybiwEf_eJDdi2Qc$`r zXB**l>ASoEwB{i-DB=PDwUvjA+e}WyUGP2D{2@$E__eq?L~EB=)-)zKZSSMkBpeP` z)`v;B{7nR&OGU(X1&gACI!pBbJco}}kf>23#ZD}pfqg!%3xl{c1UcRZ6#_N!;}RB> zs(TWr0XofjF+>5e$el3jf7(J6B%!fMTj0(5V<28%4Gx%VRQ5VXcF^PpuWTJU>C72A z)mt9b{l9W9flptKg!<6q|ImL5LH@TNDWDcI>+ZnK=3A#X?0l!3!h45G=oy!mm^uq( z!13N{Ds*-N@mhegTTKbZB+)sl0k(h8o8O4>8+gIQm=ck&8o-AS8;4npG6;bFDczE^ zMXQ0lbLWBR!DE#SyNQHnN|Ok-Li7%M0lli|-!NjN-;4QSRo+VZHhMte%x2+kQMN^# zx^|g^uxZDQp#n|L3NR;40k;OWf_IjU>XH73SJcn_t2~LqVRRDa^GxR#J+fTvygf^Q zPjfpKcH9kKOD+cUb@WsB98$qA=q~mU4El!v)GAa`V4e@xU?g1PA-?UPLyn9BJP8@C zq5rMK!$ROmgaN@*T^)H6<=r(Os12ypubHqr!9;v@$sJyW7G?{$-s~1#zW^HT3P``) z1)rDHao893!Q#Yt5j?*hsBcx(IJ*c%7(tp_4d=%kA2nUr#?L&4j=k1iu`VO>54mef2RO_f;sFFcEE0o)!uYTj}Wj(IR-}S|AW*7 z=+I|&$LpZv4-^n1u|?xpWAizial6bbQe$E^Eh81NW3!=p4`=b4@lw%tWllZCKjD6n z#%DrK4YwLE&k@{dBRDIKc1_ZAl6Qv4a55Hny^3xMvF=%cNk7tx@TA(5%X6)T3FXJ~7$&XFWp`SVj?t%GB zDpxK*Ij2Zt-~<%D^#&bW!A?okpFkJ+TJ=;spw}I;d@`^yhV`BeNWcH!)r!TB2*9>c zx_&oa0bZ|Mf=r4Wf&tQY8Bw<#hIlu^RyF+4mmBfyF-}92{pcG+P67@xub~)v?*wau zNy4Vft0P+Dv7Zqr=Ty)$uE21NuiowciyQKUdq4oLv3?Wn5+$^rFXh`wKnH$*y*4!2fm3p;G!xNn9)i8G{ErD zhK4vXDu@c?h~^o7!9z|`JUjwjgi4w)Z!~bqS`a+Cy%~gDqx}aFM?0`0s0!No;8cgsWz5JMw|_7(-&Z+SI_c(qHv}1I*>r3N=aeI#zgWt6VLG1RqtZUGtfu zcW93(P_!E+wU>2mzdhKhOBCR_^eb{9#gxwbDhT=(9P(D3#=)Bg6; zX}rLfbm6P}g3MlX(>7OA-^IY6v&e0ejYZkQh38PL(*?|c3@PzPM7AVS6iYO44=H?$ z+^}iHref{MNGy7jW7d9ajYZXv22J*GeCqATp@ITvB@mM%zv6Z&cJ=;X_{pWwUc}Wz z+@3AJh0|ZDP)LO)vF*B6Mf-vy$Qfbeuf!}~v= zrEbyy@9ucegLlIndIe&iCa%t`$3u6u(>zY^Ly0cdH^8 zVG$Xp-e}dWGrQRPMtpXQII==ju_=^0kt+Y41MXCt6Z@8?mJv&J=68SGaYUmB0P`fm z$3hRHs@3d*CV?TRbCuX=3WylyFw;>C>H*TPHTcxhQMe)mgLWcKCBhQE0M%|ikR~vP zl)zK(CD(Yz2~olczZMIm9G^bKOHoy+ljGoPy0GrT#~_xMvre3bf=1a-ZrwmiB8B&R zfh`#cFN!Hq%ROrtdK)Z>nWd3uHWC8|;G_i8%jggA=LkU9W@nCkEa-(q6AtE9(09h{7FCPXpid z{Sehj84+>XFqfUO+~6`@P&VJadp(tk)3>>Dvs&$IR+{LU;NI_#lR6JScx5^6G4&?i zoHf-ju%|dG7tP?CC+Asy!C=u~}7JVE;3rqDk96O4^5ughrt8 zCDRqoGH;6^yG`HRqkyDT8RZ`5z9Efw*yjmh4xfN;Mmm8$bEWkp4AyYpk(R0Y1!)wr ztk}q`UXGEj0zsH7)9bf`fxj;PO<>S=)J*p&@P_ukX_)@c&&wrJBAz=q&}f91ALRl# zOeQ_;*S`TB#mY^y{aWuF^C$Xa|NEB%nYu1txn`z{(N~U-7h+A3Q}{sRII&!1B#n4mu6q5o!gdJ#0u`v)53QEo)_Qs{B2e5@XELvv{(WsULjD<|?lljY-C1|O_ z=f~gtR@!lb7r-=i>E(UxCQx+xy_zG0#xT_p5re4CB4+M3jx8WCfW1f(}K*re%s6&&&hzaf9dd>aVTWd^w z6?SFq#G_8Lpz&iW+Lds-bs$SN6>;(bpzdTQco2ukxvr{hW)3rjb(1{MdDo<*bM4s^ zQv3HZ&D?iiVBsb?gd5yA+k*1SKC}jlocET;LAZ47+4}VRmA7&H+^LkV4cexu_iaAj z^e~%zO}*yYDZ1w*muKkr>x0LypbWlVok<#7_Tlrxo(C(f@@}tjn5V5uwte>U%y*uU ztYLrTvTdoN9zR6$DjB<+)$2qZ;I>7wow^ofXx->}Bt0}y@$A#avVAhtoV_nt;vG(B zImLM&L{a|GUh*05ST!V_KRh_);N^@GoqjgE<37|=k+IP|#VO9Uh`sr=r+kvgzOH8d zz>x*51~G;PzHxecLK#c9HTg#E1wbN|lP5iAdx9Kl{}{F(E*4w zz#a&^X_o{-9Ta-tTMK+)`Dm#o=wdz~CB%)UCHdoaiR&6hApF!%P7$1|lKvEd1*P(v z`R#UWyuC9LQ|jD~8H3gt;1;=wpq z6mzoo=f{Q?t0fd@%ESyb!}mKd3pY#(O<@38DPYod0g1oN+H&_#Xh<`s+{hd(0qk`O zYNLy^En*r+&F9X%<}QD`S5*^P4iq1<`d{VPt!dFG{xk+x^a|?QPT}SMHC-Iaqej{v zpOx%^x2=X!eq9XfNiO)idFLQ$QI!lX>MzW}pR3Xe-yTG7UX&5qCte)+U1&0}toRsx z6^gDu%5KkP9klRye$25v0TzirDb?`bHWnTXJSZQ1*#=G~rfnZ$YbfNhZbpPAzY#`%Ng6fmidbeiJ0g59X%+lr z8eFv@J1Grj*~atC6RXBXTd2vTftkA43;BiL0oIPVpmF*!{|^2}C&&pz^~LBn8E>&m ztEq>Z61u^+(c?{zA8INwBr>6BABg+E-3u)DW~x+`miVU)3BUB384*sGMtV*9 z%kR73OBvb^w%5>WipLW3>1z!hpgoEN+Wyr6l%vmmDR&nu&78ocl}w~bGCJTV9wF1z zHN37Zkq=byby8}_26Sv5|!=}q+3dQ1JX!JH=MN{XU;j-i9hpWuDNu+{e5e# zcfIfP+z-N5c+vx|>oK8udH4EP>}qG`NMD@MeZ($t#rN-Q)82lU)!z`Wq`U?FcC@X& zg>YD%jd@=)vf&=E6g*v@4)ex7`Nu2=?a11w}^cb$dkTfIqj;~)hM)DsnNQP zTSM(I_u4aIYUA*&S{J^@VP8v&Uw+hm65h!kS31XxUv6*o&d42Aq-$C1@g5GXNvTnb zy4yvW;`E4aP!PJrJZVF3(?Ig!=5M5^+x4l=Ko*N|S2)!kL(w8el$%4hhx8f1Y*~h8 zI3qQrHJG255m(51nEPzxD>(=+g_S046T^U;(xXiQa}fi>SG-+QDIg|1 z8YnAGpsJph;&lFpD$|rhI5-ca@48J4bKnMBt~n+aB;yJM@e>^8$ClAx)xC`So+$8eK`$0ptIgF^uTh2^`Oyk`3MY z2_;Um+~V6{(xh*SrGz%;zBar9X_s3(JnneFoi!F9WiZ2TNdpR`1hU zR{N#_HZIcaHvt8ANiS~b^SI|{58IW+M?&=B7^v~QZ_2LjCU1iV;Y5smQ z+<5Staet1DSJEuBd~?e=%mz`IcjR@pVJJI5+~*-YTRl0*HJrS#h4d)MktplEvM zKr-J`P<%eaOoCM}QW(=(eh?f=yOFUH1O_pd>{K4>I7>G~T|tnV#1k#%`EV4dXH za4Nv*{fh_Y&;XxV(V89VPw~t-+d5)XJIG5C-D{7u+OK-M424+_dd@X^ortV9M9){Y&*y0ywN<_t{a$&*wO#!6KzX%?s39#= zd~xTbB7a6q&pUS(lXj~1W{Sj)_UO#`6NpixV8965LOMbj+2zzC;)U!cHDD{3NUW+I zQdp%2uqk+*EcA8eD+%W4t#{F%h3v}IR^4y(YYWB~jG+YqQ=+Peq;cH2W48z%e7mFB z64C?GKWwmTJ$=kCkRB;xQIPoCJ9#2V48h+*j|JS3^h+U(aWQw_GAX#A$n!90`pHEGt(rI@D~JhF9Wn zxSsxAsJ=mJs_qfAK0tZxSt&c|I9%sq?Hw^Th3u@v*)r@Jflg2GZ>aAp9+Rjb{Z)Mk zEoKsEQP>7i;5NvVyJOdwb)@|Mff4?7x#xlbZbG5SA-Yf|f%hv3pH4?6p9iY_N?6Pq zzIFnXgt||;m!FSY(AUXKV(^ZOWp_6TqwdZFxQcaTtka`u9Uqp*!n}Lm>1FWpA9s%M zv>voWqq>2nn@cOh58SkmzXpXwu$aBa7^H|OweSXHtSOJswNA=#c&u$(G1*h25wce9 zu0};2_Iw(d;MK43Yd_=S+aNW{^G~?&tht>m^f~mGIwSGPU%z@=0j+XO$Jj{w_-}7G zhS>jsB@PKE>wBNyr4`(2j_N2J6fGSZLo4Vfry(Y2z3_CQvjS6rJC}}&vTtaDd?0*N z%PBqLFz%Egev!^1bUMvi3|ta}=f6LIJb2OD?rTi7n6WfkP`Kg3!v@0Cgk~@}JtpT7 z3K`rHnZO8bmmTga=2`shGz_F(qGzqX=p;LQEk&Xv4jcX#XTW)&TQ1ORyrHixn%UNy zKhcV;uow8lT<(4G3D@*emnUMUK?6e$Hbi!c$pLoK&o;PI)Lus-5O11~f+TDc4@*H| ze)7H8!D1hGDXgx?%F$)Ph9m6tj-eG``_(^@1u>h$?1hw6w~YZdni-Z+YVx=)A2cu$ zxohj>y6IMk1)P_azL3gHbr@?E3$ z7d8IY+XM;YPbknqYaKyp_2rYn4ta{xqb*@z`l0fcF=-Kd`?piTYp6D_RA2VH@ud9; z=d(5;A$BuYQ`87Cl}2fN{+R@MI~@A)O4_YSQ}4^xoV~r~`7v_dbqpjT00bT?^=t-@ z39&!RwwzWvoi(%Ktp#jceIB$AHvv(TvYR!=?i4d9!MPQi?Fapc^!U$(;C87#%HH)qWqF!@j7JMXZX#LW{$t2q>qH0rkaS_2fcubd{qp8@z}xQ1D8-pJ z-jC|S(HTvt22odrpocQ>e&Va`^}(X7)nbrn`n?*_5j&sX&sW#zR#QX-^C?5BRcnk# zxn}a-+6)yqJ<>CK?%o%_d+*)-xq<$xMPI?0@X=By&Cz;Uk6nkNjNciM1@gEZw)ZQ# zxhn#ksjp~7DEuK}KLeEW^Ayvr+~y2Qs4LXJxX*5V1@Sg(4qm&hRaohC)_xXkQk1aj zALaS8(^vh$e$A6&jxvM?eTWk7J?#;Pp{&@Vib#!Uz^ik_&4mi{0{{P=aq;1zoVB2k zFxn}y#*!xRak`7UfihR*+$lmn=zn+`Hf>WXM>~S>sGw(TPv!1W?)VL`Np4AgE;WY&fb!q|95#X4zrc=ueB-8Cme+JySzuevs{d zQ42U@H)-XTxf5fNsuYY(C#jZgNX&0J4f-(KxguNy4bapdD(~SRczpQe>VoMBR9F-D zW$26T6UuWz|FIV&Y$2u8S@sE>3rRtD6Xtblq-+-N{zB9{fbGSd30p;wR6r@lu`d7} zhdDve6zvyThv|?wojHE`a~*1k%FXrF_Kt0LwsdPzgtmY}c8GZ)K8Z(cT%(2$zk3Be zTkGi{l$j!+hMJml2Mn<|K2rJhe0Xr#A0sdwZP9RL7p{Aml4 zixF4qLPIWUC{IUz)zK^2tMQ~8lf>kMRv{_+?ypytOh`e)%ZI!LTONw4bdge8yY5y)iZvk3Q>dB6r^CNcE%lh@;h`vV*df#il0d!PaXU8thmMmxr z(Cou;pBgi`%wd1K|7jpB&B27LrtZBhv$}ADjFviM%morcM3vz1i2OL#Y_;u#GwHk) zosk)xK@L)bWDFtGzl*H-2rNjNRsa-rab6|o=7ecenjP)QHocG|5ifb1192-iIf|~L zzf!xNiU$220w@T_KW9Q)M>dRxtfeu{wsCIVjWgnVES%p^&%Pr&6vRaa7zZ&u!}mhv zKr^&fx>eSCO;1g2=KT~U0jy9RBdChM+i*EC$?;-sw>j1L_4#+E!fO-m_Tr|24^~$# zZT4EDbj{<9&Rx1z7YCXAMPjz4_*D1!L2GwfE!{CP)wwO!Du;n-z_0o88?pIpIrpfg zc*R+nx%mFJ@%h(Kik(FwH#(si0`HMVpNn7Pam7^Di37*NRCLZ&>c+*m3rPpXz9;8KSg20(Z8jgu7Mplti+hKYb8|U8?X+kO{uO+???pvK zN2M}o(yTo55KpZ`J9l12-s~7A;w9RZ3Jc5}v2RfT-%X`y8zgPVmqBUzo4+5A^i!on zfBK|$oYdza*)hrzU$plQC$qsgQEp)_F#H5@;SHxYg)L>3@}uTFk@+Ei|9b{X4mr>q znef$aZTc<5AG)_V)pb#ga;NAv(jXhOdls)AFn;eLBsR0?x0K)0A$RN2f}BBc3<#i)<1}5 zoC#x@@j2Pdj);3p48y>_`Y${2E()?}YNuv3fY9x4#hFjsX$U&N&edccfV5K~?q{KQ zIKQvO^^fU8HwK@r^Xo~|x4Qe>VPdS}YI7Yy7<4o(G*Q`;5MpP`^4_=Us_c){{^>)eRWoYf0gwUG!}S3rPkf20I9WphJ*Y#G(gus(o@jx*Hs!hU6~yqaPd44`i6CuETSPf1uYp-d4huAAULt9jE_>r2 z7b#F7jcFQ>Br9w=k$y|>0 zx6V7_Dr}ufq;DZ%g6?~P7`ggfbK&=BNk4GwS6BWDZOAX!H+7RraE{pHYJAG;zLZm% zqUqs6gq^_ov-_P7C(bn@-#i#Q9r_m zo>1x<`=aS1fti6UAJb!?H|N^F8mQr$-^*@RQ2a^kIl6um_+b4N4{}$!|7>p%r>BMo zQuBlF(@xMmI!Fy8w9Doo=J3U6c8=M$HK2PD_s3=CN`ClSkrcG)qT~hrzK-=`X??nV z^qF2OcPjaaL+M^d6&pPA)_Td%6Y29V6-MGpdK=#0%bct5kRW}LuIa6|k1#V~Nm!vG z%+TWMz*u|Bdd_=Q*yWoqu9#}2I&(p)*UYEY0W6;VqJiS!8@`HcYZmg6otY(G!TG^7 zSQ>9t#?-<2iF!P_>a-^z^?aMp!Gi7UjQ4@xYqadkTrZ|;T|jI_6xFs}^}}scNje5Z z-1xV2N&d(*p@ZG4(=oQy;=qT~2Uk03n`=y{367jfq-!-l;4>y1!$sL7iVoc7cbQci zzwul3rqD4DsywW`9idce)%UOx3S;QYR&!!em!OCw?-cgDeP-}i^Jg;S-gysf@-Oyl^TkK-UoMjV{G7)x}U z#IQ8r9bW52kT8gC%J-AJN=`B64>oycfF8g_d#IEA27%{4ktl;*)6SjS2rA&OxPpAG z^^wp>hD^<9`UT+u(T(vko~ZaZoA_W(w^YzTcnQDf`=5(11X+Njq)3;Nm4{n|uV|B! z`cRklah;ledm9_$%zzd8RCZBTC`c__>IKn$lq$$9g@){-v#7)rg3N6U6EpSKGAfJp z34<(%r)&s&dQmUNLnnk)bXE4BBPFwr=)I|qeJ}?uPkMGmKnt@pXbBT-*zWMESFH_t7T${0 z(z}6VG)J#wHn2l_o{`GtvQdfCcV)kE#vtaz;bNv+7{}bd4oxKNyi7LoQs%j6Hic`2 z)Mvw6(on_&Ebv&f_5Y-=i(rPa-mcIUg0^xk+@|XwmJsc*eB$rDgGSgJL*H|+(1*RY z-B5Ey@>HQmxU~$g{{&ASnnw2F694n#jEq6nX#~*ytEmt zR8IubLqnnhQuOk5zq=Sz+#eZZ$j~B&P3=cn5akO**%*E;kp&4Dqe_nZ=mYl%Yq)f+ z?^@ZHfrIoA}PrRSQ>g2Zw9YU{}XWL%np( z+GWRB?0lTrJfW$GI@^(Sm|B`Gc@Il6dUYgE)OaKL{Vcj}^QV0JIhMhL zDX!*D*5mh3Si`Pot|}K85YAym>18GaID*5hjQXlj zhYz1T!5s%X-c27p`KYj~Tm+NI?31|DwKTD%X1AVgk!4q*87QGp1=pl>*rG^WPbvrb zVqJ$!8|DmWOJ$5mTe+{2bsi5S-@hWK!p{aPwJ5wSsg2KdHSTTB2-V>@$Y>Fn5^ol09_$L#%rkU%u+=~a-ej79H42g_0dMa`Q z(?@NX+K>9wFUxMww$L?3!{_N{Vr~2ie{B zwv|eDC=ylJ(4f1hpjLPj6bgsbMER%;`MzoM+Pz&5;IRm}a zFsTP4s0ynX?aWLCadC-bd;|AZ2hy!WOP7sRzy;(c0b4#HMqh+Ny5$H7 z|KY4=kJ}HmvywLL?Ia`e@Mq%y#^N9`P79<%OQtZlhc}Fs3#~!U9MqPH7<_nPCOhA4 z156JaodMadJNthsr3Ry=C_l0K6;1~Y2|pLT6awW8H^kyzu{Q2&Jwo{`QV5^I+W~y! zA`Z6<Q>o!h1iJ87Ua#)7_f zHQon4W40nI5=RW1`q39Wk|l)_z!eaStt1rUb3^g@hA_WqtqwUvM`(0Naxxoh(`nvq zwP&cONOs(Wy`)HJ9k)Z^PgQpC4F;OpPahevDCl)7p1%h`Z@v4QaUN-}Z;kv!iU;CN z?9~g^RMIZ9XIfibiBHz0aclg%eAoMGGEL*tkEWNBpbb04AJZ@+(>&#tB?mT7G8~e0 znks%FygjJ$yS}*;CQfwY!0@gJ8%VfXJW>JrWGJ;2_$kq~r_ zIWrk~XO&*TmU1k9elZ~eWP1eERT3N+3rW=jo&k?2!&9FyqO0uWFe&D~8!-;`$MjzE zyP4#Z)rV8}c^h-Ja<{AKoQ00Bv0+ab}PX2Zw5s$IxZO3o9^ir~|+3cBonh^bIz;A|z)S_Bo>#Wj6T zPP(6XMnmPV)Ad-k)@{^sAk*U)7%x_D3L?zKEkV8_tTe-%0kh(fBbb6uJ1f0GatLp+ zflD#;OX{e=waE{>zAhOZ7Kt?j#h=<5n7W*c)4(*)5e=rjU~#XANI6oNa|W9?gH}Hvv*UWjettdShu8V);;e za<7wsTMnW8!BG@sTg{qW^XJ}9AXe*b56A!>^Bvzyr8!g*npC^`aiAU+7&do~UJ=oT zqc0J|oQ4N>1Q%-?dJ=AnTjp#qVS&{LBQTbQPlQOPxZ6D17c%6x*$xN+bO>^b}UoIre@mx$ z*SKDwHZZ&Y&1B`x>>B&lH|UpIXaqQv)SpVc(&{%&aiIs1;{C1SrhubvHJL(M#V$vg z2!JhLuCdw|&$D{vpQ#o@EKXpy=_56d!SJV?dV&mD0);5hzl;;oN=o=B7A8D@J(K#U%+;jX`S5~m|=EXdk@q_Q)hSj(*?ksvsKBJPD& z*eD+xWO;D+A--@4A2@?tdK+p2=lIe81YiCAc$G{OINI+sJfY)8hu);@Qa?prjHY z;YCapmTDPSwEecWl{-HV)b0;tD|ATuRsMczrCff~MW$f8?xfD@tN7q&qP3#Eoc{2f z==)#_R6g~4mtyKdruGWVWYUhX-f1&^HOK_1uw@d%LaTEd$$`;JOKyapt_M@d@M=8^ z-0V3dEPR5?L3!(`{d8s7Fx{(VqFb?ZWQXJHS7jm5AFvDigRwVJ&4MKRv)M5Phj?X$ z$y$qkpo-t~b%=SNiG)bM)QjS{nKwi*HNSk6rqZb9n&p zG%3gD4V{#`kwR|6WL~(V>Qzs)H4aCWWnU6(ACt2>Mv6!&(?k!P&|kU>-wD}_wEylu zb;Cg8S5T#=?MrL&&NM%HWr|_giHD8FLurIf40~nl=~4Q<@4z4ByXg8I<%QI;Vsu3* zJU``nLF@08NfsjDZ%NNbR@@@rZXk>8q8MF)C(&p8!F>V9%X-0&s)Xh$mVt5M*Y+Fv z@R{kXkN^0#kiO`L3RzIgFnuA`t1WbMXO@7ALNH=DOFCZmLX>>zCTX=#z|d8GOVhM< zXvvnVcIed7p*S+8ZEVlhL!30vCjfjbr_cbq&GD8<3bCXIEt{rm#X+JH$EB{_=ywnX z3riTzPl=PMVPfJu;%GKA3ihf=&zq{aYdW>jRU%RBa}d}y>`Ci`w~Z$mxO*iHEI#BW ztFy8XSxl6(U$i{#yiIDJ{S0UEZkUHhpmLmN`Ds_}Eskf*b`i@)O&E2crK2sGp!<*(xz-t2(cj1YIM|~&0(eF`OxxFC!_`OI3`0V`# zxc*raK`_3k$I*@H$08unq zXFDary-*!<9Kl00sOnVDsbmBt8`Y^bT>r)6cd^2D(C638??E@xQCK${`={A9RwjJ0 zVYrs^jwkh{UQuNlknqZm)=n`pBBEWc&37Kw#{0t?2JKzca`FdUex{xMcp>=f^DVWB zri+w;Xe#qvU%p>F2mRe&)!!a@@abpjj+!r5o1-JVO~8^wyjloI5WwaRHZ6EuZF7cY}Qb<6>6y_+ke^ty4g()dJV zv`gw~?zTX2cuOdf1|P?CdtR3=$vyi0JANJEzM=0n2Quh|AYxRA#bG2{3~Ejk!6#ka zQA@Jo&rZ!2BdQ$!(1hbP5^CJSFNf-+iD!ttkdz+d7lhvL$&;%eQUDch!QTH|=z^O{ z*2-af%D7(F;IRuk+AUPh1TFg}53PyC4J6{bPhRrYC(@RKEr6|m5zU`~iXA`jKulKY zgXgQfn;^P3jfW$u5(*hhsc)Pxzj^~ze_=kqTmGIgos48S@y-!;qz4QdgV0;RGEE92ZBjaNEUDk@#CV6xA zShYLuVk;XimiJTw@}t^5w@6v*ET6liQxkmy2X$J39CyjdUf{(7IhRJM6m7>CQ8D|I z9pxLIa5qp9-L|GwyiL+37gAAt&vVL^m;%g*q*sw6AC+97$8{2im$QGzQ7nBVkncjn zLK;S$5LDYQtNeC9c&~vHu21SJCYX>~n}b7=5Q_95f9;5JB@G5*TG`L94f}xWV5L@~ z;I%kLk$n}zKdzIpnvbz*cUk6PFi&`jgL6zIzHTblVJThpbkjY>&N|0h-)~8)a*W|Jz z7o{8F#aPfP<$iYa_|>y)qL7zZ!(eRtF~$c}4~fSc#RIuxUvn7{_2|BMAC)d}Wl8$N z)_=y-(<8!)hi6~VaZxB(R|5mXGq}F;=0VMS{^)mOgLY1>@2nDmF!`C^Mx6M7;^3?~ zfzQwTqgkd*ppd=3*tj*&@OaK_eERxD#c)htBOm^@cy}$~yUGu#k|&&_CzJeEV*@8; z6E~Mj9)dfLgJx@6(SH=H4;?O(C%Sb@u13Wq?1+lJjZWU{zU(L#j)KBOrcPtN45ZD_ z?lo6l^9|0sR;FH`R^`vu-&j{u2@e~2+;A+6%jX<-<sYEDbPpNUVH81tpI)12)w;>4H2$sT5IUl4#SB zZLzeTA&8t1i6B)f(fJtc7y)gvpQ%pL;B@;5x-lIBcY}FrqjxguZmpQo`b$mAHS@?B zgfwDNJHGkKwvfun0F?)Z0CsP@)Pzc%W)nOqor_LY6x$7`>hP#0FZ!3Fgy-Muf-$ta zzc3cQ<@1p7gozREU}4uF-qLe-s<5-!9vAN7P9~L;z1_X!e3(H%W*JTPQsdrkWurQyMcHh#1b7_!1mx3`QZ5m3R@*sz_KY0(I{~ z`ZHVTk26jMo>({!pc^RFs(qidXMs-)p=X2xj2_e^1-_^PpEa(%Hp7w--D-7*s$BCd zXc;&!ou?~%r(_Mu%PpXlrPTA6DH3T?Etm&I%ahiJ>>QThr{#rGjR~v7&lrEQO58PO z8Df&p5+lm8w4U?{w|I{tR`Ks)~*xgRm=(5*94l-(>+ORH*c+f&DknRMJp`j244cn>0 zHlC9L5j{SFwM?J=P(!IG=P7b>#S(7DuU5l1Z+s2tat9TN3M~GL&*L%^lR(={7=0b9 z{LaJ|eAS|8Mhzf9?_38xm9zI?EIS^8R&U5vyJruVYWJ@VgmC;|LF}tD*E=@dK$dX4 ztU`oBh+z~ABvt^Sf9>}q>|7GZzrY#1~ct|u$C%7};L3{}hAt-@nOL(=n1Y*rF(?64D$HQ3`zv?;RgQ!z(teYz0j*r1kt^v8NJ zUEEZr-E^-%16VPT(kDmJXrB(QhF(S{iPv(wz-`HMr%IBCY#}L*ziE*yp*bt7#uA}G zLG5!hCkYukbDaA`h?HXfj5F_X0n(!nw8H^zOVsbq z02}M&MER`iP;5miWQpX*J0ba$hEj5ry(qcK!ywbq_W9c0tCdc#!(GgoCO|K*swoBhDs3tB`P(7 zgD$<{_<(CEYz>SHJ1K7hLV7R!8H%%h>b|Kf4Cg#}T)H|HNy*=;(Betqf?$Tv$n^Dj z2UoqoD=6g&T+t)iz@A@1I(r7?kR#0fg>9+a7>{R*2^$kEJ>$W4oGYB}UU9G=CB(3t znBmR;Y)ZEop?PX&K*f4R=U5`)lq}Yk@1hY2xXEL@B8h>JFDW?zVtYaH~(zn)~ zY8h@sToSw5S@)Zv_I3kEGt7wkEfFmBflR%;qXR?OGw+rQwlKNx9b-dC)os)Rv*D;| zLdnaan$Mh0DKR(;VT3XgQ7IPtvC_BcYSFe}efr05B>eejAGmqD;0fk$~$(~{qq;<<4L(*8f zHC6~tj0N%)w(v$VS#l$T7BUKz=c}qZEWsJn2_S@aSZ}Ti{3~&E4C>xTb0qG12Tf1> zoLm$r4dOp=#fwl)JljVO`el2-E&h^a0vaZD_Sdkwa=~0_5hisd`{p%$_-@$w+sbhr zB4B9&r9+tG=4)fKSp11jo&L7Zi6QIJfb=eh$FMAQ`3Aa%!%V3ps#FE$JK{27Z^ZoF z#Kr1rTWdtx2|dh9yp0c+*Xzr?f@|j|g4Sf4^y@*YewPWF zm(>sUcq)E&ISf#pMDraqo%Ji&&N|tTt`!V_u+T^A_jy^F>Np@?`#hE|1A3`d2?B@t(Zck5zTj1k&fb7F^n=;Y_qwQzeamNJJh_m_nn2X z!E}W72B7QRcVwn?GrJt+KO{YB2El)#Y`KGZKCL1svhT6lXZYG^&wBgQZtW8PDz#eN z$5KjmhcdrgQ;ol{>Ek^5KwT;8v85cxYZ`VI#X2C!Ma`@W8HBFk`p&t<8tKqFtAi(n zU;pR80Uq`Y0ZR}ZzCX*70Z@+P0bK1rfGI_1A6qmNUb&$ckTZ=W+wm}@6p|2R6UJ*u zymu@?S-9mC`o-)yPp?d7+^Q=Z+V)d^}87uNgbQE66|5^bH$smcCtsEO8N7#h~`cuc15Z8_U4l0 z@$}x=uLJj`ZJrl3QC=C`XioMy2`qg`RloA67J8UJiak?!&|at-#`0B#kb&V2C`#OU2>N^SboFvf^?d+gqnj}e~iJM`}at{n+Y z8Hzv&JVH^<-^GPfTB>YXJ2Mk<{4Js;JLbY-xbD?}e z@A^}ho4B%`@*2;o8I0wtP}1EzYSZSOV7(@hjyAor0|tkPXIV80d@?Pak55G79Tvc# zH8)Y==CN4f3t&!?c8yp>{M{HNYY!AWZ!GK~;qmKULud4$zUWD>=H2NpbL~E-IA=JA z;FTcFwdfTOnWugmQNZ>0T|;jQ6F>9?oXRybP@%n4t!2ra?heRosv)NvbS3CH`T7Qif1ixaL!!Mn(3R zHl#sWFm}LI#rpRQJNhFJ5gqqF-m(dmy)O_$ar-|nHk~5dtdcpV$76)k zMFlczGDI^oAc*ORiB&MsDG1o*+vFgRz#!UDr_=I&seZl*5VD3=8SR*g6EKED;ABdY z#pnk_d3k_Bn#rD6i#bez>n4*C=Xjp}|NSWQnsz8VtZ z^8<7bGU)B7vGo#?Q6ip4^w^P_s@(-#*a>+g2P&0KNdzn+o^Y~P6TT!z<|o4DoLzQ@ zrV)6=Fy-*QDVoP1$<17}+JzV3emd#6ntLzdrOQj-F#-m^OadsXlDUn0e+oZo3#`2b zpOV>jqu-3zjYOshfBCXa6a{XgRIw%DFy%blifOS8;6J)?!aSLd>SR8vVmF}O2-iFH zC?Apq_}p{4Fz5u9i2M&(`K-miMz%0-DLoVUtT5yVX|W+YjA86E2b#Pz=xRkVA;R($ zalU!*&U-^wk#I-E(gii4AfuhZiat)u12lB$Ts=rlafg~d|8AzL>vB3j{(^AiwekMM zyd&~^^ITsv4ui%uPHsBuMM;M4x&gX_@@yH70b}>;=F&%q*N3SVjc7|0rF9*? z9u+<}a&@RGbEHz!9whUpM+5hG#_Y8}-% zdT?QU!=bW>0x8)&EH@qiOECVDa~#8f5m%1b9TM(s8~W{$8R-Xb11i2(1BUcH#Lt+y zPqZO5P&JuK+I{ZFwrNGa4!8-0@!Kz8;& zID)@D&jTCfHfaDy_}k*r-yQ&ap(~T;Z5UPdz4vrEPGgEW;5kvJNTD10?3sLIteMRi zOPPwqWf%)XrwaLofj>$w0;Nx6=XCJ&fmwSz;4JkEh{<>_G7f@r7Ot z#nJ()!)q}S=q`7Q1FVkja)ky%{yo^k(~j zPY8sL``QtKrBnRe_RxOkA-Qiiz_)H^Ho$I4Q*c(SXSbgV-Og&$2dVRRM#Wu>uF92k z!b79uaxZ7z4^usn{p_FLV2uS3W$P^p*~>E$;w!I zW3TiAfQ22d^sIp`+Kc)R(xw?RGnd2$o4CvYB*G8){LREArEixVnyk}7sv`+zQ z>sI2Zvd(&t2-d~g#t2yf>#o9PI9uLM=Y)0KB&glsg)ax46Nm8!r&$3~XD-|_Xb!SJ znmLJIamBua&w;AL7EP#%!p`sYgvd*ZGxOH^QmUQU^FMzGWn z=3t);*B*FKF%`e7rqr=>Vs5`_fPH>54Ma+d*24q^+8hUDhJvZ{ta^<9zAAcR z|EG5~83o6v!lW<&`(_604LF|6dhK3Of3^lE`}m{F4o>MKk7*k=!Pl3bxA^P9%;COQd3dh4o))!r8$ZjALI<5ZLS4Znvg!BQ*4zJI>?@O>J~ z@@)Cu?$f__l)Uz*pa=sXKue?|FmeK$af&c(tSkb(K)EDgD zcP{dJ(KJfb1@K_=s(N;SMsRopEd>?$7|E%gfFUdLSigh-Gqa?^9hv{OUMeI|NH|&s z_o)^5^N;|U{+|}dCZq#HDZitWogbB1uMVRpSVA49CbHFVfeq z38pY`l(x78*_EBazvi2pUmXrB+Uoq62mU{N7zT*%>+ntVL^`(F6OX0$1{HR-c>c00 z>K?0r!Rj-*e`>C0ba8s15mgIWr!+JWyI0jK_YWi~@hm~bcmohy(m*`%jFpf@H?-nc ze)=^249Me#gTy^=ygBy0#sc`vh-CPAMj$b4^I&wM9x$_{w2)8BxqQ#~zxRoO_E}9C zHBI3Y#ovcD5_?u;AO#ENrRk$<@iI4l(rFAMcy0d16JM)T@V&(3l}{>xD0^7;-BbSuj4Jt~k55nXGDJO!k;L2n z1P)CZL1VK}mclhA7DRAs4n;T|P{qU1b6NjHKS-g1hpk2_6)N~wxD#^^JZ#T7_KWKk z@Ke|`eevl#5_wTaiYoo4I<}*=wp#fW+POX#`gFCuZBdL`x-hpu4+!`BvyJ0ZSs_6; zX+kznnXZwU!dB__R$6*CEP`$u&nf_ueH_vjv=l8l7XhF;{TU*oCQjNcw10>YdA=H# z6~hgQz_f@I)obmujDQpXKp`57L++N)PeYA9B4k0~mjcQSS>aW>6%UMz*mroDThb)nr zpf}*5|F3n$XElyH327RM4F4?NyWT!}@9xU|{Q-LJ`lJdJj{qSC44ChMr!^m>mVC$y zWkejW54X93eZC%wr{DuHL`7pWKqr)r>^T68ItOLD+dr5g8oPYuUi`Vx_^HDq(%Psbr*irG|IaI zwkl#0SfZW2(O@yLY7PJ|`MlJ#0^e_e9P%6qeXQR17c8&gK%`-*^40fHZ%^!>kNG|! zwU<6oH}yY*nrT)+zr*L+Z)6EX+7U?b5P&}LZ_m^a79n{6fQ`ksJzXW3qZlm=hDm;p z8UZAFUaB+5?g9`xQi}~6RuP2nrKUR`_5#yhK+T~T`k!hw+gGFe*0Abx|G#gyLv~b! z9qoC*KX3OrTBepP5&LcMc9Ze+)N2Ef^hEG>F~rl#IbS|)-3}b|%T2QH+xhj}$R9k; zt3fqY=(!e)3z_Vb+U} z`aC~jhGcj@0T+A%k-29)2DL-|se)b5Yj92rBMk{j#8mfQJ`;kJeLDqB#}s7vFy0-Z zf)~H?)z>c%2JZum!Uq6u3z-6v`cYQ%rGfY2Ga2sFHpi!7oW;nLZ;PUlK8iDd_vZ(J znL?_(Un}bXdUqdV;(`J4yV$yn?|r3uFsUvt2igZnBk12-0Unp|p^bHhlfsLXcka_Y z5pa((2NY0ZV=HY>$PJDW`Ry zOzQ{!);oBg*BHPrbEA=v>pKLn<3(c@ArnRVHNt>MR&M@C$*p(eY2Cm*9Mq4+Ys5hb zMZ~SFzBS>7$$u)Ck^B>oQ$fj9RAV#Ri2zv%R-r6OO6kv}_rNigB@>Lk>TL^X1^M8} ztu{6U2pCzJUwJBjdwMEu%6(rTKklI&`9>7mHr{LA|9haUoRQwmc?Q^i5o@`5{~_gY zkQd&dtUS}dUm&S}1af_K5=vF@>H|hL)!F_PSnmDEF2HvHNeVO@AS3SwgI;7VJl|-x zJno6s=OyqH4kEzLuv)tm#fclYj^t2KG=lq(mh99^rdnfTBr}T`Nvz>GT0BF>l!O0k ziVE;-y4kMwy++1MBgj_l-~{XD=E0EH1OcirKeAH5L>n;+=T5p`2I`rCxSS|38WZ$6 z{oS~*ghu`PbYT^kjLTl#2LeH!g1HMiWNl@USwgrdv1}jWB0U9O(*OpAK}>QCO@wyx zT2TKzr0DUX$BrF6MTM>vz~~TizXYRlyd^QM3=q>yaR-TlE4Pt)?FZm_GHuHZN*7?W z_=2xR;S%bz@~QITY;ODM7#olA9OqmlA99bj*9Q!E@qX}IK*@6%i-*~|tq7Yq+yTw! zA%_Q;A%8+3>RgIg&XKyzp=v{2o4mw+5E|PL7Nxm`Y=pOQH0R%v@9r%c?mWgA8nh?o zl|HyZiG_ennlJm7V7#x3zl+-ZzHo5RsBM^39zAr7K*jL-PZ#^Mh%cz)4n~XS>XGh} zF@2GuROE?3?GGqh14Y4fDMKNg$rM=1ng1v?JMEW^$Q!Wm*{Rn ze93kEeD{0Ud`}k2{LNwHG6A8=`7dh1lxvG@<06P*wl{bF?Uz@TB<5=v6M2Fh`T@W; zv7+_-iCO_9h0>&HABxykb5Chw+Vp3s&-_# z8Ma^IbFIA++3)t_g{gi#SU)jeBL}E;z(%;@EZyuTp3Gk0NCthdGs|PSx3n+5+j!6q z0zcl}zX0bc)%mcQS5kMnO)Q!iAZ}QJXz9`<`@L^NV1&h(N1dsrb=H~ud36@4YKV&o zq@oIBDC2tkPGy^gDW&8+1=imJ{f~dSzz7W4UO;L9gHid}o^8q3ahS|wQk`2IXqF*T z05;(E1dtDY9DQCr1d@h<$2DG?K-0A0TdgN3pT&a=ul(PbBw*hAzr5JvPk#m}E*RP3i@PWr%YMsm4+{Jh9!Gp8L-TrqXF1-$`hx2FeD#fPK zl=MH>#xfbJd0kH7M_sR?3 z1b70M0-6$lSKk3C(t6SXDv?vI6X;wv0d#Bo_kFfZ z-{aIx5F%;Na6D~0`_2EB>W=jlI4uj6IvP~ZtCtKXc3$e$0(TV!oC;RUfR|97hP@3+ zvDvGO`J1H81o&VbXJ8FQ?6xl305JNJFgIckp+x?xp#;dJiHc^EaJVZ4y~eXSC0q}17CEu!$)HIka@Uic0stK6%(`?F z@Nd6DfV+$i+0(>0lg~I@ZEaP|2m#bvQ99aox9o9hZW}q?W?PPAWbGW?w@785v6uY@ zeL;jCcGvF>?I0eZ%3BJ@ebbIdk4nqX+46)w{aV{K#-Pj5A`_pol z619z-K&j=K!up85>rAePDOzmg9hd>I!01aI0PD(m8=L`-&DTdI|Bv?}|Md_|R5wW1 z!FZ2;{`+>#JkJUJV)^fZ!h6t3fOczpC%4md0jmM$Z6_-pnMD&B*CT1MV}^!F4TuH- z>2S#lb|{xXu+%NaKR@}5KCDijJWDZWkkQp0_Ra2oH2cHjhE%9hFV@i`*(VF*qJ~9V z%|tN$vu(X;JXG-5eCX3;sNjd+Os{dJ`sariVnGv58A&J^V4TH(kS5+AX*C2$9O{{j z@~a0kF&J-lE3tx|%{El9I*JA)r53nIKQ#1Q2ns3{bX^~MghMZ}Kz>i8+CbrU zEFXPsRxU^sER}OB1n)(G^`YY+J^dasCYe`X2S_rvSoTKfkXWZcbo38aU|-EPC?8g! z>KQKvy(gs(us76*eLtT3tn=~O2?>pv1=(H*w>wubH^egSNW`)Q*E1=i3p`~j{h764meJ_iVB#h$5qf%za z8*LAO=mf2)4wW3>K0|-E*4Xc=>PHaJhrOQx1*%~UY}V(a^EI$RhF$=!kiif7Pko>6 zBR?iZeRFW`^1SMFu+5^?`|i_(ML#!clUvjUb zt64m?w-g)!{rF*N_CTN)PXlp^n*#l>nVqfjYVDC$ZpB&_)@bqLlx4Q>XRj;mdmNft z0Or?tx)192BKdfC-ni-3^uQC@vNKRkCsgz6TjtdEpU5^ze@YWuZAb-SkMf3zK5F`D zVqbwcr1sU?y9srWj~C0PQIo%252|n+)OYUXCEvorHvO?^*XaqtvmUXWbT=bgt?f%7 z1}I_u`naaqEf5pmS#+yZ_M@;L%g$&kOV(qFGiE#QQP}l>!)vA$eCBiK$s^DnDf^8g zzv(gWt4&T{&e_e=ur;ELA$m@5ct1tDvXh+&Nnrgt_DiXrV`6>&4Q@CUUonaC7C<+~ zoc=BbYk{Y$n7M%W^Yb*La|h)433$IwlP6D_AH1CU?tQYf<0tupBw-*SGS?&3GRevB zw2f~0BAh8od;j(S;Os4ESVE9%v+m464}J%9Mvp~jhdi_4kriTt@h^eeMzv#Gu5M(pJS?x^HOUMp)5 z4%5cvJW*?Lzr?&i6E-S`CF(7Bumil8lZ5zZ%00Y>618p?JhVKP1f9vkd zzde4}txUfCI;XOXDHAclD`YtP6^6H2wcpo$T%0I1YZvRGKY~T=$C?yCzkiN`>YPX` zZQj?NH?dD#%f*D!C);j<`HDX}M6qdb`n65Alh98Se8ES3twyOpUK^b0O3r5)tT9cDn0guMvOQDiXQb_u%5)`0gm12;JNdG>cX3{7-#G_GHeT9+azTMz)0?7d?r zP#>uUptZsBN{z>G1P${DuKx{*alyPhRk+0x4O z#n*w9BdoExJKSj_D;ztEVjWF!xNx5$e&FOVm@@M!P|fq0&X1G6j>5c1za|kpWD2|| z*dBOz@7peU$9WI$Dpe4DBTEnM^WW4y@FfrwkZ!h{($!OkfSTmgBAG~RKyThr@^mGJ zvL`~S3zQPi=XSWTEjukqt=zhRDJ_qd^zFIT42b8M>@|m8yf_2>Su?Ou9z>+CER#xj zp%X?K;}=XB{kTW*a4^L@YAVS&Wx&7DXc1U)GVvreOcJy1%HQ(`jyxv@uU09aKU3UW z`25u&4T`rErs*yxs-w_Rr26ZV?L*`UdT@i-0BFC@r2qXGKP5NT#HQ(hCut_rR9KR; z-JTs~aN`!ZS=q6s$p;TLzpgyQdVU?Tl)9F>0mK&VJ#_1}I!yh}?H4bbfKOp6yxMap zzU4LQQk?21a`UOn17f*Dh%&YQa>orDZb(Uh&K@}liSy@)sexO{rN*?y>e69w7lA7Y zoW*=yPOa^}>P?^s02jZ^69&sLcFl`fuJNbAG7w)zZZl#wz2P)jceEY~&+oM)wc2vB z7Z`F#3Od9NZ=;}~#YNF47E3qxvlBHW#FnP(FGvrUqfY79m@Q(8kUcz@;=BGxw<;q5 z41!K@SVG@^iEzYXmzg?P2)YXtUJN*j4hoN0MoZ~PvZcQ}w_fxkbcPU{T85x9C1?c4 z(MXyQf1rcNC|rIIx@B~WBg~_RAdJ`D6ICCwoYP;1@}5n`xxQD?gEF}g^YiDWvvO)j zNInC<$Z(VlWDU=VIZYP-ImF@}w96ZWc-k?3Osk%*a%VimYcP!}!q>0pATxF3ryp64 z6H_BQilY+M-E^szXOro119*o|c??)cZf2x%yT&%T%0}Z(<7bKnY62_Cj0?AIT~frOmZ%Or5VW!|hjnGZ5H?l?^V&%CC4uADxQho65Uk_Yx|$B8xGu zb0Z0ykRl+MDjpqEhJs(oCL0Sk~VXX^F^^7U~$(miu)_ z5iF-!7|0owR(DGecsm76lpT|mC~nV}|)b$h=l5Jf3t_p%7meYiiwv^sLAAY={&rG+DV}Fs+68^_G{rZsk@RoGxNC zRb6{?JNC`l#b<&{SD^Z|kj z67nx}$&O_Bbf%PXFbLtGjAWF4yZWTmx33KUn(kCFKLi#m$67X!o8w?w3CBCS3 zx}CXdRwcV7aLsT)B1PnW{hpWSVEz7#jk%_A*51AP4h@&;kIvkR>6-Z1-WS$;pR&7` zV|l9+!?{wM`HiJsP70>dX;U@v(pm_He_$d$!uGh0)k zKq9>PP8(MGT`^0az-a!rrVBR+Ql(W}`T88A=XHzBlpkkc$EHOc)y2!0%9(6b#@KiC zIw;7hUiILIc%~GY%w9Xb$LgcVelCpOp+!dx%_T5g)XmU+_k6}8==1g~CTZy9IxmMm z$eAb!JOf3Z%6xc=O@5#d)q3c$danBC9&%GXySzpQC#P?tQM|GB#@ivE|j!#rxr`+pDq9|YCL9`qpQRhsGaESr;=)byVM2eFoQP!Nab zkFkI50??Hqqd4-FVwxu_e&R!k$qeTd{utARW;!ZsKc5Mo;su#gl*J}0ZB(s=d9;1$$J?%;LA)b>n;8p~Ra8K?iY{)II?RJ!JB0TpjJxjY_&V zwCiLuzw?8j^hO1Z-%r1EKk4tWL>rSMYm<2;ue?d91bFD8JjhR3Y!cgo^Hw$%NLyZ|u}+(3WrDj9t~ zP}Ckx#H!XxbC}4(vhr5s{bZmnEbEM}4+Jq(KGA98b=oSXYwJX#jH2x6VV%6fLl{OC zC2XAuUtf)RFv~!c{w&|~3M&%1?V(u1+Cw_RY-+D zoDDpPVR@EY>7L<@LptN4KB9c@>|M6QAdWzk??lcM%il&&>wB*c_}~t?Z}b-JB}aJF zLGNMRk8Gd!POH>O=BYnOhG+p!iP3|)te^PchR+s3|M9|229X> z**d6PNK=R6|0!GmVnK&NEEqLG*WYAIjvS4VBn(#YU=}N+K}InF(@n2IXKY_{Y94k9 z_JX)x_DAr%-NS-2X71*@`N@{aES23U_;~)hBg6zd)wG0<$mcY&jNF&pBxf61TEd zYv9gZn6hJ1yx#9v!Dom-RpKzLtFpJ=G=6yY*zOLr2WqXsEt3|hUl|BCSuN(J;$5+# z@yAIN9;vvxd4ueTzR)zF(;6$p-J%RP>3hJIAnVEOoP=#$5IPm=`o0@Ozu3BU!KrE9 zAoZI5?0M3vUZ+7?uU^mLcHMW=<3p<{2s`aTiXdXVO$LS_Q!)#+STDZ*R*VM(AT`Dt&cD+k2Ki>YU4js*1IwW=kl9!P0pg8Srqu}R{mUonSM9c5mm z_FG*0MN*cX_c;zKQwMQL;#Qu;agISp8^y8Abtc{ot56RiyDuKbH6OHT!>0TO&t^s_ z(f=u}N&hXa>o8=U}_ z*5*riQVCRmDri?EglOmMnO3;;uySMv=KEV}KvkV9&+P*eSD3?1Eq3%*-gxSz84)k) zJq_!BrGFMB^)5!|gaLke5EV&%W}3G7!ytR7Aw_Tal|i(O5|G3^nrnCo8bRF`)reZ3 z0>95xc!t5r_p1_j>?LI~t2Z!&1pQZeDS>l?`I9C)<@}t;0r3t8VZ)|^8-34}W54>Qr{)U*Dv1Zg&BK2O3#mpQ+ z=cb;&A$1l7HUJr*hK5W&Z}r+DRZ{e^$KWl=IbRGR3{Lho_>wIkY>e4d{{*-|xkT$z z9q1PiJ{Kc>!@i+hBhRNqVbat#y_E(_#G3i;Zx?uvdElzD%MOMwjiG~ISWD=P!0qYf zE|}OfSrvYkyB~mplr<(2Hg=n)4U1RT7TnM;GRzt0cau?d1N+*8vl>=pWrN?~F0z!+ zvOM(oJ2sj8W?fpFMPQk6Lh60R&wzF!J#u@n%W?K6`A$Fd=CYqbko4`RBb1os$&5)Nt_RPaW$lI+c;W2m zZn6u`e&c#x+@A1osdiMu=Y8Mf-;w#?^DxZ8I#Li2gxUWe2m(>aEmaPuRAwS6u+3Gs zY*rRAv@ZBvd0Anlumi$LkE2n*_of!uw6-eK2I{$F zP(i3(Udb`S)4%ABB?8F)^A%UM|31&hM5$Y*W1rKX(6yIf=GiOckgsto&_*Lk;W3+7 z=`pr-T`i>j?ZR#bu^5~2*=niESse8!AWtJC$e7=NMF>2t$=@E^Y?$T!Y8~5HeSae zQ27kUo!IO)1P&pC6a)sHUs?%|ZnPX$QY9u?q$@8P--obqn=!+S1l}#yMk;1&`e zxb~y|x-fP(;6;~!S(IsMxas_-P$|q!I7Cravxdg_%a^mRrXq2(R7SW#%7S~i>0}W7 z3JWm6(Ir|Gkykwcqh(hFjCZ^kFn9^QvB_G>ai^=OvG@*Ed~9juCVKv$74A_pRC zp>snuh67U+CW#YhFGEywD%{0ZWDsF8ka{rOj9p>G|0q?w<>?t4AS;}^aLbVfFT*UX6ar~UtZ`$MT=H!$<^ z%`P%ZAEj!F>l9l4Yxo(s{93^9NHH`Ld!PWCL*UZK{X1;c0h|}FVno&B zhehuJW{*1Ql}wJ6gM}jyagC=V*8tsLzu-*k<^K!Aljkjpv9-5}3=ta(Zuy7Zon# zvrge2+CG5C8&wC^A=R2D?}MK3I~)5TJ-cs*oxLOjBdv>~2qf#q1S1y<*o&YWJCF9w{bbitD3N z?kQLd-f`j^S`WCcU(B#a)g?JXzP`|i$|V?Rs4*@HxfH=_R7Z8@v4-Y5=oRLHNpRvT}LoYXy zoeaSl`4;0Xz&fqvIu~EgCUO#?;#-nF^@RMy&GN?&dz)iRURLb8i60sAs{_BU}fWgy!BAZKA(X?Z3ClnsSgRaTs;A#v8POE3q%rjO|>0 z^~_CS9zh5i26&e{Ko^kZtAp%(Yx9U!477jyJv~jLAJxSmHpXR&s5)U_dcv|$VNvu= zLDGIlqgxg&g18cm-4aY336eQtpLl-4IrH*28}V|__h_i;xHZ`n-~0t~ACx!0fSI>h z>VjJs2U!WqB3(`VLqRp3DPSl3X~qSQ`3*I_a1u)cOkk}7+}Zb0H2ZuYsFPrDE#7#$ zCW#o(k3&aa)nD;%%vB5X*e(5LhUbB-CueYRrj*O8Ohq_nkEupF*@X3i@b>VNr3jaKH2Dtr#{AavvTdONHA;3CF zQ%`--@{tdRjLJ|Awnnj&m}J4;tAmmF7~JU9e3v+gxo6JR4dHlf<+I7dvW%*4^xcO} zvI}Q}jtl6q9A8+YUDYLYOiDf+4jZcJxtrvjZC(AuUQfNR8hGP(%9({k8Cy)R!vyYc zPlGOQEIgy&;0vr=aAdaN$FDDYbMJ3`l^ z9f5tTk=p-4T2W7O`$-Vm_`yZ$S;hh1W+P}zlwc=soVJe;XsQv}za`(qY3!-EiRkD5 z#s=U>;l{^6TR^}=h((LI=~VGCQhBqP%1AZk3mgdOT(*7s2)r)T)m2UMup8xfF~o=u zef|`__Lcx(JauPy`K#W8qF9~>d*~_E%$+FKll$fcU&aU=ceu_h05>Edn4EF}i{)O| zI#ajt5(-El8Xq{ZENW-WEKl<9WKuvsz+xHtYIDEK=^PHAAR2SLsJ^8W zOUf_%ell8{=RkJ2W-ep0iGk6%B*}N|G@&VsvxmxLq3XdW%5Z?$*ShqX&7hsuJ1;@T zB(Lr47F`@n^EiT_?Sa34-t{&3EClij^1h46NoSqNtMf-RLt_7|dQD21ttXoln-?-u zoG6lXSe__zGm*~DZ3o}>X;`nP*Y7vXBm^s%x=Uy7XIxDdukDl4 zl=!QwVqR^R%DLo8_G@CdXbN-tG|tB~xC0G>-6`QgoeY_TL7j9X$hywat(No}tTw)z zK^@$(EsdaB!aWh!K?CnC^cf6Ew&qFZ4wU}iEr7=4>}!L>{;9}zRI7w~z(=N4fbP}c zQD;$80zhRN88b05{Hg4UD{q$Yf|9n7D)e~0#LAirozyc|Cqx*j;dmIQOFOK2ujH!T zBjs_7A|MLb|~a~X9+jOQA>y+I#{Mg4}YH^Q)t-!)l&WVV@DGJl^5HDdxTeVSk?6fGJ!^IUvV9p%RrIp?bpYl`y?R zMH_ewVdp$p0ZwLETPg!;9W=czo0##Gy_T|+8S+>d&CF+E5f8y*BA*=Y--207SBt1l z&khD@Tlg6WIQq2TEMetbBELf6XU&QOrh-!CKGv}hnie+fU)(kDE)3Y!|Hn)qN8X7H zW{0DFCVl+BEoF@VacXe*u#7A3Y5YB3M%9zDS=cHB#ykWD`#Pz~Io1H8F+t9$u07Whs+%CD?F=f&r;_8S<77#&>1i}r$0;@V$(U0@6(BhdL zEtZ7n`lDjFzZYC1ILxmT-?zLqkNQS^GG|%KpjXvHJ-1yAlH!?PZ5~nGPY%Xn(N@?A zKeIIuMMm5RYI+9R2DjDQnDPZvi27Is%m4V#7>`l#6J+5B!j7F<^JR@dH`E%OQy{$- zHNbU}?V?QO7LKqNTho>CBRVnB^WdAs&Rle+3((J7HJ9;pWecykII)pY@+xP29$q!D zw>JB5(-2M&!E1q&vg7-+TGAd#RyOszxgE^+V`7XZaXL6bTNhzE$@5)g1^Yl~w!J9O z6)=Wcz%)vf=SSn`^i!u9qSSiV6G|CWV!=^0jj5L>Z-e1R$#~5PEpWimtI*P&a+rc- zapXt#3zKn4j4O9Bit~LWx*s!*pcj~(>0jztPt8-=TI@B>IWN_X)rRwhM)*Bjs6t>` zC?X(TLHVMXbXfk_>&u8s&AX*gY4DAFaeEAj9d2q9YPsmfGR%s(knX_XJfpX}mJPnl zr|q|4aUd1guuCg{b0B>qF1s{g-dN=`n`$4JDivi-MS^M{CaT}1{^R*k0Ny)vV7s&EGlk(&b2<>qCtzWs0B&R<&j)ZOO+L%LnXpiq4LO zH)aIzGXwx-{yP|kOApS}gB7H{VIVxL7_`(FX^Qs2k^psa)yleQq>wC8s>lohl zqkD3R^{QTEXkLSmBa7r^b5Y?n#8PSM?lFWR3Zbv(igPQg4*GRdFb}3%-nRWvS})O> z?m!dRD{mlB@Z=a|lh%n*k`=LE`$#Dj04qs(^g*{c?l7$_kgIP7sadMgY`6&gYZU^Y zC6wEArcPGmFSHj`NQl|<1CR8nf&JQRDAA^}%;6>mDeh%r_usicY#6MZ3llzNeOoUk&@W|pX4vfW0U_? zEg>&uzZmce4`$cC@)iWOHPckK{YtXo(lj2~6th7sk+x$9Dk(lHB7;gEnsN17?a4>( z`tnC7+du1ajw*Mx0hsdnT71Nkv{Uxx)EP3ddVlVYT8#E6r za4dv!+;KxOp=8*WF$|cMzU>Sy<8|dV`{tqj1j2w!$tqg6MZ$2eO!e;p84d`G`46ld zMiA{=8sd=bBNXB|o!lrNuN>F{q?JDa!oSrxA@!OEa}{nc1HcRt`z*FOV;SpPk>P)~ zy93l0jatsvSmn+HWSh?{o(}m;{8 zRHE8p2#_E@g(%w~tpdJ6#?xe5tBJDe7tQ&kQYW}h7nTrMJ#7FpynY>Ek);HB&W~59QgQYf9u<<`HfG~EP%jaAs z5sWemDp}$0h1?tH;0BcF{tNiFLMY>hB?QjdJ5DA6I3d5~3i?jn-#inZF|GX}M2V~z zIHwpf=eXCqJogX-D6~u&Urd#T{)b(7eQJD%6Edy*W%JK;P;Yt{m@}r~#XM+|VED~| z3Hmq|daId#$EnyMzY$cM;j3M)-~T?PQxu@u)Gw(wG1bto8e8#hFUJ-Iv?0r5{y7l##>~-jtu8tJ@=C5T7`K@*D}@G$}IpahKDzvW#fb ziILtHlVFNBJ_a^E3gn;onSdgD1qNtl08)d4 zRr+?PP{>vB-#1r;Q_#Tl5Lutz(#unS|L0fk(0`uNbhUvb86*#pBDbR2|M!%W2#Vu0 ziTM%yzc*LT4LWsQQ;FfGY1zNu)6j|IpZER$?bVSZPtpDNF^jT9=IQ{zP6r-IyzPa$ zl_*Ng0J>s?DK1`XejHf!DW5)x|8LdTF#sI?WuOPC%fC2$BjRJu9yXX3J*NA+^auA} zRT446%et(DaYBs1(zljm{Z^G17f9_rhHuM>62pZagWXzXUd!A#`0uOZLH~g)fPx*O zfWn5Je0h1YZOEk5=Zrunz(dssVnhae{9RxTK6$j@mHh4<$pe4=pT_VZ;w1@fW`BD1 zF9DYvnIB`)pKlEaY`!?$RP z7NRy7V!|Tf@WYYf7D28;a1tAF-)-A9?tImjJkj$3hP^F7`Y??{&R3AmH$7Z)chzy{ zf#{8jB_{z>{UZBWB*iAFIWx_=T`}{?JO`%m`?(K`-UfHIE$@9`!{^jCJtJ@m;xm&9!uP& z5C1)$OwdB=J5xb$nWjoDf?%D^_e{<{3lzlWO@Ig#osDn`8kRU3a&HHbyfDD$)EHUx z-;+d8o0<`JEM9vHPpfZ!3wO8y!9YTe&svAY-Q~p&&yUyG)=vSP+ zCNs@9{1p1{QlHpVl@`RWrgM`9FvKnh^vw?%tOA|NF31n|1dGDC|HS*^0Pt&@L4=+- zMhK+Xc^eS_xS;fjb!^3?O2+OWcCKGs^yYY?XAq<-4?2NxR`+%Qnv1D4y^NG0MX61{ zZ+u-jsoDIoS^J{vd0F|v=ZV|P`8_Dv=PB0?kQlQ0GC$BedIpHIwt?0+J~FnLwh)~* zU=)W|N@9Ec{OlI+bq7P`XDJj-@`Oyx7OTwd*v_2D2zX+96F?=RCF}6C0k9HV0Y+s& z8aE;^p^*z0ob!RRBYAh?+Y+I$1^u&2>oMEXHRS1pkrf+o+?9XO2%u~Ns@nw}H@rmX zQ9r02E=oHP6OmQ`*tOwCWoD>?yFdt&qSg7oBTj%9aS$)~*zo@gPuj|(jH5lFJ1^wx zVY+#uEtwXRp#A)zbb>AwXv`29H!DgyyFif$yc#SiD+7ZTflHox^pQ|l$E-P|*lW)I#rE-<<2Phky|2D2rOCa?o8 zGD<$g61v-4B zGpqS}91RPL&oca72jjDY#(6d0G);cofmG}8kGogeQZeb0h)KpA`0Rl;IKJ(GlHLsR zqbI1ne>_W&Qeb?@@f$eutCjE8xW#>?PIDqPBYxpKYpWXAHf;c@^vVke zZ!%kfq!tc>vP%{sdtaU>eC?Z!rXMW>4E}#1>?bhppOG>zQN}m_4CQ6Y%NO($uyN3q zL}WL_55dUA9|{d5&}!bYr^dGvI1kEMyFe~XG)*c$zrEU`ZbYgG@8R0#>ahvtjjRp)|l4EX5gce=yhkCH^M zRoIN9+75uY^rA^D7f?Ehn4G-mxwS_`R(R)YUgl2S?8WlJ!HGh-JPw9)&c9_sc2oNE zBWISi4p&uA&`Xb<8h?hw#B`+ja*pT!TU zKXw1Sr1Bv9x~`j09R_qynnhm{un=+_Q~QciI53ZZgHvin$3*|IYF7ZVcW$sHZGVw^ zKi;0rDva|R1N}gNN<*qKLTaPI2SRKQLdCth5YrG+W9v6^$tg|o>61S1y%>_)cT8Rr zo$!Lq3#H!K2jSR13mvZ$gRU8mlaBy1Lg>1RHU5^`L1M=iA#(W-E1o5B0hHGyl8|~a zvG=sUNAPXE5%q)J(xuZXLbDT|`4pQzu=f2ZIDcK5wK|TIT3`&y1iOaKx{Mt~khl(->=!9c= zbY5-)3#)e-2f!6qH1#cF9}P%GiGvL5KdaUHyyw6G))8#Z2`$w?#N`gubSyL4VjE1a zD}4mh6<}50wEY_c2~-?-XDHK3J{p(Q0tt@lKAV%0eq-~}dlw6Uj5+ru(VrwZt6$;y zHv8-?$d#4Oe@CtpasOzMw*v%5yP(rzL&>n8vpq@h1amBFm>P@9*33LmM>+$}>ml|2 zEl@3ZDbw~1fhsTyJ*4Q8WH>CTXA++cEu?4`t*2yKP7r1JpN(f)9Y4fFhXCM?6IDnQ z;0UNmD#W|tC87p@sgtGrzgPQ}4%Bgxz9ggs|HA?$kf*TA&f6D(e#aTulc%Z!aL%J{ z=uvErNA6A?WG+;u*!vrW4Gc6>iwNW&ahXmGx(9%A1r87-)-wtb8EPLu1oHu)k3W~{ z>(>C&6n{JP?K^9JfbKQ@P*vlsS|93IRopm6lOxff!UgDA_Yh*0%hMgsTjm>1;XlM@ zRL^8mEn}S~Z(Dr!%$K*pw2tIC=^13?a3wKoIUJJ+4rn|}AYR;|sp|nJ44_il`>ML% z!F8ZL4@89A-z9+EQc+tJ$HTd7z`37gewIinJffK+0%@cHVztley9Z&aFPFO;;ozZa z;ftU~Li~w=8hWb=2BEV1Bp+MpSI0VCh-S#Lyh7ZsbXOu+S=!h{prhYLGJkdW0 z0z)gG?vOLu2JkeHg%bp2b|b{m9RcrwQf!7Bytbn2mO-9YPhEqA%ar5nwlNNHnhEwM zP;Vjf;t>ksCFcXbw|vr4sg&gx^Wct27G|TQ>ydl;6ex(N zvTJ*}!c8T{oM7nKJa?a(s*TI5Hr`3DaW9 zEl$Qr~fVUI$49tEt_H=o}c0y_vuVCfEZgBpB=_eFvQ%f;=O6ty(8 zt^Uq-F8SrM{}&{574fe=>QI9<$bkL;{_H6DWKAMlpa`p1Py4eco$aZWC$(8#yec#R zw_E!K((ZrT?iIVoKIambI5$u=ITjsPXpVCiyP>{BFA1t@n080ZyWc$(_+oy=&sIGG zj^oWVjnLkPvE)nVOS&D;#%RUP80f>Bq{X}2vxL)gKq{*qc|@JkzN3L>xWvW{|8OJL z&Nv%QzUQ~v_vTsLc>9XlVVIvvYpNg05d9fX+kTf^n2o@uC;^nheHyPp+Jg-8O7K>ewOlXan)%k~b^T*GqWgL2Rm{+R{4eE3H=W z5NOC-`Xn->zicnx6^HK>$UC7jCe-sha-r@<<9e-}z~ z)-e-2L~t3A9UMh>i(;JuMwf&O6DgKkYx~gSY#rfSe!8ew|AEBvwTsB(R!o%yY9wEJ zp<#r)4E;cWlO{xIC?&OZmGe-8v{(W+s+k%J{S5kvZoGEoc46s!wAIwnIf=zre6sYn zibu_U4>dIUZWt3p+wa$*A1l~JK3Dlz5814%DFMKaW-(ao^758 z?M?eldyS285Se`g?$En(4teN9UItZ0y69ju z%Hf>Z5bi#~LR>TZ&Gn56W)HWsfMa+t&=|Kv1!zv^zy+>Gpz^+0{pl?4U&_qiV!1S) zDvCSYsljrrv5l@nyUa<=>8=XMRF~APsnmLHPuhd5KlHiKA}9pUjN;bL%RE@YZxN7c zS~WWouo5qPT{74FAKC_n1owdcn6e&u_?(_9r@Vzkh`2<929~Ysg*#LEeP2aT?!{s2*h2Zo>Yh6br;3xRz~%H4(8(=_`s%G zh)jtu*vvJzz5F_>#KnUd6IbvTJuTih#RT{D}JS*4xWG`-u6=TB9 z*$#y@&XFVG*PzDte^8tZhMDl?&e{UEvfo=#(1ftk0CZyM3z9EgsMLusd;u7T);)Y zhWt@LC{}O*Jx8|$6?ReNBGKX>mTX6cMdrn~&>+iU;V1%UJ<0esjrQfMuAswqDCOa( z_MJ|}94PA)0u!6P6Pg@p3s(M2&P zrB0YtoE7gOn5Q@-88ni9D)X_(JYHqS9*lo?Zz@Z~Fc11e*rT+k zk1+0I_4y@GWB<=(Yt>4qB>;GTL< z_tvg8`yrI$00ogA*WyfmrXfb@>_^K4T7$2Z4{R*fM zJn9KTdpr*%N2kC1k^dML>%z7_p0Q+1JgU<#_!#AoK?dj+Eu>unc0_?(5FeZabEx;# z0Z&#>N(D<;o$@UdY2`9Ap-1`3y8a|IBKOg*wnaSuTbb1_+$2Z zZ;7gD-z!KLcS@Jov!T;j$7eNYZmH2;*t%3_{3&L68nRq)w#Ldt^C7#l679D56KXtTSKSr={NvcS0b?~ z7@&O7n?w}RkI|G$28GcIJWVyl^zjY&S>(K8CxB+Vha23cOIG1{&7rb?%JPL}E)mT9Ed`mueNAn{#ZsBwG z?eyH}7}2jb3qC|@KqE5aWNkO+TbmYYt&lJTO!C4r%Y0){snuF4h#$5~GQ)QP%2E3i zwx=w(_^JU|QAnlYt-cU!TrY-}X`MuW@{``pjBvdIO0CFn`Y5l-s;QFCgk4T~jVLE+ zjqwZ6D<|Wj0y~>GA&uzBY3lDznt&+p=%1T+vNU4H#i3>?+2W@VkuH5Ufa+ z?uM|`Nbffo`B{5gUYxM3N9x1AWH9%$B`W^v)|#utSEbwTcg6)*ABDs#*Q}!-{=O4( z{Z8Ov!QXV|8HO|^{tVj1pLMl0Mt2GXu0`cJo%qj0!b3U6ops*<4Vh&m zuTfe}L@*lLH;(WFF0_WRL+tSjfXuSSLNjN_SiXQ7pUx!9eY)g$L`eucf%L6gRHM zS)bw3S9AZ2+0g*(?*O$^Ml>Wwi*Lc>&ohb?bo|#(d^;gITSPGz_88YuV3Y2s|E0kF zRZU`qaD}m_v9R(kHJXWtUF;FbhH*z&M?4M_O2VT@IVW}Wp{QJyg~~=_J}IIOH)V;| zr$0?r=W$E&-G6E%&Q?_Y0IrDMj3R_D#-HoC z7I?5wRHhc~7Ul?Pa_flA3Rede?yGc0xYGPpN0?KQVg;^7;K?9&&8*tF|lF{*tc#pX(H^vSB1%HYBe3Q5;gH89sw?YNS=jINdD z9&zs(Zqfv;M8%Z57JrKm1Y-6gYfkC5pqAj?#lX&dxTgK$`(>|mv39e!dy1?F0xl-U zfwIUi46);z(89-efU_3MgAQdH-x7I6vcU-@@D?t2=vn$t#7FlRRL)+d@Q*mhU>) z&0>mFQLC+cT{M$s+iT4clS>}<2zX&wPTKuk6yqNZPSA4gm8=J4ou@AT*Lj%RO89E! z_W~-^XJh#q=s}bAZv(9Fag5Mi%NXc-@#g;u&*D=U0KEG5QX{t>Y|x_Xjg*JS(9#D@ z*Vyu1w_Fm{Uuo>u?Fel8RKnMKzp{GlYySDddBG9wICxYU`TITR)$O-jppAHc z0gA+^+3;iS<=rK<-|dh{C8dp}>Q zw~~=C&brkT*xtW10A%HOMvkHa)tl^Ta~Kf1yvV?s?f(^gk<#kM(GDBypJ$Teah^0P zD6xytG)Sh6BN1zkY;*NN2L7>NdgU|eSQtMGZ z#)IfIEtEN1xt3vjwfduZd9H9OBK`i8`R?4Uf+wUo%XzOYOHCu)^Ywo?5^QD@;@mi> zu2=rK1Q2JqS~SA17T-E0@1SNY{BvSmP)B@B(_{wa|PZOK6B*) zcIYtWw_3&pm3tC~nzNkr@ZV1AGMC1{o;Iq|(J4yo(=z%2o}gB)Eur#hjon|^UL4~4 z^<^Q>4&x!4(rwX5&vAAJ?Tg!sRbAo@;~zZ<*pRP5#E}8a^J?=Bx$36!BwY==XJi}- zU)zDyPCo4bOpG-!{BKvClQ}rCqHTSE6A58i`UO6&eyPO6jQU02iK0EuiedH4UtsXk zE8Zc!43rPAN*l(Ofu7TN`-;eCgb9Vi(3oqlDYs`&K-g}{V7x~Dzzby55l#Z7+!8>+ zdDh()`Gq<9@uYsM1~Op|U1hAjErCvfQi{jgpso0(s|ngm?E?df7Ff#c2WYSPX!JYi zRkPWmrsUX8)Jk52EA9b&2)~>ZX#h|q3}TDGTAri<^O}~^!ncW$GFA*ademv@clGf( z;pA9+z^Oy|Cwn0(gxqw*zEWFb$hy~bjR9$mcxm~G}*nYUIPaJ z?M(-@degiPe#5(>V^`$>VJQE6blJAZHgba56Cj8JRRFWTQ|A8*>I(;>KH{KdA$B`J zk-D@G#@9zEo6tLJloM$lxs9MmE0E@6RNm*2GG=2>xb@2AW2Hi~(s|o+jR{>0oNdMx zd(p{0LYo?(PY`_ty_}RRxj+7WT2n1%+<(jp*r>xFaDMppV_KCJN)aGeDiE8-2;VeV zZqR|9EH-OTp04zl0RF%TXU6r^{u+x@yz7=iMU2bCu+hj(3eG$FuLU%v-9JSh(Qw>v zqm2?{)2MLghQ?DoR?Uhu*YST6Yr`u;6CzbarMoZ$B{XXDHh$Q2?LUNPGq zI#N}XfrFcB$)M@p|6%Mcqq5xEcW()4q;F|%8tG2yR#E{;m6ir+B&8cEK{_O)yCfy0 zq`ON=>4rV8wVvm{-!b;s@7UkgSYv%ydd+*zGmhhTobRZKi;4O5s-~#&dVzh)0;t~p zEbTjiqUDJl{BJ=8eKY$v;Ib=b*aNtf<68QV{FaxRKPTC+)eW**c&)IJ!DjeW#gNYs zwA41~4|%g{x3ve&mktFcl3yl8Swt)VfFE}ubhi%y4m3tV}} zxtBJzB`WVws>-xkME#c*C>Cls+W#xbdPf5-DNU$juLvr{9Jp;qVQ%oT$_2J(O5jJC z3a@OwYvqdqI*bIEAhp)@lW>at~;$tBE4x! zKwM3mm)QT9uhj{C?vDQGz6 zcBJ;HIjXwY>Fk%(GW->WZ&k%_d2h~I?(aT8uE(&K3}ZQTPw54&mdyB;ViJ+OlUI9= z!954Ve;76g`G(ge@4ZKbkjP%202m3sI|S87swRCwYvk z%ZCcI(AcK7TI_=!0j%2_cC{o@5LPMniVG^>L3aTe-S6X?F4Ui_Byu_(VqUQmju7k4=gctjQUAGn#gOoh zAk6A)cjo0b&n$X1$HdXu^HVZF>-!pw*q-Q3_&4qJe9N!g7>hrRD}*;HQ}0QFiC z!}dp{4V(=*`fkVSKbm;0vF3v|xBs-zZ`4}}lZS&Otl%+P@^x|;Y(zm4?#N-^az>Bd zO!B|yb=J8u5$5k_cSfafQX9wYk+Q$~NNlV=@T3r0Gui^<{t*E;r}3|lI!=^*mc4J+ zy0tt2=I=G*>;NWjm=9HXQ=dh<&n8DyRS+v*VZ9FpB?|%!iTbfoEFnHoo{SMnUYq@-j(Nh)6%I`sSY8`s4+O-r z|CDv235gSz=;F_fA^BYo+}zZDnfqI07=^f8TqyH!37%hH*XepwAik z?D$X6dBoX^{A=3v@uUK#U8$V)Gh*&(wn}@d^ULx3hEMs?=wB*Y5xXwC~Z_n!OTyN$^6|)>AIL^mgOI(-TRzQyprM!>MaX+ z?EH|OG0iD<{T1Oz{CerRkd#^Qc;RThykZIXs#LM49v$aDoF4MaK(yoO-VrGQ9li}ffMZkAZ z*3F!K>t!Q4&m(-{7vuZw+7;IN&YCmWRhfoc_eXm$L$JALS%Y$=Ti6 zgKWEsACE-hPa4$QQ1!0(Mq1ovkdyoysU=$YI&2n}`J%D?fL?B5q(QU>72A(N`rilI z)PlCBJ@u<#X)uZfZ`wBW|a zX@+5J&vbwmDkBE956N@5(S{{%K}jYK2Rwf-dwi)jeT;#*SooX-tux8ZtV6HQ{F_pfMJidT1F_VS!k>fX_sP#TRBUklLy-f^=eDs(hNaXMm+5zmi~ z#Gwr0pAME&sX{esRG#tCx&5@z{7ly>;o*n;L&P@#MKZDrdt6c5X}OhrCDHuIdrkMz zD(Y$4BpH*|%d!`(M&KUUmvr$v={Q%Skky4Zzg<_?B>04he&732*y2TK2ixL?@(22W zx$idU%KH#``iKVemB!x7h3Se0yv&=>Z#Ax(VX+-@r?G6yT-%&z-&l2zcWhwqp$cs^ z$Rz`xnmYLq3t4ftx0<8y{vB%OmwrTqZKK)Rm}4Dy2Rq^T60tMIR<(_en}k;j;N$m+ z_J&m3u{aO^aFCHL-9h9YvgjXe$ydt4mU@kfiB;^xC7sx3U{m)ZYE2d9uZA^4g7gFE zhm>aZ-byB`-ikW?R{N8(jB=yXnVZPSR!stFrVhf-pMMCHwT`(d&|~s{=YPmv=;$P= zn$G`4<(>RviL3A!rnPrf$B*8XNiR`+eGs3^}q^rln~7fQqBQ}|H84*sucsCW zLJ1rNPyBe(=cDxsdQWw$d6LH@dp}l)x0byMcVTeQ$Z1u%evSR2A}rZn`Fhu5DJn>U z5R?pZcoxk||LJ1a{(rjI5|o#Kog(X(7;42A@>S_0mtvO?vZ{jr2m*`{uHK`0lqq&V z1!R{qYSf84U@n7Rr{CklFv{8casHg>^@iMfhIkS|!^EGh@xqt%Y)nxVe2f^C>fBUu zi2&LC$y|LevB<$$b3T_ znW&eEX=DXR^P3-E`IBLBm$!;)pL~#g5~XN&uh)AG&FKx(JU`0*K&k>tL2(USTzT~S zHgx?EasLit2Y-7kp`fS!R|xJbQT9bYjc}9W>yh#BKRz6OV#r19mTy|{4U?h4Y7z*r zD`$B%rRz6Rf?~3fStBvs<@>FgyX)HOR;E}0^wz!A0cOIfj%V(zSJ?V%0UYS}}D~0Ws#+berzyTr5SnrPu)N?{~-#J`JR?Y*Rp_D-Cx+3QA z$eAIca9^9hYZzh!Sh({-bcYwPWAFI3NIiu@CB!0ij&fXS^i~hiKS^gcjG`~YcL2t5 zZ|alF>;RBjzRqU?%`^Ck?qSXzR#Q)8FNp@|Zwr^q9Ze>0`&5gC&mkbzxnF(VxUwZh z72WQT1X>ouZT3IC*ODbE50P1!+TexK#Hf0U6sDvo?#T}etJlWJhc&t5aY0M>j;UZewQ+)`gR20a@nklRze7RhO^8jO~x z#wrJU0$0-i`<|d+;%%5}{b{I4!GVN};YVTt%SH?m*=~>)ufh?&%>wXm$(Bk1l0p6_ zKOU&Y+lPxVjMYaSeYI1%$sXuwi?Fk99zu2i|DG)5Weguzt!p$s$$HSaDr(yI=b`yZ zwUwv40C7yIGEU&Sn$!INo4_~5C;9vN1TzqZI8u*G#hjoQV$n#xmuTi3QhO)0p``h7 z0{f52YK)DMm+^ZdO=&7s1){eI=pKNk7)d{m--<^o7c!dAt%_a;oICM5Agl~|jb;A5 zpQ7q`HgWk8LEPX+#HW3Rx(k8>%A2#@UWS70AY@NIY(6Kd&!G&6s$#Gmb8 zytoDzl4Xm01%BxgIWkV$EJ9NpXB>poq7w6T+ia0i|J{?5&@S>4gW5X}CTn#E@Nf#F~FH6CYcUy+VyK=*mUd|v2 z(QDqM8@!Icf3KAnP!BOHhhIr*$G67Nco{n&n>Mt@p`5eWCh*lXc5o!2D-goMZLL2QiyV-~1rYDNGcGv?J zaRkx7KNbTuN*;JOm+%gzmPVw&4EEVI^kZ*XN|k=Uk^G7 z>~yi)zh1nFZuXKl>Lp9S(D`c{D%?xbU7lx9gDgZ%`L7$|HnjPX8#))FdjrnQa z7m-V4UkCfO%WJ#r`%?qYJ`f+|*{zagqq9zS5(i70P+Lw^^QiZlexh!Y7=dXNX^OnO zHFjm%d_inwg!)j11z=QvPjj&#dQ)-l@NAYg;Qn$KimYjNl+CW~VH&DAUGU@q5<1`$ zctUyB|34$RcaUdjo5Uf_J{;c`=-4Pp6f&vx`X+xXA@ejuWNklA^VPTy7n2$?Vvkz7{q1m8pZFttegITq8NtkNwy{wYp3=B_ipOA%M4BQH*RkFh`<;Ybi=GW| z-^D0)H7BYBJJ@p3(H<5Uf6J=J_Jh%I&ShmW)q+;2kLIIbWsa>46}@xbl>)3Nmx9rG6 zm1yaf;)kz?1=VcrMx-UQ)Qjc|Us^`plCM{B3#!QrOqHqvlvD6K1f4s9bqp>d#0o@6 zFI>$Fj|+NWRGb_{b;qCT!lpB`6HB#+2dr|mwwVP=0i#a7UxvvVy)%C{v(@L zt8cXGWCM#1`%|b2?t8a9&2{F84Ajjx_dYXID#|ZB@pnNzU@cupIbpp#1hf1&2V|ea zT>$!J^?KL)7kAC;<%DkUc{ppOf?IeX`tE*5Hb1PJodIG`hmqE%!n66eh?!uWPKrY-8RT)k%Qo;Et7 zTuU)>$)*z-{l{6*hkl6ozxSbpTwu%Xr!w%yX+*YC)`URPOx=b6oNvLDNc%a3GHWnT zab@~>^jI^;D%Wi@G@RKrNB^@7FVNX@zs2(VXk(#1_(J**4AC6ekDqB!s*ON-x+0&b z)QM#-5r~lE8Fl-BCAa2JG5t#IY(3$vC;m$9Z#Ta87eEQ^YJJ*6gQpOZz)EPj?xZvC zEteT`RvGl#WSSHeh__EA{rJL6@Y@*DueFt_%!37)#Rl{N{#!Qkt zFh6D|jrI>9#^gnC)mTKC@31X3tG4M>{O@d9SXV_Af_w{0FBPuz^pkFZkl_OPswBUM z9-zEvy9OWO@Sxr3Et(8oxv+3p$gQnB^aW<=?=|O!zJo#{5SQGbO|#!6@2Uo}iDL6l zw{iKH0W>Hp_BT~W(Z0_oe*f5jE(0mVnE9@>kx;N=>{7WVSi6UWcQ268Dg45D{fVRD zxb6uH&vYlUWqx@yJ8m{@Od{zA3&yi1RPRm;2fF@(ac*VhMsYpi{Ms17S%Sc)T5Z!`iuNSxJaOcOd8ltHMkTCPKNu{$KFea}wic&!u|*pv^~-MA1Ia~v-X*`OL_{-5UAl-~g;?@>p=fxi z3l?>PjRJ#Cf!v%Y*g&r2K=U2NR>7lPp!Q-HX*xMrTC!>UlefZ?BNvIUc>ogMn7`*S z0&Yo+qWtaPM-i9ekZ_J?meo5DfYRBv2N5rm99-6Z9Bm)@k@0cCCq*D`n%9CJj~b6V zaQh#FcRsda2~5gWT&TvPt3U;4ASl=Le!ARnwHeQr$W%ltOrp8>bEm&ux`8aG%k^`7 zDm+xK`=rNtOAib6Z$lll-dg~pfh)9>+NJDxL}wAS6wp48E`nDW2|@xZjB!L#I`>$= z?SI)IrvEs(mL^?nM$IDfPA+nRS3ZJxCGm~-Wvm_;(>lgD-KLR0C+D4sW*Sn4d4=1? zLC9H#4~8&<|5)A6(bpY`l z4E9LaRPv^3y>?wZK|CSTd#v(x4iv;8esM?}70mv7;K=_g~`PAoN$( z_v6D#u=ucIoG=8SfL%soJS#*n{hLGP=mXfI|E#5%5Di3=IxGbhjKT6T)4H(WusjDS zY|wJC?MYW^M;5h=JA>JPQFHgtYk)fMM56~&d1TJsAIy8KE~AQ!4NxqN0f5Rq+OX%- zvZzwt2eKj)d#$p%4lXuTtrRiZ`MZc^u;Y2cGD#gHkGkjWVrstZ1Xjh3kO{mtBkE-p zPrNRwU#Ts}buSS~Efo&nHCjeWs4uwydp&8Z)(OrAS8ajG^*n&-st_6;=N<#I>8C)8 ziwf{Bf?n%`?aOF)*5YfMnu(5`)ZdfM0DBOr2eMn%7sc-{RnNiPP(hT+`OVQ^Rq=P9 zbCwC@e}OcYduGh!DABX&dig!w$NzSB>?jK#d62mw8U#wrfMP!_5C=?bUxMCj0P^l@ zkmZOljAy6y8CAV{9d0F#~$YR-sO$}Qt)qBnnk z(BuXbV07wi^5Ie!bOPE3x^ACsj`4Yo=N7bI9N=jN{#jdK)pbSdxLJMNibjic_@yh4 zi5v=)t9+|v2Mk1?z$Z}?0(Wo;InRfV{}z8tSbkbmN>8w~G3)=}DUdDmcG!%yE;iEn zwyTXxl34!+Y0%chKuiQyjpGo^VIPX@VVd3ck7H1dWpkd14c<%e1ldnN=0SYV>NK}2 zh)Bb*%j$3jt9fCR*eM9Ady3P#)IwBpr`6LZ5&mrc*_QW@_BLomWvZP8%>*nLblVp zjusLlCEizh*(i3-f-x5mrC84hW$7z9^?(nNDE)JPD%SH)j*#^m$&Wuv zpMU{z-huMO)+ycmBIHnoK%Niv2yL8S$%&8VVxQU!+@pXrEI^BhMC&RqPcU~EV6A^x z1vK+B=d;u0 zV<9IpKDW!le-GI^2`JA2;Z2xqAvMqd(n&z~xh#5f`?DF~@K)Bv174%JgOwZYOpD7WS=flY3GO<`%XRf^WeTl} z1%MFCF;FS|_k{T#1xqf|6!(^gE0hJ!i2aAgbNzj0_2p0GJwQ^UkFx;>&7PQgcGB84 zEKEEuZ&%5$FqX|`|DRMu9Q4nMU0Kq>K~r}J_jkiw4Pkqg{p|G4Kj=T}uTH;+GuM8Q zAGFQ3U8i(+c{pOGeJKV-IrrqTo=H=Y=dtFM?ff zvXx;vGT+400KMKa+<-n+;=An0umW`Cw-K^&Ov=Usd+=B(eZ?K3SNbbz$y(Bf2`98| zh=nkL`mVpxElZI1GInP^2TM}_s}>B@0!L}mMuAEL+2f$06X*K*oobN~s(4n?*jhv(`-E?zFnwp{Uviw^**i6>x zF1clZL?&B6Jgz+Ax2Sm!_8K<5+9mxap5w#=#5`sZdhh$_O^X;%9>Y&p(-T_nd+Lcu~Ig}BUFRL4gDSZsKE9{?n}N&w7!<-zYdkTA(|sYuIg+Zb3G)P4)m zl)u>%ex6ZDZfA}-pg2O)qs1ZSl%TRmGS2BKGxV(tF#(h+h;hW@XB>s)m-?U6r;@Z= zL5`OD~sU*I05w{!%vTUJGn6T z^ORErB&zfABpk*TxZoEC=5z{D7%VSeCFJIrm_sc%d>yU zu|p=;j@PBs>+xZ)=2f3DICP0_7h}8j_??@>Hi7M*o)JcAF4tfR z7u>)X8t*Re)OAhk@L6$Iv?#IeB!jx{q4-CI3Xik~*p=nFO>e^qQRpy~V`aP{QcUgrPa z4>zPCPyyS!hzVN4AKzz4%u}h?bUYHk-M2CYtMbjyDi@U(Ui`AUdyVMiL35wpym0TFl0@#V@JCa+z1BUeP^;tx#eMB z{89jl;-x}#euj7BfyR&yg(oo6p*4)OhK|BI<$YMF7%p{`2Yqpn@Jh^}nSC`N9$%fV zgO`@pUsz|A+oTs45_>veWcd>p=94oWZGQ&@5!8REoU$D~cLJfg2lCl*MUI8zXftNJvf1NU=;^5w`{KSJABti6_ zqe-MTlOu%tmOGk_NqudEKinfHK<9Q)hTJBVZ&F*DqmPdBS%Wnf>4I3iq7jUa>u?7M z92e$+*^b@&aw@^I0?Ns(RpVo!{6{4TyQgGD0qY=;f6%WMl4f#90rz2tkcq zT^O>ZV$1knH7u{)iXNF}=RhK@nEq#Crp0rQ9e?eBPRj)>dulwW<+}^1hpqzjHj`Wd zu3Y`IEYWA#Sj&?^C#)vQ0KE?S8>rxxQRUT#y<-PF)}t|;S7Y7exX7w}3ca{tP}~=u z^2kn%4fUTfcE4YGEaCW)R+mH6W!!dnUS&F~l=So5JrB(v96PKFJZoPLJxu?Tv6kMz zzS#m0@C*$-;-gUg5l*uY;wGr4ygF>+6)42CHxvoCn47D5u>CYZ?VN%Uz3{&QT$q6C zM5r}8BFSV9L1R9E2}M^jc3XmU|Gog`f3CO0y6MxyaY;rBa;C>fD1>UGjo?Lm`3j?o zFFBU<`fP7!`iS2$#(G98qU({cFP`(*z&}^opP$d`Pj?hiZk;k2*~F}If;*B)i?$&b z_pMHyG5LxMaKIgvc!Dxt3i*rcEja!r#lK>g;xjrO{FsocT#Rs_UN5zcrZ9!4Pp=d2HAIwC|r7j4< zV`D#@P>|u!N}W!E&iaU?DGzNt z)-yB%G?b+UaoO8pG=*ngy##1M@J=W2H)HjeI|@tj_I^eL$DSqZ`c`%Kqq;<7pf9Ox zg)DaW>yYVkRK91{c)O&=Jz?}`_$)3J*&)rZIzbp>K?VNJVF-Qp+fZ#z^}8*e&8B;y z53c9wj{8Ecs_w1BjtBcQX=z78Dl^Hhi-rhTO9olgzuQ*3W9-9|9uCuD_)RO!12nW% z*?TfZ>+Xfax!!DC1F$1F>{a~IQGzFfCn!lyUk#}}Kf4DoyHNth;JlBEk8H$4pCm?Z zV=>={=_haC>stM*&Jujbo}f=We%5B(9pNBX%FeeKls{-rqMmqo4cd~DUNTs9wpqC3 zCInH-xgO64GYNYDr!Ty}+jRT+B;V}?{{gNU2ozRv>{1xT^{iV;*mVUTf`AhNNGnH|4Z zvGcZWodf22;Pp4F=_2eT;afuNb+)h5i#oLOi%h$v7Vq$^i=TVB3OsFXiBh#j0)5I) zrr^k&fBh_BNFsypbWAIA{*+WJ>55pae3nW#{S_&xQ1v36tByhl#9ACi_dQ1uU-J(Y zn78+z10XKX7^ZH9Pv5DxD-+&RnuU!97(^fTBM}7Zh#*&9_19pY%4Zy7HBDN?-Iqj4 zygqPwy;AF9yA|g#-lNuF>VV5^@|E^wRw??hUmN}z8 z-#F}^U?R5w`l1gyWLh-{ zP?n(95ao*$ZlXkzXvG>7K^9Jh=Z%J52bzb{rr+7&voV@`I^)~w{$>0tldG01xfCSB z`8Xd*R?a{@?|{ix9n;z^PCL(i7ws0PLyK>#!|4Ikwigt~(_F^a7S+~Y2ZK%IuifpzvsX*LSpi5 z7+xscKC44J%;G^QVf=a?9&Rt`GQc?s&8uSiKYRmYFg72!V1K4ERcbIlAIPSXr*h5P znCSH4Ndre8he44zGBLT)`wX_gSssRC>V7HY-yvM~&Hx$bPGes6=z&Q>U)0;4s)R&E zD@L}Pv+>u-Po)=N+23>)1N6e>Z+hX(VTc-XN3I_TKGtCAdDl@Q>fCPV=6o`r zu2D(3v9m!w@~At;sH<@l$r!J?-2heWf%kFBQoW{@&ewH?%%h&tht`@TwxPO}sD9G5 zL}nc%HHq)NVScHTh zO32?7>rJz!s2ZQ4p( z&ykQyJ>N&ZaNT4_1)fEcZ4C`;P%Qm<+@4*14JI73Tm4|hxIGarTdypwHkE>a07$IV zj}uV94?e&b_Zwh1fVmI*Yi4^$oY_(Nqh;qIFVZ7kxnf<-Yaz!MABteBvv6J#57+C z(SN@1WkH)tGB>?*d79=dG?)=O@1X-`V{0^0>)})2=Dp&#pU`~ee0zQF3bY>%SnTv* zJm9qn_pGYC1`{t|bpq(@jUp@nD zLP3;(PR3cK7{?%l@){s7Fwa3=!FB(9eny)NlBJ9Ghr=fDGriFoTkfZO zC_~N(ZE)v0aXj15jhB;3erd1V|IUfNvcjT?W&fMV$N0~o%@-Ulw@Tx`T$)8&KegQ= zvbEZ(eZhgejft=gKF1D=Dj^y514IiOC$R245Np94vxWdmp2J_job7VRzuFN@D&1Gf zk@;IB!9a$sHNm<5E7x6Sb@w^#QYUBx%ApL31)#Cmtef7{BR#@ixmjlvuXx)p*4;XM z_;$53^ihHk;R(Eu^K1w<8S%J$4Qp-Nx*hv6SD)qdTA2L6e1P%=p~Y58svsx7Dmi?P zj>PgHLYh;o?Oe=ZlcXF%EyPk<%vibCs9S85net>K;H&6>%?ScGa}SeNoc(iA6|x$@ zX9GD;hNJu6k5!gjz$87-7DTPy!PaV6Ka%rV#_JhJ@=0xZ-@sg{R}yO@ySQUm)qcX$ka!|M-&O5D~`bITPz)P z=5Y}R!~ebEzRA{`;@X1Nhv~%`=BHawm;XlRwmwHQ3~hgIeRFZBZl1cd)*Tt%EB+51 ze=UNiem8O=$31j%NBJ;K-2S)9q`whuwQugQ8#9{rc;LfPs0$Xu= zk-h4dG!j^7P(n5|v~l?S+N02wfN@^xX<+9S0PoRXA^b@QWGY6(!LIRzoWZKE1E++j z1no0-CW<~YhIgaa@slW!L1UFBaH9D%(}YrU=~xwNATjY9xUpen4JAQFqF9ryJlglS zUC0F_4sUE5Hg?TZXm9gi7vrT*IK6 z+k!w82dVAL&@|wWy1051P~Xulj&*g*!HZh;cj7llTuR0m?)Aw0zAx^5@37gM*V+!0 z@S^_bKK0rNHKIk9fR{u*La#ex!|sc)`=eu){1w}+U~tAr0akpp_t?9C7AeLpF^6OkWq5$@(iI z(x-f*Tevg@&W_z4-B%G#|CkzpgoHgbZrUO=xLLwE`qWkI+20ScU(5KJOKzUL*?tWD zxCHFB>CGnS=F{C)L%rwYE~mk~rb!vU_2%e#9WZEK@35-;S!`~i3O3t!0X@mzPQ_9~ z)_G3Juo!!h=JFJ}J%JuDx9Nv)WKH>0_MoC{nzL(NxZg)xfsJz75ZUnA6eSn#j8ax) znx%K_Clb@(GaY6ZN5=$xQql9Xe}2_>0ODu{3G_j<;WwJ>T>y#ry(OV0DmOv=38M-e z;GL5d_}s@Wpu(U!T}fhGrgWr0^MijgG}#0DL=l>kO3ttgi94c|$(YFs5Dp;;cH$Zu!h4)s92!4oj(6omxkz%OH^4%n0@ffgZ>AGYrpOF!h58Kv z|5mW=JqNkANSc%kdViKc>OJaRh=|THJZ9oesWbEcSxK^-N@cd-W>SK`{+1(|3Oq!3 z%%og!fL;q`q!OkD(!=Wd!$C}kpstt**&HP@#(7e|c=MSJ|zGMZVTlkxaEmQ3Y&*yC5v-&)C@4=Z~r0T;G{x?SWsT z-Ow}P#49g~)xaLsO4D$QRf(jtND8VVw7%ixz9g|Z2Wc0h8>-ayn2Lz%G|y+x6bOWV z7DYZ|@li&$8KajCn9J)Q{l-|J8!$)0V+LvX1_=yFs`6}bt%iVt=gen$Z z;{?|KR4gk0RxF(u9>Vn&a*T7eK9vZ9@!PL`Zcl%I0tN=zqNPiw$^>6QiG)NIkzpw< z$pxGvOu!2fIBXZ5gJIQqX09yO4jO%6zF`igBbR-_C46SZaeI=vtm&Cdk*mCW@cT%FMmKrx*#+05xt%0X-uIna=X&^wx&sNbq zywDkjF|?|B^Nq$rs!Z!PFP?E+;?y70iD6=r?-UP>C5CG2O z#M4L#$|a)H$Pgn&=;Lp626RGa&a3t${HgNn``zoWF2CXi}8U$1O;;&6uoPmnU<5W+Ep*wm zpigK<-CUWX{VsxpHmR+O81Z?;$Z8K*k!>GKRf{_*ae1{^;^E=GkW zV&l_-MI&4*k{rNzs=gm=1z_Z!I6L*EI{q&^yDF%7Ne*v!Tto7JBRNua(60ny{^ZR?m;?)^a|Z z;CW}8m5dg`fQk6gu3Ie%M0le#VdFo(qOB0rG&Sx)qaxvQYWmoyM+#g7ub76o-MY1O zu@(&>6d;vvHe1jxna_Sv8MqX+VTHd`Dh0a+=D8nO*J~nG)n`QBrM!>najU-SjXd8Bv7d8upPb<; zeRx?p%9{xnao*Mt7km9JTPQ#e)|@o`@~a`EXpc6BgOTUr>}yB)nUC;rX1njrJOZch zBM2m|lDAG;aa*~&j5hz+c<1OpZKLw}%`x4PM<@Opsj>(PTX;VhE;yvz zLiz~m*KEAX7lN6Vxvy(Kn|&qKQv=ZeOL4Z5zXN=Vb90b}_z5i>qJoQ-q~Pd&-%$kP zR*wiPR-{0JsZU0cAnijhc0UFLjI-|Bpk%md7)fSbiu0 zq-r@7AerZ!MnChXEsLi}oqYYqb!t~>g#0n~umC()^JN`Sucw2xmAC%vs*Svhy5Xna zVAHbM)6+0S%onaa7QywPyKykKWmvj{O}jJn$%+ck$_1jOFQ9pSbzj&7LKhs58Y$cO zXZ3;hM_}DteTZokJBY26DmcQ{upYY)<~^a^n|-t?WN1{IAE-=)HTEEgjokt`*4{m- zzYN?|(xokJwQ|VUW$P!5;=4VHh*=2Giz|+btBm!YADNox%dXJV;+7%BZ}kZ}pIDM_ zMP21@1xmmWY39wcaz6Zb=(7!mA?-@p765K^HZ9gb2>x8z{J)x9?e5)X!(41<-~Ivd z-8Z$A`u?2(G!%M)S<5|>xB`oAImYF9rwyeBO&$;RdxeTiAt<-oK%8+b%F&JTEde4u zJZ9>FIl6ir0l49W@%+HUN(*Y$bhalX^NnB^e|x4aldzYaBqOC0tjIxVZu8Jhkh(jU za5(#?BdE$4^G0jyu;w;jq*wK|>f+lfTet!>fvZw%g5?QC2o=V63(z{2bVUb>*E(xI zeHzk_o5VGK3PPf_WWW*V;r!E|m`gL?jb{_Jq;o1!@-pfFm>%gBK1MtZ^xgKm`iave z2Lv$|raZt*LG1$kf8OdWCOX}|pnf#u81VJMHP?|zma7khV^|!6Lakz%AR4%)s}G!E zZIuLi3iYzhgBq{n5JP;RgOVoXXhvoS8P4CGC)#_qyZo{^Zo6lHdVh0lTQi|`-1>}u zJ_wO4t92Ltqf{&j&z3D(%GF|v`jf!C5M!Tcc$`k|e6gGmC^&T->l*(U-Kf!(1Amou zOQ`3Jwa_fT=%KKL`ywpIQa^M}A6tAQ7*_#2C3CzcP6q$|)l<+wzj}=#(B&3A38^6d z=>>@7S>n<6JkIq{PXj^m@6LKZ(cXS@=~V)nwj(`xiC#$xdys-)uV+(}Kt(P);Y)N@ zuvD2=Q+U_)?)7LcK4mK{S5tO3>WtrRC10UBIW3H6q z=d|;rT%Q%&<5YzE#0l=rJ0Xo#BgD>LGKR^i(*Xm7dC(N45NALw6@aq4+)-lOT06p+ z=fmt%(DcUM3_uUW#nT_9&a>-2R(9x2|EV z^(T4#aBKm=j}7_h9?Z^u)?jo~A5A5m-a~*LyA9w~u!SOq6_?Rm#n*-cM^6O}dm2Hw zw@{Qei29{Q__A8wZ^;4p)|1-T zrS=~mptW%*?9Efnpu|q(62w?Rk*-PHiy&4o&V0oELZP7f=BU5sf_VPBw!?~-4P_%WvwwX{x z4K;9!#QTD~-vs;!9J~M-;am(tHh5R`LTU@5IWRvm^AU}-hg3G#C5%;s+BUH`5B1}n zIT?^lZz_2@ z|Mgg;8=fbDQOkr4P^9jI{xTw@2(Z+@7^C6?5u=sy;QZD#jzCs3z~QC`^w&h;+e-U9 z7b;^|sg3_TpbWlmjM)qV+6RD5zZIwr%r_QBjQ0n!EHEk8pF$KOxxR=i{KR-Xc>Pkm zrM>j|%X}|VgXj!>r=h~b=OYKzM~{VmDK0?YcEMC}K~`bCzp+2|n>>>WvS#`#3Znx< z@~znbnm2)f5Ef!zBp~_UA3G9t3}4a<h~Dnym^VKWNN>kh6ixtxFZ< z4RG3b{Z3EIEZ_t|lpkcppW zn+eO*rA9S$^DV&kXA8ukrz_C5;!$A6uj0YYFEtxbD!_+jKh&rEZwX1~Jf#TbYM4~& z>C-0JTfrD;|8wh&=|#aD_~AZ1TR{ff#+GeJig^%)J_AHVFj46i*2-QQvF`w)IaX1C zO0ZIkmX~<*2|8CX|4-)%NSpp%$2w?sr>U1h@qmNIY2t%7w5u<*cs+!E*l{FbISuLyZ(bJfVd+8XIZqdfyX>FO7 zxc7$y1)00Jx0p~Z)<))Ro0IjN6R3K4ql8zg(Mm;KD0UNXx>onYeSH3?-1p0loL(qS zx;g1yhF@nbo%(}K;A!0BQ&NIY96NmG-yWC!bKQtqOJ}SK2A?~zBY%qo|H*`$#vMAs zzpY9EHKLCH6EIk7IqW9;)ad&J=VX6jj^KrQ>Kv#|yqMPlNZBbJI`Q_w`XNm1ExZ&& zX^+^^uD>?~41AXugXd7}^laP*bn*F?Yk(Ixrqk}|05UnQbD$2&i>!RjZc&m&-!gdOi6hLo1Xa58HHqp4KxH8N&$0sdXV)B8xym1`3 zmegBMzk^Zlge+)vxK--0i5x<(Z3s*>UKW7@Wb}3B1L?URh(run)YI8${gVkm0_p!M z+&mUD_6c(Zv1MgAdt*UHFGhy+0&)k(w<@LghTv?iwtk8fGMDU!O1!l`{x7)pHghT| z_2eLALj*V~9QH%oQ*0XxU2%jG(M9LHc^1W?u;XSAv0=#hdiMT|Ny zVb(d>>!s0w=^lxS8h2y0CMDQu@Lbz&)a~*6ze5%o>Wn-vaB*29BmQVfZ)S`FWI*+L zV06;_ICUR`So(-uO=FEI#dTj2QiuUbknR0rML#Z;; zktRg+M62^4_-7Ii9u8hyL<|39x~wk&dN(5A(O6KIr|2pasCD8;#C;6M9GksMNBKmjR1l#uQaB~(&MN(6?GMmnXH5Tr{HDFNwF1PKKM31J41 zk_JIa^4XVq|Ng)AuJvE0bBJ<(ir6y!N^Gv5$yTt-fGONHi?VxCed7>M1SG zmCG6=rkv+-*{Sam$8#C_&YEY4OrSOm2tC)Pz_)z!aKU(%Ef!8s?>89OH1XjG&57fy zT60VV8QeRmiBizFg_Xt=C*CF~OgIv(xKCSDe*|H{W~3e2{=NCa-X-gz$BvIapYlX9ek%FrRBB}`0hePl?~3N@ytJzZunrvk zsxGzc`+^*Ugnx}!hMtHGqTEuN{C%Oh2#u?4EA-49%%A?hK=GNLnT_jm08WNT>kofs z#g!Ql*S#=#w7uRyvr+(YEv>u}LUOHlP{q&Z@Kj&JCq3DH7eG1{o55|DJm`j;rm*`k zBeN3OqX+MP1FP;)Fm0vh&jU8Qz}x# zW2Ww=XiUFG{AI{7o9urm1;~bx1=Kr&DzX=X3@QTxoS#>=QsvU!J|-J*`b2iD`l+)| zZ{RetmPg*cZu%^3oiG2X)gkW));W^{rc*w-2S)d^g6{%TDg3tM(A|eO{&ZiXn;}+blOp%Ou$1u7QeZU8TGgp&G?=D`0bZ{TAa5BzMak~|_Cv+a zqUSQQ$6mUh&x&)Ul99NCf9))cBprZvEi7|lP4cV03?>B!VF3VXYdvX4%NS_VIc<7h zZQsy+B3OZIb;7$}FInU?_8T;_o(bnrF{PXqkcURv40r3C^zGo%2bK?((T@jK9Isr+ zf))anD`&RvpGD*#Zm{8`CfC!u@?nx;l4=CDcHh6+;9IPa^I2PD#~sRmj8kFn)=kmY zs`uiQe4QQP%;E1U1}a9;y(p(kcJ`^C?-EZ`8aMeEMbSvX$Fs_2vjOWZC>9)o|F`Ah zz=_QS=I|(B@%D9Eq9#zi0U#2?#aXC}OyIjggOuWScs~dWGLD_qTXh|}yyGt-JDv+j zMv1ks!hT!QR}@~9%b#eSfvvJUMsf5*=;*pAyLW~Z%rs9%?4CB;<$wF6+e~qtM^jb9 z4rlIdTqQgvg+v$wisU8Lp@iiPA(`$4{@m1&uC5K?7?Ix3A`nrOV`mbj0y2oIc#r7g z@sG_&NT%!d1v>R#CJK8rysvi-nN{C*`~raNltLph*g%p^Xxj%sEk|Zme?nQ{^_35* zn3(*65V=kK^U5V2NoSOic!2a{HjaK&k!8y~<)0@{YQifDB=_||dSpyx5O*&%8;}gT zklw0hcB@On4q| z<8oskU%c(AoB2M7dRgltVOIQO8TJubmkh1+qRKzveU#CUkHGFBZeC*f@|q>t>+8?> zk})4rI6E00*WflNq|z_=%t$hPl$q^{l1|^0PB#^HE9P?X_&1|?OcnhM_9NRl0x)9d zNOw++sGkzgBmTxmC%TLu26bB54!_i7t{zPyq0V}~#_wGLw3MA&Gnw(oL} z{&_!DMU6c46+j_Sr|qFN{pm-~{QuvVbDj2cA&vXT80J-tT%?>gcp7QdYw#+w;fx$x zsWH&_I@xBV$NPx%2CPRgcJ6oH4vD{|tn{X|;LMA@J~g6zTcKMRF5U$2hlgQTYeRog z6jETho48eq+Mgw44(j%_JkIR=H8O4df9-s~bOt6Pw0gPGE$G}_eRn=EQ#|C2aH#7N z!tUJpZ5y0seh!Vh382d6{8tV~lI7e|=b~LA^D_>vSFVs_#KJS78%+z9=B|oM3oVnS zKydOuk7&rPnA0^X`Y)kK$kXTIp=@R{nTEs{wVGEIS19qgQo7<(RIld&krxm*s)j+& zn?cyY&Q(<{?sba``Bw)89a;0&>xF*PwABb@wd)}Ed91jF8-LI8ar75yqKb8sAJG0R zl8R1~31e^~LruO%Eq7sj_5nEvW~FA<6)RFI5ARF#lDq~G({0jvMJsGs;x#|PGBFq7C! zmup@8J8<3zkmf#X8O_XWdVAdn_1>9qf^f~ZqN&o-$N52WV*gzGy_vh_=X6UN-=SP30XGvFLo02Dq zC2wAy>&+Sc{yuON7{=dS!Lh8Rdj6i>-@?}ZzwSP542RfRi{SJ43k?3^i~caltlrgJ zqCfX<$-l9$wI3`EKd@&eayYEn@ox*IAm>FDkZ)=;MxkTiSoGyIqc0! z9Sw71CE=DZnislCHkwa|r*|Ut+?m@!*l5;#04`_IUpkk~XR``{OzO=RYb6nD^=&ha zJKQkmUnPx7Hx6$iyAL1r>=mT2bOrf!S|YVZ>mr!ykYl(NO5Uc!{PuR;;1%rqkUM2i z8jj6iyH%dn-)Z_eK8UJ5;~@D8mn2|@+nE1q2-7=udI3qdB^CcEy$ysRBz&!B9C!qu zMxk|FmOR`stAb9o(&Hl^oExE);<^_b9McXVukv{hmkqP>V|WleOLe9ZBpC4brC zAzow8mfbF=}g;Kaq zEBROqpwFQ0^G5GuVegR#m#e^g1lgV5<+W@jbC~L&}=7;xF_R~9Lp+r z&~-P2hFglj*wzl`Faa(oTic@J03M3ZCq7IjQYChs+JnPZ95NFq>;0W5p?I%*p?U9DPL!`&aWk3f8}cy~s~` z#Ke+2ceJk>;JUiCskS zcjcrb%bC-RBBiWS8yYTu8#N-NmTnsKkQ_&A7{Zg$rcwXRj!#dH)c%Un;cnEr%>4}u zWZnp*Cy1Erf365aK$yJ`fsTh zDUjV*wHncwl;!=;3!u($F~};|#ylYJnb8Pk0WTkh=hj zFbREd4WP{=jZn2sJb)7Gy7bco1$OL6^0gxgPpP!tff+gGjOIC;;A1l^Q4V6DOsdZ4 z7L3^|`!b#^FjdD%Y*^>&_^{{dvy^MgU+47u{=#A(GAbn3fx7dZT|IpXO8K=TJJ6(D z(Ip$^aqYP9Y-f~`Wp?O6)d!wJ$KW~QN8J1$aN`VIhe9{BxzK+f z>lb3^I$u=C?j|TAGzaK>Mg;SWdVn!IaQ5FuMMG>@RD_!ftn9k4FchO9ORgs6pK{2`3ZHM^vVAM+X_sCXDyy|3MmU5XR5KwaM^QvU~w#{WK_|w{8T_|1!CTm>#={6CeI_GUNz5H49PP2kT3y z>kp51+N5xBV3)v!xGp=D9tfy97w&nfhS_Fi@q2)}dG|V^El7EpSrC*Z>4A)ZKm+eX zP<;&KDLs5$Tw8#cQ88RL4@-e-rJ+vsFt{b$306_bh5*#8z`yMbGK-%wkj}ntwCNTj zvE_j5AMQD8oNk1@cD?63B0ZOS@|cx>9!crRw$h-X2h7rp+pMzKs`(*Yb{pFO4&ARB zdGJ~R^QkrT@vYn8NNLYF$>~{UH;+I;Dh&uVeA-PgHU1YyN3cO}B2ktdd2l!oz|ZGw zzvQVM^VbiN-5mt`ID#9*FD^sty0<@>vd1CT~!jV{iNU zc1#&nmD6Zj#;n_`8SfvTlQFNxT90&~&bkuDHgiV{&y z56@=!uDtQ9E(My&1&mju)btDjcrOa?qYn@|I2PDC-riO|p>5#%(KaO2|9EviGe zqC$U1t;-@xRN`=F%KI+iY1;4K*2O!v#(jN}0NEY>S3_N$9Yb4VUC0(u)6LYj?j`_o zZtqbj4Rs_b){*1Pw%BW?`_(O+&9a$~k*%Mpm}!TC3sZpcb4{xzK(2e20V9$ego3uT z=<0fzWEsBgwl~t9^jBqV5Lny1im(m@J@2%N1GsLVV*WK7q~ZlwZ_mzFh|k)K6wCtf zl)acCqIdSpqRXyN|8lH{wUsQ}GIC|w$9&Uo1Y7?`!(pVC1b+v{YXcr}$PFS746Dek z(fEx6MdNt444;egn!CBMb*MF#rY_Koi$c^JZr6<=ae6#8UN3Bmrv-20e+P}khldl! z{&)Gyr9&cc&%D-QzEwD+X1BfWSzns4{~7PMfG1z%*;#^tzGUe4ZZI?vpAYG`axa#? z9G!mA_Q~^wN`4Q9n%DRlc<3*Ch8hCTMIFAs%XYX4Yxwq6OHrg&T0SptmYC0t6JM$4 zw%#i7J>c$4K?uEKDFSAS&PCEfG2I@%#FW3D=p@wBh~H%~?3r!|Yx=rXCruyKTpEXL zdw(V4o%)uls8pPsq0)x;8x5J)H7gNJq(0DvkeKIiMiacnzI%qpunSYsBWI%UPBWs`C#|&s0N#qBU3CdhI)ckQX z2ORr&$y~J<4g%JPR6hRl_nuiLrj#r)MK$ynh4?`D0}M`cZW}QJIW#b&e?)12heC`#L(i`);7ofZA1s5e^PZ)Qx6~u~ z*&BXvoyM%qRji-P&D(fFLK2m|eFO)br}HshjYKU?;>GTZpMnWA6;>c%MSiuhRO8B< z(^Tyxf+YC;$pqAk^1kqb%qMU7%W_whXzPZ>&j~w9f>DNC34F=M>`*};s`g4r(tfXR zi3XT?UxV=`X{T;?{i^?SA{FJOiK~Lg64n0eV{=&E70g=>PrlUT*AZtpalBKJDI71# zKltketS&|`BqA9wJ^_MUaAlcylcx9U-w=5-HC(beT`O{G&*=x&=)(T z;+r)@nlQjE9uMd`7d-*%xiK9`pI4@1sa6UOk~d@e|AzO!zmA?dZfvRw64L2nUa zm$xRGU>3k^%=P-%=<;DZN7J>Bm$zJW7@i6a*F_ z-*j`KAz$jDB*>VJ-7fo>2R(gYi%rji|_^h>(3vXRvrL{=x@F3xiv1IrVTm zr5l~2O?U^#20NwCa;X}o9&G)ZY7l3hX>NnG-*)(eYC2J;+@@$Pkd>dG zn_Q|@Cf(Za2xJpF#aI9{(ZhZ372j)Azs46#kw~QyP(JT#$GeXAx}Wr z`l-43g7GEehh0~n7`(R9%*-p|&pD8U5pBN*(1_luA`s}7l)SF7QaoVf!l6*pJBRe! z)+NIN0f%@lJ3z~tCnjNE>U~O$(fs&!E9@F=!Zx1umo%6v8_)WMuK9RTh25lw$Qc=? zKa&8<^?9}&q9|5gMNvao743WMG_-D?St!q+`TFvOu?%zIIkq{Qk!@@L?~8jL?j|#* z1|HnT%nz+c($z_5{NR8d^b=~lUiYp_Ev}JX>}6@(iA_Q=MJna`6}W=deQq7v>G-Mk z%}Q9$GJ9j1-{3cvl8lcEv#o)L(QSPkgl-eJzExQltS)G$wBXL{-=waJu0#$Y%`&_m% z*iRTN733$RV|5{AQi45{(J73Z^SQ$IX&d%PyVovtdKV?p6GG`Hf4B*r`{YseI(eng z;X0a<_IR3z0J(b2DV3=D>-Dz`Yn?BKyXLJDtkTLmF2M!4-lF%5_VW2@hOj0wYT^Zx z!$E;I#;Nh^>>v&JbwfR=!V0(y+(T9N#_GDkneQrxXmi!s*9G?9O9}EL$n3tlac1SCwl;^e2JpJ+8L*ZPDN(R zZWR0XIY2{yWHN!^!)39=fxbd!9B4j>uG3nFRh;pG*Pcn z_YCoj+7A0^OD=cew|-|G-H!|A)Y#%Ak&vJnWZkGaD->t}@Mx@Lo($0yE(DCQ<qsAT=F5hQd)pD>!}1J`y4VfB?jggONnYgc~(xx=-e9%_s5IsiQK&%*pSN!*u*q1vwH?yb~+xUdDe3BLjm zsH89Bd7O4&ZFN5Yu*F`yKDZb1RL}l z*2UrFs`0V7Gi5l3Re-@Cl5vC$AzGZYP|6a{HQA9c2FlLd6Rh(2($=~#ZgIDA0L21u z7^8tJOc|EDhTV0BUCzivjW4TYY|m(enpZ#?5OmL__BGDn|Y@>K4iud97|LuGuNynRYA8< zvz~Np(dbsligF9Mc3jRb^4b*)YBsj;coxltyEtD6e|%EF;L?pGIW_RR*!kRkT9Q|v z61?2rfOo#&J!kbACW(&8k=mqgJRjL{Yktjjhb<8Z%4|cH@q-L@pDXr}42-;g7jI*S zCMHn??&NdN^M@LjE&(Yg6-AdTi|W;I3ni}V$M%n-J1#vU%Vr{JD1}eHJkZ1w?Qa{} zN^^ZDVt1$%HZ|)zTWZ|C$E>~0QT)LLeH&=@8_%hh)BOx~6~L4D+)D*{o!!B~p$*}q z?U+Mu^Ir~VU}t`?7xrR5|FIla-yn!;2UOhrfWP!t-!l@Mso2O?CY!~`prHfb{R=8a$jDvO1BqglXuRn0*h7Ot? zr8hyJoZ0YGBf%nK7Vdhi*cp|mcxJZ#pu^kiMnN;jE-VyPj&N;UUSk}|X(w5} zT46KB$-WYBI`?~*tpoNS=ni{-dRblYc2xaZw)Ce-JT|urHU6~6W$?0zBWU=e5u-7w zvmNiW)kC?Q5`NfRTxBQEJd}Vu_i*LULBqhmDOpd;wOnBv%S3oKgg2gM^Ws0pLm?7dvbyeL~|#5`XD!ibmM$##2yWKJ4VZ9oks7C0Du_ zWMC5$MzU;((>->tjwi@Y8JFfG%mk>2=LH~Fchq&VD(&i9!j+|#+pQ)VwO!|M(m(A` zkR(~7yfxCH4m?+sNYeJBnx$OL-}qc4uHi1O&K_M?!bY*2$7zq~eE0why}WtuaEIoY zA!FasqS9vK!<(t?3@gu%|90xyLBH z?f42ZMAMPd>D~cO3oLB@may8z-c&Xw)711*=y>C6%I#4} zYBiZ|_X+(-hW#64%$&fZ zKZsNhH^AfaxTLWR>1I{icoyPB*~@x6YF?NcX08*Ltz(G4BOu}r&CV+iyugbjW+h=! z(v#m+3jOOYEX4%l<*Iq}B&`_S`o-j$?R1r1 zZk`B>yO{7ywi^1x*%86p;%J)A=P;hgG*DoQR?U@fZE>3EezSkGr+stTZIC=q8|(3& zs7l5AHQdjSN=6_3>XK~N>U7mNhK;s?^=_HNcc$?v#r&AFRHY5*bCT80-<57K9uNIBPqTuF>41K~Zq4qH%~NrBUnCQ@W83nuKQD zCRFFqBQj(l8s_92PRv*A{CW1-&z@4?8fb^dJi!t*-oUs=pOUu^RlK?7h#ajIY9f-STU(gBu%in%S+LXdHb9?`ugV(PzQJ=m}Ry zK_L-ZJ|k z7OfyQFjpj9{myVi|?GAR2mE~&Zgr~2IMNtZYfcHcMJuOg~) zl;8MQV1lHl*kE-uHJhcy^7nS*4MJ8&Br=(~#QyU5>-68%A|v^LKM>0R_|U^ZqvIt0 zwK6O{k}{$$&``nE=|`+`tn3(9qOBLn+ULrteORj1ud|vTQ?BGLs(8vlC4K+u<&;-r z>=#M(UO=Pnx$^2|x)ai%a@3A&YQ>=6WK%USBXlqX>1_yAL(H3K2rLXLLW8hi;h@kW z)SmE%nkTq#Vsnq*l*ELs-EkBS*vy^q7@{f`1Fuh9w-l>yuu_`07E)=M<*h2fI-}GIfjC{ zUi+)>W|l6uwa%GfmWXN+cC9}r2^>EC-MTfUW9X8=@m@At`SN50o%J+y`wtP{R}KS& z3XJI%owfayM6RT(d(3*6=lmTFD_LT8BSf5E2V-bgvXu6pb_vy2e5|gOx}#QC03RQ5nzOOj4M^TE(fdQk;mY*p#9- z>Mlq#nmdjFsegb_-yo8V0^?}z;ygl1Rv{KUhjdJX_R=+pl~weFD#@)b-&k?+phf;UFop;-bN0cyn>6hXc%>Ojm$15kt{&?-O*wJL4O^b0-t- z4ce>jj!laVpnQjgZRa=+W?=RC!M7wCh$_1e^nk1JmFAaC)P+$Q-QMIv2r{`81v7MgDl76w)J zNC=LxG@ zWq*h+$m08W{<3*3cyzLdORAcYZNBRz@^URlF1)MwHePVw0eKj@aZso8MLXgDK3Nw1 zYKUIdclT=sj)3N_Ms9_b%kfn)%5}xlZ>?A~BmrN>AQ~L;m^Fr{5(VaKcCX}E4-q0A zu!LgEMh(8Hw81t9KJ(Na;#16GK*(dGDE$o$Q(j{rejP9XJU8_petNP|42EBaeF)c3 zgDA-M`nj;-tA7aenz@)37Bb$q{aQZn@ggYsiHzk!NjGP=&bsLLSE9pO7H{Eb=}u=a zBO8c(xz*|^(kh@*CD9z}sx&6bRR^CY=s*RYCLAVtYuJ81q^M~aAL*yqmD8VsjTGu{ z^+G2L-4$2JSVBeR)ad{Y9!em?cc!9c#nOy%Km^<>)(%UD2ugVC(Ud`1jqHzA{oLro2wr&f8o4rt|2ZVHmn?ln7Ige-cptUO>jGIsjr(En-EJ|Z%$ zkDmlvb^o<#w8;I83XxZ#!DB+ilmtz1m4hU0q~ot7Z5j~uzfGFiTcv7+s0aQ8sIW|P zyeBH&>}{SDo&r)tTD1 z@hc>s_MiiyO|Vd2ixtw44{YBBWZC@^3o7yp(cl%(?|Cs zHUC~?&V4pRK(gu&)b4Z^oi~PdpW?WIn#mItRv~PIqNL@(iKtY*RzspIkbjQAD6-AG z^P|9E5zqSChat&casvf#dX|(*6GhHJj!~{ekeX_Ws+WJS;uloP8|A=5mdf{p3_HOj z4PM)>JhdXA|BFC9hN6yo z+)3WC9U0#wAMtr}oltOa*ukDSNg9djP43&bw950o zijo<2V<9OIGgHnlIq%)V(Sd9Q_YOI?ZJ!uC6)VnSKV8ga3=+Gh2Bj8cXb{1vOUHRMSLF?T}g*GVbQlSEmWu7{kIec#~-63-((e3J{C*G z-~Tj;CyElI`Td?2ZC@#!V`#j|$7voeImI7S*OFQXI6k;*2f!^K;%*nCXHk$CWT17Y z!|VOSSPgXl^VV_Au|-%+j=3xjcBP73k1!_MAY|KM}5rsy|cWe1M(cxY*?-&CF>@KLT@yMEmo>Fcib3+rfovKo7AHAOw z#dRoopYjQN!`}m@_nwp}wpPF(vsIKNpQY@VQF7~E9uJ|M#cv=6ID!+r{FiDF*8cG83NX#n~5 zH@>0Uu8z0(ByD|d3sPHN4Hu=l)jiiW2jEVzQp^W5P^zSrj9O+jtHBC*E(3w2*V-vv zmgtq*&)Cj>c5QIXu`LUJd-21FH`VhP@%45gtU8jLnJ#X!(Dfs|Oj=ZyoMuz3+-Vg1 zaLr72Y-*dR4zvNJ1A1W+wg+jJAX4Th@%VPS?s;=`ZWw+>*JU zur-j+c2jKm%E|ZVDwFs5NL?$V)$&!OBJt={(?eof9ywj9cUKXDG?AlyQCCA=s)Nm`2q_&ZL+))Z(>p3 zaJZ1VoGA$|>760iu6KqLPn(6ga+)Nr^H8SQ9&`xYra5z>Ncd56^^8aQ9|g2yA-DG> zmN$s40C#=%O#@Yr9JS2bBLIl02k~!~x~DD)s~Up5>PcYO2}jAtpKUOriHnktDg}Eq zn?vLY97&ugb2GLg9|e5&%etH>->AMGNN|jkPKzUPSM8~k-cV=P5Kq$*6Mn(UXx(0h zBZ1<>uczBQU!8n@{5mWkZd3Yua;H?#v^1~{1$p!UsCeNFpGpI0ePBQ<~v|ZstSX`K~i$DIcxB`g! zu`uUa`aiw<61n8`UOI5<%Vt^tA8EKuuOx`XpU7W)55FKV8}g*%(0^s{=lS#F#}m3nrY8|aDAS{#GU|+^kKg7ait;hgEVLbf zsm>+hM-VAQ+UkzV&m^_o0_IOOtZBX$L61*5uw89Iju|#RG0Fd+*5e7!)LK#7czmEG zJ8qEeM-)9Q5*V(|QrZ7Kgk*U0K(R`Rj#~Loq?Ip*eFo{7YGVY zYWekApkoC=A@R1u4|Zf98j!_vvPGgJ{Erz`JIw6$4}2&*wt#u#ygllcp;IIE-S0%U zRdK_XzLMl})6wDMIvLQL9IZcVss@TxA3|a=x+=MTn?r%fuY{;dA$CrQ7@o_EV>zGx zryHR~x)G6IR4)HsHwpM&!=4_+RL?@BjZUQIwcad-murp(xR0)=K4K-J{!2(Ra{J`K zs#jK$%jv(o_hnjrPko|((&O>A2&0zs*lkku?KgHF<V%YH3A1r z40teO(p&}|A!;cMuLh!ga9~&YBN15n+jZjye6`&jKt-HKMjdQu!`29Q?a8byFoAOb zijlK3uXqP5&Ip#7(Lz>0@pVOVfOnF*Prwq56-VedcZC|h(5s_7a*JW5rj(2NKvJ1nn0h%QsiwrD$v~{Cbk1y`L%00o6@7^!K|$K;ba=aJOMcmq>yYR zVbf-O8lAFW4U#uoK-I5dxaNFc(;Z|UF$_{Z^?!`zKy`4?02v&g4Z(}JSf|7Y(;kaf zSXov={qZn$Mr?^0uH26`0C~|e`8l&c+LFLHK7{ZHQ_i}Wp>ms+*|^(~CY&sbLOkYrB3WJUZ? z9t1hd0e|r>nTA+0$rABxqJHXs$8g|vX8UdOzsIl$GJaIyuaUBX{vz<$f+Jdk4FniA zCze_sQ;s627XVR?+|v!x^P>i~nQF@`z%aBR9GZWJMl`>e-hRGUSMe(Zu;c(@B@ zva2vvlOP(^-(Ct#2dkmK-CD?%s$qvy*WRJRkv8pnmRYiXuGWVNh6h+v(NZ3$D#BMW zzw3PG?>7mOW-$kM@Rpe0~5RIfanBpZ;;U#lc>2 z2C)oSJp>Ml>nGl-yBkZ0=j5ssARQ|pD0W61Ud{NU7ZFn+wqj_Gzf|5Lzjy7`g+JBk z@(pl!BJy7+=d4QO5yoe4+8Xn+7luh{Pw3}MsRQc{qtr+19V&rSsyKe_N!KkF$tu>_N?F*D(8rbTx+}GN+JEi_Y@lA&PSVk?t zEME@*?!hcnsOK!M#YJ?BUiEo3=T@|snf1uXLuN#j+>i)MtEqA3{brdvKu!Z9eTBW zdk;U#N;CwcWJ@F7KIuNY*6Nvtkh63^D`j^2(Fgt?h_Sn*QxB~~?kF^hoV6$^(6IZ! zsJjA0#Eo$!pwpV~3mlM=Wis{)P9)Z3L0a!l zx6gtDOuNH8ct;-lSWSCx zq&w$aEx68{3$I{8f%dEbv6tdXT~{NzeFpCM0-52DIf(m?Omq;B81PG|N8zs98y!E~ zs>-&3h|C~_4x3{GS6&$sc!w+T+2pQ*P85+9Sfx6K{Bgj_)kiTu7ic`1j#IA%in~oF`J0^6g8w1-FJM6Cyd3cUSUWfa%w`|I>UAH&4jf{g zG+Hed^TFBXw@fWkI>k&)>=AdP*}`;YP}~|==Ox?)Kpj_M{k5KgPoAD|8}U5+rLBb4 z5JdI^g?a(gZ{WS4M#m1^?EBICLSPIzgUKJ&Z_P#K zjb};k?t+MK|6Z1UD94f5S^q*w83}TX%^e}RT&!0QgTKQkS%S`sAB*XsEU72Shh826 zFM^q>fnayBPdw#RqpOk334@_&_;{#yQ8%j-)h7oaqNb2V(S`GrV)t&!op}0Q)f6k zQsV%FY7JW;em zE&44+?%Rk+D|?hekElEQ){k6$$M5Wg5u*fD9tYJ73oX)vVZeBmNhFLNz&Q*9S@IRcrE!S0*NO6$aW!}Rt8|ipJhIveT{uX-$ zgiIEfO(vh5Kso8daw%d`)O*)?=&j9AwoSsmiI?i_4b3`rtuFNs)(EX0*`Db1S&4nF zUjhb+Bj=hR-3Hj9Pg9=>HaG$P|M;7-)kPM=r_pw+6889DffHbSxc*F1Pi6cZZU9^i+gD^ltY@Ha(93O_!Q2pHW6`M-W7wyXqiqO~(LQ0ONe7?Klx~;j!zk$E~k|DsjN+ z?)*PhqBf#R)NZ%P)BO8>J|~2HhR;AL`^XEyC+VD@$nn(rgs#S#Y2+%rM+H8@zEsa( zjkN7cvMV4YWz=OY1Imo~9f9w6V9K1tU8fCGHNimrHikYV(0 zKWs;by5D*7>ekC^{j>J4J}pp7)iXv%Ii!Td-6*?lbB}{Jb*tFGSP>!vVjtA+>3Iiu zqH%*|wjrW}V_suCL0JASk5nCf<{#uksvkZ-Fy`JYkDpy9u8Obz(-frzLhsf6UN4Kt z-w9f09-24nxF$eiq8&Y4gY+yC?x_0EZW>TMpj#XV=J9o(ZpLisT~Jm2ZhckxHEs0k z8(w5_3Ah5dFt5tD?0*3udPMO(B8L7|cUpj>WhDgI`PM0=mrH^o&I9xRA?!weyi73AR1|2Zi3`ZL1=Z@i({~Bm^@Uclo@`{iYJaPWzC&sdOiV%)g6rJEl0hTtu z)2@&z^P3G@#aHn~_HZBk>RqSWVzysrA|k_Um2L{diA8VU93JfL6(x&~0~EhssU4f5 zeb-TePvIj<4oR2ug027u5XoGLoa_iRMmT6v7LW$19YW?42cQ?K(#b*!yJ3^h0S-yi z{>FsplFy_q)Dw`y&c2)=OZ#cCv>_XmN$o&~Pc1<3-{2Ux1Ou`nyAhrdMIsE)Od`#m z`d5-~>WqxQ7Qgf79|;13CgXf>PUyIgJ<#bK5NxtF$sj3zY9GdGC#y7za{~){Ln)$)?Dg8Rqr$U#<;v5iqOvaMO*07bt+A{^2 zL8W)bBhHaNc*_Tf>FO8|CS%wZuEEkZ5vjwYKwVCv-9~U4WFBbD@XJ1eS9fU_?7rZi zV3ty`KKthT9745G@lHm>3U9iy=-j_F$sVVfIYKU*KW=#%0%hlzgBKb29ecOb`QFe?7hJt5px>Y72uN?vnbxAvxbY?09_v_2$`e8td?} znT?)Tg5SnmbE1TtAe3#@TNnJ@e~CG0eEj`FWHO8mlBWzGtpg!!8ro`;5-t#)#O&E{ zURf)WK9Fe$(NtPX!+Y^E)hWCQbqH<2P~I(vl-_0%Hjr+{`sKbyOWf#9zM z^mn2O=`3jQi|Sx`Lzy*=4YU_sf*sh_lt`9bSnZP9#&*-uXaoGA54muQedG1tu7YxJ z6BNdl9H@>g&1U5qk9G!SHifKt!b&yAW(=qTwjst)_ewY9D~(5gHjwEzgn^g$zOQ^& zvOvX-Za2~ex%uFSB9v2Kvo|)xW~$tUrLs?$^CAO>Pkfho{w}5>@T%h^mglj#ZI5Go zvt3w7_upX-e1A?Npo)?t7xh0-g%zZ6mY30c5C|DxuOJvV8>`Gu$h&i$t!^^p)Pt~^ zHpYjirLeS=b>IXO)pQt_vERZ>cV7?8i`c4|AN}+X6yE^B=G9tMdgkS}AOZ7pf`r-# zD@8r}jm-r4B-sP+)06G`G)NsZpmEH*OVkhP49n(VE_k{?uDS&>C1Bad#=>GHkoCko z_Pb&X(=yF#evz{sU8h+&g6^{8KRt~{Z?Lb2eLl@TPfvNAv)3$+Lw&2@LPa^P>DJQl z*No7k`&F7>WM+aMpFsUgl3C9_8%upwxul{^MFcSbs#^PD?0#Bc7=|4!>?71JzbOSr zM{kKqFBx&83KDlvL(ZnSW59^sVIKy}bfp`JW4_$D5P=Tf>GueuZa%SiCQ@2EBNH-? zXA*DpnPDIHJu`x&Y%B|-jxO(}gmCjR;vlZk3znoWM|N&VG*92pcetZ+lrHtGuthi!4PPo8X>hI(q;OF^d!^^QS`_WKoc{lW&WdkQN0To5=)#?uEm3rc&DH z1l}{WrE_~Sv|*X=O26BEk?8q zh-n(Dy=8amd`86Tbc-<4c&hcseUzDlB^<_yLD!f!v(0P~*UC5 zmFqlMmm)r5p?ecRCpQy*r>p$)<%l|%&kk}WhS1Z9Iz6>hpX$$9rNY22tsnH6%jU3c z&2OVWMXJTQP)b&Q-x%!>a=tS5E^(|Ww!MWgjv5iy+7GeJ--DTnxS>g-S;{~+&{tjZ zcdprGylk$(eGq_Fa^$x*ym?Gm*PV@G=h8^H;LYhT?X(9(d&)gxHNH}J4!}?4&)OX# zs{f8wvIAR+mu{xj0i+xrNj~q3BYJl(H#O^aOJfxXm z!6h09sl;r)De7T535hnmGZJlQ*>FzXVo^`8di$cNGU+2cxfGkE&KKzPNeMR>ZI}Lx z>ClQVIznIhg*-lP4rn`xS24JrVz2fS9xgRl)nMLf^4|;lxqcvg`{t5E$m_3OVjGf4Uu0%!f2&eH-dFyf!Wix>j1w=lA22(W)d7gbu> ze*HWx7@`$NZu9$GM#ZfD{mSfT)a|zAj8$Ny#pMBgO|o03Q14p8M+BLuP^FvXpJs{{ zqHRIRRG*6Km;(yJknz1Q&Fw^43~5z_2*y)MSgV>xcApWyZ$w4Q1h%RcoM=lrN<5(_ zev?^tj_LB}TbWTo(uvI)L1(FT(Q$V0c*xfTVS#hrqLfLFuBF}dP<41=>lu77xf#0U#N$yVvp83aGtrGS8 zETmga;+q@Wxb+av`L#*mg3*D?&BRl>yuR39p$-Kqv;U3$iihgCSKZNeZ#ARh+N@~#zyM}dWqY?6K@+~A{v?lC*U z8q_@=5*p1k#GY}~DeRiN;eTEL%iiS^{5CvcZ?n4JfeB? zo!-ng%AP&!{iTMDr%fMaRno1LC>ld;8zWPe3fjA`>sE`rX>jCsFdd7udKYa!;9yHy z_GbBW0Do7s*vj08up`O|q3E#xvuk^VfEoMZw~7CO8Np=ADRV)z=0P!lyQbuNojAN#Z zWbd7koxQ%-xx4T0_w_h&u2Z_atY-q-88p4W3E_82NwmVcsnJ^<=gCa>>Qa$p8- z=H&r*-XPR!CCFUEwCA?)#RTnYIuxn7a{14(W z4y?QO%Zu-YruyTGW~#oDQr4VCpX`s8}9dH1*@U95zmYQ_d7{1!jMs1X9ip0 zo-z)*Qa;lVo^8EyUg!ffX_ZdM3;zl>F$LpLB)tf7BMR$osE31Rf0XctFSTOT0eX&o z4?T_Eto){U+sJD50^gXo{e0g*nxxx7`fuL0x8EuSPBE)~v|A7eU;M>Zc+{N2hQiOt zhs|E*yY?H(ZgTR2yqgn=^q!>+Oz(u z^(x{*z*O8O3Ai={C;tDnrdcF8MVP_fv^$s50!LPh^vV6`pJ>OnRDNZBkDh4bJ+GAy z))ji2u}xOXR@@pV#uBGi)jB;brVcU1edKp^t)d(tH$f)y9Bh>#HM92oQPpa zDoC9bU>m);Q^L2{Q)5!%-Qb=NNjahMkfRdh$IqxeBSTnT@iuezfj;B}YoiK_6_NV77fh{7$8rG2YE}ta@Jx2I8O( zmzsutWGWnT(oKD${{6Ejy6@F%0h7Qks^moD7<2eR+a8x51S?hNdt&FTS(VCyEUTC_ z9V(ljZLf3HuL;n{nDSsx$Un1Fu3IbMtv2=`n9*0)sJj+c4)$M^&7c6*lq-TyKyWWhr2*JQq$zf2XhkqKdm zqatiLF7bXEjb?g5`u=Kpa}41EdEMCMRs}R*d&*NH)EJJ-y_BCh^bUndoN%A5C6h=4 z%Xw-ravyk^;f?DZjihqXHXAdr=-*K{o?^GZsZ=e$aomFQErg2WKp-2Ei7+hIvc~jN z!WN9bvEKYIGGQEc{=-Bw?OVc6RB1Oi(H#K>-}K_(Zu}2Js+$puxH0bMKKKhk$b_N5 zr`g!=Ja&kb0GjxSJo{)%Qiz^z!*@S8P@`RNprqluT=KFSB3k@JJp$ms80a2!LhpYR zHS@cCNfM=?5^%=s7LfegH7?yIc;GLiDFN=n=<2F68H{j=BxVIrCmL&uS2-_aMRT5j zA!dQ~-7p2`FTHp|Z+s=$!Ts6ph%J&fOdIuda7>t-(0G_b`SDZC+XmDDmOg65pLmV7k4= zAfysnLH_g{)|U)Y4Fe-tqaTUoUf1i@{|NZ-+bX)+`w#{&Pa|5fOVT_&TQ#5bt#Rjc z@Q@U;V6B!TXwTv``4gR!qrFgyV|YDVJEVB`L?>aC2- z+}v+z)1-~+{eua&jxASSk9|~~Se4q}k^Gf^?6LbIy}kTHUY_f~2mRU$qgE4E!O?P+ z+s7ZlIHp15*To=4R_u;+>3zns#duBCQgQA6JVQgs-50|%;DSsaZD=PALD6&q#{LNc zs|Hg3x~C(8{F3%$>HWs5l`-h$%mz1B8AR|I3KUMC&l$psz8{hKc<=`~Z-QO|9HsU+ zsE!|Sa3nk-vbQQf*wCp+d#_R8))N;piW%ez-w&&>U3Gt5-K)22pA>ZUfB;k$r-T^! zskFIaL#1d~;k^o?TST$4pyQKyL5O#hOpmBGKc>LejJf|AHiWrOvEfTZfz;F|kdi;c z!|k^=+80zRs_zCaOcrV>s5ur^jF&A%5od}WVUtgW$x*7r<03`6%kukW)S~8no)Q@I zARiizA&j#cVf(8@qd&O=Zb3?rNotoIYnuE`i`6+tran-fb}|5un;?H2_F{)+FDzw* z-dgsgpj0r{Z#<~BzuvAauX3tnF?H)CzBq~$m$p^JtN;azswT|n;)p7alIvY8@OM04 zBvlK&{{kVC^~k6A1U}slLeHc1lw~WoC-jwO0$sjW<4|Px1;r#e9wBAXa7b*<K{4Soz30(RJ93$DVVdOCy66?BTVgPh~ZJ&8Wd{zn6kC zlyP19O<|?tyQWIuAiUlhqS4Le^B~;unj$=WuUk^Wm=UE*NoorQrB6B#6ED?oVyvmT z9oVoBoct`S+7v;hJRi~D1AzVWMFMviS&A62yG!!_o3*A8h@n&1V&lJv-#*Sb#$FcLf;e5$1% zi-mL9z&L+B3ZH zeg4E*?np6-r)kRHG@1kL$bc5qa3sDhJN`7UNR%hqM|%CbT^Q#QmNl1jzvaRfep$T4 z+pCR|BYKzF*1fzYwby^?+7w^n*2-eIYKIt8taE1^Q{Q#`SbOkHO8xq8aH>}S6{(Z2 zTlQ3a+>VFuW>3oG&@Y30d&J%2E#L&+^LRA&q-)=4T91_hskD}H^Dw7$oa)9Qn3Uu_ zLMYrOJ8HDwwd$%W_5EO%n%(QVh?#=T-vh6jnY%=(=@Q?%lQerP@OwOg{kb%Uw+qkx z(b&eg%t%0UYTBCn$9nl6N66oYMd0w>4tr?{9uR<8up(K;4$4E*?BRA*VE znQ`37vVtV-FXJc?6xm*WbE{4VdJ0eSS66ENM&HXGh}e$T3_g)@cfU5-RV##zBdNCr zSGkvVpdB4TeTNC2&j0I9N1(UeXOwc2!_B=Mfx2S;WBb{` z#nX{)92pK%#~1#(_J!Ya@DBk}@^fxpa9~stZHpE8dp2bd!7`30@60~V|M%wr6#2Wm zvKz%`tcfd7R6Y+FE_J@u$e8qwX;_gdq~W#rLF-e>H=ewSG0113v#X;D;RpdiOVC}R!nW!Gnydxm`)i}`?a^@iLUJBQoha+o?4u#K>9Lgevmt*P$ z++)2PL^JDP+Nno23h~%{v|a9)6>xII+2x#*2!263vyP8372cr1NfGKFoD>;zxF5ZC zw7=zt9zxRldat(36Xo90BDy##zRW56Iz?y*9pkvFxLrTNF}kxnaBobVnYu6bOQdfN_&1@A=*K!jI0A!H@izJf4`)zmZT<<0 z1S=1tGr~xdpUW~Zkip1n7p?odk1n2ZTper_kLyEp(HvoKO#2VR*!stZu@><7sr`pA z?KpP_3+>{bUY!zN6l=v*BbfTsz3=kIU)McvumW$BRGE4T8TNihpIUw$FK6%Z&Cj>* zI%=BwxvzhjCGIJWAcD9W_wk@lli~74aU8swSK=s$e_duDrKhZ+get;Az}~TD2?aiu z;QDREAb<{eMR!ReWOR;E{1b3biSOk!?0TgPUcTdQ>CH>rAQH9cl3^Ya1J}LE&sLG} zD^=t+sdG9J%dt<7ucM=E`Qj|#l>Ny2C|#-&fAx$>lTNgQO3@I#-3C6BvQ`>UHtMBW zFnq#j27c5vg|9%*$aJj+t8O`$Jl(j?E5cVL|GDw7=g22i#@l}+^yy_}47LEmA*=Ty z55Av6D`nCeNkWaUWf~YD<Re-SE3>8gwZa@Zf-A$i88-D&gIM0@p(KEH|+BD;YIKl*YcrL-PdlNGEw03MBjW5l#~$xYQ0b z#fyVYvUGZ9Kqy4q9&n?BY=2+wb{+4av+34_rn4LUG`#*=`bHO;Tfe2>!}1b*wmryQ zJz}maVyXz*$td%$w2{qf^ZHH=A>PyP?ll^##PMpu3ZgjVD*|$|pITb5re57An^pFQ zvF+L7!$u(sRYU)gD*In%-xa*PkxXGK&33hMi+jmKH1#rZM zrl*qe*J#^-@s^8B|4v4G6O5}iP)FTwZuxoo9z_gBi9%;$$#Tk+74q53Zta$qLW$rc zf}BC5=uLONNW*DXtZGTtpF7}A#dstOwS@#lF7l~grcYa*wL6!>aKfs$qY)zn83NmW zS?(LwMiamTwhK&iFkv`CZ%4eHlxU%uAhV<4*UKH>OTZcG?b#;GBZwxR+KIcbN;uu< zYu#%R*!FX?-mx=9%yYxH{L-Gh$E%^7JNc6P?-~tNzMk6bd`k~w{(dUuXVbcl;NP=0 zYkALQhbhk!HC<5s+mp#w99EB+01{iGL@w4dz|Y(qfE$9Yt-#~WEg9XG+H&`UOVO*S=k zTjubqB?+r{t-w-JvDy3m@>d2L2@bD0;Tq3YfJ*6rK_2r2~UA8H{ z<;R*1z3Y;P@WTd>4mUFeq`eH#wTkX9&{d{X?feiD&LaI7zoJoipeb?#H&QNtH&Tu6I}=mGJ#0L@#YF8F zMwi)_O9m0AG4lvzzVa;Ik+%Wvr;TL59;-Xo2bc0|-qJrko7+dWI2F0cR`$NRPHJ2S zIc%MwrJGa_*&7a<`6{0o5O$5lrrEOxI=w87=7~h}KopPsmp^<4HLn<-Wj8Nq-cL#yRht~K(G2S3cqa+lgKHj zMi8oe*lw)|WBa^x*xkjk#N=Ol1L8uIH9iK^k_C~m6t3M==GBv`I8(TGdf}1Y58pQE zf_Y#7e%sHmf<*EVADjSUiQM7ebLuVCM;p7y-Q}6M5!#jk)jE#uY%PBK`Kz%UIC!k} zwc03jxaLD_FCDYl?8NW~x0`s+*Ou6z)yFmppf7o#_xPb`9f+Zvy}Gf{MCGHq$ACAX z)vY^tK!)@Az7j&5DtKg)CzuN9G#!<*QeCYQ<-?4-3cEL?0&PD^kxZP*pi}D5%8nta z@9RtZW^28jFLNxXdqJMKNo=)z8>#rmySffnRsD z@y_F3im#sT@4~x9RliP2;O`b8g33mXohIiew9;%YjymMHfD692a{2(YnQ|CP}~^5gVXWxy_fZ`daW3 zZJlA2BrmvD-ZCsk&cx}O=1MH(W-g^Xuj_pIOvtA9<$6&i!M94`%flBGR$dEzLqDFH zsEyaxT4=jmv|zMf*-TGz0-nhDHbc`URxcRb1zVn!qF(#QvQ=6z7oq5oS}**o>a3_YHd14rSSkpJ zs{X7Z`z-zitU>8y4fkm^pEhc$GRmrs0Vi}de0^_9_|E$P9R>CW(h8q{7DevqUE!TK zOk4{%L>!#ujnFL3=*&*S_5b-bP?y%$|BC#CoH&qF6>fVq9^$PL{E<+=>H8&WHHF-W zNwe4TY%Wdh!0_=d2VR=k7mM7MdkoV^2gd5bV`qioYFvxT=AH~u=aZ>(%Bn`P1`Td> z6Ve1GUJI>7XRH%Kc$vrfKtGNqC!O-)6GmKrJc1q4T;}NtqT)#&#dW<5 zUN*#&IAFEEl=5d!JRE9Ig))>n!liIGlGX~EaVKuQ)k2;^Hb;Vuh}Tt zu#=;nnsMSYh}QLt=9_@p-X}{l?PapJyQhgpbhpj#0~>E?G-v+&7;<_#naJ{{y6>8h z@`SZ;6wzCo?(D$|9!#~$B%Kk(Ko6ausbV0Dr_6xa$(~dgrF-?1TRUbdbnQt>oG+Eq z`bY&jIgj}~hx*i?x9H)$2-{LlrZ)z)MXRm5Gm=o`|90PMuL-&_1j53hg7bMSLz{km=im9$Xf@S~R+N=i4h`a& z1(uVC&!}r|5pzlR_~UgnBX#czeCHrh$oT0(HZM`+8+N@UgsnV;O>>!%FyV=ZtTq;_ z^x1w~rj#sf?Y@@3yXq|4kb<8esd6>lr~F>o7I2j) z6d4nTaTnbg1v~Tdj2lj?dgWy}%AHf6QN=IW6o{5a>b$(l*^^$%#vdu#tE#O!k*6_L zIDhacg#J-Xa-u(9sjDi0Yj!w#%l?mTjjpaJPji*K#NM`D>znp`?b0m35=t;cJbRC~ zSA8xF_wc1XAz4=7pZ5rMA|H1vYWf13^TV&gp@+|V;v!l06qx(w#_N&w7u# z7)h)NU&ce<&Bb@=Y3ioYt7y4t4Q0MdqWnJ)3S3xo#u89T6Gw9Ui-y5{V;Nf7!-~zt z!|UTg#_fzb87%g`zaMzGJz#L9)Ab{yf$4sJv63|Ph)=pFg=(GY0pC4}WeV_3F_$QC zZ`}T63%^^>E%Ahszna*{41+<_fC({S+viMOGP% z_2<27PXGOd%S9QpJCD%zW;p^3fzP)a z&JICe@y+`zE{;<*9fWr2yki2As@PXxd+|Hhf>C8t{q*JFD%8SFnWB~MH-0+Xse)#q zIx+zPx=uCjftR|0JADrr$QQ9WntxVCL=@|iZ2o>Ym3x%S(`?cGrKy^=o?|Zepi})! zur3+RfAT$*py^_LEnU$0F-t<9vIAM2{eF#+gwKWSqY3otIST)_kSGrXq}JAvXyN?# z;l$YB!*!|&7)Jd4a1lb{dCCY@?1wu`l&W!S61b!B(6%iK_o?0ZZ((htD?Oo;c z5PKjbnuFRMcPT;ZCU|~PH_-ua>tNpoJRst*AY8#z8n_xyvzTCwguVhv`c1zrEQ~K? zL8EQbu(BSsw`-nFYM! z3ZR8gQ(0o;#9Sa`#SA=*FIw3V_=l7aL(sPl?s(A4xa zrioGcu)}N|+x^C%0K7J&6?rCfEC!zU#zGiEM*DU6mndxQ%?bmUc5%9E^uNED4LB3e z<-!1~abHit zg>`TQ#8NY#Xf=DlYT6Xwn-VyP-+({(M0O6^m;@kr$cZ~FpuoAAc+?K}?G=JLqdLeu zkblyZ2Bzv?%74SDptJihr;uciQ|tF(j>}jQLy)y?^)BAF^5jSb4y!Bnurlv_e+{{! z^|i14Nspi5{d-vNR3~Jn!C}RHn4|RHVb#YTRvNGQ{{|q`6-4gcuf+W43NQYJlHZ&& ze;6Wj9*2>`#QTl?GXifdVlnU(6l}i=88@I7iOetW*Lgl@6!ad8EO0|eLktk0RA478 ztqrei@9~Gc!k7SJns%T(XTc$t6^G}atp_(%378&p*;T;Zx)ijBI>6FYN&w_hf(UG1 z(M*M?{xU3eZ*j2LWb(0!h(#yi9_fc1ju6KU3dQ9iRUU)7)fx^QIg~zJ+lv2uf@vts z;ZQxx{jo?#fxG2z{G8u_aAMf(w^+IRA1fVgBr#Ik)oVl`rJ9@H6>(GSr1TR@?qS1x{5%ecT`=RY#vk*s8|AnxnF z-#2hplkb(TX4L)(wlFR4PasyOl0oFa{<~=cUYF|{hz}MiR$1hwS}v^KVjbXF&JEkY zfO|`TwV?00&9?+TTqmus0RbbNtTyDiL^d#yHEUiON%3CGFs9)5a@UFh?M)`0wa}CA zw2M92%KO&}d>MOOKW%l;B-1|WNXlMo>eJL!;d6oMXZm3`PM<+QOCf&l3G!);(Dz;V zjx8}U06*SD4b)aW{lWTL%swY=)yI}PW&H=ZmoMRD`dIqylU{AUt!y>^8*UZP86mVl zV(Kl_fT!BCBDm^$w{x@q!1^V-|B3$Ja*?4)4o6B;Cuy7gpGMB-gA9trj3~|)vI^p1 zi>;=_3}d=;CT8-#-9(f!mYQE~g-x8H6)**As;2LqOztwCySuAnbL9h%e;PN4kHJed zJQ%7KJ1094%r?4O`m3;H|1tv?|F0A;3-7KUK}_sS{g3Y>J$JvHubUpOmvoPf(4!*l z!akv_AQ`C{Q`c)J zR`;#cY3pPVK*VML;=0{4h^p{&Q2rVzGg_J|`NZzx^A4Jc8t}o01B$Z}c3TvF7rfAk zs}|mdnSyw{6a6uO<)oTJ&p=CmZLm1gs&XpuImqXg->IfzWa)o9U0OIxfByWF2V_2a z6S&)~Jw9-km9Rz^*kV{_uBdJk5YHQny5J@gaaFN-uVEmkrwta?y0*2YaQp~VA2n2} zT8JV_w*8*RvlqC3dzh}H_{x7o=c!r$%fDCMGZJXPEDM^o4gS7Nxla+B>Nz!FPSsPO zTai(_mm74!r-c=euebu>)(P58%ZY*a@B{V1?zw<+u}16F(JHvt!opc)TwDPDAVAv4 z*64$gli<-l8`D1(Rt4W}{tkkk3THn&Hsbv#ud*W>8Xo@FaJp+*Uqx<)glxv@^VFNsh%|yuD4ITrt+t}mBXx@IP zlUL#P7pM+dUZ*GT8`SSe%D`=m&>UlNUAQ;|(c1U(sIKvo;8fM%--)HVe-R2X3nJ!V z9*F!r4Ay_rBi0fwt8Nn5hPuGx!jn_K^8$gM9zKiD80}+3odaP>1u4$cAwyKWCIqyD z^-sFMP72(j=rmeVdhUt8XNfCyfb!NU{?Kh0442%9OR>v6m{rump!3iTE9ex5orw%w zckn5q1o0%sKLVbWQCP&N#;eVyn2!(vJc~U7Z#`a9=RKloHoXbEN!P;l&Sv7g(zprz z)>k5)e3VMkbwaldr#l20w$RT|?tM=nxXy~$q~l;vFV>FZRyd`jR!7AI@0N>R?jQ^;Ffjo!FkEps#07(h z9q_!N)-C@KnohzHO^&rtbwy_95&2U-x?Hd!q+2`KjfQY<3+s)sKqqU^(3pYlDi)6z z*#^Rs_gS&P$yRJkf#@$l9&;%(e>%r*5mulktspdA)@Y*uD>mREq??!^pN!8bZ_rpg zYxs~ki$6M6W;XkQFwW38ZoIxkLK?vXejGawDvrV_x5k!nz^?QPzQcWefYW#mt2am+ zH=5N=V@^1xbB5PWP?fU^#DH+C<+G1f^DvBXot9h(AcPycy8B3c3qkY!tW?%miV+yOpy&;f++z(x9zXabV*95lv0#KF5e*XIpTYW9pRRE|ZCuMoDDJt>q zgk4Z>wLp-O>N@q|M+3)bi}t{|mKT(yym-J5>$pIMM_6%T!k_MfqAQsxVwMcf7?}7~ z)-J~0f~H4Ra*j=}2#&Y}8q}vFb6{&lj6Y>dcGfDX=`y7izbhD~n?hvRmiwvwAxMqe zU?|Vd8iC`c57$rpFg@JN+ezaWjoxE(tzVG{56XNRd!Z`^JICyYd74v`Iy9WNJ|WtVydUEA{sLV>0_Y{~ z%wRXy&w;MK^dlB)0@h2?ddv?O?PqT{2uR6gxau>mStuU>_J28@Hs z?f`;bdYr1r*z!Q)Wo5)OLLclMBpR25)@{=xw>Q!%$FU&aa_6mCgU6&Jq@~tEQCMqe zvk$-ThYNaE?Tt9cpaWw^^$S@K_mXj+)G)VpH@Yr>bY>20oF9gnBAMq}Mz`U$A6PrX z?pw9-*li`-pYVHnCVP5Gz2E>yTs|b@8-1lQJNsi2Dr>?g>ybNBR!hui#RB94Wq(>zZhEYX$~&eo(oTcrS$6GHTh} za<}qEjQin}CG4z>91cAg_0XBI)TrIFLF`0ZDQG~Aka&vgZUVZhFR~1iZkCYW@{Epu zsd^cJ`=4tIm1{q5rY{32Q9s@8Pchh?8PuKKIPaJ1Z~IhhCL#tRZ@FLRfS$hx5-M|1 zKDzw=x`-Ax+%Eq75lnl*6~!6QEp?y39ry7Ypxhrla9VZX@OOH4Pck1r1=o%{M82dr z6HVa%kjdz}@MaU5wDt^HzbtSHJs7ik8T04Ng86!okS%$>Ec-CX!1`{oj!RzNt38GP zV_yl&C^Sv;VhyCV0O(VJ+}3f$$Hh3{S?^{FV6Rzve1(Xl;rMh_L1gT9&Y=cvApV-Ae z6-B?XtrWgeV~n_}pPwq7>oUA0OL`>s9Yvk}taB2i2V08|HMQks#Baa8>M47VRB#E@ z8fn+)c7UeU<8rqB8nph{>pcJIcA?Y`?KL~fK*FL}p0b23rZLn*3yG3+7b&OS5JJiCJN`rXUy>Gt?PgtW)zPqI!U(?~9_+l0c zuZ*wdS=lwk$i%3Tid)d%`k}KcLzeNg6(zVL$~INFsg7fyf(p~I9Kc!^t~=O9DI!LL zNd5=JCPy%GU4IuNUSge^oY>0*J30FCm&)4}_ffZ7PT^Sgve=Cpo2BYjl6f|EoJ4{) zO1wfX{biu;`3GJKHw)~E<7BnM{PJ`w^Xx;L!<|((vW>>3bpxx}syG#>s z8QIOutRmS>X2dD&Z{Ik{jXHDC5`x#{+xLgd|Xauc&mLPRstTE#`CW-VU_Ubwr-f42`c79S7k^br4+xV6VHq@U1G?J z5L*R1dMbwgm)lFg%1TDvu(5i)COp&^_N(n2J<|T5QcSvi61lTH%Edsph}1}cKo1K# zMuEyzSRlTC#5^0YUpJCVGaJt%9GE;}O4HOFp<7vKkNDD7Lyo`YDHn6&B!&zQLIXS$qPC^ zgiR&aeAVqCJ_9#qCZ+05>xJH$b*q^#6iBDvpAOg}Px%RhN+;~rn71l;#+ekU%r=`T z;;9asfSjnk3&Z7s`qF$?y1_5uvxvE}gQ+FO1xFkE4+m4@uS6x!3^(6nb6*SoC@W|r zeOmEl4c@4MbI$LyZYWR__w3lFn3<9I9o%mRLYP~|QPnkkI7`#y!OO|8-6k2&j6~4U zNcKxkROLvgzevvXt=ZsjbvE_gm1tphYYqCSzU6(hMK<}~t&dEvSmrCLh+FW3K$ zJ_;v3$os+Lm)gdEUj-CSd6*18q*VLeP~(-Q!?Q!W_mU9hVKK3>Bd^-$lm4~&UKw_0yzmEL$5gm=qJor>MiVDr-GXZ<5tx}t@BFg_i4<7s2= zl@aVW{rzKlDJ^+Z6>R#KQ{%dg8` zeUT8klws-#Su{&B+``gcKlsBX+K4+b>Zzp;y1#hOmYLfu ztZLQ-vx2Icx~bYM@Ua9b6qBf$IxakS?E3!xHTWKq>F*B+U6J^W?IRS~AEhTeDsdD0(SkEp^1P}@e2EwjW=tLwFG z`dsQHl-_o7h|iM zcgW=5X86oj@=(FY)@JW4@d$PJnr#g+AE^V)j%S$)?v#^qCCTWb^jSJru&wc=*oO61 zg4AYa9E(rZuFSr@IVm(XgKkz?7&Q9f|Eq zdNq{sY_O6`?DVp?Lak2Ux^jEK0pK2vj%1NXr?45;Oo>19#mV%cU3(dd*=7`z#M~9) zb}Guls2!5YV^_l-*?qmC*hCcP8(&JO?xco!#a?c!&@_HzU9-Svn6HXC>Bl2^8h=DW zs76B$D{vuP9g&{f!6PW&>LJiPZ!79l>=h_PC#BzS!fSmvRmt}*`r4H**rY<&8ji?# zN8;a0fi>vfd|j=9na}8&Rp?f!ns84}rrrtz%qAfA&;Q2_7p<_sw*X zBU|mn0xsEbQNUmq{`rZOe^i^4+bVamZOO}nRQr=`*~CmT2}SYzFFCwNt8R3j&E-CB zdzVKxeoU?Zi=j^H%fLtr2LuKU`O70ID4W8_%%}g%+2a%~O%&h$)FxJ;A_ZDEDnz-F z_ErXH|7DO4=c`6ib7G}=YXz;1BkF%dho2Xe_iK20JwAobqF+L1K>KwJXdoXpeh#pd zWFEgqyFck{NYGvcPQOd#(Iu0*hQK9FN?=?03c{ikfm0`TJV{^Lv*_LtM_Pc9kZ zdL2fh!`2)0Mx=cQtP`os-w?~<7TeN@8b+=v5-bH>2mizOyO9XK$fk_l9kSMqVG)wr z_esLm&mLcJjBxw(O+Td4eeCkLNjGW*A&D5L{AaqCIwCV*rMZ?RlMh#p3zuHqZGrLOGY(08kF5pdM53#R~nQTl( z&Ajh|WKqYP(v7>qh}P>8f??w`l}{Af``iwl>d)dY2#ksHA3(d9fL$L(S;K7Rcg{}J z-mEE@0;%^gk|1+pYHvzW(KWveFSrMHvYLKkj9g)dr1s|qLs#H7UkwjTZcL(iynt{_ z^I8*+YlB6Fu=$tyo^v#ho!=PyeinN!XL?k`%*ICU6$f+Mu8h((BV%}uvk@{H6Dc=b zN<@91-cIWNcvCv87;o$A1x>AsjV#hcuPqO@ENYU+=6Nmp^R;ge1N2xJIYsN1v4xFG z!S$-JQ+Ax}EU{@B)NKzisNi)@O4E|l~L9YNoEEapUw%>9KO6Sb!3>^b%p zN1G@e8J?JCMx10aya-fkvSt?i__k2#I3w4;RPJ_dT>H&>>*rM8`MBUiLAN9W5Xd$P zrpWEGOO`kPg8D+TK$t7fu&R;=`h2i+hOLB_9j^xMrGWWTxQin_6!tpRr+H)_I z%d4S-8m;!sH$OB$*dWCW7t3;TRNn+|jvoPc_D0@1I=|t5_J$;E{L>!YyKp}ZWK%zw z`I$xs9GC3vs%aQg{M5#a1ut8~;{bA-u^%NR5P)exFBQV7*gGck+G)K3KaYw!k58wp z4K;e3>k7pn!P)Ew=bl~s@SEk}He*$w{|L9Gm1YnDJE~qj2!URZM?53&sf00(JT4ZU zyry?GoNRMpic z?XY-Z>tV$=W*bU&D49V$U8>WyI*`ge5~1?#KC9ucL@7*QvSrCTY76KIeaF&#{u7vt z@B3a&$SHMwKS6@xB%{Bs2ve)^_9o4#toR=#FM=~MlK|l48>O15o~dvN|O!@;FOhw7p%gI^} zW5M1LWw4ycPT*LdR2d=f9lk6QhEP00gy>rWBpsH zMIniRBw77N8AxYNTUvyy{xr~VY#nr1c<^r-y zrPzN2Hb-|3cUJh6zF9vW>&vT0Mdj{f?lWyd?4$jgu??RG z=y8TxzUnmkZC}DE50>dk$d| zRI_~z{KppSK%s4x8koATdGvh7tsD@YrP)_M)0WqF^H@aO*Qjh7Jx^?-or{bHREvGm zw+a8qjvOtuHnixFXQQ5MyMT$#opYfjHP&{=R4!N-I{Sp&h>F!jbl=%YH)h{j(wkRQ z^L(21$t^S4X)x9r3@8-|3Yd5|qEM-o3xNz*&d}5wpnqbCjWAM>CysS#* zcXC1V+Z+2&PU3?8=#n5ogH^S$|LCTszn@8bsMs!*1 zbXL5r#_NSw;b(+xdN9_4xBvWiBGv2&Dnq#br}-jBNI{NBQ;fI<_jT2SU&yMZBk6aj z^G7LWAHp3{1O?XZ<;KoSp9YQe6;7qdzpEc&diTMm^NtKwyOHqpdiedPc#k7xKG-P! zq;YC0{9G+xP(Q?Vp^wCKKUjjhth3#!(*L7PgCLty1$my!#gzL*=71=((d5=i3=6K? zht z6TRCwnFhCq%p5A(Iwe0PsVECxH|kJ0!>AiAzYZmIUjvIcl0eOtIk+tJHL-Y4QclRe zrx?S%|Y-V7h9$@7%Fu(Y)c)Ly| zwtWk1r_WhWQm0wq{t&wrS9`^|tFW;eYi5ZLWHJeu$wBw>Hod5UxJfO3z$$Z} zJ_|UfX@?d4NPa^4Y!;)#*h*7yG-G(@{I3NHacP|vvk4kCoa-kX{$$O=r~B!_vYzN2 zUaO036*{;)=ZntI6HnJ~#uR9b&xBSp&24b^h0F$E&^A-pOQ46ha%Suf!+8{Yp4=e?04dI44d^H z(IV-Ls*qcHr80DnoEY&e6@HG?FmH|J&b;WDHtF3cvRkClL6)LNK&52I?$b8QbWs)U zdv1O?u_Bq>$nUB;(x%#Jtq}Rq-7+B|O}~TnwJqJx3iL8{1M+&MCtT{&1Q7?xNE=+O z=e0`o18zINx$0Raj6jgzuK3gX1$CJMNQ?UJFx~jU(OpZf&~rYrsPoBGe9X8mp@@6 z!pW~Jom;!exN_d(On$qV;Kv%kveadptxqm6{*3T^*?}oYKa+-6c8!-^3O3~pPEz^f z(^)JN!`A#D{q|LSKSNnx-@DBS5U zigahNn9`ISlPU_%wvyg`F!3Uq7R^p!d9Y?= zac2J&2D1V&CzP{z$|UNWz)?D9WVlE)J;Q9SJy?YM_%DEy-}?h&eZ%I@MV!7stj^Nf z(aZxbv*6n(3srKFM{RwQ;;pCl5pMWKk)bXeC%?0Bo4B9wCz>|*%@5faNhLCz8gR|5 zSv`(&c^)VFJg>ijg6(ZhABkggy3!jn0p*z7TXEYeS+<(xj9ddHKP{ngHME}cVyld> zUP?24{d3*NOfc4}|I^c{{%G#s^aJmrlO)-mcEK2QkDM}e7w%m8% zKXN^JD(z3>>A7?XCmU0>Qq!=5edE;=C6U@XuP7%RUItx*9X?{#lyXM_q|M7tV0PrY z$V5#E&!5|G{t`${HU*eSowx*-KgS!+9JX6AqH16_Li77f#R2{{e`hAp0mXkjsR^=MGjNm)~?y^d0*u1E`CIC!+J*KJ_$x z@tan(ZT^lI;TG9iB#|LC0HeX?~R>RS&817lWLhli01 z%xSn@yso#1_`>ex)BxVusNE+PmM;5P>MZhXY>`i$(M&99cowm=yPH4WcDXYO&av(h z$NxQg!vIhE*1Bg+3FYsv<9ANxN^bt{?OX?<)r{i|3vZc^Ahh@=(tl za-0};&c?flUXsoKHal6#eon$FAJBAMeRiX*iRjp8`=3QQQ|wFJH4dIvgD z*Wu}^SWk@7rqgQ*xVGcOEH7g@oj7n9f2I=Uthv^NS-TT(;C{I_UO?+7(|MiCwD9#e z_hEvJ?z4vsjl2_BW=iX|^llxfg?~yq-fdkPWmQSWKl3x!g&QLyf_2D7%;ZaKkaXfL zw-zuz&2;~B-1bwuvS8p7I%sbN50}BH3YNuw;B z&^*m0C$JfZCeDuBU?{-B_0NKOkp2car>sH*{e`TxNUsM@hrf6xqc0;1i}wP`0KIPK zC%5zvlmUtIteGaMnv@m`j`|rFEUiW7ah`NOjjW;M_t8L7CY@iAuOB*by2*wL)d4D8 zG3$mQ3T$zZr4Kh`OJBz-`|7Yc5T|X-ot1&x2F2*-pVfGff--B zg`mRzSLZi^t({({?JDO}KeB71jf>QptSzj-86iPTw|u?cj=2GKUlB^Yn5=Vn*RIni z`sV*maXD6`c z1v_{L&nPO+BGhWv;W36<1IbpQEe2u4d0Spt#4#vgx+IpRS!H1>2ydxut_aW;Z-$HB zpwE`xy)Gjy_X_CTT58`!a~$zX)}4QG4^wbaeNd?Ip7yh%2j+X35$nemh*;RiNUfJ% zEm~NrVCfN^RZeQX9$?78p(#2 z|0&+@MI>t$+?%YbpnBfTk)xVQPo6E4xGB)w@>rQ{yJ>d~Of%GeRX4J%%wc7q$KyS| z&2qi?zQQ{pYFL_fdfd+arpC*f4IHZw+1K-VHRC;t~AIV^kqFu&vgfn{O4wUFd7qxsGvnJKEduNn^06fnB|0k({N`5!F0VUlcT}ms>D;+sB+y zsW*Kp6Yq~W5gefsAJvm>oxk?NM}Q{z?Qb`nlYMfVmxa<-YJk(_@CA3ZyJJSArzyS8 zh4iFZ5x66lJM^Y=;%)iOOcI|Wj@DKe$Q}Nht$+ZJG;2NnTcmR>5Yus7SV>97 zb>HmQ>}QLAQr|5a#My|C{j|(tDr3=>1T-(? zfne8h{)YL}vFIRUTpJBm66yzsl~QJ6K1VJPvVoYW=zqMoN-VurUnzemdZZY3P)f4_Liw8K!-U8mr199V{K+nN&QLSuZ zI(+Cat;5@c&|#bP!_@|!qqtq`?!UlpuY)%4pF@WEyo#p79C*fENIu3)$s7r7+-oKX zx>egRyiaNKCVBVksNzUZiThh&1MMoJs>|DcH+#Mbsp{;{>qrIWMPVs70&j>ZQ2!uE zK6eyAetgGPHX;3Qd3{FYBWf1PRhJRhei`MSWX7#k>f;|DTZA+*x_dD|{u-}yKr=O3 z>vv!biKZzpX(1|46~u>(1*EN_4J_|C0v9wq5^`1sGumIgro|Bl$1ysgrtNbDUD}Leck8xkLx<$&bPgX(prA^4p=8c6)WvfL?HMR4V)3-Zy z;#D2(L|qwEEbWC{glh}RQBY5uXQu|;o8=i3B$l!mW;rd z@IBDGb;;TEPBA>-s0m#g+Oo=HdU#M31B>nMR~uy0oQHDBSGz?|Ua(TU=acQ(>lyDT zIqZDL#_Yyua>&ue$htFvyjCg#&KJVLdRxsYiN5Bt$Q_LNCM8P0(n>!ZICNHS3>a)K*h;HWlDIrwdaj_c~(E(`vzidHjOr zasJ>*udP>dtvBR|o{E44<;~TEfE{Xf7yF* zWOd5uYb?$*$}&J`M{U0JWFF{pyc-f3L}_%i;f#Fv*@S$9G!);koenh!g=VFgR<& zr{|(>*b>*^&x7N(KoRY@K^@r|m@B?NuY%vgfr7071H z+c7*&+!G`PBNFx=U3`VdNh)V=C#uXHAdA>u3d<@tUc_|y$biRsbm+!(Vc(Wx_y(}K znpW=Q=h)*F{J$|3D+GQQD9rPIe^14>Ec}``NeM|y&+q2h&Tl~{4zTw&{3x=`8tO7` zOfGVNm9bs4vpZ!E+{~pCb9>Q7EM=jJ|mkCbk6WlRSyv|8j zsQHIxXUf(2B2Lwr%jB7Fg~SKDC-JJDT&Z&i#gP*)(p|#WG^Bu!|8GL zT?4BW8SFUVmn01x)hV{ki$_Y*t| zd-QUWCuGHmh>(t6Mx+>$jy3bGr=9Xz?R?;2nQCHtP7zF~6}kt5h$Plo&{Q80o=lk9 znO!#Jkw&Y;5IozZOe^eXy)^*2HiQYr))X+M1aqF-PC!Vl;m@4u4{eg$%#r_wmgxra``J#|pREY@u1PRFuxI=l;ITyF84^CapXZVs8@JtajSHjPG)&#{# zYwGT&|IuBIn%EZ!0IeZeJ;v+b+#|$-bbc=na9958{KQe6g@#Xxi)lkQG<-Z}AzUI? zvO;dr@52MF3OHN_OT(p?Q`)a-=BNFkb6e?aW-(9~8KOF+jm`Lui%3%!8KM44{OVo2 zKw-89MO7Du2t*NDXpkvL52_(Vbi;r$jpu4={s9aWEQHhFL7cOpq?kTPV>!V*&xmM? z|8Uwp<0u+_e6G5U@K@ujlWn|LU??q0pM(Wz5&bxbZYw6=I2vzaidwf+l`!)_?&Spa zPIB29eH_o?-sPi`pe%-u^nSC+8Q`?D#E|_*ng$aq8CY_e1@4t^{CyZE5UrGD>PXSM zIG6NCa(3!%EBsD3>aTJZRYqM2)SzMdD|hSdX}Ly!{qOHE!>yOqYUV!$Wncc&>^tej zcF2>jUBzwO;`}RjyG39gMS9c6Dk`~G=s!CB5I0;>L$cz+|IM01(I9pk8oXO#AV~d3 z9hDX*A<6|}WS^Xp?m$PV2ZI0o(SlaDT&4L?Ah!W3xVZiM3Jl&7(acQ2wP!jZj; zj-JdJ#hlc-#T>9q(QvTx41qt}Q?zsU&nF3$3Bx&=ar%F{EHZV3E1u$m`1GSDBX$?~ zk?k~cfmA?F_^?R0;$o%$`vD03jGL>nBB_z|HI zpLEEY6T;*~L?s!ZiG0yFL!J@@WaUoa=Lz%Y1wZfr&LGj_w{dmcm@Sc+JVK2Oa=g?x z)ND9OI=SQ{15^d)Urp$zm3$Q_D-^LupybC&U*;m*!Gg|?%JP_1>3@pXzQ7zA&%29# zATYhJmvmfOe;B@ZY#q?;E!&cqxq(ZY0vcQ@KQNN)2;cj`4>bH@R@l!+?lw09D_bo` z|0U;Sb-!iO?7u-Ml?^_IO2-z=zpn#`;-At4f$SNJgj`Aluh=!|yb{9_QLxFMgFt36 zz}VMc2cJd>u@h`iz<1QZYyrCpDMG#J8Q_GTczd1VHbOvVhd;IDRbJRH3&hJ@>X=L! z(mY&=fPta|HZ#RrOy1>3j(h@#t65Nn_3t6VRN4CZ8^pUcpp)(b(v*)kieYM`VDzvf>xeY=Z)=)MNLL4O*}UNtb(pp_X^2*t_%@L>XUzu$;e`lFg(fy z?l)ViyPj`oFn9qtqENT3N|6&9*R_S{UP1LeH*^frNwS_X&e99sc+)5ThYH@-c(^Hs z7^w_;!q?niciCmg)gqt#M6D|5NVou^zXf}hC+m=Ll3!p&e%2L)fd9uJi6#7mFl!aG zkAWA>Un13qKju~h_Cvowb9xIzYog_^zIaq7D*_Gi4^wIqRum`3>H`KQ0MSTi5Vb^w z&o<~u{`4D3UXW#lr3G;JS;xEM(NbopTWxwGia8J(QvpJXPEc}W;fQRX{08m|G0SR?s9$8w@<2BuQ!oCEr=mPbV7p*CaqyR27{_F$cC-aUe{1Y~3nywH^efYz`Oy zYc(|Un-B>|6Q|4de@B;02Wy-aN!NaZLkuiU8~GaGNiW8}%nX*IO3`y1y*Gcc1<1 z9WYzN?XHSS&_e9i=wT-yk-;5ahps`4l3T^x=%RvTz_83!(rX6;w@c~_$}g4N3U+Bg<7Mm4JqMItCVr&QE%jz;i5QEW*N&JW(d6hpb+RKXTeW8 zl}dSA^^bGV;FH@(gLNh87kqD*)HV~?1|T}Ecz^SG1U)NT^d5M_cEXVqLkwx6-}8EZ z_X&p%b)#c(Iz{0GH`V@|o0?!Tcbi?z9|2qr8EyP;LP)xn@u^w5PmsOxVieTBFJ1xG ztFJf?n(jd=hHHZ9Kzj#~c=|+22?4bLV!K#D7yShqsV?}UMZi<;u_6eQd(htx-faH@jD)mp8F9x$g0()u zI4J!a)R`fiTDQw24SKF6Xqr%5Qd6a_~J|h&ccVN*MD)zcvGOCVHgmwb@!AM66d;3{n?+xTz1ElT9*qiUgp%$w@W<{(Zk{Q{%6Fk~yNM-YbmJ_sRSybQN?CkQu- zGwka97alOUQmX9xxb_#sGbYxY`LF6}rKfvo=9^;vXu~J;T^TcOqX!AWRB=#UxH2U@ z4jK^N>f>G3Zpc@*JeG*ebtrq&a6K+I)@b8H_o*V+;@hs@+2CD?-m9hM}{st8(CX+)#}@8#;3BJ1BS&wLFo$!lv#H2WgF250vXsv|xPSdRCIX2d z`oC--2Z(S4xdU&I5>7IpY*^Wx*5DGIryi`E@oXnk`{3ZjW6#I#_? za4hd@=%^MWpl)=*FY&n06fj^Ud!9yIS1zqn`_CNM>7@a)QySsl^J|sL4-8BLQ6Z6b zvGNw0D^%+Iy4gxsHZZ@@ib)ahwO;TTI)r32Vc$Wj6#xa6uG5JqYm&BEi|E=>H}RzS zD1b?BQ#0ud7%MWQhF0ovMt?zSuMDszdAl7HiJKU+gRpSJB-$C{TQlJve|Pq@5`C(+ znx^t(G%Z(Rbg~MTmHU|((|hr6O_7FaSfzV7^2qPtg(W0MU|;}UtWLrSQ+OJFN#zAMFEi5aL9w4P9k_#*^7^mZ z`_>Q}=%Cz?YVTJ3+Tu&6+O@Dszt0K0q8!NO8M@XJbbI|uo(V!PYEX?ACSQR}eYzwqcDKF=9a56L5u zcu2F?27`C02-Rd`Hp=bm#nGVUzfX@N{x`c9YC)0gpL#d=ul}deBSkWB{Vvf*5WDJ; z$^g-tRHQ4B#e#fwZnqrKd?~&mt zBfA&|GY3w%=kM9QCGRL^ax8y`ay-!wP|MwvAvB{_tr8S~K|=Jtz33tIW6hpsg3&&S znran9lT3t5mDqH3gr><1)(JEgYO2*nC&GifIZqnbK-Vw&!I7I{k+edzWGh>m9%qiY zxb5PZ5>KHS0#4q$M#O-th~1u<0vcQ_m>!t?Q$9QtUh+IIzWWCU~@;EM!imf z``rG75PK#{^BBPshE1t*q7(aVijiF`I&QrX*YG=%*E zo2$HfL1q*VR}-W9?dWTi49~Pb-@GjLZ7kJDZEd???8j?th2~9d{`0ykB(KpMthy5$ zx_x_J{RMPcC##|Pc8g)O&%gW`U`Q#YoW5YdPTp9kV%rwflGWg{Jy!Zg;@_+#APO^P z1_Okp{%e0r&^&@?eWEGR)!JXnBkg3x=qRz3{y)c+OiVLXo;6Ihmb~0KENdo?#H3u4 zp-J6|QuROF`L=ZW%W4vb@+5=P9SzD;ns1|jJ9oXL1M6e+7qe8idcni-zKSo8w9f<3 zA0rL2nb%(VjAs5h#1Kupwsoor?xTB|vp_|8I?Ybll%N9>xl}0YJBiLe91Jcb`m9X> zI`AkX5uYQzF9Mc^7iIlsbnz-PP+0DO=5kS~Bx~G%z=(NThCw25A}naLy*!j@i_^Zj zR7J+|ev{15rLQ8t!8aC01qSzYRLFSnbTadkTrk*%uJ%q5%V)yjD+)o&C5=B{Z(TSA zxAA7fvuDPnCAf1<`!h)24PFVW#rHHqk@d&a;b=OgM7duT}zYVCBUsd#2m+* z@6nIojJ7iHuba&{J0&t_hU;GCUAB1BJP2MeQu81R;6pN@F%+A`tIRA}E39BsDH%)| z+ALaj)ODnVf0fHKyD?Mcc@}b?sgBcenUtcpe^y?9%Ds0^gR>_zPIX!vo4j>;T06Rs z8=0BJ#cH_#P5#jH5$<1XtZqx&0T_nz+ zauZaOma?}UDadx&Y;SD{p=-czp=*0}I)Ju%;r9ME=xXLKfyIM4MIg-2^G~$HSxao~ zB^6MQNlI&{5*mVpw!k`tPyvRE|E?=DZ;u*&I2Y zrY05R(86fDN~2Y~`S$wHa;uOi3K9of^P{R}AuF0*qhf&o!W_GU(k`q?`|8i3B2fCbOP zM70~f#iV$tHi3;s>-Ei%3l-E}zRjk=jsYh;W90hA?0&ey<;Q%cQ>`|J*BUouWVsar z4O$f|L?TAzJxV)ML>HdwlTA3^{l5+)3z^Tlk4T36?}quK(GO&M%O$ES31c)3u4$c! zVO`ZpdX-*G4<29y1VM0ty#CBmD4N`lJjM6=_6(MLRQrcVb*OJoMi8*O5s5Lur}qQP z&{EhU^b#U7l<&S&p&x)qx=|>Tx;Uf=$W!Yc=TG)|*{?55WM(>T^5&ycbgu(xP1#z) z23Y1iYX2c>U2D>A0!E9?WBjAdT+6_{X{qTuZmvBshOWu>s(*rPq!*>ZmH`o`AK0B5 z+l&4p?%1Xa8v?HBrbV%~4`umzHue6bIe6JQ9?#D&NJlS(%+ez!qKC?G!8pb9W}x@K z6K}sEJi(xYV0(D_1HkS~UxzIaC#U!Sf$fHtrI3j3KRnlU@+@a>h! zI zz$0*U3d|kozdA*KsSP2Y^TFb8`z+OXZG_#u99a-#;_tekj}kfxhFJ7_=bRNeM0lwM z_+dy$qqTWtgd)>{=FaCkQ{@%Rzxnl6vJcDS8>)%+8d6Cab{YXWQfVPNJM0Udl=bQs{YrzO8t0ZD-WSF!VmMf)cgbD<7b~o925`31b8R?^{>wc?E?V+ zU66fc4Z(hE@Q;MwHva%-jTiue#j=l_qq@;G9WEf6zvDaI=1Pal<^b=?>UrivD9Z=} zTji73ib9ucMuxf#yH3v0-W5N*dmgtPLzLlfFUqkX<2`Qu`regALEwD`$z7WH=@I<} zATS-IuTN&lJIc!z7ANlsb@upA1e=iGc8;z}&kg)6SYZg>52nQ@8#bA;Yg$BoZu+p0 zIu|(peP>Sg3%V#F)Zcd&qlgvZqZZ&s-WjzupAicD#KS7lD@;{x|K8d1S%Jx4&>WaA zRaIxP${)vN0m5GjD357rkNTYtCec=3T9SIk<#>x|qJax=i8tdvv!6KCaKzV+WbgScB-?36%Oz3ujA&gqTlgJy7Z<&kQQwd zPeN@JcT{($^(k}>f$_ z<5>9dh8nb9Fs0%U&lc3rZLk+3GMg<;htN6hGS;6~wbFh9%?RL3&@?#pbr%p0a+$Xx zpxo#$(4*ayXcnE~@ay381O6h}GG~V)lqB~jTI8=dyIA~uI3@%7-6sJP5LkG_46|u1;h-_8rH3T-~%#3PHugT%7;K1gSi6ui=8J) zw{J7z35D8@{-z4Njhod~L?s{cz@=#N`wJV-(XDR|Aft(TYKJ&UtZCP*NYrdBjht?3YFmZ)qZ3C3=2gn{ zYVV_K0=c+k>KrwK((EXRZoOzy5V}w|3Li6Lh2folAM+LDko7ZQ0S}vi2-rfSlODeHjjk1I2vEAWG8IcY5w#yZ z_POl)9%#aq-tNI_afJK1{VXL9M{1tEk=(L?H;x14igsfCj*7i@jog85O2VHYu%VcR!KCZb z18|qu|JIwEp0r5oRsLjJEMh0|db0d+Di)8E?CM@%&xtsQZ;b2a$>cTlyMZYOk)zTK z@QM2NH*_*0;BL4F>ZdnPg=J!~69|Xbuf`_&~oPK2w?t@{QRXjHfX6#xgMk`59p ze8^RBOo)87q+xeaUTj5lubE>#4iI*Vnk%RWp3z*BW}JfW8VgP}{nG`{UGCkvL%hQl z_ED|h{)e>lWY9#{itsav(YLaCEvnH*S4d(8ro6dK^w2z;#STk12cLg@oS=1QHC}ZV zSzpZ7aJrl1!lu^D#`hyTxdn0Oguh+4Dys9k>MaSP z_U*6R4(PZ{m}4H(SgCFtA>Dw8jbn7wWjrK_etc!sWEGUCXqwbpJ~PrzupwzWfC1>y z@I^%ZN$_bC9OP(lnbI&+XQ#>bhk=IZ=z|{UuTW-dsxm|$=3sM6kFnu|h7aS7q3qck%q$+Hra7<}DTubfM3%i&(Dxao z?x?+ZpDH8LK7J&wT7c^0^%9sRm^C@ley5vX_`qHLLvE=^(d`|@4@kxlt&&^PM?Ii^ z^Ac-V^dgnQs8*W%dk06h;FYcAQWlAmbJu2eV3+3l0j4I_Zc~zF@7hUX-Vz6Hl4eK4 z5V%w)c@HyL;6mlV*&U@w*^f%6_Q-b~dP@I_rj>ux;cY?>$pbF@IkyZauy3*gm)qNR z*6rKJ90c25umyfpvm+pK4u+pp_$i_^vH6Np$w!T{I^xTW-4-W*)`At9)5_PTMHjQH zt8Z(P5_?oLzt~NpW-LXDm;?jgTqBUzQDbEdyTmYQzsc@+s_nc8O)|TZWv|kfHR>!W ztyd3C!@WB($=svBAG5(w5xNTlh+6r=d*VX);f_lkK+KWyv0o74Z1pyTg+MPiwdzb( z6|ZXAD8xWbY$(44=#E-cg#z?N*L9%pY)ioFyE*y2we9R@!2#g8e z`^Y}-&!N*tz<7Nxr3^4XCV&>xjS_*GI{09dRc9Hsj>kI?%uvw^Xs8ZHn>OD`mia7D z7EQ7R8H|4%XVp~gR!iUG?T!{-#^7?Jw3OmbAJ%=1Bp>WwX21HK6NHOJyX^-Coh&a4 zWMRdYRI#(b8vGUS2flaEX{ga$Hx)2`Q1VMVhUg|5<%k=Q?D9vGxQAf-t|?xHt!a_7 z6~;?#ir@ot2F2TU#QQ_herOqNo(8@nppX(Vi)WmK#x?Ok4-GrcK87p^|E5w4#@tRS zE5^HRbNq2_-9J*csQI-K!6D$B#n4lT$Yk2>w>~q+Na>Py#efzBN<^BPahtQ8fVB zlmysuSL8lG`G*}Omr_Xs^?1i|jEvu4XBS($CjoJQP4#CTF*IH*8p37A{?#IV#2&Y> z_4bqhEp3F6%`|o)3Cu-HJGJOhGpsnj%IU;|lh~GPEu`+g7+mXB!1FiQUq-31Bj(MA zZ7LWyu)-4HO+%Wrv9M;*k|7Fa2~ASvPv{!G5N>ghzNE-o_g`NP;8dr<3#VPxUu@oKeA|44;TSs&ykDe|8Daz<U;_KWlF}PY z;#_jXeK&qieAB3naSlvttqBAS_lE90<*^tsw^c{5b&myqLvh7mv z6ufWRPRgiQ+n1w)v(xR?HI(cr8sTc4D=-(Kw5PlbBLLAdj#VB^snTA(ge}dJtC>D8 zVU1h|4y;2{&#GX+1faa@h?5I$cayQev z!QlN4Gv$+$8pwp9njOQ4-NmcznZ2+d)kmVv-tlQZO*c7g>~vQ##IKB#)z`=_3AJ>l zEaxg*PX$q;i>G}NYd9EJzwN(Fxj~*iK#wcaF&s?{~N>Pkui)d z!!Z6|=k|%Z<9rsODO!1onmzJil3GR2tiS@Wx3t0mov)f9BY)cP=J*)siH7dF)47gN zS#^Y&j_XpPcyMVpu-Y1`w>D)zlQAW72szZHnqvjq_Kg5GbigcAigMs4<2)93T0pks zTg+-qx^3Leq>b1;5{Vwb3Nf`&CPePlCSCzQ$8AV8O&rt+uD^OvLOoUV2v&yY;%zTN zOu+M2;k*Da8!ex;aN$agN4P8(OQs^2vt$ixtI`-naQS9m#Sf+2hr4qw*E=Wz4|*7< z(LR^MCGCUlrc%v|VLJ6mOx?yNmnLoUdR>fY=C(cbq|eFaic2aIO3IqaZrbm!)V6Q$ z0i-#9oxYpG&Qn>>#8{DAfLph-j%>=_E2hGc+en$PS!T{SliTioylFV9ugw>E%Uw5A zE*BYtzvuaKX}-y79E$lK`kX9b@bB&H8^tfHOW3H3SP^#7<5FDz+Fy2&EjE6We&z;6 zYu}g@FT^myp6*KbUxCXP{|1%U_@WfEiy|ptnm~OH<)5DIQs(=|cD4E!xOT|+R z;ecm@>|+PojTe!1OMI2~33VLqH_>WaO3QWU7FeL0m44hc3%)rH3*l!Bp$Y+uX*c)5 zdwK?B9_I;%Vd-*n(mYWGabc2fow}(>C?MkrQ-fyy3v_|FabyxA*C7|VwY4-NRz_$0 z`L4J$T!4PCCO3vg?3sWBD|Lq^9C+vJ-M`KItre1em3|*TiTE$iY69WO??Km#c-2Yh z1sPJ<9L=cyvr*5>aNoWQCv+uKQV0HZe<2&>lJ(>6-uNG6gCP()>qk;K2wj)E{e3Zy zQU;xKZy$_WTMg8Y@*8KUMcW@4*%u<(3v^h`IekD9$J%52)%Zg^$i`Hl_6K)} z1z!-D?)^@)wuezIhLJEm`N+X(Kox~vrV8a^1T;{CGF@f;X|s{sCMAI;CH~};cJx{T zKumSdK8Y(TAUSZr2WLB%vp z>maK65ghm784m8lqGfLM@_T9AgH7H}p=AI$9S#s>BYp(X?D6hAr7y6Dl79pqHh2X_ zKy4oHz~^HK`?zkfePvce7IXMlFJX+ygk7w(&+}pO&)3m4Lza6&HJEL3{B?GI$V3xH z7U=`ko>l|EIB%4AAk2wHCBV31jBWP(@KlTR&M88@A3_rk;(fBkBFV&1LM-^}!#{;t zjM9zKbd&^DJjIrk{r zOXA0u8d(6@a9_8eFOxwq9t+?X8bNdxVbF=T6gKy9SSVP&N8n;f5XleJ2e@AbI>@7# zCv7Z$emQPks1l>AqdM&*&t6YUI28ByXG%9v3ti^K=(?Hjw23u)HlT%GVTwFZ1rz3h z2T%QH6R&-~xHFvVcR>!7FhrSohRTiPIR9v_3eU-kSoYB()xOE_M-Kfe)A zrmo6yHo-g#RwY$gDiIB*Hu^M-V2u%(WO!HVogyUCJ_63z9Pkb*&3r=8K-Cb$-i}%!4UW55mH>}^ifU(VA3A`v` zdxXX->D)-uKcFKBDd#!7k zOvb1>b7K!0DwfO(g>8{zU9+6F-pu*mv5vLgYz4F5&7nGdk-x_}{RSNCblY~J`~Mwl z3><6ISDmi_py`HL$+3F;ihCtE;}kg0z(!pfM!0O=&T99O-cXp?F2Xu3BlK#g;Nwi# zeh%+8!gi?}#7o_PZr)?a%LW$VUD(cimhu|?NOOfn+RdqST)jG``|9q(|P+vUd z5ku2YZpEejdFQ7oJRz6att2Gf0$sqJ?<>JZHAaee)BO7(AD=*{*J02+RmGvxjFU39 zDEbQsX}ABU@XPS?^=n$Ho|U0X#;3$s30vJrTJ>vuI?me~!b7snEpGYm(C$E*wAD^P z2@M$md?L}RM4b6I1Y3){;lpb;%sknIC?OsJ=gAfBfA2gbP}ri@$NnpzABk4(wHTk9 z;B%Y>%7u@J7uF+~z=uWme*&*i9PAHW?@AuRXY6VD;?m7I%6E+9wYV0Wi&@V9KflXl z-q#QIMHj!m!OPr)i=a&knq?)mF;e)d{Qkb!4C{dO^VdPld{h#^&w;1sh2Lt|yWN5s zCPv9MI+ti?9w;IH&kNw~_2*BXl=IiE81DmV>H3Zr6pdr+w(*!EDim4i#E1?%{bNj# zHfpihGaNv|Ibg3y1L5RV(>7kxA(f&nH0S{Se?4b(*qkZ&oM<0?42Pwf^XZdsKdOU% zvoz1*yQ1L1cj}_&fvJKdpB`D6zy1M=Dk;QBR+<4ZWHMq4nj!q>O?q8+I(Jx~FitHGzf61eY=l-9kmA1X56|Ag=)XUl4j1(oWN zP{p}vMh*w6Q!}ZS?~6a+k()w#_*JI}svlW;aq2m*@l|=-d$(cr&jaGEnK0-@- zzIhsr#`kN%NfTh0WH7Y^Uc2ZeaIFq*8z6<9vl9YG_ z?ZYDrzOZXg+5h!@ZwTT%;@n6mZWbFZ%sr^-xu>FXa{B|UcnmIh$5qgACD(cf0o_%4 z!=M8Q-Q9p%S;o!yCBVm-V|Nz&?``rX!`tMwQR>Y3TRYHrf0RU+q25;MOLguQ07tWd z|8}=GS0NkBz-o*?On@rsBD6)rT%I;1lA64J5NwbI0`;aGP%~eAQkapjW*Xr2f`Zx$ zau&|pahj0BzIn~|_wJpl{xiZR9eAQ=kmF)$Ub0kHM?gI}+?*ewoYxxV4yc>fp1f&veZ10<95tkQc0wac8nGVrk27(%Pq3Oz`K~ zu~E3=5m#>`$>j+^$2^fO<^Z(2a$=iP%0QL43=aHOhS*>|A@~*H`4#$4`_cF{b?j45 zByuG~s%vxyfO)ALn%g{}c_<5k-T5)cO_+>bUPFf0`bD@T%Q8I0b+4U?@+f3Q*Mz#~ zkHWoTEW!|uosoeQm=CsL%7fc?na7F(Q%{{cRKC^UqvH)1?^sDwD&%?(Si|~h$K?gy zA#N{Fhgq)54cKK>Enk3EQG)k7r@&0@d8J??1u6_spM{*S@L7HL88zBHW8>G=pz4!}kDKXJi)y=B%MSq}RcUL^M8@ zgf)H-@hl4OJcvxrPrZ#PxjFmtz9cPs>V51X7C~&47O%n+l194Q5U2w^z|C;ePTsv- zsV@*y(<-w6AfPdzLF(h??%(N=RP_mXmLyCEd2y=o$UjBf%&4__>AxvY~l zUpBT9&bSoXlN4&L(7`I9!lAb?S6ri(`AzeN->m}gAfV$&z*R1I7G_jQYJ2d|)C=Hq?%uq1?m=LXczAm~CUVtdgw!RrU4TEfpxktSKl(`;L;=!|w ztM_Q`yaDgGRV_bLUd@^VS^?kj81=_O&7Q7E;o3ZFe5&;ri%fR|8L|X-1z+|1wuui~ zM*5<^9Ho?dvvR26)y8G}G4cnDdlzLONpT&6VF4i+Fi>t|SSl z!O`l+#JOjmePk%k;!%d*%=WK%JOAOK5d_zlHUdb;WE|XKuAl2e9`XxVYc;Jcna$Aj zS`>HSNRA{+A-Xw|zyf!c8q8rO0i z8HJ#5e#1;VK=@?_pm<&$I&Z#n0}6VyDvGdmkaTJ{UmfFR5&GC$&8uPOqQRA@BeKxb zE)739%YPX-Gg;tS-aj7u+gDL6agKE)QA=FJ6|tim7DA*6OuxK-#{Y%~QqI5~u`|o~ zr4drPjOV~eKSgOg5E`#Jz(cC+KaTc6j|_jYrA#D5_9Ap;rww8ol9f}=vZN^e`uM_S zR1qAD=D>@sJd7{w@ol7iK?oeb&^s`V^jnI?_NmnYO^|&i`K+K<{Q}=QOdyuRIY48} zK?v4J0?xqhB}TDEpm#_B!MUuqzb0tDuW4>Cjyt97K#}|-F4XOk`u%(D4%UptHmy~H zCp#`$BQj1;wyEDAbU3PpE$RZ-px-}keDeM?3zW+-B=zCP%OQv!`v&gl94h0xg=2jT zA*YdGil`xxk_Ps`kM>ch=OhTr>(m( znu@QAS=)ca;{A`tGj&C@B&Ys@U%>u^f3PrArXn-qD-wd9d9XDx0ZU<-enzH#7cAly zYr*Giv>!=+qAaWzDd43WT12cMgl-Lo6`VA(L*7)62!j9osT#tBC!_BG%#NeERT(_L zi`Hd;YwLd1qYm+z4ruSK5fk6n`1V-DGKe*sETRX+hUlS|xEeiWqyWQ|*IsP{WR zB$XF-T!f^i(hHq($;KD+N(7`)Ox?Fk83JHTtDa2$si59TEf@`owc6ro*wi(7~m zr#WCXI7FI-)@z~r(;UCc96fQ*x7sUV;WwUA3R!*8As`*<7Ah{GnO6d>M!f-7U(@Y2 zbAS8CjT-FQ?Wz`B7$BL8IwxFgEg*=h3wY3Zjm8^C4*FGMMCLP)_EZ{CK&Y4rv1 z$x!+= z;sKGh%0-xHEA(FPQy%hA{v0259*juCfcJLu1OBknX{zkbO>7QNXgjJf2iTX|q&#?N z0A%HeKkjg{qo4R5a3$`~jOhWy@m-yVe97YinmqAgnq;WqJ}_4t86!V+sQ#WOcOr{p z7RgY5Wp`gjzgKSh7=k$$iat5IdCjhXKte2%WM_g{O-p}Zj`5g_-dRwky= zqiqvTF(>vK;1f!ZT;AuY(e%1mef?@v_KwJpFLBoxo2ZJNeXXH_ZnR>}J%AVqtHk=$ zske~GhJZvb(9B+lnK9av`$&SLpb^he}L#ca>mUik;2tuTy#5~ z+Sty^FM>zQr!X_-Aa!R+=hoEFL^2b;vFFh zrgCe((Mvh`X!cnwwKnO&FHlB^P-AY1Ioa~p&BsKuDTfAs9vy4_7Cv1vSpV%%jO7iM zgxmVzdp^>cMwrRR7w0jdxky5#nU2e=n4I~gO)o{qx2*4TXCoLn8f&2kn!X53qKe-6 zrK~pd#fW6-;j%+WYG4?A9I!pn2u|Ksk>V&@-4E!AGasX4l_|v2T#T`54`i`1gO1kw zo2%J_l#AR-j4r12b&H-Yui?}9REPQ51L}frw<_iN-d{4Xx38qFUj%iM+m~GKPv0aX zoKqO{26h(^d?fJMx6!GFF*VG^L+vk7*rk>penI{pif)Jc*>zCaZ7_RXZ9qbO@xE-u zIErBM!5p{-U8f#+{qOj%>A>+{d#;iG2g-rtkN$J~QBeSPxpAs~0UU%u#1Am9Sm@!h zD8%`X;YM|?q7`u^QFK!br8v~vPPSpX+!$HqQ3X?0GY?=)tXU3E;_N;<-cX7xun28w zCN@2L*75ny_6@DN+SXQV*$J5cPX2c%(t16)C_ME&~B`}oV}d&HWX zA5?CmSHEUDrj#F$wWyYuez*}Mny9APdYqr|U7DjOqm_raJ11Q;Cn4w7UH50@Bm3*6 zfj4Dz<|^WkL}F)R!Ii0P*ZIROEnOblW>MeNVL)SD<%5PPzACIzlGOHDh?C+dMxLq0DrJAz!E3p4C2vWn7`8qCAVZ%i`6~ zXy0Z&=FeYXkaZT_J0+o)c_g~96h65T;;4>9-cryGSs2t{wBv7YB@^w!=xwo7_d+nP zYME&fXxQ(Rt$^H9N{{2}DhxgG^GqWqE|*?m?Iy`!WgX-p%=f9@s8@@n z7#_{T8AT<1pFU>Kz(yK|R)4m12Yb3t76!bDTlYY>NNMmncCh>6k?2r)2cHvRckkU$ zAF8np{QvWb%@=qjp=sUT#d6Q|H#!KWi+Ag>LPEhpeK@lX?dvf!(&LuQEByu#=cVvkY3?2+k)F=wvPTf{$=5Bm-lTrz*wCkO1;Cwp%@uPcV3 z{RYqId`b?UpWk4_c?GKHOwyjwtPPl-H~)KIM1yB5^qRASh5B5mzwq$2BOGUWpz+k? zhJPS+!jGPC2)fS)QQUK?4PUv#a>|P4Qf{W~U81V%vM_Qy^AyHwHUCug?Uh~!CUQJt zX2APi5iD#oE=96L+vt3q4A#|EsMRQ06J}D>N_^tM zuo7cLwEQuMfnrQuK~qlGv!k6OA}6rrMB)p~1&gwcQXhs$9~R@p4NkVQ;2S=QrQBwg zv4bilw;kz8xv&Q!v)4-|J3>-1O#Iko`KAPFofxh&0yoNoY!uxkBI)hvdt+LDIX$Ds6*w(&=+!;${M&-pjGRK;Rsbh0F zN=_q5=?v|lntN2m{EbANc=-DRkxhjq2jvsJ5rg6#^9Gn~>~wzODc_c{GHH*zZ=WC2 z*EiT)*t80QJqy0R{SgM9Egc!&(34hT9_aa{o0hsY4JR+2q>MeS^5!(_WJYQkaiPD$Mq%h-bUZWc4w0_I4y}4DCuQ!(sS0<4_gr;7RrWVAH2p z#&9n&-&<7%@^&3X*~0qr)#gAS_Ts~C^o0n;X$7L}iBPsXSMrrHQ{VQYZx^hl?*^@3 zvlfBlIebMYiD~jyW#i`k_5xm$ui1t_^5488`oLS5ePf(KtJb-pqwShplmSFn!8sbq%d(ie&GKFEo{!*D+H==>{X=*Te(Iw zziB^1p4?GIcBp>sm-)XVKFm+Of8LK)ByW#LEshjJ zhtaLW*xp8|quQO+zfLn*{bsUlF29zjB_e~~UZ@SH7Pd&8YK|;CU9za|F_U?gVHd0e zwMF}HKdV%vs~%li)8t6fvW^b57bh*QQM&r;g%{4i64<5RtA4*1Rn-yA-#rvst;hWk zdS-+#XBi1G59@k@DE_PZh<%6Ofk~Vl!T`RyL~FyjsaiyusE{ziA1~ib#$peia(5Y8 z_&p#=S02kNcRFQ;B4otEj`uWz?`%dAiHsMQ*_~$)cDCnorJ0l&S&JExx`(sCzWFYtAQiSaup@sVdJx6DLzYcJ%@Z0jMpas z=-|dq?9}_6xN=`b+ulA5RHPfXD@KyOhCQ<;Mn*=%!Kyz{gG_G^ zg_F&jJOnZf%28~~xbLRi4*o0wRzN}Txb2gOt)921-^a|}xy|+FI)ws`S^H!3+qvV> zJ@0^pSw6CC8@3>R;!yqfMK_Wdm2_2mVUUtB7G$shQ1$HTZ#4ON_9tTUK&PQsWgULp1Dlmzd!!^s+D*5 z?JU|@qA_+h6}JZ1+cAkE023A|%>oesn27$CKS%nfPOIl9U^+I$3ls89&cvu5Cw!6Y zaMQhC;sFc%uM@y}8-c8xPI~<4b3V?+#Iegpz|*Nu>?En9dUfWejvKXswKb*|*H;go zjis~fqipdlb*IRgF|K88Z<`6C>0Ag#L^~1k}Vbj55yeKs-;;2svf8|WHHu~z@XE_jgxrz zyh|IRl3*W}jz51!MM>sV-{Xo9V6^PM|8zvHF+q-I4cRHeE_qan{8c#9Gl=9oe)YT8 zAfekw@4~Ua^Z3eU`=;Eh5R$T-IT7XQ_bQK=+%HecT;mXNx0fatuI_cq0B%dU4)Sbyj$+7niKYbBq=)yEWQ+^d2IH+>GCqP>Fz z`{jiJwE6rlpRt}7a)Rqxi%gIcOo-HA8g_YF$AahC66_KuD#{~ws<}t&6t$?mDnCdw z-^*#eqVgK1;|Wt|*7B4!h2|%X_lMKD_q#IRe>`2s$@YyKWBsY5dFwiGXD!+AMou1B zjZnf8miK+}9WH4rVGjVUt19`)m;5|@=U`)hTaw!ANoCn!4Lhx|*ujO+WbMO zl7+7Eo%k#l7I{i6yA9jP-J9T_*5ImCaOkVw3BDNE=F+2@jelz?7A3?Ai&f!Qk>?fv z9@iofRK-E2sYRigYqaV`)Fl?K(Ti<*%F(KY+%SsDI~b3C7&!A$Gwj8;Z5@{w-d+iI z-#RVQ6ve>yl9xArV&33bucbxCXuBvyPj{Z;dT(*X3Qmsb6AE{w(7`*%RLYEZSVZ}T zncOF>@eQMLl8WDDJSRZl*K08Kyz+2iD=}c< zIUK}_Yl|gYyUYO$eW5kA?k+~}(iM7zPE3~X#}J(aCR1N`PuO;!%DeYx?oWTF3m>ap z9(QD9UyHBokcL#hm-9dJR+p?Ke~mqS7G|2nU84D#`xA{9C-*2&!)2a$jGy}b(OPD@ zOq@gywp^CVEWVV#1r*xP?&+B9h4AW^;O*(VH<@caVZyrzH2PtoW$;HyIE%#*M;+m) zE=Y{=TC_(bz59MQHPL=@kBQ>yR@dQ#rRbUVT3}NLshp^-FF+Y6;zw1uW~aQEvoa1~ zY5Dj)I{bKsKy&GH_qK(mmg%Wq0h4gJB1Dq8Vr~t?`qJ&jt8enXWGCL|*m2Ss+()CP zAZ2t^sdJaH>t)h;T;yq*dq=XR^6KQ+!EE;>=Z&i>-g?u*n?KR*;a5%=hXc;I`*F`# z%VzJ2<>2~tpRPx2gF4E7MzXh&3q0WeV(q)bss8`JOXzTtgOHF-I0$7WE3!%vI#xE> zo06G5lf6?JDP*sTkiE*@*)xPxWZchp13$?y_x>dK=w05y`bOeR2u4&;gS_<;I^9D!8^-mO3&`VLRSR0q0%9r_7ya*fFu# zZ`^+hPniry4D@S`%W7<7c*v^q<&t6?1Tf=BL?~|VHy)h7nIP3jjmL@DqreTFV824K z;Gt|YMQk7DSwnC&GUE;i*z+iLuuf8AMh;=d1HcXyoQd=b%0P1_G)jM-wh^u2Tcawf zS2110d0W&6HekwjnQ&sAdY{F(;h^CMY?iJO&7sgJmgPpCC?sn_n;8f{gaLUfNS?pgu4nsM?l;IGs&wfX<#sdkOBX2&i5f z>UyZ~wVa1wxPT|wC5DopaRE>Kh?`-iN?4D=sKB{V;30Gzi~~v{{qq_%RtZY}H?A9K zHJl!S5jpzlERVh~_KGOe$=ATU+qs(aRfdrpKQxzubz8bL7e@RXo%P1*zF%iXp4jn} z11cwZ8EaxlA0MFPZ+v&@$=EbEdW~*$iK=ZMtT7AhW)f8+X-UxNWi$^Z`bo=O16D^E>C*wsQ~Rp2q93Y^$dzSNZY45!(K3t?Y=nO3sbD#FW$1T z>t>xN&z9e<$-8{@I}DW1m()H1H4WdgA1LHlKKF=Q{4)LpX-FLq%SPR$Hv0}vMXj>7 z0Q>f#$bRg|8GLoO*@7pP$}!^6w>c0{xP4*zBXGSV>&-RWy~!uLf6yb_nix29-Hp&teX+ieL5;Iz$h^#MEwr2 zn5fuc=XKjXF9gdck;dix3Aka z*f_n*OxT~lO>3*-WUlutMH>Go;K8`}(~iZ2B@IqfY?h2(j3H_PLLiyM_<4sXD%t#L6lDN?{(&yv(7} zqs&u3{27ig?$!I*DSgipNfNY=C~qZeC%#bRQ5lH((N`}!B6!Fy=as8S=H;1_42!9f zUGAXF@Rt0w?8`IkytaD}-9oS3<_@Rxm-1w~c`c1GmsII-yY*oB%5ImVC+Jn0*7uMNaO=zA0}McoGR6vRmE_ zB)zS2Rx{C9xcE~K2r<_!rEA#b{PPugz8qiUWKM-o+VOg0YgIfmlBTTtR@kGiT=p`u z`s%C}r*Z}&$VG=Zw}dlet;(U|laj@rr`En%s74ouTQy8^$R)m*W0S)b?&O>REnjK( zt(0RA&%==E1tojgi!q&x*%9z{aRR=SwAo@cKNlNVi6+dPHv)T z!_`~q)xs2n?=t_Wk#p0XWSw(eei=94G7CXBXMaT^W1o8xcRw=Hvdg_cF*Zgp$02dR zek1)$s^8~ROM?bpH==EL6+2LXR-$^LaRTfcAh`-%l~%F6HGDB9E$ z^;AQa^gE8Fgm0G=PiIDwRCL#kZ97eVL9ZSFxvkh!Gt_5^);b>k9mET3tkgb>cs*zP7(PD4)K zG@&h`SWWE7E_gqX?bH6td!Ri^AlDR8XUP1>e6X){bh%1S*Qx$ z#C^^A5y$ea!M>~S7^B4zNzr1Lqlp90cplHW2Gb${ozx1+kr=H8uTam zW?kNyYLg+v0ehs9si@RI)!VeS>3)6c39O+4-?sr$vVJe-s3;i+15E)DsdL(kpb=#6 zRBn4{G~%RiXIN>uvi*$2mz=!uOaeng17KL7rcFQbC^5D^=1{n+0%P2AM!N3$u#}`} z75Ziic%UTJ=eD`=mno6DN73`<^3XSfsdNI5V10>@BSx3}-3Gl2MHa(qU!<)*WSjEr znF3msZUZy>Cb;|!(7E)f3SHifKzb0jgDh-=w%cY>aSf%vZ_9ei$=P203*V?kZw(Y# zR?4fzmtyaC#i6J3DZDqR1kzXZ8HuE>IU6o3Rqg|m?wHJRRugd04nE#GM0S5?TbQhp zz^v!G7DHLshe-lMI|#cZ-lQn=S#DF$tyNrosZLaZ5gNbr;nHfDq-G9wl_14jZD7H& z(rs$*I$va=8uTclL*K^8z`0`K^_@p`Y;FUnFt2xjqtctcpjK0g zk`Z1M<9!EAq<4WeALiopQ4MRNHoQt|1M6@}^JN<8-+f-nm)<+SD4d2E$+}XIcHezf zBNguI@T{V;=EF{F){R$>c3pQq*^R^0U1xtG z_#RwSQPWqc?W->>RbQYvPM;gkzYfay1-iE7XI*+floc@&9ex~!*r_nKw7LKvalL8D* z>lhPtA(zbsq33VRp#rT7v2*x*tSJN*cfqtW+xbsFo{FIU(l{TA~h z^(`D((i4Sh?OP)C`O361XV9j$8~%-y6_|w>Tyebsu!o*4O)^{Wi?=uAI*QP0CJ8Bqs~ z6gb`0*v8c4yTmBBgH1&^!W|^)(iXaw(_cBY%tHQ{X-oJY)k@UzW{oieyp@JIp%b&rfyc7IZIA zhsD{ZLI$9JyBwbh)@Aleg37({tG8YJaXqb9hl0;s{Qk?Beu=*+P`K|WhuLH^Lkf6e z9~$g^YgQCae=7WQDX^W~bV;!HCvnk$A;m$Kgzf=64xZApG1uSCF6Z#BG7esNR{tB% zou9b>#9nzfN)Bp7;K>!Gw9C0-d2VScg>%iI}Mx^@yN zZy+{c#)Q{j=d;*ZD${x-d1*k~*?`|?23wR#!C_lR#vNrib*$#sU50XX+V8YA95yJM z8q9ID72W zj#q-+JbkQI))E3_QFv1`oJ1)kQv;7r)XRGsIkf5fyDdqZ1l(m{!=3fREKmvWpPy-d z^oZDK{0_{(e7;Q9e+?_+jT9k4`yWAt*XUEJaUL6ZXio~gvBNjj4@V>qMDm8OP3GC} z98?A3j!X@AlP*buh%3G@F3g6x&M51(F9bzYH{m_8 zbLnmlx7rOm{8f7xMtr7{gh4|5eKJedjK4(Fwz-#Bsov+FB!={eV+D4MCk9ZSxmHg! z^|x0S6bFZyqB@6?^{#EQ0hSJyRm!8XubuXHfV&ryNHU+_Wp@wDK6zbu{1irXqxolR zE=hQfN)URb9$AR89JL^g?dgFr_#jTbTjO-h9{*U}VBGP2e5*>sDcLk|qhox3{BV&6 zT6@irrU^Lnca>u&u4@(2o#B9)wMxKOm(v9_uXntrg?4uQM?sj%-{P&CTuH6{NKuLV ziMfjfgdI?vO!))V^3jUlvlmhP6|opdYx}}i9sM*p!X_0bb7|@n#YA&8xouhvwQWhN z0NKE&`>z?FZqY}S!Xf~q7N{j7yCmJmQoBwIKM|h^7qqUdBr)o^#VIIq(`^20sg=A8 z$GRcelu&r^+P{fItR!Bh~qP< z$#N$Mtf2qm*x3&OQw2>39xGH zfS;S4vjT&jJe_g}3jO7w>sxTxB%g8^WXsWKy2*z+b&KPLGDB>!tBo4kk6rF&iA{xZ zb0oXm?1eC%a@@N~nao@{_ZaQF!kn*E1HadRvcu$BSa)Eq@%Z&ne>)@yp!ehr3XU(&S4jbs|Ap_>Qn5S57%i_VR2=D7qaCBRG{6~LDDsnPg>@Fqzc zdolLu2wSe6%cvV^N$b@#tn4wqw--@gj@peZtxxL`bS?EBcomZ<%bM4={ zRNdg2NC8S`%0RwO3WPJ)U9jwX!CQx(PZ0k&0RE{~@w$$!dDB_>WP#u5sI#Nyl*y8< zYvsln0o>;Yl4D@MZ{C&q+P-;?7-r((n#iv(1y}iMb7G&>lgj5@Cp2DK?M~%A` zsv9tO+p$=zHYB_I!Yjj2IjhfKYKP_Km-3_$b>n8qri|+FQ5dTAQ5ma+ez@zRI6n{& zbxQS9B=CM!%8aQ@r@A{UW_mJCcz7F3_#Co27~6#^Sg6sqWmhnm(?^pi_EpL9% zs9Vq%P@E(5LQ5|}w3M&o*DZXv&x-$P4E?2&kaIQZc1AJZAMmX|K&l*AvS`XUP1NZt zz?;yt1EnNhzqm?vWcCGcK;q}*c4s$@?iHZYK2=#hJkrklmE1MDr(Lj_aJ9 zYk)c>$I6i*^m2q2xKjrdLgGk-J!HA&M||gTXkjKIY>AVq}{=Ngy-8Eoia&OWb_|c{e--@re4n{v#o^Hx%nx?g_St_mqL3ED6Re-bf z+GD1KNKTIb+mkO)FjvVBwp3^OQ?+MkWA3&*;_QEz+onbH2X+jvR_FAWl0d0%i6n{j zbZJ*yr#CfMlOK_*Pm~S4P9JBXCO=JsoioZ6#zIrf6^Mmkz$?C zK4{n3cjF681uqykg%>?$fD+yej5US8*jo@0{#~{p4y$hgmUjniRMXevl4Q2@c1j=syohijwhT6fBP;DwIVJ|IkmRDPKMV`YG9qd50c)z2ilQ17(=(`4Iaz zFufmUnIvLhLmtJE`l7@G{&-c3mg~qo1iFv@vE!7_)=tSUF#|On23q6p+ySXYNzFFp zS{7MxSVcqNeewn5agv%o^a0Xx?m5$vWz5Y{>?1DfsdBHCT-<8L)82hxM|XfZ?_I?T z)!=fw&lBnKKrGC8(M&l5CPLy?Q$OIq48it-+Rw@sOdfh)-F~gzEmxUO5JLB_H;cUt zi`C8~%)bMP;ghx*&oa5QwH|pxB1oLMYPy7f5nwP-Q?4P2T~z!C5Uk zSOogs`z|HG)=!l7BTNFUO;W&16l!z?*U3o!l_AsrWSa9je)LEj{Igo-ZE+Y#n!Ql2 zsdW7%U0fi@-Lm>$w8fzRXrY9u!%xlMfDPN9^7ldoxf?Pz*j!d;`@n)e>Xc}Zx8faRtQ!>t2&WXYiD z?z2C&4IZL~j}~&<$zp2{58hm!UWAUkwE2t!*yau78@I|*?k%f(e7Z{umZQM5N;b=V z-W!Dgw1sy+d1!%rgJKJqFp0yTyNN(G0+q$dOG{8x`;yCLj5I0Mo&l2;ljdrW#&y|y zIK@JCi|D~gnN`pWoTlukp1V@HKUjNU$}{TtjWOPqO(sJE(WY#|phxBApahEE4MyqT zg9jt&FC|ybaBOwD)l4C9%@))hDbFLt+N|Gg5A0mM%{TSruaIh_=7iPAP77yFs?j`1 zEmXk&t^|_iXDKuq{jXczp1W2Fsh26zg*6iZ1Bd4FQOcs!$?;t1b+~iCaD`#cnSuaN zxym)RB2Xp+7CvrC=u|;mVk8LuaId&x{;X5=O9;K=7j4GoA2dcviz(_G{~U1Z_+c;J zF}cs!gV;LE!_grGYEVL20}HN)IGot5Ni5G zAm3I^jU<2vV>@C{Wd^c|?&N#u4L1M-e>^8D0Ct;&l`4RZ!WY26S?!DJnDi07J~RNV zFbVUFKC+y3K2#kZKE!N5?;BYfj_0~QF|Pemuh78P0*naqQ)}T~(q!;Cg61dL0TOU0 zP*m+8e8L>@fYLThZ9vFoO^+Dt;8)?259G=s3zNcJwm@ zZ%_#dJp&GFlE!Vliwg>fut-N3(TF`=k2yW+O?_oB`*MZVAa618^n7i&Ao#8cAd-l* z6bMylK+3nW=|qs2BF5Y<=Em%qjv?@NvVws3degm1Bhp`Ln-OmI%P#rRO@AfIGmk&U zT!a0PLd0|#bYp+0IbO&H@p8$g`}-~_S>RnZYCUSlzX1x{FGh&CIK9=%Pg1|q{wb2o zfz=YaH4Uc1La}UE-189_;PY@Y?se2Mh}dV)h>Kim&%)RuP>kfgFWX=#XaJW-<9NBa@Z`TpKAy(KeKeO&U2biGCwoH^#Ajz^N18@ z{Dec0;GCgc7|}i~3`$%$j8B?ji9eE8rBX=!UR&{N(RISRty6 zZZM*+uP+hM{@-N6foB=*gW&RODdxOruzzZXLH;2)&~L=se+4JUQ!HqbbarGcM;N3> zMC==V1@Ts?>KM2ci1;OfrfNMAkt~^%RGC2#2tUX_ijB2AO^7^?wO2;@mW;nuW7xTw z+V2Mn>?l5BxUxRU4dRR=-oIRhvAm_?;#wc!2sS`DQJFZ&~a3GB7rM$*+JU<6Kc5 z*Cm;Zmrxbuyjw};j!NTGeL)&#thj=W|Y}qU@V5*G%mk4 z5|0QXriwSAxVnr?@*b>~CETA5;rPNrwXeK{GmlK3fYZ!o;`?WBZ>xZF%Och-c{pZA z22KyWZbaz~5*$(GmdhXuMTBQ(0_!|Lj@v{=D?*;|+(9tpMr8!cQVkGfeEai_7%I5y zZQLUUa{BYX#X57qM<_y$!LYQ7K&2-eWNDM21rm&!jm96(0KM{WJ(9Pgm(%@ngE~Ab zhqO*U1h?Z=Jr|C7A&B?wm_v&FGM&~rDRO?yYei4Y>@eWD<4r9V_)#+r4|yLT!xPpz zxQyyc;gI^0U$@>KV6St|04n?l6SX&%Jtm4J)@{>YALU9Q`4(tA&{6hb-}R}PegENv zSMeeY#IJqX0-fH9D`0IZh|ub`t|*jsu%!swosA=@LZr>l5RMO9vZ<*uN}T}DGDSnR zlgotguNf{nu?&S9*G(Quj7U;&jZ zw&Y-c-CG#@<&v@_0`J}j_3@YbSwuEl4sPpKRsByRw;A%fpvp^`hfAUCLq7yX;jCUl z=~uoL-^*uWKqdPaEEL(bX@C=;YcNa|R)TAiLvCA0gfo5JYF_KL{{=Yxz$7r|=`CIi zr5w8!O)?cPGBz#l;u}z0h{(pHen3&!4zu`X>(WnG&0?+#@gw0zb)j~tCbTE_M2b@a zOd`h{HwU4_HFyr6!;>Y1-oYY1<&q6cq%NFKRsGqU-1v_2umL+RYX%_7p;Qb~JMhSp z^G8+A>@qs{L6{1z=QA7?mg#`34drFnJ-@|#kb4RjYIbW7_Nuk;Cx?9iW|KH?WhWvn zWv9?6Hh2s1BS4a3rZWA2WZanXdL33yAc+O^=qLAfs23xxN8BMyAz!64b8=$)p23)Zo&G4xxcDkTP6;}Ak_ z4e=0P-z)KC&LAqn4oK`nkY^z=l^5?Hy8ZgTy2^Q0M8M7P&Jod{(aO9<2V=D$8|aCT z5HJ21La95?J4xm;641L;=KvN1PM?N8BYj>|qi(3XDGP&3{SrBML8VdhXQgUR%{QS| zw+vD`_o%%~NtaQgTOER(ASE$-y(3TCKyC~4%P;z08C~kGUQh3hyeE11y`py5wTVv9 z_6j;h0Wr$Gq;ICubZG>#i~JgwD=BWmDA2m$d~Ldz%gd=u>iH0G?#}bPp_hKw50Qzz z%gQeRTYxpyufJfPa6G;Un8vm6AuF2yg=7H|16BRcxwsv_DDQW zi;tUcz=IK5&-9en4<5O2;{PwYuopH|bZT9r{uSs=)oy_*>0LeW&C08QgT9-0k}aT)`7;bLEgy9RDiDWI z=0fuWh*jb{v!~I|&Bx!lbZqDgL4oA8+lq}T{^IXngo7G_?QnN!SIcnYJ1l?;h)dnN z_41iDsKXwy(HN_)f{alitTx&fp|NSIMZCnyFv0}1sddaq{T!UDZ6wGw|G9WpsWM=Z z$d_`;9iX_PL5D-e49JrC5ub5<-vTFG1J_RpdiwkW)Qg&>Vl`)fu7EUD;FtYuRoxZue`jJ8DqKQa&))_ z(T9A9=1Qw|+~?7JqXe}?(xKSf@p+YbJ!sa-oXTfigm^Y31V~*r-yb8zZC1P?J(Tfj z7JJJF1MTw&FTpdXbOk2-?R4&oPc3Xqk51HyY~&mM+Pbc=hH-3=8D;7KcV)vn4^}V! z5=ro?E9(W#Kh5SU+R1o64niOz$0rr_=jJ!N7&6EDHFY{Cn$j>cdvL{>fE5@+%PGxn zfKXpZLe;-Qs?(?|@po-)<|g&D=R%u!o1^XVzqRE7ZYO^{H2#7W$C#m3WJ@8C&znaI zexYV;_?52^H7Wj{m^5q#f%({`jpha_+8UiAKQwZk3j2Z))k4YR-kOk=6x1INLWtyq z4UUu+X5@Llei!^Omn@F=N%f9A5pc?<@Z-G!Epsg+8Awr0OAtFWV;*~WEItxWTZ+JeJ=je@so6S-x*MTkGgWQD5ab6t@MB#a1`K2G-3aj-L6_|XylVv<9vy04WZT3_cyn#E}ar8Ld%S6Co>cU@#05Iezi`ne$AyKg;aAf7LCkSDWkMf=a)kl6XqVs z#w34H<}AofOOfir8W&uQ_!vJFze;Ayv{4-coyRoF2@Dx==y$m7fS2lE9;=bFDxZbsdoCZx4C*#C5rZYNz-%wK z^p7$Zf`35jNzs6P!w1JbL>@TMCa})TG59r-x#}A_(q8%AE&=wKac;sv7|H8C^k;%7 zM4YAlv0V7@R}jISJP8U{aQw4yGXDIeAV5m!H;LUpfdSs#@^SDa+O5+lil_eTQDB8&bYM;83Qh$99m(om-;gZ`~)LK(&-Vo6x^zGlq>!O?Z^-y+OBA^VOm?SQF1=U*m$(eDuJIE>$bf*I=H(P zf{r?dJH4InHANJ5CkjtQDE_(r3N!qj0dmx5-Fghk7?^DHI)JDo6gK4UIx6>=( z-GMQqYP^7G0N%56_1PDM(smxoU31I36y}Nfg$b?#ccqfS-%c|Dn)5^$a;82eiK*}4 zO<%ryaV^z6i!$6-F)@ciA!V zrpq(Jq4sD8GHetW^ztw+ICclh2)$>5&Na)^)=upZ2vxQPjeA6S2@r?8FfI=KJVF@` z*=4{fdCpl)KE>mO`GH4RLSKP`u&wRlGJf&$s9kMZA_-~?q)laBj9rMY@OQCL`xTwc zz{S;xOL$QX=0wyF?}3HV7fx<#6VtPu9%snQFYWlB@3_GfxOIp0^!fKE=*9X1eb135 z#f#EffE!9N)U&-=%G8&-zuidN*lO}9g1Un@m@R4@3eE3lUzKzWJFQahx$c4zdbG1# zTITT05VZRwDW=bBj#hsC##eeh1k-XHEI1gS+@sWlW?&D{EhSh%=ZmT>J&m4!zx`x! z;Ko?$(4tUY{|(|$jlVNgAI#mm&=uI+{ScS_Z+(el6twT!qa$$_O^dpT;?uyW!^z4b z^f^Bnw$EUR5Z)f>k{{K{SmO%K(7CaV0#u##c&(?=2y4DjC}6`nuNr&xbmQ2lU>Z!gB#_mRZA2gw&lE5M5D@GkEg z%X{vO>%1ZOllObG;G3}d_)yU+Wst`bFx|vM#h#g>YR|(}1;i4IUZe&;=RC8kk6i&A zk#_nheSDb2MOFSS1eUDF`vlo`5TPJ$s&IHRmIzhp@Ige#PMTd7#(dD9=4*_Kyehy@ z76pfRKs9Lw|5Xe|1_#CArqSpDd(atAX|vYoqAI2;8-7Hd>JXo=UMWDIg@ccY?ah4* zm21(w&h`4A+TpHooqNKx^*rktEN;ee_o44B>W5gOfVXHGD&O$VJ>FKXvRYL~7@;6| zQib8Z_XovGGvm)lu7M9*9!O>e&|BIdY}uIP}20Qa`K>~1oatN64xH)ira zgUeRkJd6$+T4zW2DqY(MZ})_d3kL=Hul*498W#CPFkL8%n)O2@$2Z;*|A%F*OZKti z_2w&4V7R{SiZwkSKRm-g29$Vr@}V@+8#) zV!5~SVVVh@Y*?qnZKCJ@94k6PWhDjzcf%no`)+0q`6}j`0IavP#8)~8-|cf$lw@s_ zn~M(u&Y^d}8&Xste#Xd?NC&(5WM>d|K1j$eK*6N-_4LY>*(8EyKuC0cKxZ=`B_mb% z(gm7JopyyxYBn4v1d%jgrSZb_6bhzL-1R)?_Sl%m4gvxS{^|-e-G?9&+ zZ^TPGb#SsGJDa_52)xQa%@uisZQls4F$52-rii&{VFsAMyN-oy`oO@iHMI1i949D?7k+z6NtlA!|&Oa+nfT_u@G>qvSe-~byG6eszW0^c zJeYnWr}(+&hB{;3&%)Ee_G4CH%(c1=bEt;|$}5TYl)V^D|*Lg3qF;S%2pR5NKl@Ig zRohJWEPX4lN{(~2vF^RkSMSMm5WRp&u;_N*t+d;~h631m z`M6`G`qBT;68Q1X(6+zcgy~zY*saKaKQ@s8km4F@sp{V?L5@@*p*r>-&fFM^wt{l^ zSiAbvvh;D|MI<bgptpUvF&|Uy*I|58x-dBgQQPLrl<}j9EP-ZM4=X2H9D_Zh_nonBa^$JW*0!5 z2j4Y6JMX`!+dvkAsyJHuUB-XZSsYL#E*d0CFuFaz7!aAS)PI1XgUz^6jRJoi6`l8I z*vMU;$qH40QKn1Er$Vlf?IBhmU8G%}r=MoRzx-jTKy|8ck;t&0V+@gM#1pKPL&5Qg zn5wdfsKaKmU3Qk6b;@=6Lx>s74$5~jQUNJ{GHwrMdF{g_wiqtN$0demYJd_o%|knn zYUezoQth&0h8Q2Z>8K(?d&QaRltb9_0Vg^`u-y5j(Mh6CW;cc5Vp{P1CK@q^01_1J z0DO-|<>g#UGP+9(?X9)JcwDcNZi=IW?EdaL`4u7r?m;{aY&f0E;0_e2>+3Yeal$tWO=*Y7bE;=06eYq@xGk-C-RO_Nr+Ht4Tb zH%buS94g2CuL0Ff_1x$|>;SC(+jSeUsv9MR?*MQZlE=LlgBok~V%Sq;Zh%Yzrhaya zRDsuB2ZR=zFW{262r12WWeMn{XG;V+AJ#194Uhi=}nX{JGY z|IP&a_6I)w9GfwZ3_L?v)R<@oAsit(E})&WU013_t#V$n`$geh3}M6f-SNxYI;bJ~20O1Z$A z>&n9Hiyv1b&NOCEN!q)6r8W)&ndCUW*c1B|p+dupr_klYO6<(~OhgqBBYqLdu>7)T z1fs$s);3@c?H51nMkZWqwTE6S9pXso@Z+8AokIXy=7C3BPK#l(n`a?;>I7OwwuqJC zE^nq+G8p+nSC7t%gZTF5z+FCjiyBliC5Wv#sD+&JN=nA|V4>hQH^@BPZn zli~132fxBDn{i`%9;a- zcFEvR{c(Ynv)_9xvBPMK)ih;6?EOllm5_ypC>k|gTQ$Vs$y-Q-u86-bzy)oj$;z4VVBEO)#tTD7ufRybK zXO4h<8w`eLc|t{iXq6ko&V=2&8_@Sid4wUR)A~=^zt3j zh?f~Hl6Y+{(%(RhYQX&%gVE3lSvh|a_b4(?VQRu>Um(ZD*yXD=ssdMFxI25K(^9V68%$;Lin$g29%hWFM+fM%l;bK)eN(E)HVmhR6i-dX-{)}|0qf6WPsga| z1$lJJOV>$OAO7g)NV`flZQ+FR$|W7aW5v}+kUzwT z@$VKBxGH6AyrYp0u7J1A+lv1E_G1VvjpFv^K3CsX<>XS?pj^Z5h_ossb6j|R!1u;;uj&C7_t2JQ1@u!Ka zD6C!~eou8=ybn!v-E8QM4tD%?6iUFt&wP?XSsw0GL4=@F`PE16J9y{tFjgB~Pmpu* zZ&XKhV6GP(!QY{-7m(S9wtV2u7T=&fZqSAGWFCXBR-!l=D|xlgg=_cI=Gf0(DJS6Y zLL6mE`qY%Q&^N^W{OQXQ!7WDD>T>9=2n=dAED=*F<)OJ`k$XRIrB@kM?I2ePkX}mXYxF&7KeZ<+Rf#*5ikFRpEj+jt=(B9j@*FrtR^~o_#%S=GA5n*`ibi9;j+DDEt z0a7W_59EBZl05<8ZB5wulZ(%6RUN=etd6kanrsaOT2NgmY6_!627>Rupn@tv2RMuh zvJI2s9S0jpYY9dsnVbGcLf~xLUf_iKytvGWxLnYzqwsVDooG*V=rFFyf>yEql8-H7 zW;}A;v5W5>zxfL=qjf*;F1#yT3_I<33PqZ?*K=oEAtl&xK?Af-N0#v)a?}&bPdi5E zcj*CK)t5cCm#{-<(?~?i#VNVPKcBC%_hYb1RE>MJT`Q)EOJGae1f0pgC*LPxy{p3H zAnVlfwqW%q#|sP<`2~Ny2~UM@*1@tK#qUbg!hQi7VvDeMfkf%_#xR;BjQ7MqOp;$v zquu&inj=T;PcKjJ;qU0Akz9sDM0E%F*5oCvJQ035W_)5_WZoY9^S=Nk$1AW2s`?X= zQa<9pN_hc<251&Od*vVBx|I=`v-60sYyAx2Qh-9WzUrqQ9oD+|{hB|4Tb^P*P&m7C zyK3pY+wsI?we{;QHcklehNVUNPwrj0L!y)R(AkGli|T!v0cBXDW4bB%6Z@3bb;Md0 z=b>jDaS`uz6kQ>EBXc!HkBdKgjPbdetG*-2@uR0ZJZNB2UnV~LCg8PJEKK5atRCML z{eGJJ24ql_X{Ht?qO}s;A7XqojIoz@9$w@}(c!54eD=VVZ}_=uE?-``=$KaN{Ao>8 zWtZ6b4TGeJ-4UoOSRR>f_f995lgU@wAhW+O;6KiAD{L0dc^yotR!O$ml6v)TA)}n0 z33z}6JWhcFqEQ+dAge^izJ%Y9L?B~fyE_6)_({7NF!CBivS!MhW%3eb&bi?EQsOBHFIIkkB*1UQ@uiK!w;+5WiDKt51a zcLys<-pwB!WvNml3uz~md6BB)jLNaF;mG%0X39djN??A5fu4joE^zukgK8C|-OL%; z6?|ugPW{81 zLeU}i=qjH^YbxtUm)1m-uaPu|$+7k{zKp63R=Qv4{_T^4#)o!5Yaz+PP&$zq~dAhx1yIJaXKpI24|(xA8aqjQPH8(tUZ{T*s*RVS+S55<{Xs3!eFhY%=3`f zt6ofaSI{N6@e>5u?R>&<*QRzI{X`v>uTcKGh)_#$-1=N9bFdyL%5P#eL55Xq?gXBta36?Yz3IP%T~?_D%5F*877U9kU6L8{Z#TOY zf;o2zsUe>B+!X(}0^5j=Mnuf1>v+#=fZyCJ!8zQ&1Ct#gT=++&|7UG7;VaD<6Qj%M zVa27_8nwG&6lZfNLUmCGn!)U{^w2Dv!ZApfytq12RuZ3I9PwOY zPxUM|;PI2M&#ctktNfoA;4&8O>L}zZ;6hj?Jse5>pG;V(pDdLIUo#u+>QEq9`2p7Y;50Ge(DjOb_k549VF|t;@3dSyXsg zz6dY7`kVBkF1A{lS?+V)OHOZ>PcAVS`JgMuuP*qKpM@NYw6j4CqfZHQnvtu~!BJ_JH z=#9j3-(d2-|JuAG(U4Jg>keGqn_6<5dlOIK0qY1*RcS)nLWFGg(f?+mwbS%&dC) zj1FgEcvhCjVg4LxDRZyyT*M_0S`!C^hua&q`5Zl_B>22dW0*O^E5rJg3e6vGov*tL zR05Ze>OA@sYOnKXlFRa6ws8oBTrnW*_=UWY0cKt~c>JLX~J+yYKqu$U0wi zb-*4t{UuS{5HHeHSEVX~e%bWiZHP4XR|r$V94)MzGXd?s0Fs9AhQv$MGVys7&^8pH z)J=JRdHLZt*~$o+tF|&3)tHYWT6)|0J;c7hDbg=ULtm0r?V!XVYt(FWwly9z3a!B8 zCt#V_NPwSQ3yBqCA$1=@H1b^ffnQHx_{`bX*@*-9sga9!;A)6pgmvo8o?373g~kK3 zzmFtKLql;~9KfaT@91C*S?4I|Z#y3gEeJN(gG+GkksFBbVY7gR6pZ5s+8u9!67x6(TQ41dX2myS6d3yS2 z4|aB#Egn~&3Th4M(~-qpBVp^VlUVOkUZhO8em0=`CYKvvRXO^x&B)&;l{aFg-1}O;mhk{C&`-KRiTEz@_9sKa6UIU}=`rRpcb`QylsYGJ zIG0XqSTju`LIo+$sM}=K;j)wP)dUga4U37lRiY5o)Uzity#k?>hC<`cw|;#A36B6! zP2cpt>K0v~>#cM!UOAiNBnijYJhTS|l#=W0yCROj(M?9+d}!%uk?LE?hU*2p9?JKn zoYcNlzvesQze6~FsENamX8WhfRq{-=sSf;EJ5s3GU^tFM@p26QJ+RQ|0KI21Tj%EEMflqMi24W7svIFlf5)Iy;F@_Kfu0zLH1OW0Po);O ztop4E_IAvWh$End7E)O&4k|`B>Mb-MvUx%9x-8tFFDW3qr(bKGs|@oM5yNIkw7e$L zlV<|m0kab@>Qeq4bryH%w8~*yWWx~M4E{hE80l60ali$>dlF(z-g~EZMI6uRb&`<< zIE%!68+4n7+g~9XJrQyPF9dV^ZcC5{!}b5?!E6EHusCcN;zA>aVXodwd;o;P2jjWRl8+IWOGEDocT0j`2W>i|m4!g!~U?pBbo z*nyUptzUs6MHc`m()tQ?b*m28%ec#ObyYP)m_X?Dg5gDKwYuWpW9d99wtc82b+&Bq zj^L%$(pw|hwe=Y{?-W6ubZ0wj><@|92h&0b21zB-ieCR#WGo7AZj(Ptc2Z4fIrvD} z7Usw^Y+v<@pCX_?J5d4(-(;v6M9qI8C)b0~*ZPuH1j4IN-5MT*OXk@c=Dz~Q_(ZQH zUl0kcS)mUSs-)vxChkuc48}~DbJdi18o|&AiGnA*Ah@5DjJu8|$)CNS$^7x@6K4~i zywgTRMVL+KZ-)pT+v|2|8$q5&CxCS3L^ZDpsx60fCVtT693b)G8#m3P>RDwNX%WQA z_Sc%B(C~|x2(!t61j0|-e*v!~;X`?+VU31k0C)k-xEA~}M0m$<^Wh<~CK{mZ4;%QA zFbgZ$?>0afx*ZVw+*XbYRPqfkkAa`|^CSV&(EhAJEpvKht{*c~VmfJ;a`ggc@>V?6 z;OcnEoxBOTWu!;9kHy{2;rh#Bn+=j08){Lc_B&201oY5nJD^?f5gMsF^_#zdSorGH zlt9pE<7Hwm#E|Po+xsabc1$(!B3?HUHH75&(_FNSMGmA6;OECpmTWSF{7(T<+Xw^m zzr|&lhD(h##|rR97vC{L!920)TAEnDc3fk%wI0M{9kLdjpc5(Nt+U(-I3HNn1j}I* zY*wBRY@IufEOXTs(DSKN0|p34$~K=Bfh)v<3E{>HP7NcuE!$s_+?KN}cY+BM4C1u_tS(?ND+LUY|z9a(-OBk-~~sHNR4DGuluWz(qfKM zr4~6Ve|`s∓xpqs1{W1yMXfljakT^stzVz4r-d~E62_r0|k}C4) z3lvyXL_!lqs$y7VtsoJ}d4gM^5HP|0r4b=J!!wo`pnrCb!*-S#ArT~_Dt?EOG5)!u zb!&&!5 zCL|Rh1rcW=_hy&qMg@-5=fkxnB$rb&{=Z{kDvOQQV?$-3-rCgQ>>msx^xgFA;gRQDYG1h@~vis`4;R-YSy_539<}6 zPmuO?0%z7vXyoqmycn){WV07{d4vNq#n|U@3H;MkzO4IqFn<(hz^=Rsp)gl#hLJ>2 z8Ia3VBuaShX4W<6K8%?cAv!jUVB8Qd6FVP7D@1^>2?pA1Bse%j?0-?0{-s>}ofLxh z4M?$wT<_0ybdwVG!Sh;fX#J}w8OEc&Mvsq>7iY@DpPf4TduU5k5fC`SG1dhv^HR(H zmzv~JjVCXEyNSp&hRku<;}F$hx%28(1E|sN3hSyTvrSh|Gagp4{QklzmkNlr#z98= z%HuJJ?f+$`DeiijCg^7UE6*_zQawY9D$>jSuM%i3yE|*+L*h_52Wlr0inWVyW`0e( zmcXm`r6S!!_;wh4rM&;^SAyX{F7Xj{1tyH2RFT3F{^8%xR89tvLXZ$5>f156R=y9t zgUQ#&@YDSNgRnP&hPsd6hBF2;C}SHG8hgpUMRwVXSqJtb$#lTwwFIUfx62H z@j2=}Q>;=BDN_1!_n{@=wsYjaMKJwyf}9BIi5s~Uql%Zqi&;4%`&B~k^umBZDDowI z*j^_2pe*#CZ15kG|GT3`9BHEWhF(hq^UiFl10chJN-c5nlaWYbzm3axd z=RV?C@FP^JdTX)W3099k1+UOco?%zOIhl#N{S63sih50vs$~hbUSg{ZPyhMz&WVFh z%P}vRXMd!#1i$bT^`@uIxP%_8`D_iGBA+P`o}?+Ni%)>aiRkzecS$PJb6 zKP@)jb-vx43Fxf&ISBuFI5&N5?hA-Ydab9c=agMuRI5x^LJKF|3IYWapGagMVhCXk zzQ`HliPWkPwk0_IAEGK9Tba^S0^dOY$53+Vv*3#BK#nP2^-!idW@L}F zx&pW-9BGVZJ6n7O#E?&5Xl$h9En(k)*#MkLHtysT{mJali{tI%AQ(!7BX9zo2F9RD zy~C;CmCE1w^A_t7G%tDY0Xd9d7P*znQYLE)2%S%vyHw0Ukq6vXU4##(;J=(>bVk;F z(EOOs%%KXe@sh_=3!wKAou5&J8n?DIu1NTF-o%nC&m6Fm z`N@LhwHxEH2PPG$$`Y6yt~0e*qqqKB`x1?IIf3F=Lw^1Uko)9DxJ*E}evK^~5L;>< zL=gr{sdS2JIOeR$llVEYnQv3`L-itWtgDE{gCMgq;!b!QT})L*WLp6Z9PLmenX4BR zjQlXJ`&@EwQ{kw7EhVk{srg4G`a6H+OU53mvM;}lgZJnLqv0npD)@VQvSS`iyFRK| zF#a@euz6qTM#3JfV@$A(B8UE85pOGK+syds9tmqcE@c(7GS_+lTm_TiyuiK9Y*rp2 zAl*8ec=U>O_0_F)PaT%%Sy*ErJFxQQlH|gkk2#{5%GcM6jO1&kBU9{7I>IMYM;RCd ziJX69W)jD9Ji=KDLn=1hfc30T?7JZID|}JEehl*Z&%tSeRjuf!d)Nbw zqU@>$O$^+SF$?ZUJD&B|FCfhzhA>~%J0<%^EYv()=||2HgKK+lTlYfY>j&=M>8(c^ zYQIx!);*dE73D@GlZQ<*gU{ZjUm}qEgfhv!l@}-m>eS1XkM^`zU9}q%5jj$oUs!vS8Jj7 z6s8|C5 zuNf;xm^qJFn*3%ju*6 z-6%;FtfM$8XnS);i}YGx=hcM#VVZY2V4R_pTPb1ZS-4$5OIJn5DxA%cZ&_vpW6-?H zZF1n=*xPnIGI&iJVA8xfk%*1^aXw}{mTrUmV874Bx;pPFZ|OO`qH@kk-U?p>sWqc; zW4Oq}hfDVDTx5QnK`?2+mRpH$_iu&?2B#dBfpc*M6Cs41 zdH()YjE=`9Ovn^?Pq4TF)ASRl-bJ4Tlnl2d@Wu9-M)L673ag+hgR}m?tiZ~maJUcR z+Y5UW;%YEETUHnBKh0}l$})-+icUeA<$lk`9l)a^x0#nyeC@|izVV@PCHd)w5F zfLiJQpqVCB(bkW)Lx0N)#&maK3)@5>?wMn2;=NS>d6Fq8sV9mzsN|sg>^Wudik(7I ziLst<0jg6$1VxN0c!;}k18Pp;_)@K2^#o#K#GVY#92IpZjQeMnNDBUVUbM!x&4pL~ zL4j_uH>CAbCiMuin101W+1j_w>2|IoQ)EW)_e$}x%V7nOO+WbJG17CV=3}Yn9?gqo zYeq4ZXU`eO2n_-;YznOQNt>|ya^hMNUMQg|T5??NSio7q^m=5+dX^36Xdq@NIy=wQ z<9?p;-4))yFSw->eW?6>r}4vULVthPJ%&p6FnFWWgu2KZl8>Wsv|k|}fj2FISvNe! zP9dOlvF83w$x%BN?$bxF47rk4m@S8DH-%kc!|6o^D{FP)`cJx$I z=g>%(OG#bBOI4nG;qpD_JK=@StI-+1OfcssS&mtjx>~Sy?c-K556{Dd9vuMGGza&k zU2%G>HL0hvaNz!}hh)4ZSKad$1208>(F_#Xg@V0~fIq!>!y&c~jJxC)N(OQF(4&J? zba-^s4OlQoCf+&!`tlwBPuHHk?D|d|-FxXv$&*_-YjfY{BI6A?F-bhfB8u2<99h2~ zB70@Xs>~Qo<8k!H6+tdlJ|S3*ZW2f$(z)}Ai=Ki=yUs{n?~B`4n4q@GgUdVLb%;W> z_J;P7lmEYW!$$GW*QQ(uj~U%&9TK-a%fpUOaxhiE`y1b1wRy(sWOuZaF=*lgPvEnV z_0@f9AKykxk}O3Wn_{)8Xj#;HW9@1chK9*pX#tX@%!jr19V$0WplQ8~#CZ4#)(R$B z(or+${Y|O5gpb(lH7S9Q?OlrrYE_u^C>JSzW23qY$%M~IYCjm~U4%X}56Zdp8r&7J zU@|k0rXV2^`pts7WAjfFC(#P65AoKxQOK&Wb;!}Re~(L`C2rPTqbMitZ4 z*p;C|s{k#|1*l*BxwyS}+~s^4S`9vL@%@@f6RjMm?8P_kjSkjdxw{gnS3^C-H$mnbIttM4d5E< zH$*4+<~f5@)av;d#=(1AAS8nFiS6>y%iX#jf6Qbdg08fdSnrlXX-FxwG5PY>&hL6U zgzA*TdS`j?sc3u6;3N-8RI95lp%uH6KdY;rMjR=3>&d%Q1!89Xu2qjsz=d^zoU4?p zVNd}jYH`_QC`|&;&n}l=%u=(>=5`+yEq`6T=Qw?ID+kdes^PiV$bqhcAkqMIH^vfr zjIm#=9dDC;U|tm4cTO=5+`-!cY6?Y{mG4WCE;Z4tc0F#fuyz$@2gm9Lz>uL0u?%qL ziTjpeS#+DXit@O#+W?riyciIZbN*1X?}z6xC@Rq`gHI{rQuGM5koc#uXUy<7(Ygd9 z^w!svn4v_{Kn#=P&aDW^C*X_@eyQ@V)3_)yA!_rs3cpelLg@u~%XD$|CezRbWtcok zfqm0?vJ&{{JiGk&Rt%U_st!{VjVV9A2w3C$`QxycTCLkHCEYWjNIeNZA}E%@a}q?| z-MTi)h>)IgILeylZX9|<9UkjKW}A{8VFM{kEO^QT0Y~X(j$~_16gZJr_8HQLH87R( z2d32x=n}+d0MY;O3el^wh@LakdYBriD^oiQHSx7+_2doU?z0#)aH?E4r)3omBRt6W z4503%>lN?raTT2qDhJ|mfxAn8$%PY_zP)*U=lIv-#7DAO-<_$-1kYlwq=?&y9XVT& z3?*lpEy7C$b>IPi6~`9bidFPahpL%ljOS_Q#ZG~XPo@cx>Niv{J<*crw>Xyr_o2s9 z0zv+d?zJTte%^sU)COlkWMk>)+U;pyPrxuqRfFTpCqi9Pt3o~2LEU++3jZucu(xj; zc|T3}pKitO?`3z)d%IxN0Z~Y1#fO7y+#3E|5&`TRt5WqAEMQrfb2oo2PKJ z?i)IP+d+s)dYZ`1(KF-1-$C1JBLV4nYm6=-7YRskbCkj8#Bre1Eq3h;r7!GWie)py z$PYIn#eJ+in?^GT;NEMp5ml=JX6~tU$-=msx*KGuNzjK%Fkg`A1qx;wc(c%kK{am) zeA&2)?1x~Cbr&p$%&Id%!uYx3hfw(gNFk$>J<1ee^n@T}$+&DG&`HnM9K_!y<1<`% zgu{J@09Dmrl6)uU+D|~}jTu2u$)T>iSv?bjqdd;yIsk_9R6{YvhJ00RHQqC@Jljm| z`r?@0iWB`@O{rmqk_FWZOz6+FWqRIkfV_7wdh)3>yu;Lw?IYH_d_U3{EqerGUpwFi z0=tvLMWXCF+Y%Nu#qy<(!)P3c9ua#vc+X9SGynskQ_3|2O4k?Wh1SX|O^fhH z=+K|RRwIknyv+3ruU0g^XY-ZYz?pWmc$xQ)jsy@Ux!i+hfHq?VZnA6!Bi-Xc;G>^m zJTkQc4M;1n*&ln7x2Y}!_mROS1uIzlNqX=K&|XlIuNGvK0K2Kh-^MkL+}JY=)V$~Z z&$r+DuKx1^s9oBGSIX%!w?JVc4C2f=`@Ex%koaeV4+SJRPllmDqZUnu`k${*}b0l zRyTpysAxN*4Xq7VA3u0+ji2~1n9Hk($T4?oK8Pkdlt=d(UD*5WQ^QH50W;#Qe9GN} zf@aPn%catE{p;u-VZ%111Rfo!txHhjMB?&3lQaP=KhJJlPE`s{Im<4{7Nf@c6Bn*g zW1eSrI6V)?InX}d@PYj?|9p>H#5!ARyxzT6%Ho6o0p`eB7u6({%0x#pPG zEyP@2lzRB*_u9KBpf!Sg#!RwvRd+^b_&C-NhJ9I4XV*+Sawgv+>>g%`d2r-E5KSC8 zI_N>UuSY_Xa`>5B&W-K=Rvu(JL#tp<7gzlwZFr-WSrT2^L>^{kHg5tmzJeha$pqB# z{i&^#&GU}*6t9Z`_S1*E+>!hHd`*3RF7smWI=;?IRhqXCwBZQmFsdng<6x?}w7sIQv%@KyC(7rF#Wk1+tKkTd{mYn5*^_5CV|35 zVnX@mb_ROxJtFGwDtV$$peoB<enbq@fh z^aU6k`F{r?jbaKpDlv96FGZ zGBEFZbBp}GSFW38D7N;PvNU(%uwJ=KUxCpwlmnJV8A^wtpSf1&;Q{D+4%-lP33}nQ ztfYcFqLycr2lsc?+fr)dA^}sg)Eb`u6#dT7_0NO=05NY~2iF2mK(O%^D_xuFkkAZs z!+nV*p^y$fe)60ETpWoF@osWwbmuNRvubB|nnk zj+kZko&72xWR#AJG^L|b%6@tgcdY*T4A_XgcGWJQP1$FEevpRbHrOnhxN?Hd^r%wr zx?xt@@_ef06MfcPKqG2BegnYZR*(&R+kJ|r$AYJ)9GxfWUrF0-=_>mi(&ekKDC5^*-2V=<|)r2iJe!%k7I_OqY2F? zy^D>8bnwLYh@X;rcDITSt7!zcDnZ(TmPuC&74^X=f@$z6@0H%eo)~sh5y673s(tmN zB2}~YB{bYF(>>4G%%Z?%NFV%m8dfh;8q3hJi6ui8dtUYp=ruXMmPEdYvi+FLaG0Lg zT}=9tZ}Bo4^k0drmd8tsZ8K1+(Ar@6H7YZ$A4`0FYtGfk-^wJHXNId<_oB?O?y04OV`n z*@NC=EyGsNf$olI+Ak?hk8s2EBN-yxWNCsC$w1!rA%U5&gy)afLo+=(-<6%WCj zE$|^ZnXSv{2f^$KID>UwYd}zvF`!^G4K|lT`FaA3oIYb*z}UpC0-P*0Xai=I>;pSg z)bpdHRGC_i!Luv4cz)Ioxnnrn%FcI`yAc^92(LsU&Qbm`S&k!vsr_Hyn!pIJM9MnG za5qp}=m(3RDq&H*l2L<}$EMUU+|=R=G2oBK%#ML<8ZG|G4iJijt&OFNyc9#il}toH zWG+m6c(e!#ay@WHBuS(z`JF_jN6=9w!r-F?vN8VZw{&C@;{Ik*@C!g@plYi}x5EI8 z@E1$X2rxqQgF>7%;1rVrq5esQoKpw;WMARKnp5tf)O$&v8aBfK2xE5o%^&ag_jOf$ zT{MDsWR31G2tX3t-#LU2@+B9Q18Lop=F*BAc28M6HwCTxXTFB%f4{4t*QEqPxT&KP zO_1+s5*HfI6C%P_<0IAnVX4W&fDEJmB#_9qLT4uoQFgDeA=IVal!#YC&ndSLTGL~o z@k@qa+zMJm5e2U?j{=x!sy#_?&d{KT0e#VJas7slHM^#~kr_KYK*HAp4?y)TY}6srl+Nj|Q>pz?N= zmtxy}mAd>81_VESwzc?ILvf+5rzP$qSa+5p-^cBs@)0AHI=bJ8dYG&y$GfMi6h6`E zx!3ddF0Nba3!f@|uP7r++T!E!A)qw51I6j&HO%GVVSI+`Hz%dux}{m*Bk_ZRG#Rc^ zZa!7Y zw}n=4;8;HI!R^4q<+n4qPVIcRc(p7hIC!QH>DzaLpc;xBT^E=}n$3q3ek2kxszZ`n zHZ<0W!03sydQ3-Zu?I5OCxE~z09kt6&L5Gh9mCFJS>}ERC{!%~5j}X6e)h#V0oX;9 z3^t%TMOxlfvq0ca76A1j^sZw-4UAr!Jqc3M7jZ~{zII>6$I)sLBD5N+SP18?$g!y? zt;5uE4h2Bu$KON9jPYRLa>A)pAcmgDiByz=p^uz68t(ho3xJegy{v%oZREMbILqoU3^Eak$~;)oh9olcYd{rY)q z@j#YVG*xzl@#Ut?o@wL17n3X)pA+cltMFJ^HE65+>QuMh z=2w_I+=WT6&i&JM*>J1vxT)wgc5ksHA9RKtCQ^L6Mq4|%ZOm7M)8YpmT6g=Ga?eqzd*>rQALmCEW5P-fS!#o3-{RBTz<}MX zD9L9Leg|)V2g@wzTwxk?ZVZkcn}YOHLWmiEytQK5t!qvXbZc-Dq<&C^V5)kw?I&(# zsxAU^=ma#E#|6Wize3?dCs+f+Z%dLFQm8f|ZST&-Z^P*}sCbDCzlEXVn*$7sGhmpm zcJ=;@cCA~9s`}lByDjS{Z)oCDfNo(RY6V ziuzfL#Rm(t|&_>ssf60Uw%$!_aH0?!9m#KSlYK6`*6~zAn{Yk0LF4{1n#|T z5~O=wsF}w>c$);ijI>o5wS1x-t_SmlOn+yQ<@7zcTMw151T)#;gob(1O%wd_S;!+` zc_H;&3xW(RYIv$4P7KESdiFqmdIFW$u_&rycWqZVTT`zO^1k%$Qa;LOq4nTyASvgg zBoCIK6TvE8HoprFT{O!#H&w6;(SQ>AlY|R^&Y7-IUM544{7G1sYm|~km3K*&j|0? z3+xQqp-mhk(TT+)er}gE@$>#?s{OA)dmWt)UQ&>ohv->jNCWi4bovIhZn)SSBRJTs za)P`e$xtgBJ+-><7sE0}%`g+~?Fd+Yf!*)2XC2~_U3N7T z2Xa=AucxN|J%t1+EdRNK3RH~ERr*lPaUPcD|2yd-goq&T>aHpZzcXJ6M%M|E*QBTh z)`Fmb@j{whka>@%O#*B5QI?g}b=YZ~ZSqJ%ec`Uy`Mf^HIY2hR%z}niR=;!kz$u8^5>ICp)kWwIHrfggj;ir02W=hNJ(B z{2}#`q;k~lD?dVwz78b`3EK(&W-ZVZiUZ=33_K=mL07uMDHFMVpqGrLUCc<3y3mGE zs;=0p1ez-WB!NI_u0K@eC))-UB-%0rlKW{n_rVDx!TwHXP~@HK1Nr$mBn*tt!JX|@ zHYBM5I!|*o;AhYCv+XeYK7yE9`D>Sv|B3| z9zZJm!~`WBa=X<^5X{*@@^_;~56nn0O;^Fmw0Gez=jkX3Z^vq+xJh_WZmfG$d zk!7!J8|!>vS?z8|e{+GSYN){CrFL`l{Nin@LW!6)v5GM!#K-|nXE(focQ72Fre`O> z%(&YBz}$yNp@DkPgXE8EW{fu7_AUUu!^K62v(o{4V!k7EXjb$Z%x0PwjT&ldf#sGn zx&$rhRQXl#hFJt>rgkti$r_&=s;*?_QZf;WnKkt-Dme8lHugcaW|NTycRXMsa04jK zoFEPWVjAC#9{Hvdn=M}MF|09r)EYKUdwn)MI=KLF0N+<8hqy9IU+{324AXpL=+lz z@t};`S2M6fc`Y+QRSg)Ouwd!vy-{%3Fra$rUONlsKOzVb-G93goi`v+>kk}jmwBMH zKU!&sg260vBGBAE=$ZKj$v-@LC4)A2)&-gKzxAk#W-a>$^ple?-VM}4KV=zwgAMoX z)GMEtm&9YUk0D@F&vfU1zzEt(*|Uk>Izb5O=0Un+$1OSyfW8tD77KqqTs>1ZJ6=>% zFpL;qU$lA|K(9#wg#4!$IWbN=Y7)_!$hz&!fP*U6`z`3BC6@ueAuZOX;vEJc`Pr~# zj%0C6Q)|648XP@|2|obfROL4{H9FJKVvxeLWU7ZQv(Q-;$9K0ANWmtx#Eq3(^%6{x zvJn1@1>3fE%Duz~YD$|e39D3+;>gmG5HjAIfNY=*_3g+OuXQU zst@P;*(5ascRtE8jE{>xupcl)V6p&?bK+c?yQs(Ikqd~`yNJ!(!AVO#qgP9&*5Jen zdGpm+YV2;>WJ-Y%V$`Oq`A!0&VA4GfFP`?yiqGUHt%UN_vs4WGTchr z{X<^BW)grD(CvcTD0S&GQtlA5DABa(B%{z3^9C-iT^Y(Jfp??aSPdyxJT~ySNs6Mj;@~K-FK189;Bzhv-xi$BC1N_Orei5)w5J^?oSK9A!xwE2K> z--}FP^VaeE%pt@-349NHl;@fFq02z;+N&ts4fs;%hnp{;^x?kAG-zLTocJM}M_gVS znLho>j->LIm=U)7@zetx0$DyaemYcsTfp$gzbZdU9Z;YK;yw|o-KY|#g`B0*Pa!qE zt7f4FJgW`SGzO_XFD&~kxLn;MUkHJ&##Q+*{FWgrE`uw-I(c%XDb&H0F)W})A_T)w zCgFPD4+ix>eF0s|*-3o|*VkA{QTn7X?LAxIa(|51CW)HcXW=AuL<%l-IZQoO(XI}y zj7T96c)ibItL|?4JboEkI%jhwsVXSEzbeI5ROpxAP4iEoBdW^~kA6^VS^IHdU9ob!~& z0lHfq|EB3o(MX6{Q8M4ZTf@x@Ahi$n&&JP#X_5{Rum$#v5awH&UDiHp3kbMQKR+F~ zQuWB%jd4$0aZ^%0Gml4b3P&n2jEyT&-%i^j`i1Q9w`R9_lY!@F#aCkJuBb|QiyQF& z`u@%az+&cP`YgLhbIDd`;}Q5Oe!?~3^9Vmd{gMYMMbe2^GJ`aLR7w?D^oODcz+pOn z==yMNOE(9~9uqZ;b%sE43EhR8(wL7qcFJQ~aQ|-wq2aoVjj8#4h~|^oGivIpkH~rk%`Gqj>KEMRP2% zFUGexT)Zi6UWty80%^Tag>UASHi6>hocdjSrU<5vht>e-N-usZ`j>h5Yta6u!<;as zu>($^axa};ab~x*?Nn^NH>lv++>v9llROj zP~w)f536}R15E(h5?AZWQ0Zge-B)EBl|shb+w$R>8@xN!TPpK6~pH- z))C~_7!7CfO5pUpc4ry%|A-ZjN%9!>v=?F0y$1bwQf_C+3SY>KLGX9VzjT>gZNlK6 zpSn%&U|fu!X+qWWngsMQ)ibQgR=()3>yM#zPf+!Vu>gv)ZLt%~#IM>NhWXG`_<2jh z-A3XUVoi8IKFgBW9!?`MfaqnAalTqZ@F-NBQ$lFEA`_D3yx0Bea0#XOwBkZ8hKy^& z6n(QBeX;cp$ZOkD{p1~(p9`qoU$op&5C_5GRiHXwdE>t5ejc9W^B|H~gm)L6wxnJK zD)Ez>HS$9cf?*7bx_Q}}Gyv_W^NlZ8G8(gwA_ZOAtKzL}vfN#nG`4>Q9W_$WjVcte z{ObqG3JXIV_9acV!`ii?!#bBG@kLTVz*bv_Q5H{ol2p&0^9qE3bBZ`b4x`nhS z@8_Vk@c88*Zx_I~gqi@vm^Y(T$tmB!CT5Bw zg=8syY&hJLNleKoMhlf|M0h;wn73rNt^2>djQEd#E=m_ricA0g%Wnp~^{FuSQM-;G zr66y#=!EpVH$tcH*tMw%PZ4w(v|4we=$!6nw!Sn6(?N?O+mQV8m1mk`flZGSxg379 z05F3ol+nPbC@pCrhr`l7L1?5W$MiV#kWZs8ACPg*9KWsU5&gjPo}63WBw~(e%uwbp zIZxLiG4v!s%?U>~SCu}r#JzK9TQv#Xfn&~_q+we3k8@f!tPu}5J{}Z1Tadm53~%A? zaN9mP@mf)zT(yVXl`6JtH$6n|ZRB_?-j><7D^l1&33RU`sOoQNd+aX1v4#gXb)gLu zD-Fc5+A+)AlTXrRRw+K+e<3NE>kIRswtwA-c4+x)pjG%VDMLf|j%w(J*UwJT9~X3F zNS4yWQP|_IzLysDy^o&_UYKHTJ23;??k>o~VThKAizJ`m-LelWKB(CCfB1bl(4Ak)8m^YMeY#kPTc zp`olDkHZHpJ|*`)ZFbnLEp+$7tA5(#?I^mFvr4cbCgP_+OCc_xpKL-qZ%+5|MM@eQ zefcWbt?5+1Le?2Tf@Hn@>opgHpmebzt^@y48v?O1utV(M)7kgKdJm-hT%IruNoBQk zv?nohyW8QY#jVOsI*(0@AdIhD{D%9l1G(+2iBIbJCip%I;*KT^#P_dXz+4R_Smc2& zgOO(B_a7`o>0#4^wJhCaknCu~bpA=RZfNVN0RSFEpz-P> z(7L-xC2(yT*1awt*Ur5*dE?J7YL)-8lRTdVd~Nglc_u#e#@6A-O@>}|-)NxqjhatK zGo`5I_(*x4=tzXhpyA%0cQp1$m7vzkxN{c7(Yc^D>icF21TeAloRbAS_zU))f>q5B zlRsB*#*&elf_+%Q`f>@h#wL(!vIl-5n_9ep>3D4PWW!O?AVR}wuEh!3o@HUjBkTN5 z#X+y`$)Q9n;=XUwepfUJYB*D4Lj@01u?B=ISx&$5y(3}Lo$|*kkll0$alYa)rfGg& zgSvJRXzX`?9HZ1FaHHjW<7iI**hNG-&?6spVoSx@qsYC)kKwwkOUm;nqaSdQ9UI-O zNtTgrJa5A7o;AU3RXX$q5VR-TE@*`2`1Rs#9~I$44t=fA%L}A_t^lim2Yy_d3O+Nb zordaaTTsbPaN>WE$dTbBOE%4nf0GMZ9H7Wl+`P|s7;N!@m@xk|6biJ<2@ERhYIX>A zE1_^RWuG}0J;jl#{CjLn#9WF(*`|&u+jQdx$4(2ulpin7;J^0kg~mxM#IinF?EL#$_cuEW*MHv_&>aTC7w22%{T;{=CmdY_ViK=?i3p>FOf4 zpJ1P6HgSEdh4BKzkD|^8iqAdRo9Fk_JApponNhz+k!7Wi+e+RoJ*)hgCRui>vRgcP zHtAu}voL%g(!j;{s#;F^D`#q#%!y9%mbctqL8GJsTjB47$X-m zWvZxoqn|vy4{C|tuonozR;(?N84_Z1;;zWYC|~c`1<9~CP5#RhJj_ByGS5g{=aJ0v zlaub0aIveKD6t+3Wb%#s_clh<(?Uq zTQvMQAr$9yGgjo~j#x$a9BN^TPvi$oAK>nPltat(wTx+fr4TuPG& zLnqz|{{F{XyXjr(%+0f+BEd3Fg4^#Eny#=Pxz`#Lc9RcQ!La%bP=~m|^f#RlqYT*c zRQlXNS=X0h>X6cuuaHk#BK96gFPHa-6PJA2z-tnd%XlzaMRF+C%!5vB{?{gG78TaK z<9v%-mO%`Q6Z!D}nesCN$8xoH@<&D2E&_sj;=@`+ddsF{9| zg6!o$87pd&Z|Rv5?}evW=G!(k@K^n?cQJ8DB?9-m9Pwii)Kz|Of5Iq|Se&=tiO#+F zv|vN|ubvNrl!MQJEpQ3lW-Do1vu8!dapYbXz~?6rrtSbc2j!{!>rHsgdG4^Ely=gh zUMRT8=^Urx)r6UJ3m+IX9(#$5(reM{%D9fui~R8&=uewBI$PG)K=d;8nsroD`Yrm1 zL70Qp;G^R=WhMxi9IJ|w2!~oB!R~5TXs6#yctbGv=NMIvWOJ=2oh3d)EG4gw484u` zD+p5uV?ag>$KWcg;F)k#Q3~Uz?`K!+RU6y{(f}3K9cH%UM4I~S8;9ywk$u}e2NkbG z`b+l0jJgs&f{>Y4M3Pzuf=75~ckC3>pjT*k8OM3a2Inn1Q8)y=&=Tj5Syx-XDq^y_ zqQ0?KgBFLUs2U`}p;;gTJHDAc;V=*pZpWt++pWN*$l3g{Q>S7{J*~KW?~;7#npDJQ z-Si7f^Jp%%g{r|}5Z~+;fgl}4z|Ypr8FLVrA#FWqB|twxjn&MbcMe@I@)~c;ZCQm% zvu|lR$gW-A^?=3O>wXur#H(dKS~Y8ahtS%iC>mDS-z3c$dX&#VLqp!x`fYZ~z9Ih_ zKAX4K0g?W)oOSaW7w-85#8lQlk%g%43mM#ry!%JU^m4!s*(DSa%2I)W2ETS#l zlh37C=l3D`o%z{kWw-Gv?;|a>s=t#>M+FuB7JNEyLWv03J`WT?_gO`*iv|S>L#qifgqz65T*=w3ZhmN+{K+#*& z^f+PA0hkXYU&<%?cTO@?4aZjVRnUwks`*1AHvS(PjN?&MT91y=@>@bfE%3EJH^*%h zdi*$-^&n2_h69d$^etp~Y4xw)n^6igdtkd(X&{tUZxpGh%H&wN|1oJUBe_*JgU>~M zXWU_kLD-@9$+oh3H9R$X@-$Qox&%vRTg9{&2UU+4qx2y#Z5>Cz`kFsKyZ!FwW3iei zf*rP;Oii3Hah#Umi>dB)jKT+04tzSh}L8P@&(SB5}P zY87O-*AtVv2j-vJO=$l3L||4t9do$wM3=ye+TxDHu<<3SX)u%jcx$L~<73fM;d`3@ zOCzNn-2p&!c~LWb7vI-^g(9#6re#HZ+K}2GXt?$lsUrdC@R|HnpbOSxkJ8lNWMHFp z-@7;HU#T&LJdSG_0xmm){rJ6@`3w4T#Fl(}Gi2nxJDCLH$~gDoBbq2iW@w=sT2h12 zOn3MEdC0u_vB;J`{t~>VE}8Bs#+?U}h(jI-cQ?=;$6)_r3RJdw;0uth0T`m8Q&+|V z?Z{{hAmquQJ4q*5-o!KfLw2qq$j-5@MA@A$)Ca$9Hs zB0wwbHs^=iA!S<=oLM*f<)scdsliYJ$C~kPcK?5#6y(wPeaLreKpu^xl;950PHKl} z$H)keMzfqf4b5~9c{Kkm6nXH+A4VPxOGg!U=g}}R{(UsPFn@N0SCUcp6&XE&!?pm7 z3(pvrJq<%>ax2q)r#xJO=aY6@`je3mAr3D~Sg`Iyh;E^pl*74yVl3(>5I*xUcLV6H zwS%FxRyOUuiRKlmnG5*~74r*I{8km3O0uiaB`g67@$fH!=5Lf414BHoUS%PSiyb8H zy}}J(S2Bi3`yt1)!G3|qeSm3*A(a4BO8_}&Mhop081efNa@y^mE$4Qglp`}j4l?AH zdCnmTBs;B`7_2Tq09*9HptZS8KS50s3Hyv<+JYfrf^dhzf|Nu!v5vF=8%k42U)eo( zn&^I=&Nnw@AV1gJ8YBHf3_OCe}^fu(ZGpY88|T45yf1Ulls6L%OY zPB;AgCliQQTSPd38xMJ0cB|*x82*9wWCTf|-p83^Jb_G+d9`k7ZoN_gD_B49E**n) z#)vFPCtc+$8nJ!bf<7Br(uSzgvff8bN=3oll)}nfIgY{_5fZ+(0-gQ@(k5ky%xiFq z585HEMr|lfJ2cq*aL0^2vWkxk0k_lRka|e9sJ3!_?^}?f=|0 zS>&$m?@D;RgHE&vqBW`wkkKtwQg}lDDPv^;$PTyp^%^|E0a}N(hcFBfATRWXP7QvU zF~G~c1DHV@ka`N^ClMZs>ehUy0fQb<&;q%S$ufg4x_52uyWqx%dJm^eb>i0FZ zyzYb*0ziN@bALGKj@_i^NTjAxGDOTny+C=Q2V{zDV5cRj-uNxE0QdpJ;d8HYBI*ZN z1UoOmS&!0zFy9a$D6$*YdYR^@`7XM(p8WF*A#eFwc!-2*ty)uem3nBNg692Vu|nO% zaBnoe{$Dur!@?u3>WUTE)nG>aeZ;`37z3m|CK99hX1<8c7{pt6%lTvwqiG!jloKJA z2|0RpDb6WJr6fF>kxhkchJoe+5_pJRVFJ4X>~rAfF_tfC zv0A=4Sm8}ISA_rowdrQ^5Ps#8+5f435|M#T>q?dRx!tnJh|t}h47TR&z|Y5r&7ouZbe4kfpgcuVJPgh9UP6i2Hk(**$fHKdCiS=yChFvR6>;jM4T&T zIkZl=w-J?JbiO-u3!0WQ`fO%}ee z0mkvwc|=%Esg#Nu^bQOlZX|BqupfVQ& zf;du2AznD+z!^#c6DKp6T?+uSCy|7hqJ9iAe~w}hR%cq=P9g5&S0vFvJ7D@X#$c3 zX;}`DEe3$}+X`1p3LT29s>8lCJq=wfh%FApt?i$Ldwv; z1Mcc0H#6Am&JT#@*G~KUF0bBK`p)@$y$>nf`Tho2I$HMbnEv$n&Q!Rq*>{1|kg<&D@Y+=C{Wmuetf^*#Q_K0=xT=;lmJwW0@M~e7EX0C0q z(F9KbcTjVGChlK{K((Jnkz#q~%c+8@MSY>$fv|v#f&(^&s_}d(Bxip^I(uUuuR4^)dwhz z%h}sUn&n@rxDQ zPG%q7X^!|&;LhU3n;drm;26@tD+Bg_Y~NNR_}%daNknz$u9ouRTHBKW_d(e82(c>3 z4kGb5VDw&SjYxEt8m=5!UY>DDVwl?QHlsi|)1ZcH0E{%I&U`9o2r~r#R_fY)4N~R% z?4V@un`yrkdmQT?2hz%VpK})wZ-ALTqH+9t1tto1(_BQD)G7%JZy;q#iX>q_>j@ z(?lwbq~|6q(V7|@_)mi{${A&(gy9LPV9E(PuyitI0V)-<*^3&`y%>t6yXg zkAzeN)lnSd@#N_XkRCE=AIJsmd~RIY5XJzXzRlsjvFh?KusRnwm9*ul^2#oPiV~i4t-* zeqY}nI{NdMu}H5ZomhwLtAoR(uLa+O2njuFap+}r!{hBkW;yZNjrON8Uf-w}L_Q(5 z!EZdM`*;c(c|V(s24U=NV1mXKaDU4nV1J&ml>f3bhm5mHOYt#0?VZD?v|n15I7T6c zc#iLlnIco6b!FspK(6|^<(4ad<}hVyu}z!>yGj;JtVEQY2U(4ZT9UT(P=p`W zy`FJ^SG4LaI9$3N`-trdnY1_r+$|c!g(boobn?|2LrvTHcp>co=FP)ZKSC(cI=K3}`-KZdw}R>s^#CGH zfPsHr5p$h&q~vXO%#i!=ouRIo-{Fk3n~iI4s0;ILqvY5`$lb62Yo!y7H2rRQSVwS+By6PuW^Mq z6)vPj)NJ~`Uml?Zsxr<2;N}Ijr(&Ib^4{$?2z}xpwT7hw%iw;dEf~`2%Ah{Jnzp_c zTy{2w$_`g>k17j>EU!YIz6kYTb(Jk8th#mD!4HM-vX9U3l7uUunHkEGGfqkn)H zIK|FQ7i&vA82mO&vQl|vDv4Z?X}o6>#N)5NJAN8r<|cyK?9+7e3vO$#OZ+%d=v*HQ zG+*60nYo~ak4w+HX0+-LK0`Cc@#Fs{^RJLPtUZk9-w7_-J;C?^2YV)ltVA$VLiccF z@nEEFOULw*XDObNH<94v>-a8;``R}#YjJqKSuL@O2GH-o8_3O$1TuZ`+o@g4rr?X@PBl1?ThSnZIVQh>{TdPAu_U4WD+rAx6gY#Ud+NejrM5KXR7hZhGCbVN+Yue#~b1-fk#Wr%;1 zvy%tBV!h~2))BOl-L+iJieD1Ug8;TvkLAuTmtSMaD@}!_S5Kn)0f+(T^KUT$7p*vb z8}bbsNyl|1k8ob2LeAB8)+>f#XF;u}YwZlJ@_2GF-2p%?^W>-XQC*h)FRlsKrG)7{CF{aG6R zPTjKp*KVNg?9a@zuQuV)F%nq@f@x)V)lztLFja8uIR(qmb6K+E@WNj{BUCCT)$tE@Z z^SNMY5SHNSop{&`g89ektoK;seH*9QrHTi3?zI$jRG~_?^->UVB~XU_q@LPxu|F(S zJ>+IML!BT>81_Y^u037w`xey)aY_#aBqNIBkN2RaQgH{_5KB+E@02zI!(txmmI!mb z*c)@F9?K;Nlnd4dPRYvTa!c2w&I03yy`T+iOuyBE3x~27}}nm)1y4i^qGjWX<}q?3$AaX4^xfWtkIhJ}LCfR7pt_9eX>n}1& z2MDwxArFmKsMWCxU+r0W5~53M+7dr%Sy{Js*qqfO`Vz+|LBrP zQ@zl|dAIZ6B~aO`d4vTeO@&hl7Ve~#AZ)A)aj2HKwUSW3TR8|! zzCfAW&pSBN$n$F51Kh?8h`#iysu*HGD*&@3S2|_I$Jw?AD%5k{m6NAW-bDb>yW$(C zxT5BeE+Q!8f=XMGXS8eI8e|wTNRI-YJ-vKR71`P1OENI2c=%&s_8E?+D)8%e=wIa| z@hiPujejIYHpx)Ja^AUdO^GBo9pU18UJmNh(SPS$z9Br@2~41s)Ptr;W=>5pkKhfW zwMa^oSse+g*@Qq|c<&TO$ztesJSF-u!TiA9dbB6pexhBSua2r9M zvb&geto!syk){X%8x7$Vq^>EA&v}N4zsjnb3cIDDxTP9JF_;6Pl5v63pEr=2dXhSp z*u*Uts|l^r5h#!RyS`BS(c-zi{IRaw7$M;G!M{%M- zHV^Z*7PJn>)fgG;1OxS~FIzvhJP@HSG#RqF-sv7sgcu*9C=U`U6}-R3XGqf?U#j2S zFLW7~E=(Kv5m`!=f$^oQU;wfRwV0JTN}GB=_4^OlrzPEe=#|7I?#IepGJt%=#h0V^#< zonWyj;Y+|G=cOwj3~+D{HQ4j9>Td@Ava8Gf>9uBVwleTqnPLm2Mo|)s{@;$sPG}Y+ zK%PL;+3mAuk{iU`Ao*3-4)|c0cWwTI z(l_*f$=V1$rGFm%}ipaev;3Rd($d# zx__-}oB;Mwn#p~qFF+`uuk7%K6nr6wY}77%_PSAnTOV{S;E*=~4V;sW=NKj1Hee1J z*I1?R9Ed!1c_md=mb#ch`K;gE1ntJ2R}OVxOXxB*`Pk@ws`0`%P$Dxzx<8On!XwGu z0(Ss`!LMgfYd3!)#vE{uLv1w~2q+Uu6pxO{pOzA=BGYM&GdI`{t$pW2V zMlLWGGuYTjH1LFxuDoV#r+tWcF2l5)qTz=WY}>!o5uNcj;QSeRY5fhmzt>jSLk!{l z{FSi~IH}^I<|*dN(uM}(QgAnJfD@|kM~Hm@lyG8HdkUG;5`k&kj-PFBbaySP`tkgC zKwRrLTFwF1#~JmYt_t7|5<+#uOqSf-sC zR2jM+{&vEEjW(0bOlbH{N&0GW*acpAyrkhRZ0`jQ7juSkEb@%?%a+WfTB)EFN7DupA{g*;F zWIBx9hu0|SEEa*ZSs}D0C66Be7X z6)&oS3gLhaY*s)1f9M)XixxJlX za_h-?poo9`wW;q$6~cn_h&}Tk0z6ByK3vm8d4iHPRaYMvuQoTKk@oG_@~SCQ1cJ4G zJ=K8y48kRD;d80rX2I*k}X#%7~%7yW>8Fan3#;(_tN<%N@CA;zYjCu^XTj)c?ZBEo5 zJ`dW{WMZS!uW#7`OJw0>ZDaos+IV??fJ7fk4|M0@=aW8R`rM$?oUYWA*#IE4r{`K@?cIPF&}2M7S>tRg+9CffH_sBb&F`F;q^uGGUp}&O zvMcT@#xJpc@|BjqZc$LGV{r6348Rox{lp85@|{3C>p4cb4x8J-B7eGl*|zwc6j}}8 zf+|HLnm>j{wsPZiJX7Pk9|YIxO<=`oU13N{vEewUMZAZm3)!E{`W$HsKd zf?mqxRp@)gIwNlJBpfVi_WSbteobT!xF-iMoivi)#|aA>cWaB`k0A6wYllbmY9bT_ z(@%Evv;AN!b zYT}3{@TE2zexVdXv86#c??6TIx*oa&0rjMt zg`@;Faj~RfK@SblZQ=S1c(1`IpWmsk1HHSq@MVlhO`q|94s6Blu6mF-wLQL4dMibk zdn zhVSjIqfgXZwd~fmG=3 z>xKU%uY&raA{HC+>VNoxM1HI5(pJc1zn1j!QuYunv=_!asou`T4yt__nm*Bnd;nS&Z+tv@K8&g(D2w3xX$(Vd-=Tc7aEwW&qt&S1Yv(O^bw27TXsKR)O|KR64y z-AiJ$(-x!5G5_Pd*(28Yjr{3flWXx(>C$E+x_A0Jf)Lp@Gn!bDB>*(7UPzUCA^uGE}maA!m#S+Exe%!u@EKg`1on{a}+^`Al6PiNCw^B>DVv}qZOlho|n;L zX41-7>rvAMBj1kNNMNP$gehhhvU-NWl{M6Lk_bKJZ#0 zh}ev#ucJXw1g$2Q$xHW?L2B0Y^38rk2faU)!CGo~QXD%S1%0~Xnq;F}77+C0Qyr{2$skH!OqTG+)0p)pvEmAAYNtaKY!@X9|k$%7t*Z zG7_^ac~ zm*r6NfdhoA!?y?D>${g;7;V0sRYuWfIcQ2<3}w`e8#UGEdx~jT_aOQB5m+{KrjSgi zYE%2GUiWGWxyC{WiqUek)GDetjrw#va9P`p^U^VM>)=g%YX8PgPzEe=1zzgO=L`JF>l-iSfw?!*xc zJyEzgAImUSK;L3MJS{eLf!5m(ICqVnBt&s* zU+hUS^l){yr&gW*?(lMrh1@Zpp0`{uFG>lSg}~cydyUqJ^yKx>@Gn8_%X zn(s>G{47c@T@mXJ=BNZjyu2b@GGgrf?(2x}4A>PY9~Aj$7TRdFSV-1S#L`u)VP*D+ zR`qR}l1cU$-D_6CxhzIV%$=#V@G*_nWuyQ>QW*`?wI`nOk&S0^y>GC#L;{$zX7MTU zKL}9dAZlCY&%H1{R40+ffK~^U#FTcYErJ&vA)w=($I;dlb?stzCnqm@npP< z2*DaYswlp+zLEB`;C*ADC#4AwStb<5*ZTYRj(!jy4{h{_#;ksOJ>>jiH$JA3wmW_p zFllAAaC!6$t>W{u0Gkcznk%&1Ysmb3qfS-MJB*=79Y^Y>B@2bTwD}|FiVJdp93?5q z54}LdQCc~``&bOj6wLG==Ns2;p`=UySWDxps)Ek3i>Ba_%@_O*)z#d55Jm=tuqVFh z(j(WIqJ`zd%FWGPpyubloSJ`yXZISKz3mjh9y-wTu4423gmqW4Gu5eEY%CxUC=6p` z5J|fTdSL~8R>+<%iif&=t9pB8unUBUKY?##o**_!A*?L2bD|}!>@#Wr`L6(p^ z`QvyB7z>P>!Z^dKQ&!)V(*3&|-@lZrpcIY|eI-}KL1{$|VQDWUh(hZ@3O=9BPN&=J z#~&fWk$i3{kI2&sAoXcmT#7BcJKCkRt9t_arISUvVklWYp}@?Gzoy#hTu}ms(}5z2 zSUZ%c8>4J6l${{m6zKOHrX9|?Uerb@v`=)H@>I+pF<-RIey+t-EBebS2!m@1izoB8Q9TxKt5!~B+4rX4x^7^= z3W2W=jAiLaGu~;#o%#s03fqJbG4d&_kS!?YjaOhS)V!iwfF5&})V|o>CScW@Wz{_4 z;v55j-onDP_HuH!X=^4Q%v~mh0oFG8S;pkd7E=04+*w-*-g{|>3;+GpWC65QMk&qu-nv|K^9`hnD|*9BmDz*n)4Z%Ev$dLGcxW~N9N zk$H26FLr)Mx~to{H>2~SP!{GV^_q5>rtHxUX0U{QpRX{o-MkPJKud7%G95g&>e0_!*=EWE^H)bNL;$oAsYC zG&?3R-!Ge$hxbgS#Z>Z4{6uXeqT&dc0_b6>rIw|!Ba`WLcN}Qh}yzK6)OW>O6tK^weNQ*h9>}zERW7S@M-Q1=E5;Q!THT( z8;bSWjvsU*Wx?B$d5;T=1u)Ov+SP@poy`A4T57SwvSXf#h}yp-sibXS$`@Yx zkQzd?-dv@ zkw6f6WCpSSHwW^AXT9)fd~W%|i7girM>`Xfn^WF@+-D*~yCEk_uduqy2Y$5ln9!Ae zvCX~3+&=RcrxR!=+kCk6J2^P^U8p*Y}WEyj#9FrTgb|YaA5Y#y}D5g z%a)U}xX`ToAsIU2KKy2Y@B<@&_sb`O=Hu>+1+D)iIoSVL5Zq99DF7b%J36M*Jel6i5!vEVqR)Ic9e!64Eoz~As83T(as z`en&qAO*>3i4eTrKl=GUbAMO|dc{geqIe|c^&6$_QBOH)J1&eKz3)US}Jye6G6s zi&dT7X)dD^QWtvtP$KHs*rAW%-Dc!mQPOB&ZhJ}H>=p6C0IhveW)|*MD=e`UC|Cl= zs%B1{m35PID;Vya+E!&`QwhxF&Aw{po)|Pc01(q<(CtlfVpe-8V_a2iQ4$Aqn|V?9 z6WIU~!=Wn(%ckft%9#AOP$DydfKY%S?VGUg8Hx2xhK45tgqmm>iBg=a=T|pHc zBZxOl*w%ah%-}Dc+O5Q@4Meqq2{Z;5O#wW$hZY;C(pJ2Yl)BZ$wGT1%68x?bWT>O| z12}eRV`z1lnP>|DA(si^?Q25wP+{wQarV|^7XVXMps5*|Fh)mCJq#4NWu&_HmCn*z z`u?+%xV?MapAvepIJjsz96Su)13a`t*h_v<1$g0$gSwP}<3H4uj63)c2Zj6$mpo2@ z1y$Y$zD1xKo5Q5kr%BFj{I606-2DxI{M-TkltQT6o)F1|i_s6Aoo2{@ITq(u_Got& z5Xl<`nX&~bvSr{*MHd2rxyKqN+yg(N=u+&73zHiYIGjc@pE)di<@QkS>S-NOjM%6} zR4K*u9%+{k8dRD3Hhc^$hoYs1AFS39_LjTa@;>XiE*6_YcL9NBpiq+R3P(%3>28Pg zO&}WN4HnrB#a=UE2<`K0%mSNOM9br0s_W6_G>Hna{vW zGdds3Ye@&oG9b#fNpQFbSRB7;B5diEWCre|bsA8|sk1Ncz#IhpT^1DD)QPmVHD8ed zLjyDPHUgz1c}oww@BkmWXW~OH4&9ssP^0Q0a)*G*vOAwb#8V7Fh-s@i=z3V|Tqyui z@@?P`25+-x%8@6*0eST?H4D><#Z7(+_)8C_l@iW}vt{ZW59*Pe?_wD`%2^6g4l_pr zw4u(o8ZTv{I}x>FfW2k984ZMzSMpm}Pkr(Fkgb>f;uawt8&^G|*8|Vpp-i)@##L%u z;$WcSRIUGidS7EBWrrkzb)T4w7R>l_rzm#t?oq8?^$y zuEh=St=L$h8>5@+bKnZ?;9@;z+PamVWDS~MPA!P?*_G!ahf_5{%724OTa~MH%ft-= zG281t)E~m&371|_cpm$E)_vvHQJ7(#j&Q2KkL+j1>pLzsbTj0){NKZmhdM1zU^?AD z0TW=6L3-Q3&>a+RVWuwGp&CZUSQbjB`-ewXtdwWDE)Vuxj9@lM2@fn<-#%kMSg7(s z>HukA29`y-N+NmTm08#hThL9<+nVd-JR!)Ye!709;iL!w`i+L~tmPi*O}Gl@MqHjI zfwSi^BgVxmy9n!$^M(E(NX{J3s3UY>`f8i;y%8&jMf1V?7y>yyHFz6_YxRRrDof~w zt#!7&cho~8kG7ujGBAfS<+V3C>ayv!lkYS$AkY!sObDMb-utb~akANpe;*MWB?G%W zf94Ir;q~{GE2fllO0Ykp;B&O=?63yGwIA2HJmT&9^IlP(R^7ZFlLwsmWsD5A6s}Nxxyd!F!P2EfdA@H2h8!I6~Ma#f&3|Z9zLp z&-Mqt?H>W=zyPGkrjMD<6~k38krRZ2R}A#xu}r<}+psPop$-9NyQ>r1!0H_WEx~}! z3lh-mQ85D6Z{?3Scq;qowx|qCqP$)qgV92Qe+OcXTF%Mvms$qp-+Qk)2nXcZHtAQH z!y6%oCBma;e(D<=WB`idb5b3bm<@rutKcOL1DY#9x%CP`GsqYoe<7M0H4ZcL|5eT(b{x`-U_^_x9>=c0~{T1M5c92*$Dw?~MJR-zvFjQAeiadWWq zf{DZa&JRbhXngCMK6~@L-IsMi6R-q$!`ZDf_nYHPJU@=Ye8)x5u@}A7)u_Dj`~pgU z@n)yxSDL@ukAu?YfIGl#cijK45wH}6<6$5z?Lz){MKD*u{-2FBl6=~i1T(w_LV1(t zNIiqLZUigFMt2G)od(jo7mTS`V*9iE5N@hWQs#%^lNU?hCoxJ8_)&4g_HX(R9fMJ^ zps2(=mFxg4zJz6X457Yqv{dK{ z3QMzl^HfkSQt(|ok5W(OMrxBtSE)YqAuWY)M)0lA>E#&R%B|kZEOH!^;jUZajFg&m z3z>(JQqe3obLHcpqH}D!2kXxMA3tY{U9dz@4CnE;gUvhKT2qJ4uLOa zesQv#*pHM7?WLZ^QOW|+N1(m=*+a$))NkGcnyyv#5=4<8O!)Lx7VtJLlg4!Qq}zjO z?m#;LjRrj=9o%pl1!ya9^zOCy`ety*3V=*D0E8GjxFR(y4|XSdk?G|9d1g98Z6Nr0 zRuX1vzlZvg)-4HSIBkXoT&oXYRlDDUqJ9tjup<;ZQYB><-o1Vg0%a?^a1`t);yL%q4bZI8!ts|-Zmf{Gy*~qz7iD`hq3Yh^b14D-1|w_WaP6SqwHM^5hoJF& z32@dDApZ7)<4)o&2O+;&WL`q$JS|pPDHA#M8NI6K(Q+v+U<=~N?_Cd)6QeZEetD%p z{>G8P!l(p6$fEO3>&SOUjldnY-ud-a@@PAc!^&!ji~Gq1!pfqF$+4Pg$ZlSx9KK{H zP?uE?wO>b|ghs9&fNJx5Q+@}6Zu%a z^qidi-bn@x=w}n zzT0fJUh?%BZax1l0KO`u;3>jF9QQZpEqwNe#_S%lxaEPKh9zCvS5#z4+3hta6i~t$}Q+|_*m4fkXD_r;aE{H5|ue&b>&E+4qHI*rP=J^7iH0Vzn_4>(YQ%ee0iekv&Qm<-%6#^({VpbKcME zw+~%NxQ_bUe}RzPxGWr@b={-5XPOPx@#nepaP;B2uE+b5lA+LYSQ%KhwK5Ee-v=eE zTKp7#325RJfY7N7`!gs(OLpYRG=MCy!}|6fjP8?sH3z_d;=@5?43t$geXmz}>`pHX zb}8G1{`x_(bHn3VcaZLZVrVWaw>aoORhQXVLG|L)^}<%JVsD@p*ume3n0@e-OHqpC z`M^vufKvZ*ve(L;TN!8v@3+wWe{btcyl{hr%iQ?uk(*L=*?aw|7f7DQ>#^SDMgcHx4Uuv%tq1$xjG{~)qDF_$)K!6h4VyT4(4QP~ zSYcSL(19pCzYhvnHJe%dlA!!jC~w<;j<*rI4xXSG6e7w~se&$v3q;Q~P{`Ur8&8PN zPh^xa;E0Y?TMu?d?&(2iyUGi4uF(;=8b$-4Q8y4oXEG;M1*y`|j2HBCEGOP=4?Xdk zI`sb5RApo3=qEc>Vh7MNx|{_Xh>LMjTgjkBiof@6tu-Onzu&zxk8T*5`7UNwABZ;t z6AWyii_(?3=_!t%3lfNQWhbn|Edv*FV0h?41}>R`y6l(UoKB&C9u%v|2L~jGgX7rI zMVo~c`BKLJy5aCZX+9&uV);H5bo4i%=LY4Rm@bB#MaPignRTcN9nSF^xzoZzJF;#NW_kXUjV#N=8*Yxb)}oMo|10yEEBnO4Wi<36<;j#=a%yN8zGl7;$rEwG}lQFs+P`i+r#?F^B&9 zh&XusR1h|Dh(9{=W*_3g2A@o3Eq8}uCE!N}pwY;v69x|(!By=uSq*Y?^;p3>)`^CIiPo64EolsGuliS z$hi4S1uwB7;^#w<0~qZDm^f99y8&Oh7o=108Wx92az`NkK|7E{v2*AmZdqsX4VXVo z2}mn0Ka|W?z$T!b*jm#DQiT3p_BTkDbK)D{QI62+0Qqo%*Mm8hqs@GT6CBLPoG6D? zkn1DxA3~FZ|FA~oxIj(&bUq})_yULe*j+3`L)M3w@XYd>4I4V}toJzU601{q7B zb!pb@T(H(*aDe>Vb6snZo zs?rZ3J{n{`za&Zay{&@Tf4v~ce-C6Jtr0ql4nxv?pe_}|0Mm+HNWjJKd{D;>OK|<- zmq#9+YKh`xPtJVKwT)S$YEp&Gw=68NXP6i+4gMk^F@c=#cWw7z5qI|&SZzKF%a>*rApn$%<3<3!iz|L$w z1uA$6B376DM4-Y@0vgH3!^V-B8ohaDiha#MB1qB{FP0Cz3-WjFbX5)`5<`#@j0pP= z>1!w6e1RO_Zu_gUutS)cMeW3ZfxZ9UA|*n6 zc&GU|QK!$wM2A|(t5Sb0@*5YsWp~_HZuHPQ!VL47XNF7Qor^$AVGwluEI}r~ZSr~& zj52R?8?d5laRz|d4I=llsU!PD-{cMfIg+@=qbjM=+ZvV;zW{SDg+p}^UJ%lrnA(PF zszyYaZLcxF41h_gg-h?VWIWh&x)5d#jQ@__NTK{bp=aWR0HHLYf$pphJuT2Z^Tng7 zYWm4#B#?@n-XTP~CSh>N$O5Fm&|hB`3FNgv6e0Ho?2?S8ws#5(#8U1MOVLp%-}aL` zMLjMP^{GI4?8tayFks2LTfJ{T*M4Z+_EOs&XpgTAvNFilC<2El6$&|EVzgDh!v zU^zAH)CZ7ykrXPSN=pW)XY*8UWwU2TF)~u#*mM5vscL|Y#2`IF z0mhc{w1Q3^)Fu3EbQvo1%^`~@M z_tM8H<0*ki^mXYS$yu-%$Em?Wn&YX8Vp`1*w8njXPU4@1jKJ|XtVaJmaDKm#X#dam z7|KI?DaT4(`!%ZN>8Gz<94WTP>g=zh`APjMv44}LRMJhj7cTw-5cBs_Dl<<=wI;)$ z0>md!WtzYdThTGOHIt+_0R&&yQQIwxas>dMhtnI&WQM(WMv$=H=Qe_UZ3ORwEVR<3 z&MEzi{=?9N_&M}mtg6Y)8TM-?u2c9PeX*!KOySeczcADXxm;t3A{>X8tJMOJo^jpXnc@0%l#4xt4kYYB>``=xbNGmM@Y$Up z%+h)tjOex_Jdl>}P>d^p&A1?LKUO`0K%NP}gzb56&I(Koq48n4le%JJ-o;s zS#v*#y{Yd}^_VQv5in9Qn6|j1SgCPs1iG=@My&uKoO?ZzUOBK0$}3=IX+s?c3o|z4 z3_(KHE5^I_UM@DcALeP}b zmroJpXX@uGc@5-9aD?XzY^Lv0UrxLN_kiEUoq7Oxq&?I=_0rW@vcTK>Nv&~kg~Zn0 zgB>r1RGZV}**kHM$=LA{0ASiL+v}LOhF11o!klDxgm6~TnO04kt!8gQ;M}PnO(mwM z%(0s5s7L!Un(Le?7tnIGfJJO`?FPyXaMyaLEVWB>9>K=bBuLCG@-+O|-=|x>0nX*m zCx6bPoU9kQ09#j;2rq~F=8&OE-lASwvqxP35ZL+>a z*xQ44f!F?WA^uv3`omvlH+m90|ck4nMU^aSK^>VRACo*=C#lL{Z7b3 z;VW5I3W@)EP?b;!4`TAP-jQMuPf<*&c2+SEP)v7qTD%ZTbPO*1m)mN&&NPZBf)oC% zCVDJLP66JdN@d6Wx9`mCU>lTq9yuIA@K3Ptnn>R==m;4Q14sN;`dH!1?86K5rFY=f z4GiCTJSpDG5u$?fSVP3Q^*)C;Rg&R!t$*gj^}Ekm>x~_=j#)cO2HRL+KdcoXV@XG8k{p%{_PE9bqIP2vw=0MSAG9y_>OQN6QD+Hb^w`dg9yNN zU`Vl40CZ<*sgINmphaQ;D40eE$e;;C@P^ZV#_R1~4rl3?9Rut87`{X~t(Q-O`jp5a z@4JSqchB?JV;DY_ly`k+7RUUTLimmGK$s`r=go{EHz{ZmMuylUv`o1^BqoT{12cqoE92t3Do`d>qPaE%Sd5VlGw%h?Lm$(r zA5DVyQ!OQL)>0-iDIZqukB09)4%m@t3cvcCo4qy96Ku1ufs)BMV?2yTM(R97O#49R zwS!qOF7r@nvbeI(8w%iNJ*(G}@M3p*#JrmQ-YKh$tw-B~7`ixkuC5u4 z#Ulr(hJnLCl=+S5?*_JF{7x$dRPI4xZ~%r4(+}M8Q=jg&N({3&K7`9Qu*x`08t<$D}Egz z(FS(=x%ySB)c1&uu`K1GY&g5m5x0NWE`#CkUDv!0uJ9SH$KcV`ej|td{B;$4bU)}wj^CDEF6>4S zxb^}yWCki=Yx%%=m7ox4`wD0b3=YvJmTs-#0MP(ZhK=LoQmb-@P%-$Y=`TpIQi6am zP5j3G{V@A%?(}ksSkE>v&L^cPTJ&}SbWV_3Jjylb6Fz&8;u^%QYFP!jXhSACf*&`uOH8 zF8`s)gm?g3)`}Fa{EM^Yuy^5+ts?|QkLnMX!jN;pp;2*kE{>xE85oi9t+GbtY&ozu z@L27j@%ox=*PBppn4#L9wE$Q8sRG4%ZYyx>Y>>7urhdqi>;YvGI^7E3*Z?3(3zM=x zr>Sj0jL1*w<3;yllLEPwRQJ5vjm~}L`NTQ$3&}y#E=R9pTD_4BW|)nI6AtMk1u$V+ ze9?q>We~=Cwr_7a=H$+rs{xeWm%}2=Aa@>D$gy&j@z;lxNy}f>940({}M9%5uxKm_XQU#!-&fBIth7iz( zK(pX=dB!p$GB0OV3jy!bB#KxpL7&YIu5fr8g84`UBvjTRw2+lusKVSeF+O2UWB-@;T4Ri5zYEG+v*&FD(i zj!Ad%TLk?>luxugVpjGAC`#eK?s}kGqb@Q3Mr9O)J{m0P^)RwQ$V~*$dM1L+bB_I- zNvIcmWC20f+r>V}T7GnOfLik6w~VJFpy;>_jsFAOaYj@O6`xjTUjhiyHNAWbf}FeF z+iQCy`&Z$Z&wuyM-qV_g*K56kbu{TENP9B#To zgb1cp2-);sjQp=5Zl$7xoF{~I4bv)(XV!N&b8!qzYlZ6qQs*;ZYI-scD1sqf62QH^ z1vfR~-n#;a9#9B3Tayc{P}gi2B7`qlALr*Hhatqe%7q`Ce8 zeSpPYd#Jr+u-s{+1ejN>q~dY!ECgW%0JXIM(mm_u0K<=s{lD-^krO+Bu80M6Ulo61 z`oZ0k3VuzZ9deQKt$USQA9i!0V3z$5e3Xrb^p?)IJ>wcPo2new61SXN;1#~@29vWa zxcymMy!}%D+g4?VtYs_45T+Ast&9wPqwwZ!+ye$*9+d984%|4*oS{1SC*qw<_KzMm z1#{#KH@;PYB{_1?1BwvqY=6d=K6>jo9YhID7oKZL=(30! z7(;={Ceh+V(#J3|=>ya&MW499+_LB4u~dgu`(g+zRR*Exeao?G>lrfA-lIGAotR$h z2}NT7l8qS{(koAIAtEkGUMpoh`PP+K++~3L*i@g)j)FIUxsOSbL!ht3d5bC&Niv;T ze_-b(^b~Z3MjywWGf5U+LA`y=dQpELTPFJ{SB9&aQYR9tK82L zb#gLh;wio2mI#jHa=&O5Hfw7RMD%CY=YlMV!oA}q@8$fA(*?~R&mHq@jqXncC(_3l zHiv=(yNDStYxQkZpQ`!ZE2V;BCPnfIi>E410{Ph{`g)ql;DKn}%g*bwwOE_&;O_n_ zF5vhXAz><=b*Rk0uodxj=S`;n6|_zu9-j0zG{D?DKpgeQ#Ws-nV^~XO>|Fyrr}Gr2 z+g=M&%+Odv`QS7IJ$I&V6m|z_v-eu|085uqNcQ2Xj$O-vs#P(BbG%DB<>9U(m+%9M zbz@3&w|YpNXDHJkzH5)-)tUoh-?CKprOyIW(@>x=rjeJwqluHL6#Mkf6;>1OMrjc9 z^8Z3BZjx^v1a(j@s@%1f2Hx$-rXjeEX5_L_mta{ztDB&}v-zc2&dGK9gc} zKW`WRLMKE`Mvbp?+HOF~z74u!k{VI~!k*Xmv67=H0S&&M{HUA8Ggl>v*R7}b^^cEc ze12`q_gMDuc;QCv_cDPuAAS1H_h=%&}Xr=F})R85xSy@mIt*PP1fcGXFZOycWfw*?QNNI_ek zeD$|W-}u7IUYCcgp6@oCvx*9O-^v_{l1j+#FP$l2dVFK(3b?_h{rjOZ0sceKul6xt z0-^vTx2-Ce%o3ey1`0$i8OF}jug;BnmO-4R{&}H_$ySi%zJc!DSKG%6BTQgY(3?n! zZQEaP_685spR{?J(0JBmM~G6G-+_ocp|N;fPoOieu`r+2;XuM2)_O5&_FXubygS~QR3#JjPJS7k|6S~D?cCEBt+LB!6itIj)Etj%g+ z-c)``60EsB^nT??7iD21OV`D@%rc~M391SlMk@yxT9L!48LSzUf}`WF+r!_X@DWwy z0~M}|G|`lL!8#0|5oX#GC;jc#_XTqV%x$ylxVvtM%vCR*56cmR%8ahAalq))yVGq{HO z{O**pt*%N3;+yn76jOWcLl-s(nkryEU>v{kE56FB&y~jD2SR5!V3J%nVZ?6G8OVPiSNJYE6Np#GDl**vLA(8 z2#+J}aTM`C&!wCK#z?BJ6^F+nq4HTXfrm%*Yy!+2;C!-qRAKrNuDw?LEhg$({WXU7 z{)R$uNTqVxrtB(LJA8h3BSmT6l%C$i(UdoA^hlrkBb&>Y8F*>PCFZbwjz3shFA)6R zT|UnpjF7A@6A{b3grRs9AT5u_{pi6i&{8GW-d8d=5il%qsm03oM#_8K_pvC++ME%+ zVUqF-99Rfc6DVT*3tkM6 z;H6g$pXFch!h{4b!A~9?9f9Y(nmUkiX0;WBgc8^Y)?ifLiK8!q{5Eel{%tx+qkrEJYt z{+Hv@89kCi$<{puw6gsx=WM(>QgB@A{PBAMRp>WYP5PvnUfpI9)tFXif8MGvW=)&D ze+(i-{!5L_c6k8HwPX47^HBLRfee^f-p_JbE*+ZYx3;dUBm*V~TSpX!DI7jGWFE(o+7%IK<`eVcL=6v@RS%O;$?e6|V?v(+^IWYCnKHpp9 zSIR@<9OEbVfRb=c zOA0>293nxMy6h8)Q2u8siKr?WR$_Iy%96f7ZYcBz3gIgyI5R+Kdydrjv%7^r0~JYP zhhAO8>qFQdX==|??V?9arhi`BpfxJtsYu@O9~xIbofBQlCRD0Bc9xBJZ&V5zm9>P{ z2p&1b`^stkI7ak{n(QyGfFKV^ka=mp#FIFxYw@`uSP=_9%~6~pqKws53y_O{koHiuF6871eo}qX(FGlF{$hSv;nrk@;67o;PFT zjA}+KQp^3<+Jq=%AU9sH13z)v@Oq0#y{gNJx{S(QzR%CkwAjltE;;H~tXFbUNDby_ z6DYIQlZLcWTc_xjhr2=46Th**d1nbuh}!6V@D{cpC{u(GZbDykf2Q#YwdV$kfJJDM zx26%0&Qb%LWWM+SIN!{4FDgukZF_!J_@stb7pCuc5S0fu>JLiWTm8E%!$q{;2SwjM z)G4FA`9zd2n!FZ-@WYG$0}n=_nOsV zijzMzGFHCxA4)-s_K)>XL5ayb8EC2lfS9eQ7hMhStz45DPLojAg|x?D>T9CSJ-VX1 zFpjk%?(XcDgqu|7LDat|J9bL}CL}z#4Ml60gPtFRo}K4P9UhnDxIX{$i`o(FJ8!6) ziDJcV)tVcv0;>>!vxa{!#o%R(5)x-Tv;5DlYnmfjHT`YIBS@t0wiLyuux!#)s%ForRfO)btDo$R zaDqaV*?!=vxbBv9=1Vango}2PHHV7j?~VQIHYWqDM1a3EtL3f2i_KAe$ZEwNC5!5U z&7>f@2y_XMQKya>DZ4rSQyDul>sh&#n?BvAaGelJJ@*c=OeC#vPL0FcQb=p7+UhlQ zAme+LMo|~1N<;T|N4cOpmtFj~TD#D@fpiuI8avr1E{Hef=54J*YLyMBM0;4a6vmcJ zfZzdd;+YO9fcp}@n>;|=nW`zvFbhx8*8LCuL$*0(JRdB=A24;2%LB=)?=;Z`Y}AT( z3i?VE{t=*!i?)n`D;Pfc*7?XAX8`zTc%uK-@xMP2#ptIL91N;P{V>JF=q**&r4R<8 zcfWw&Gy5b>J!t{;Y!uC}_`10FBq)bers7XNI#C*{r5*eUV!87T(@+5(>3w=L$@N(k z3=`Da0vr2j#tS5zq50K8>sF|G*P2rWWZkpNx~{F95tV&h#E_)kHE}p7e%>~_zgX4U z{OkZuXkwJ^T5?Ip)p%Ut&vJ{4nAeBifbRhuX#3`HhUjI*KOjKO`y#eei^I^PA$IO3 z(6u8z=L_YQ#bE{=vlbS2F1A^sN=_`6ah-{*{-PthHBt?nqS7Yd9+~U@Iet^%{l1$w zm&W6Tp7&6W;n7>H8N!4{O1qCIJF$D(J!ogg@$2G@nmcdcDV=Hs<(xM}fd?94m%YU_j&5DgXkT2;q<(%50$+OL8jSOAc8fIs+E^tju*B- z5JxxA0WB|DDZMkL_DAC0%KHW5)x}=Rz743z?;)2 z2%!Q=G=Ql85PAgfg5HX9yuWYp@gP>0h^y!5^Gp7691wx6L(0vXLsByA9JYaB%9R}* ze_II0NK)v-UJU(JGiVt<#8)i-+yoSiXX1@g29!eYcdefc40u`C;;rw<2 zI!A*Hi?JK_Wc*W^do-kj=3R~#GTC%1`wcvZ&tPF1`XIx7D>+1L-X5?wQoZE}xUL4X zZ)c%p%4yWg9KXo8!p-#}(s0lR)T{G1$DihRJVZJhLS2du=7G@XUAP}}&fH@wc0$ac zE_?RLXQ_*#$@Qx7rQe4O)Qf19fBm_4zgAF@v*=#c5{GTxpX%bZmMda*)5oHB`;Rq> z<|~Oml-s6K*-ZRA%G!MfDf0b26~()<^5rOg3cqPImuF6T!Edr{Qy7Ee5EsWP?J16% z;kM%r;ucF#Q-5Unv_&WT_12S7Ro)~^0LVk$%#TB-hRY&1i!B`$TYc}{=lTJ0h2wft zo2llq*4_m8B^eP{w{`(21Ybh7yJEaVud6cU9W_$&CK7?5~lK;Ck zMI2P5Pe0e?Fb#6SF99H`0K^|l%ejnV=@OCpNoCdTPnu2h z%9KGs@2tPwm$MuZFxAx?wSN6-%>(bJDnDUNT)IGdxO`ov!0s%Yqg>3jK_Kny&b6ka zKC(!>()F!smSFTpX=m2m_m2Rw6_`5qo(DRiOXo>LnrTJG@ z-cBk8Wi#mJ=|<#QB4PyWq^}Lzu6ALDFPXl-V|!&$QPU}_RHr$^dGA1OaTx({51w@b z|K@^n5E#KxkcZDv83rVCWJN-zp2XQTr_8YEcC3c;%Z!}at2D!xD!uE8c;ijD^uF$V z2a2{+%P&*;UH~vpu=N``V9>;MlF~vEoa3Y#Emq0tf_ z|92tkO9~Q&i^D<7QB*VXi8czpWFh>VjFamF(SEX%j#gE*C2IwlW^!pobY@r&B67}k zOF2A7uDs1h!$0Vk!1=IDPqa2!45%~FxW;!q|4u<$;oPPcGw7J=c&x(;)zIulWgO^* zEVT@WW|zJ5b1XK>M!{Cc%LM2M(GX`}%5~T^JVEH(ymWnS4a*>9XvN8worpm=KaOJ` z;NtoXw}^@FE>H^$FT!dNbE(n8F}gfPF5cyS0!LteB8GhyyusaQE2U;P0KZejFpbCJ zt}iH8r>dSdkBoqA3DecXZy!|@rF^CVfK|IfHzY#|Nkox+Hv^KzyCz8CBf+S?x}toH z=Hf8!@xCB`dG^bm4I?-0668LAY?#vWjJz)00#Yw+VFtvw@+H#Fan zx5i)SM@Psac+MxF{ldf%@k0 z0Z!B6lH3rK9n>2h{sJB3H#7JDD+>POmm{u$C_rR_Gz!cx&Ss`Oe35hgs8Q!7YG2y6 zctGdkwLiE%b!e*=4R)M)w(Dpm=1xUbYo6ZBZV<`xSbhpV?JN?tXO&Zz{&p@Pg)vht zsCLd=e~;|#lXPmXLi~$H*W9kYf!PE3wSde8!=-MF@zwNY)c3c|IbLt(3x|;!8b3Rp zb;_0g=&iPyUX;H|&&^f`qU>lEYVap4r^(Hlfwja0PwBguJ<0*v)T7>Vzf6CItDDy0nJp1HL zY-Kc%41@~f{M*R+G}wTVk$jV6jn?9y^-t)01JovQz~?l?weubjl=Ut)Hb*9ITdb56 zh%9@o&FMEB@XKVICf6{d(&7E3>z05ey5h-q$6>RMZcrh_$kYM3`Z{=;pxUyHvpPY1 zk?(Ztri3lyj5GfVB;9Pxk!Jv#o} zISMNz0Nn7&vizumls&kL$R*1Ajx7?tEPorS$;=0Hyd|=T-C1RraQ(UbUytP3ovM** zjI4ZK?0^k5hCfj|8sCROjk28OX5voMWOVjoT+^8Q<1n hQ6P!yq$+#CluWLw5o1$;1oe;O-8My9RgY;1VRbyEX0(L4!+>V8PujxCLn39g+ZzyF0w(x%a*I zy!Slkj_>c+WAv!%sx52p+H2KZbMB7(pd^ioM1%wd1%)ar15|~Adi#3%W*-6W^)PyH z&Hx34)M+g#`9W4vlH!B2gN3!7ITVyk3A#$}@dQAMxOufl^ z_~kJo_%hZ49VlTD1x&BOg3|6KaZ>-rCJf++jP-$|fJnkpf9u|s0Y-zt9|FO%&mMQ4 z@U`zDMOWXe0|K56-=~ixIYI?eVk)i6@o6KFOV10&%4EKQD#M#1W*x?iapCPPGocm_ zG2hJO86qFxHxHh=Ma)Q}r|n&a`aNXV#D@x1N0?W<<2;Qa3ZV!Ah3W-itP6#7@cHuK zuWN)<*45#~UT}qssXlMe9XW`oK}41g-|;KYa{@d?gMi6H29E&-gD)u+3VZ4(*k%cL z8{g>77J$cx1_Qkq{K#s(R7G0dSv5IEo$u(~Kl5W*OyjsL`2)`D)7Nv=G8qw!hMpib zCPis**qc09IabY}rJcrIq;USqC?6P_O_*e`w*}BdnG4x_q zu_##0P9>yYkay1CvUG{ZcfPkPcto37>Pb*TAqafqDTcC30S$zP|BY}6jU58@gEBld zmCFFbCD*D}D}G=imn&Xrb4ptxHU@X?=loB+z_ZRQUzVRUwD*{K`swrLAlU9bT9}VB z0^>YTIyqEFb#^+ItI-W+P*9fYe5y{z1!%(0q2m6iI6;h)P_5kzbzL7(8K9=qkTZT4)ptmM*=4;j?DLVJSgfn<99UsPvK&4 zaNSJoC?dfs2*HjRZ}TLG;>pZVv?Z?NnILcPBy&IDBqPvBTE}A~O33GOf8bDu`6B6) zE3k{dOYMr*igG1!lPh9{;0^B=s=`jF5$a}y?MZux#Pu744=x+NxM#^xL=Va#c;vUu zEygNJ&Zp|$W@ExfBrJSo1b^$tEO#vt}*AglC3UdB|`ZpN<2CHp;mSn$+ElFrd`Yz=&MYbfFfgGutW`QO;Z}} z8sZu`D}67a0nm+4hqRb6cwx7MttxdY`zz;uP@oq{rj|o9$1aR@&OQ%0*A6N(%I{YF z%~B9)EyaV8J`*TzQBC(W8C?8UrJvF_#(UYVd2A#8ruhW_1dzcGUhqg zIg`1*GU2j58%CR08z&nt8(f>>IkR^-V<7{1=F>bgvD3$so#T_~J!w4|wf<6@(ZpOL zrM9IHB^R?%vl+7v> zt2w*up>_GRPgxk5tF(Jl##3NM7)K14qQ7K(nJio0ui{?%YMf=eX0&E0S&!JL4Vp2z zuqc`uElAh3bRT;(J}}F$Zu@neoAp`0X3eIJr_JLU@0#QR=|L9_Cmbpq7p)S_fs}>R zE4GdFgkL4AH*=ofjnB`+-3d>SR{*_*poO|ky>->?qg#yY+Hdb6)XnXKrrx9E6?_lN z8*XrwG?HLIclmr8&09ycMNfwFzT#&J&mg8bmjr97!dhclp z0!Gj0MZ7b<>35uh=L<`VO9}N%7NT)=Q949(xQa0b82aQ-90R--E~9-~^;*_;(wQc! ztKVC{E1&tF(VW$Vq$7@CRngkeB4Oz!Im$Z8!Y4^>-%c!XSQ=H$toF8eY^RTpWO#UW zZa zuWDG}RRoeJ-tf7QzpH+$Al~vD&$yvWnHdw)1Btg=02&CBWfug73_K{H6}*pzlWDU{`g2(?yn1K zYc;zH=RUJtMsh{cz`LwQ)mwRWbb8kIwsF(7?3_taME`y5lN$epd-C_Ic})FH{e}I% zcpQ23maLjbIh|v3dNucyfAZL;FrvB3R;8bNl;-$T+5gr>v=dys)aupv~Xq%_;?m zK;YfY!Ca=67Zb4!QOkxo@`4M$YQJr+ z--TQ>3s`zw>mjr_?wNG=U+70y)u#%vWwjpq-$8H}m{>Hks(CyF-EwZn_L{MU$A!lh z^r{*SJlcNFzebZ$)Dz+z`}?(a&nUNp{iD;B4iA%))i%MKszb7ypHUC#H@`%{e(d*- zTU4X@d4qCs@;O$brO#`RH?-;Xhpst>hBq_2#pnO#mm* zk=KjF`ZL~FoV8p>9i&!OpBchS|Ag#1-3=e;I zUo4|adPwJ&kbsDN;bnK&fd=)R2dXn_a6qbjV4(9vI+B+4;J(X_amm<5k@ zEbSH?@Ff5Wrx^>y__3k!70@C&%4oYlK_O%R`9ec|%_M+=f`PME*K*ZTR1h$A0I?dI zIhdHUdV(BZOG7~kc?!Iqg3MiwDLg@T_AUaR!j%6iA@F+s=Q0~5#lMQU+6q%@DSn`k zbZ|DO;AVZt%1$YQL_t9z&&{YNAJw;iCli>b4ELms@|S`o|UlWoK*i*J=7Q z86vOU{q5R+mKS3CGgE(=x&L@9|GN76TttwB*#7Goiy&=KA5TI-i9yK%#nnBb53}9| z>i5qLTJpBZM!+Bfg6)FeddNC?cvvIjuo=pS;w`Iw`#{1tX~Lpf@ZHDBBb)*n1_0x9 zGv?vH({aJ+!*z1x(?%@%#^I!cYA5q zTutW}mxk-wpLV)Q2?9E6{DHFNds@E_)y_>f?WT9I6>xa>L0CBN=G!- z1u|6kE1pO;@&}d#&Kidr_Lpo&lu0Y?nd7{d4(wLGua1{u-vCy^Z1;&C^(-fbsI)s) z=Q6L;lx)cl#+tZa7v9`o7oLe=9q4;e)zYZjb*50_+=%{|b==-xmYx>bRo%i;lT%BU z8eJ3BpJu;~{eNh7G<)A>yiCH+&#$C3hl5HXhlgb}jiW;h%Hr*PBh_yNKA70Re>yOe zAgB+aze%D~MCB?{Mkf_;N8!#A@IcaUb)A~%oqF3mjp+zW0xjMBPX{>wyW9ROyZLbP zWQ)tr2d;YmqWLU-mm+DX6p68s|E(rT&|8uq?ekqevI}1QycY}bxS?vyl7bZlx$-~T z`#P3xU+F*(icyv-8~fqxiEhF!OX*Qem`T~LJ0aGppZ{bho(F75{8t(_+rZPZ;jRK) z8H=IVF$y-9lCrXSm*I%hjW@h-aqp*jLLY?|J~7`>@M;>4H|k50@*@IfqgWwU#AdRB zuHB^Cf|c@wcM0}0`CAPU4-{8(lkGin3Z?qfynC7z)vaGHt3{L_Rmh1cwZWR1l%z|x z`|rLwliD`u=mEmR7iUA7YBTSg4C*nKg+v{lv;KLUqolAD;E->nHgk+@a^+UV_qD$)y)Bzz<=5ERVw!rN5iCq7thxZ{KQhf5N01c6lc|r0 zC@UMk;w`V1`(==k%IrQWC3z0ZG{a?!2V1z9PKSWpYLbt&6JJ&j3H?4N&zwNdl5Ot& zc|nU^PL*$#zP#0FaYy5yS5J*6AfE2ULLrkNtmDaDtIp$O(zs>InLuVKUef?k{&E*H zMaQY1efMrha-ne^DZlH9N8$FkZL(EgFlIS}-&%FIaZ1W~IE}-2cEM2I)!?HQ9b}%f zyb@2x8@@-b`~@tjGtm)T{tOw8TYgib-ES^ zovQ&6yH?C#WJ}U&l`l!T;K-K>{W@Ry#WRD^-9y)Ft42LX#CVt3A!OQt~-k~0b_|>>Q*06yHiP7CF&}s9Td{>iJ=&&EY;eRrG<+ zL0R>QZru5&&ieBI=0G^m5!BPO2~>RZR0cymwJdfnuC2C zh~Q>U)A(z=ovD2rOFPw7_)k~0H0rJMf$-B%$Q3>eXjs=F6uo(ovOQpoo6)v=j5qvQ z@DQV@{lT7q?Zp;3=UpN@DM(_ zATvtq#%Ffh)8D5>m&GrQ3t`%-CvU7pHO?2eA4cm&!ek{3#*_U!J?6F7+sdoa`cA%6 zq3|6wu%9O>CwG>mdKaKSKkl5)SNr2y4C&f45I7Fe81D+6SP?=}=SOakv8EF_j6kV6 zj1~7cUExH453)RPp%+4$Mb76(mIz*VJ#X>DI3%JIqs^Ea3Q+|V9iB_R;0KCw&)>c6 z#^dezr&vM~)Q=2JWf8(`+tmZNE(lmFLKvFY$b0Vef?&pUmLJW^a#&9omTETdWE*<{ zCW>S(*Y>-fKw92&A6?Rh=I1|#Tpsuw*5<|mzYDXe_$LKi=1)pd-fMjS9bA(VZ*i`p z#mA}XXC?2*`?19d18T#*BC&;|HhadmHfS*LudL~ki7JdRuVNzXl6gs%~< zuo^X43bq8g9#u4BQX6JeSr%QIo z)k5EIVta&g*(?Xh;``xnMD6>g#aRQHaUOX#Qg0GBbuFh6mOfj$ESv#3plP@w4AfQ@)jX|R18jJtnWgY!>-c>}uw5l2Ua$I62y3hb*S&*jf zatx&@d4>7^mp9%hI;=BvAQ8XDN~fO{ldcau;u4UEaU~#C@bnuy75SbNbH@9IIr$Ln z4vauNTxq}TC0+@H%Jn)L_in$Nuw_MFRC(t5=yoA9sap-oy`LBx2Vc~b5c@*Rs0sPG zCG(!7kW`wUzr3Iv(KtIc*ts>Tvw;q#*dnc(gZ%+m2Q>SWs)9>$g8S70sBy>~E!$3m zp|!t!^H-7whpsoPBxEF>jcqjn=l8N5L`zaDauK~Ap?1Wqx=srM8wj``nION+BI|4y z$~AWxF(ZLk^TY0&d>;{~T2g?}XpdWLee{u!rWu?nA@LccJS)tXZ4bwj8cne1@w-20 zLPN+ zx3$Y2L*J^J`A6@8mKMXHAX08huR4zl2ssIvy}!R+k&F>~Q+)va5N=%;S87rbC?p;YRzkFcnNGR_teAkt%1gBRY}6)|@#$9*pZysVe6h_}Ty!IC?3gg) zK=&0mDJdo3J(C*ASi~6T`TY(+6fd-h}0B>5{AO#xQ(&3Ku>Tbt)$nP4FEA-Na z4Y+_1nVBJCUDve5@84cS3my{)kor2_9u5#o5|?s4&T011NuX3wPI>5?$vboa z&))*xd({pNT4ob2A2Su?3cWZK{Z^rYm=H%oGH4+?^mhu_iO$KFZH?f&`ylw(PLzXGmlM$}#qPP?-F+h*Vmz|dm=7|a) zjiySp?^hZ$=SCr(k`4i02EV=W4G89wSsIB)Y8%_9Zpv32)VSLt%*xs``>@QgBI$+Z zXm*71Yckq*H&JUJ-Yh-qFcn~%ZG9`wMp}bt`|6vmoJE~C{aV-p%ZsHX9d&X`1Z1-lb0tjrA>^%Ik&z&IgPR}NZ>rCYR_q165)iBd zG2%b@Uu3Yqf%%}S40zL(g3wVVL4buhH2+KXoD;VRt(tn`17wSlt+GZU-cy=pWEl~0 z*!^Gv@|LL&5=uK0hQ8o_XGw1 zXJ`3b%ee1Rrt(6!*iuH_bgqBLkmq2b_(_6L9JxP}T&hLspA#EAO<0O+THgoIuDWLN z$_KikC@}#f25xQ2@rVtZUyZf|G%Bt~p%5FYkQHXHXR-ymbQ+tOcS=p=8Y4VfO}FRs zzcI0(7iF^x;i2EDKt>Z01oEI$o#T)Co!nHhJ#IXkV@V~x1SwGt(}*`Gqx z1IrKOI(JTXSJhxKGo*_g-Q@SrFNh;e*~43AUeazpovt1aK8cqmN9Cd+a%5O~e*C&P zzq20RCnvEVL<%tzOpwR1kY>mbGAS^kI{NY4lo#+L)iA7d`eZ!V1AdC@J;GqAM9Dd2 za`KwZq0qhQO5mWJda;y{fo~8-V3!+=BiZ`N|Kbl;5l{&xh#l*ftAoKK_kgpMODL8+g1FW!XC>MA!;*K_k_ z)EzOhOw8w`F7#2G)D>aa2(WRtvA#ZYEoO{K!?3T5YPKT@$-3iP$n*jW!9U2$O$UKr zXe~cd)+e@Vf2v@SPP`Ef|McSaKQdrES=e((PRAEbs-uwa8+Se!%G7zs4VkSPqKs5* zRZ%zZ$_>oo;{tv4l}c?VA~!ix%CD$eP|a0!r%75d9DYV6ue5v}KA?*rDbVADWcnvq zjFqKkwzJIUDwt7qsZV>WPx?oYM4pah?XXW@Q;wXM*!YcJ3C6`N*4Eht9Jh?|+&d>L zoo50S7xQAy{Zxg$e8;5Bw%x$#CBrvK=e{q_z1uIpSkLpYn|OVk|JZI+Me)IVh_!Nh zd3nmlvYJIyM2A#xzf8zoF;rRtR1SV&73eUuXp?%)p&ovf^w7Y6 zN_ctq-dyhM7#?4^0@E;AJx~8N{y3Fz0~@5gW@%AuqcQ2IqX6y)C80KQm!!N;eZIOQyu|8gxaYR~#Wu=6@j6oEKGwgJ z96#T|kx5x5^5dtNc$hGPB(9HrF*e|n+MFObzh(?j0+I2F{w@6#ivk38<@%F}fMM`j z7EH2m#Fe0$sK2s~yyBh9^#&?PZZS4QyhNyEK8b2l50>J287%41=5~O0yCv6|x=FtF zmFee-;Qs`u-6pYtaIrsnh@&XTxSh;KC>KRf5?@K1QBzo{5vFagk$7plG1K4pPHst% zO4Gh@bo8}0j~kip_r4V!K7XSTCeIPTGt{~UCGxJYugMC2P~>^5+pn^g+t`=Yeg2U1 zWCpd%t1B1z@R9$ywErv?mG|G4@4DW*S#=o3c0Y=Xx6=ZbiR}JAyygFW?cu?}`XZn9vdh`${}U(muPL7d!j}298DJ+|Sp02x zf2Fj#B?847yWV;N2xxex{$|%-`?jKlnfo{n#e*r}u>HStVz&shqevGg!rf=rn`KBp zr6k(q_Ice1wu`dApDb$12Ix#zr6hmpZz(jhtmPE`Vq^i@zN#%`Pg`(r6ZxkXik2%z z3Ff|a=M}B|?_~KDvz4(*v{6N2hNYM*^176WG4+)qlgY%oI-Z8)!<59NMh64EjH8&C zqxKqe@daop>b~I`CUcJ}*^x(z*J5%@nT++FGds6J9~UnEI>`Sf>w@GkOG+tDt5lb0 z4wSQn_)&=7(W`4}h8L#jFuESE^3TrB;$#M7{=UEWrfGBhd^bB$hVM=hlFnrrrctR= z>btC)Co;4@cqhfEhH1I==Z6#grTX67a55~5(X`wP zN~ToX`;ccl?Iv^!^1InBE_ujB&QQb%A6rWN)m*A!Xki;OX^Nin5DbqjscPyY^L1GD zR{qF2U$gH~{wg^Mq3KMI%0=Eoh&!@Quhh0^q)&#A@BQVTjSquv`Ibm|)%YCS$Lh>F zle%t<47*3v3um(wwLwU;%||M~Y`owFhNl(!Q{tz&JX+x;33xn{gL*!42vE~sG_O;@_nNm~tTC4JPS;OS)_?fM zIL@1HlL6lN3JZNZDTy9>wmEpf4T?Y8&5sLfJ8mtfm{`^oESJ`w$%lc&>2sx6W;%so zc_eGEsn#ikk;Yhg?Y-voUu~-h(FAtC)eJM1hmgPA4$3idhKtK^9F8j3NLZ%E&l84jiS8@~HoP2;^QB^u;zXZ4J@5C5 z`wptRsyvAS5e&0Yq87wAJ>Uc?WMIkGpc{XjT5VmaS}|ONZH7lfE-Ub%`IkR&Rr~oc zyUi?p|0<-vPSs1p-h7E_>oUo|{c<{LeO&Nl_AH0b$z&ZKGs##wsi(0}FI}Jehpjv7 z-5zHWXiy?U;fddEoGeu$LrRIVp13rf)gDnU`JpfA-vq-bY?w;-RpZopo?m%60<9Or z3=$K&Q~7U+otvdA>Y9^>sa8 zRXdLJ@6clcv$BPKY<{48x?Z-e4zP$QALSH?-K8`+E`7!LNwmsH9p2ZfFxyGW zB2x&B^%Ek3%+0IL#;;mJS&qziO#?5Q_KR^r^&c0tA>U1d!>(0 z8qk5e#uo*$NjQD-tS!{-w;NHPkwXwLzb=a7=!T<_s$Z`-bdh#Go{!Y@A~C&76P&j^ zZGVkcz4r&z{+;CvKS|;+KrFKVPY9wNR!1sWStGraZKyFZ;E)pzFy`VY|+|ZJnHFu~<&!TIjZw zW{2vVH^7~s*Q9Urlii_3g>~PmrLXmfFSp$;)m2*Dsyrk=ZdY~SVNTQVBk>Ru-BdO; zI8{wp+wyR+mVe_N83@ibT%Pp=d)sDPTx zeD+txFN>fE@%x%VGM|tMkq3p9-#EosKX8D!5EvB@wafG#e%j;xLf5<%uZ-w4_ktew z^J%y!tc?5!RStcp+q|~)L!ciJGhrZ(m|Tf(J)~wvNig)+^L6ujxaec9Kv(>GjM9Mn znH-pe2*ZG<#`!^x&dpfCp3WC}2spFnAZkM*CjXh)mCo$RK*z z;pdB-7y4WY@<^f(cG|VqH}v{zFxPOldqSOG0CSy3wo@@;J16mbtcT+7x0^Ee;Bca0 z#Xj=cBsQhg;HyGEQbb?>3JB$>e{OIG;fl8xl?`ANkJXbXk`9m~k;o=1%f zjEGXi5$)XbT9P~DKuVSJl(eW(hk-k3(ffpDCBkdT0^>gKgGzk+);(Gf)}}4zAy}x6 zW6S^kb~BC`WD3e~f#ssgR}y@BM@_gDnpyL>4Zd#rH=vk#7eRgECy*yVA&b+zj4|w#YTdDJ&VKHr=Eof} ztiy`>@o9uQNi=@oNQ6+^Yk1^VMK+1BilvGZ;>-+qzS|c&Y1zqMuajq+0hdt438<2) zg9X7E%|E^6WsCf7)-^4LYW0(! z9dooY*a!+#%Afh0fz|6;l01{}5u}uDjz1$6mK;B!ehHya#X5(l!>xn1i`M%g0_MN> zIjC&5NnZJcE>bcT0yJKam$b)_g@uN7GMOL_Aqcbzfw04;fr%VxkYX&!rji+j1;}?L7%;&n?~Wp;lwrBilB;}L=cLQ z%GO1QMDT(Ez}D6tRJDZ>Q=261ut`*ib8`7pZ_8)ewWlZTzU93nEIoh49^tP=s>FKP ziz)WJuXjsTj4l0J5{Qd&&<%akx_@=g(kYwW(1IR&nGgF|?>~>}k^7$Ztb24l z=o=}qi^^*I4sm6q)5S|-sQlK^)RcCri@_U>5v`+eA{WcUc8df7PlEs8j0#gI!cf0a zO|atqK)5@1T~-=*2=^zjYTg~iIz?v$-xfk=!zP*N*$?bw3e#BZGkJ-W%D21Wj$!YD zZ@0)`B+pv{((s?|uhd9aKXDychTZ%MFxPiL@f>pj;a%qMzN1;g>P2no7E&I6Vl2t{F2W;AsnFb zU|u09VGLEY?V84{KLFF{Y3aoMLGS5h5*Qk04-yT1xVY7|z zUQbs4JZ)i6u*X$&Koo3WlO|+cS49)H(q7Z!_P1O-kczzv1AGLXVYvL>0R$R{&D6ny zpeZ@*jA!-E>pE1z;@tt2YW?Oi8y6Frgb+Aoh)GUz9wBr@`kZE`@inj5iGtFu?Wjqv zfe_K;$V6L5<(Xj53>N)9a>FEw6LBy*gmvHU`+At1y*4nXaX~IpG+9z!cg&iHGkS+1anV`6cYT00LIz9)#*|ME64$`Hqh{L4 z6aWX2Ec!nj_2IsJm&h-Fr9pq~YN+iKWM}GfYBycsz~sAS%*(AFe&3AML8T1r26f4KB)**-=;H!9JcmbuC`LON~kAW-V(OT~SEAcf=O0jC>%(V4vEwdKN<%Ib-l0M8r?i1FzwI{p1`u~LcZ%1+goJQQ;*iyvldw`3 zWJ2lS57eKPavo@7cdDs_k)FV`n2JEox+oW_`9qlo6hw&_P!kZ4=$L4&xzegpy@x)< ze{W$tCi@b!xZV;DJjdqI_U%gf8)trM799P#HBC&hoiOo9y>zPR2cHn(#!8~+_#yt^5d7O~x_$^o(0f0a#L$)tLfhB9jqxwrV6Q1W1SvdNxUFkJmP=o*S&cdT%(UH*KJW-9S&9kO$a zrc5-UOJsy9)(`SJX3Au5y?Rzh`y;TV0b{K}e45~8+?n}dgp660UEL6^PMAFc4`nnz zRsurMC>Ky$+Eas0R3<)68hA<>CnLUHFs2w`Ir zI%A~lcZ_?!WHKQP6jhULEi#X0Gwtbkt1Z{S)ntBBm>gZSz2pt8J>-G>6oz5ovF7%% zs}fbCy41Tp>)&LA$eb{}$q|-3!c~mM;W&jL`_Z#9O&S6Foc)zGz=A zD=%%d`$&}-%>n|B=sBO!5cOZQ{d!SquEpg4ggt&OZB~OCCli;xk(^O)t>S{g9k1K& zheH=%S%$|EP8J~xh5-{b#gaL8Lo>!9P&DmfPMyytDVORu(3M5(oP3ev8<&zHuom-^ z3Es&G5O3br@i7a2UEOw{NEpxr6O4qC(0kuler53mvWmN7(1hqW0CW%}07}3+jJH4_ zIqaJ$KReAv*mW@=#y!Oz1yBY^kPyLFK7w7>pJ}mt>TbS#3V?|OGnL2rPbbv5tuz_f zNJWZTNGovq-VYVOo$f=xLwJkj*L>8ir-mlm^Ibg62%V2pS_T*)j>7rV&Wn0U$UIhj zy4DS6HG-2WU8w{70{tuCag%&~)n#I?goCn123REy{KUIi|C*0lQGZPsnT5tbelw6% zS(PjvQr|y45Z#Qa>q;L|{hpYp34;h|FOIe5rFrZX?-WAetr~f>7+;HF7Y{NDA5|w; zJJO|$JE{SuPI*MI92=j$?r#NCVxdtc-wg^;kUJA@L^ZvJYPZDi_yqDz5>#&}likAn z&+}m>e9bz3i-gcOlA}<}+=)5YYAkYdS`QAo2I8ABOstyviHqFS8xP0}63NFqQ8xu= z=vQ!njjAv!2esJeG2Ac)R&PdW_Up%dUI{Ukx;POd_=~R($)J0o>KXr%z=}SRW17=V zqPh&0o{DC{qwh(}68!FQ6!C&!4v1lDVcYJbxncooLhPvKF{asykh=I3c@2>D z>D#dwz^aFU7^S+zdurxgj821hE|eVw`<)T|4c<=F<=Wy=cxzJMr{9B=(uWeQan+-AwmPW0H?~9*by$E+vlpj%ueP>bg!CCJP`PU z46M10oFFo5uE&sXNDF_s+qLu-69oWo09@us0SY^zb}lLf!`6bOw^eEpS~yGx!j#{7 zG`UGyafys_ZDYB>=6yyG2ERu*+S1fA*t!Vk{n+&|-X<_eAxlBBhrbCX2{V#_bIAaT zm|}Oy46s}Nj7xaPO|{EtBiQU61! zQ1!{*rGW0<5V5&_38-gp5sW~F_)&5BFWLrWXiCPP+ZE>C$8N1mnelEBj6_VB3TwAG zb=(T+R`W0PL-0l%6!3o#sF?9RwF7X^3)3o0?utHvYTM)Am;}j4%482L7YuK<-;xL~ z+0N)QcP*0GRAha@7qqx4yfiz&N%}Gtx6;4EK)TdaShaawyQ&J>sFOnwTNcL?7myrX z^jppKgQtlCBvJ4&m>$sX#4BL%UU40Kc}Lren}>pxL5@k$xclY`&<1df`SD)l3h+=O z?PsP+E?9zY9N`=B!ED*x@PO)yg4jBo1k4_xEt2dMBeWl1^XZ`03Dg&SQnu z-%-kHbV!!O!TyMpjw(KadAA#mLzm9lff4N28*-*2MV=6jW|x0rAzD}Y{38+@NAf;U zZ+`|&HLZ3%Gqvt?6Lvx(B+yi$JFGPtu~iPUYd2KA80~tQ{|B}C7WMs_I!q18ox$M0 zqrP#2h+Lp|+~A!=ECs*uV^O%nI9+a-DRH{dZ_4<@CgVcZrR9pj%>o(|v5+J_3v=yk zjfm$T0t&2y-#eGAI2q&%C5Rc6K$s1k8A3_MckW}g$@;;LtaYpobXQZLJH5f7OTrW# zO?FyxEU1mR%E&^nC`4Nj@?#-0qeH0c@Y^SJ)$=(2bbCP>Ja7gk)SHX#TQ4=9mwN`KF# z8h%e58?V<;Yr9OqgQ1q31m5{Xg5`{&3~^j5l-Hy|QiPYbbr1kxRdynMex{hX%;><8 zOw<-;5xeC=b|cBOn-i9nW^c!&@rykdZRmBY<&cI+o=s%(_R&s!UVI{khm??N z7tUR{f|(?iPR^#w@W0*+0ekQ^0M zCH&}H`K3GDR24ebxRI|(ajVG{d~pKQGuWx-7aO*M6OBqQibHu8wU6JKnYy%yN7z38 zs`!LJE9dY{s638}I=7=za2|A3&&eX{^CQgpz+y$>oj0rz9&XpaBt(jEDACjNuHpeq ztNoh~n~6Ih)CYr{W}TgmruXLU+rrLOPAZZ{PAxmS&a1vpRuLA80#cR6G+oZHj_ulx z6mP$}U{5s_n%$K!>mVe5)l_6)nlI84u__u?^$PPXW6ntJXlhzAt@Z9dw>GS(pgC{( z6*;}hUk={vq&c53Tj5xV8>q@yuHtAhIQ|nOx;J8>CbYH#l(zugH>D$#xv|+h!YtN#?$uP!7KY_ zn0WUnoG3GIAhGgnmZi9JD4*2ZP8$9l#rSe?e1-C2id?eVfJ>;)^*^l%rlqN2#R;;>pk4dtG4bK_m1x{HtP<&LI%y*($w051jvc0+Z<#)0^O$WXj0vJ$ z`*p{-x}u}B5u#)O2t&A-BH@dOW5xf)7(s7gg5LJ^>rs4jr25yj4;!d3XyK^R5xo7n zpR@8Rl7N2Gm)0|qpaUJ@Vv*9{^z)Jj+|+vX88mm;kfSr8*;&xHTKAfSde0?ok#y#^ zSWq432$SB<)pS_lnk4iNA4TPA-iS*u~j=xw*Z(>>7fLU#&S8C*C$+z6$sL}o> z+(6VW$?Ly78l{!`&KBgJ2Qjr!Fl!#B^A^8rZag5$96lTCn<;{;-T+ZANPC{l&nse? zQ*%FpnAYz4goom&!5J)E9&D=Ba>w$^=H`oysLD+pOSYW#2e4bz<>9Ql2gHz_gAWt; z>Q>larr`9G&(4x1#jf3u>i!F!1%*OEzuX%jzzr$>*#~g<843-3oG_NmAu(K!BOJLm zR)(=jUFqvPhE?YSmU~~#s-fb{f+Jg(BL>NV2u!Np$y`av1D?u0Vu$wJgB~5e*CXyunM#r0dEu7hO?!bTSgD7@|V=S;*0Ff>g`S9OcBl>maEI z0t3Hk>~jWctt7u8eA(ONnd1BV^v@%LC+*l|K8GA`$H=#cMMjIQZp8ib16b1pqjv31 zKQ?)IETUE1+vANdK6~rw>JEgRQ4?LgN+>hF!>0PPTW=D2(w<+bdo*l1rCAY*R8AQS zx2KDXfweijG-g(l1ThMaiJkcyw$4WhMD}BvW8>o-5^?(S%vH&X1b1b{GfHZ-U9_%@Y4@*!V<0wD$ ziFy5NE6!j4ND~x_3>}ea*Sp>mdB2_E(EF;&6|K-|YMbL$!pXue)g8AU;34p3(r4e? zzls{A`SZ;VhHl_jvZ?&EAKx(Ki-wM@xzPP?zT6^-GZzK3_*3 zvNo6#P=Q8>Y5mHt8thKyev(4mfXdssS}@eqt$~(C6E^g}GZ%BHHt6VmrRhnfVhISP zV#si7+H4o9{&0*aulkzVBB*&y9nP)Qb^cj&w-8pj?0y$V;K zAJRBXaa@{KH!_veIo}T%Y|j$eR$vNv99R7KIY=H*aht?z2F7?2V`pb;b=|{yRsKXs zi#Ov$4UW3;WZ(y|SJFNagBlXX#VKV7iNRawqK_X2iQA_3hF-%l5v9?AAmr|9L7$xG zRnYsRujR^}abK^}aeRJb-V#ewEm|zXFNp(L1Sb z&m!F-xnbJ0L~lDk!Tvz&bci4EK(mtu0aad0umrN1PSh5I3&2cyE|{O&$+j?v-kJCdtY0>Xw_I%YtAvp zoTHE4`@*+Is2sBfg~k|wG-?-I)8m{U?yfZR4-RUVFum+|Gu>8EOU;7DfHrO+?J&@( z&7(!foNB&WEY1L$`@QhFYPGft9h?KqInl48@!dy+uOI?WF;P-kLov|CP;!sg*cG9f z1o~bT*f*hNcSo)I7tdWqGBs$<$F9XedmxsO!is=C#%rO=YvbJ};rrvx-DQ@>{mNaT z)otOkL9SUW=xc~LMDKiz0W$51izxBSXxZ z-Tvi|GT#oqNe?b(MLy_ckbv4Vg@6svp7>cmH}w-?XgfmPJ0NYJ*FOQBX8|GX4(yPa zfXScIF7r+L(PA3d%Pj?^g%~9fUX)8(M|I%CmOI<#+VFMH<96i4T|+X1<`9rE%eqep ziqtR$-~2ZO5;fl#mlCX!!V;SKsglBR!zeQrgQ1PgU{EfrXk`qtKbYL}C9KP}1Cnq| z$h}{X(ta1_r0XnoywD^-v~3kuN)wXz{kR-TA=f5L?k;r@FzpHS(L0bSyxxumKX@^e zvkD)#!51M5UdJ3UMv1vxQef^_X72r?I6=dOD+CDdjMPG5F_a3%&%GULq^6lEe~zw;|Rfe!dSx ztzo)N4XV_)Wr%hVQuGo4O%p_eR>R6CKIkGs`!c>PYSRdZ(FeK(`BCGVJ|hjnzo@c< zv2YkbDY6tUzcM9}4qKld4Z*^fqvq03hATVUINGaVR3? zgrH+9GB7Z+(mmJ8E;a43P?cG~SL?7TxXqnf*zYBY`FuWJALn5494!Z8Vd~m7SI2!h zn5{-bCU^TLL$0Q>>H%ye;~a*ME=MgTGSL#hIr9k>v)Nnme>)_9az&Mj)# zX??sE&@Ye`T-R#F^)D-$dIG^kkigC3Nj1CdkE`W80IV9G<`6lW3SLPBTnoi_+=O+%3aW1>Rq}^$b~!5$ioaJbJZdgFfrc-fO^oeAABdkMW8_P=91g6sp!Txyju7& z#S?g!c|)rY zFvH70z%6;G(ek4X)Ih%2Y~!8Z1D%WUjKYLa1W)ae7@yYTRfDBIN~02yicIQ5m?qe^ zKwh8_P_j^9IL*cfatl-VidR^2!3uh9yO|#0WL@wDlbu;CIxHIPeU*NG&iip|%>F<{;h}Xz*v<{hoY8(elR}yg({X z%9xKe-3i7%kEL*J^ScOf3VYtoKkV58-KBW+_L{{`>H zi23$G@=3`C>G*N7&UPIt(jaA;*Mtl651<~9cFbX0Qug>HfaoWph4 zqZnH>-I(w6*q4iz?@swMIHncwTIj98Hq>JbJ@EO2=ngeA3d-a3-n0$4gOm@1$l1q) zcBHn{NA_)kuKV9y3hi18G1>mh3jm=lTJWGi_adfsC4>Y?jz1I2wey0nKq%XTIW0y2 z`g!=IsU4Vuk2#KmNbIJO+$ahgAYMV&f148{OvbW}mTTxa?ZAj!Tomq^HrVW>PB?=*v_W*0~D; z>|04ceb?*I9Jca^S?KW7<8sq+3Em@)!EoDsZ9mIj{7!>K>TgRGr*@Z?RF+z3R83kG z;klhV)Zin7)3Eb^*K14H>p1VlJxQBEYAPlKF7_RAzZl>~cfV>`2ug0`gh~nS#!$v8 zct53=P8)cXh~UswT@3E1zRh}#6@5O1JB2Mh{dIw~qN>4T_;KzE$%V4$TIBo4(24J0 zbiMoF1tZ^ZUg(iH1b}iVdNL65eubKt>Rw^_UP}(a*Sa-fq?ZVlSDYAm#Y*d*roeka z2k6rY#;f_|$xex6&rP?`T*6s9J|_xlIQN0nDR5)G(&4qeeGX8V6;N^y-49VS7YG;{ z3AC~5YU_^bf9g~h#olpOhm6$M^qf|1L3{BtC-~mViG|5f*J{^B{i^az^TgvEiz~gt z|K59reNZss0Uo+sFtyna(`(TzAo+RqG2U)3v{ZMTp~7eMXF3F9w6aPw9E_rF_yIgAcgz!inxZt%fhCF!Mc$X_ag6l_q^Wd zNmfsrn?hqc7mWiAcg9o)@(3rz`6tGO%vv{^ws|8(o%$;+AvWC?^$CO1nb%GH0?J@A zD?;4+}KPd7u0FouinUyP8?URRs|dwdc31YG!6!axP)DQ zx&Gx)z*LxSnboh@7kNjTl|P%DZsxIXeo#4;lqCSr`X@vZljDf4_(fE!+4x4zr^jZg zD9plG5@M)82Ag3(;AATwrrg!Ku{OM^wMn`J$$ltfxDf@pLw|AZp}9kJJ5Z|yNXNic z(nX==eS$`5u{V-L9)n1;aWPpF@fJlcM)|}27FN7e=?Q0KoBO^s7`pmY$`uTUITHiq z{#0|qv)Wl}XV!BHWy)Bm*NdHn`F2wKgD)e^hKjIUaDjUfruqC4*Aq(m)orm!q>G&; zlilr7Vsl9dPF{)lw0WO@P7_#fuqN%T2o39Hs>$$}?p1REj@MCahKp5*simtNR0fV! zvhP0kzR}J9y_cY5T`khJmDnG>mkx}a_W#?M_DRYV?|v{`%?%Is%=Glfx)O3KZOPbe+vU=#5oP^|_>#qZpYD)y(F&~-xx#lS0@s-(ACH3J+k7oUPGn?jo zw$D|ITa%Om)Lhl9a}5&jceN^=Cb8l^>GE6A?U9S7B~C#l!WP8VxSeO>mPs@E4&i#WhHb9Lr0cA*qG2N`-=xR=#J!$V#D*x;I z{VUSefk^w$MfJb>*D5?N2y~xD^dWLlONaS&^4GL{zA*h+wH6yMI=3aCXl9z=WaGF^ zP{TP1>aS{jax@`y@3sbWP!We6%z&0<9yhGB4#bixnUYK|n181D%;lM1tN|`EXZu3B zJuby*A8whsZU^Ssiv9#a$Jiq))4bE-h_<@7hSWYg?weQswbXb&5PZDxqsvmiSmWq3 zqNoMth&M6a4EX$SOA+`#U}3NOyXQnL~hyea=<%|IAf-|H^!Q|Hyn0f`28Ke>_oYzhd=;knFd5 zl&&S7sJ=9kGfp}#V6sW7e!i;*?lUp;9~t!j_dd@f`d7*${YT3CU;JE}1M7n|bBclI zUXyLIwUQ5WV1o<{_oS`b8@|xd>?!nk$6G>h=mhv|)rrZjpCc)r%xa(QOVj&Wl)!!3 zRQLh{v_6Vkv=gz_rumbv9M*+pd4I*flXDs{d?kMkU-xbR1*q~AW@llldQ)h5P8 ziA@QcEkRbV%Nt=nU_D;`XF~q>dTg61=Nlv{zHxZs)YM|KXk+CdrEeYL0wfSk=Q^Y3{A$s|))~PzP32kjN=A>b6wjF^YTxN`5dAnk zcwB?7A-JJS8(Y0)bWcpue(D#@`@z?}ShrN3al*4T)AVce)G4;_q0oYLk+_~gD#MyMPKe00uSW*U3Z*uCVXC1=NmRp6|R@>%_$y-+gNOY1TJ_i2!%INsy@M4WT`Pjz~ z063T;_AMNfa(Xpa68{CuTWsrLrrc=hvzIS)uMtR6G%lM&@$8K4rV`1i%3=&n!f+xH z^R*FlmR1F(W1Xf+re5a_+z$$?#`)MU9aF=z(-DXd^+RMH7E6 zV!hGWM(8p~+|sRZZVlIi%KsB#(@$FBb%lCponZVO)#Kh*a+k)8(Xm+`TllPyF-Sqg7w(AB(C zr(q~rUbK-$Msmpph)D+W4H+&N0k%C5%0HaK8tq0D8=*aec3RCJ*==uKB6LWyo-tAD zbvlk(6FC@r3y?{zuGc7@2zPgP6FwR;hg}1R99#8e4p@X3uy-Nzu7}Q3ekzCEN+fWN zBovXzS_w5e1sV*6##slNc_dCB0~nmPfr1DXD6U)sPXSiH%2uW6<<6h{QO$wI?d*ti zj6By*yHJwcxnCCfK`*W&iFw|91aOd*I7L=ern0(h-UmPi(8$5K9SvqlR6vQH7kOwgg6&vmib)t}CJe_37Tz z_AG)Q=Z6crHf>3c@lhCH%Vk-C+qwKNSpl{^kpwBDe2bq4LD@e)&Q-dCU{j>K{;Bgs z@P}}LSU&nbT);Z6_cQ%O2e7|PfheY*O^(-{6p!Dg_DUP|QiMz^1qgXY|(F}i4; z%Ru-P@y85+P;VH;GdbEspyx()4+u~+)guI;4=Y%{ggyW?um{OIDE`?({7khB0%**& z*z!_7yoP*)tH2cB?g7i!K>^YPsA5*WGL?;TLd9^;NI22cDJQ6^XKQS7x{7ctW-11D z*BT%Kg|1OU8ShALk*E+(YM*6U06HqV52%6+0T?#k(*+V8A+1V`52)kJwkJ!|S7%#& zpTyQF&vZ3X{Z$6tp<94pfccqf?UZr}Z9YqJXJUzvoY%nw*YnexJaeN@%YsqabsvJ;cBtX7k?5h~)49e^zK}#_uL(tW{ zJTG^(DPeZzfTe-&_J=>#1KV#JdL6&yJ#+Zo6MPtKK7+)YP{+0w1}I5gb2LyIWL@k8)t$Sm$#Iq0rKKKedgfsfA2A|Kdzom)~jV z0g*mZl-7yPij)^uUS9A}wI{6QS#tN42~AHpUAw<6Cgnr~|qgoq!;$P)#|8Q0fr?9Nl-NBwlq^(0kZtn>u*OF=-d zi0fIf@C>18&R_|j8(ja%ddwXQ!v+sI7**D+6r7|U5Uwh(ZHeV>P@CF+d*gsoCGhpr z7HM6oLecodM6k=$C(S<4d2BfvZh$!y&~vcv0|F#s>G!`aRAOMGq+zlnUh`0oQxcCU z22B9Z10Z=KkP{asLIPvvfZz4HD5mnjN@w9D44T)%+y|N#Y3EFffC1yK^bpgp3D%2%UOg@jw((2cK4>-+LGJ>PI>Q7n~Q z?njello?KicPY~O#5cWQ*qD1VLD%t`!9G=y8>xze>B5|{-o#}keeJpWEy~<5*EQno ztnuHp--c#5a(cIC3l*|O2hGlVuXwiRkG!6aH;pEz`ZW$kBz^BI`0YeH%JJh1G}wZE zX6(u1J+k*;dwgniotUiAyTq@=vZiv{VG}L!1|WUI?pGgxepGdC*~xSW*+yQP_Qn*8 zX5N(3-_^$cH&K4~g1+H3iZ4sFEDL{dD|A8lYeM2cmEP!E74@jHK?LYxkK!@bKw}4y z0prx6YUnmNCtBc*b=45BApkMIbOEUcLj;6&dek z?1_HX_{@^x#vHVH-(9|!t;a>KOz=4lyO2o3AmLR?*Yf#+X;m_^|I7Fz{z#6qd*|#7 z(=4GOwCXVII?$Xj1)R5D?+%Ddk?Fx#;O$Syxf+2YbBMSfe$pWWMe5lD`djERW--34cMC@eb+(b*d1UJ% zQixy@N}N>Gyg|f6Nfe#zjN!O26_Ih{X1`-|dE6M3x75*C0^5`i?Q41IcIuUfWsQgG z9kDIEJpM#i>?78luG!Yw5tJ(7*6Y1kJt+blEs5KBulj<7><<}fS@#6OJt-ujIp|Np zrL(j&PbqBpI9e9xgn-b1yCP=3f7Du*Eg`rLRVLYoD9C@MpiRSjuHaA6^4v4B|i z9k92nJA&mv5Gfi`%5Px`RA15Jm}Oyjv84889swC;DFW$m;l%*02C^(p2kdY7^m3j( zEu9C2XecZj#D<#Ly%3H~5gO~~{T?}b{#jDApri0|{FI4#3Dg(6OxGU{GdNpjOr2@~ zuKK#B^pc(y(d6~8po(c#1-7TV55C8=BQ!S1r^>&=-}*DUwTk%<&c_t*pG~Khhb+0& z$xv=w-L$dxdHRarDWH*W7?*+<>1iBZFF`Eq@oSMUh5?9WNSthpMgrb}OD6{3wwvVR zj8|374`&00i+1GSDCs5Mg|6c{s!|^QS%x}A$~BR^6BG6Is@jJF1h1^FbwspIabxgQ zK;qqEq(J-7Q^3yJ%BUadn%mwl*I2q!#DpIWV6R?fOR7(3{m2IHmU8Zcz&z%FNP zxM!-+^1*f;%lkV^*0bnIp0wsEfXw966ZkF^(B5jHw#i5(zK_hbSx3g$?245oFSKdH zP><(d8b7gA;(u88kr8!sVk5apj=DEiio7>&k&mxbw-qXWu}*Qtw)YxmeLEC|R%eJB zcBUsSUOz8Drlh68 z1ZJj2pGW7}Bc<-n6d;@X+0dTag@ww!pgQdE&4+}>R zuwN!-AU!Q+^kxGv+*^sIwk}eQu<};G>`MWAxrvLfyp&LnJ|B|9KR_cBiSlLMT{eZ+ zMQ0fjL>|WUTlDb+OBmPY1wD4~MvOjpr3X;6W%iego`Xw=k|0^+W?3e9Ic zW8jbLH3l8R2?|ZiIm+oZEAgtLYH?s$bg^5>HXK+* zqai9d@W@IiMcJ4?kir^eJ~%3OB}RQwkTrHUkQ7ZJk$OBCl-v~XHk#v_b8OG@47#gf z)av0iV7jeYaMktZrM)6PgD0EcW2qkQ5?DJk0z!gp%wn7G6bx+zN&!ZHf`Qkrn2e^U zR9sZPsXt|0{mHsO;50vkpp-x_>s_#1_dX>>Gw+cz*-zDxc6H8vmK^;^Chv;J+}Tr! zS14kWUz6mZ0rt5+b7yCX-S5S0S#0FsHfu!jexRdTi+Uw;B}+T*NPnXfSmpdLmePM) zq|P>AzgTtgwWXbap9N1$y0oAIrrtjeuSpZNKZf)+i@N8VW}}d*-f#Lr(L40fU7NmdIf zwbr9HIb2e~K3&$fT6Ez_F<^2L;{6E0!`xJ+LwG|(K*3LY#lgJI4 zl_z1}YrMqNb_%k7`dAbAndYf-odN;JVlZV)VYup|b?i~L!9|JgYZ?V-3b@{(UwT7L zCi5bZ#;xn(ojcwWWkfwztms?nWi5?SLtes1<(K-EsTVX81T4kFv8{B$3EE*oEd=5A z>vt(fc()j+=As3JsB-*gX-Bp`Z{=q+m29GQm_O{^{G);{Z=;0aA2sjSiu2;_T%TzG?lq6wYaRH~5ZA@U zfwLty*Tr1a1&wUDg6H>Q!#68|FJezh* zW^GY21`I_vpvEft3+B&pcQ1%YyW;9K!}bu$2G$$ zyS`9D#2-*r&?NI>5S9)XPJ(_eblR{>E$~}a&{|i1im}B-zc4kL8Btu|YcbMgfVD&i zPqj|jHmXk-?QV?PXgpV_k9lKdLpWt~8Y>rqYHDDhYf@@!T$7+1-PDJBgJ^M?Jn)!3 zBD_uqOACcX(OJ}bA#NC?R9{(2?gWy>-Jo8B)>=i=_Oyo~4-6c547eTZ2tFXI`y;4X z#>Poi>li6A;#kw3cNc#ASQzRp^_jSWb8eBeLXK>GPFHy#k!;R*tG;F<_HdAB_bd=L z)?KJJe!E8DVu^C3n?@Y{3O`mdtU~Dycy-5EFyZ%^_@>m^RZw>R z@5h%_oyQX7TQYGxnk`{WX``K?6ukRGEr_S8P|nk+dw5Sd@g7*Xmid+(3bJ3u7;8RA zink0ir+uYaG3t?wL9e=AtwB9Xw9X_|!+l;J805hSu6FUbvhz`qxzCF^o$%hAr~8~j zUo>Cgg1f~;AB-{Qz~+-JjI!1Y5}6dF00`www!!av9^no!1k|;#+LCy_UKE;*WD+B0 zQ8Q{h<02B>fA`n%mj;l>R4U1kAT-uGv7BF&Ibj{`^}RFY?=bsJT&iSA2_f_~Od$P>2RqTEntl;v3u|&k$bW#6|Pr=r(MoS#rJID zD#&7QE&y)_jjVQ=+cAahpM?dnY0A z8yVNm>G@Qbm>W3Q5gmvnpjGQ3`7J)>Oj$V+Hr9I(d6>%D+E$F&fNu&r$jP`#-8Cov zAQ-Sau!dD!B*%c2>%gq4(DLkobdj1wBK1!yE1t*R1%ZD6DsIs6_sEu{I6E5!vWi$} z;WLFq9G+@ep!19^JU837hNq6snJN&4`_KV}G*eivb%1VG;ezgch)7SN%B1bB)SH@v zDX8eAyqwT}i8JdMmYf(hY!m|bJmnK*mpuLtBr2J6(i^Vb4gLt0c9^1&d5Zm7cc?HH z(()KCAR;13jme9m+a<=C)>`Q4k3|f>1-yWm`jBe|HNwR9R~i%Le0;nN7OIl53x|T1 zl4C7(UKDUTyTAG;l8%K!_}za^?7Z!pc;GokYDz$-O?YX3lD*8T38p?ISvVhat&QU`@ z`_nc!pO4AzprP{4n8de9j<>_(hC-VhFN(_VDQ1`7Nt$=r-AS{W3VE{o2(riW&ph^= zra9SajoD?hqvaAvY9~e{3GS6toh!#P3M=pUG9y1=Q^c@XE3T({W9KyazY6H6+3EIJ zz3d(?r8u{^n9$S=2n$o!V}|1h)$57bdJz9mK?f09L{Z|-TTxf?;ib5vteC!pk_z9K zcP5VZU}hT1zNDk&Q_GZ5`D~itiSc0@zSb<*IZ$XN&1`Muo@VKmVjz;E}o4C5rZ7du29b_vQW4rMBHk~dkc%eU0E#lVfde};?`d!{R zHqsCA^(qe@?($vFn4wdQXSvEGZT24(pyGa3W^aEq6zK?kN4q2tFUrXqxd0qWOW8!J z(}l?W+4Q@Al4FC0fcR}RB zp4$(-A6MOdBYBp1&gXpY+3%G<6dEgss_?tEyrcX7C@6yoV8d7;(vZ_DQ8)dp5hVT& z_>*vMg&&a4#Is3z6?@Kpd5~lbObmhb6VDbp5$FlTB18c;%OaA0YfpVPJZ_yG#*)M} zL8Q1N!`l$kH>u&QRmmxb=$z^#%fC+H4$?SBBPumfzyBi-Rd@Htva^Va(Mc2)Z;zPze&|;&xJ{{$(kCH zrpRKy2l#<0HJ$)VCh;vJG%9yYzfl&-`lYPr3U@7FpP3i>ITO2C_M92jF|nckPLd&F z)9gu3qZB#30uY|>)YxSw1N7Na94Ie=I~unx0gFeRXFF8%SW?wGd17E!Q7-}m+NKcJ z4R{vmF8K}5rMqj7K7(jimQ3z7RF|Vmo3tj!oP^Zgs-P7FItLZO1MXM#Kq}jYSXADx zzAZjj?()WNJs{YZ=eR*u>zy~vWH+OVvu6G}lk_HE80Sk#^&m1$L995@6-F1otHaUT z(2F*9BujtAxW|=TlWZ~y6W{9Djjn7 z!Fo4Lo#qY>QQmX4JE9?)s=3{y-&QW5Yzn2D*g&4!fuAktc(h*=@60v_iEeT6ecsYo zrkE?9xohpiY6vrP9kL8~9^DOv6+rFhObjY9I*c zOE={8uK1%EtD|lBEl6fvdD*5_LTS|?mQt!BDw$0z_bpaq8x2E_!tI<&#V+2Xd819f2~r%`D3pt5SMq#0T!?LK;^Ztl!~$^hXt2 znO||%hC*dwyiPU9CamJ?5oRMj5P0f5KR5)I; z5xaMV|3y^%Z`Va;1e6r`04}300^Lyi1ZbxN^-SkYxCiBn0J(tK$?6q=;yV_Gzgr&V z2wvbZdf8eCzr{L&1gs}$95LYn zPK{2XY#T5*3$odmBlpIhw)-DX^EAq-8qggbt6PeLxgPCh3`ul3nxS1;)VmI1ib z#=t^~@%3HAZTz$hoNKq*fLN#}p#F5%^iSi zOU_8$FSANAz{vUQt6Wm2pZp$`9`*Ps&SaktJ_~7$)R~PTa-cJYvB*67lkAZgk2Jg( z?#4BRu9F)mFGHH@uqHF_QlCoaPh*w6_uEi3d&uJw;p1iE9LLZO3f!G(QUWNSA3|I*X_ zCr5x7mJ|n)PeaGKf#fbjjF~MhX(EVJ;qO#;F{vAxYF(T7WN&0o&Vs`c=M-j7`X@JY zf@LdA1%fXZ|7_DmMgSp)3b{~HU10PwIpX%e}8+s}F{#*gEuYh5AjQ`W1lko5<@WYB@_ zQ=^*&BZ-BnmLxj+2ce@FECfBfe= zfz2)+fDYvtRxXF>Ml_jICWnq~{YJ;I-~lP6O$_*fv1FU#VcBLQ5?d7_%SE+ z#_v#J%Wo!(Ia~k6FhFRJWNX`WpV4j~xpMk51B@~E{ruk)$y!jHw_9RiO_*c?yAhQ8 z?(d>p(6;(e-jMRiNkS1b`GeqptJ6Ye{4-?K9c-sSN=>xujNzoSmV2eYFilw!!>rr+ zc~VIo^6c@c#HnIj0VM{#piTGw;7&2_LMg(Z3SxKEF#!7ED+-KKPO>LVU**PiPw>_# z>l-9@h+zpA=nmZ4!WpUr`gO%ssD&0F?S=7Jfv1th3>c3O(HJnILrT)-8fpcp3DwfO zXsF)d*4lVf*;3LXUJ8?5uGET`ES|26w6r=XGdealvx;aI`Yl&ikh^)$L*K`%;f&PA z`=i0T!TTfrE#afv{iCy%EzO?^HLa;1`kWzH66rq?TadQ9=+KjfGW z7G3YI1)mxYer?QMy-L!O5QjoP9h|Rz=No!h6r$l#TGU?cyyFr6Z5K+av%2E*P4(D_ zVT^o(hS3#sMs15mNJJ&any(J&i^+nloR^q{rNv?&-Ij33NuXxsqHR{y z&j4aLh-;M%;F1_IvAKPFj4;cC6ILl%88i`cH#XFmyLAg`RL_71otm2`^Cka!Jn1iN z#Sn5s5+jY1kOF`y+4je&BluKG26+Xyy&Md!KWL!bET(ZIJY$OeZJU94CG2*gpZf&-b z$xOGG(#?uaS_^I&1Zr%B19?Mimy*usQ$~?Xp-?F?B7rW*Le9AB;tP*jL1fv05p9Bx zcXW>sHu+;Y?;jSv4@4m+<~y0os1L?wiDy5;- zD1S{#n>DITK6B}T;9pJWKmN%X5=mQ6Bp~Qo<@}Z155u>dW?xRrLF#j!9=9lQlul3Cw=Y|Bew{9ux zgc8@XN?KTtE|^hE%To;edj$|Dx?u7I**U2icFf#=(vyuYWPrX`R)PLVaJC}Aw#gIu zv_Cy429EfsNf{}<@XEc-@5vF#`m*@<>!Q2>N+eI^*@eIx~$Ay+Pcn0E+LFtpHjap z7L(*zL2O2?UmFRbMh)+S=nY{8?X2I=ot9x1$+YrHu4Yg*Hmi9!ySHj1L zpO!@e^3_%W8b$dSohGAif4dBr(bs7mO73`?|KkHO$Z#Wp_h@$`cY9NxM>~@lt?#Re ze~!;9c#S~+1|}2BV?ez6-w~)a$xexqQht2Za;75u&!znLrTq?l@D2KUvBYV?nN!19 zn>J6{?9B5c{ZE$~;r7+9Hi#{^{kuaCHIBFcnWn z{3w5)#)sR)w5`47KZtk-n` z?EiYTB^Zkd9RcJ&3*LGA&R{sdT0T=Qy_>0E3pALoG9L48)M|aU$b0VpzDe7<@p8?a zZG-|*)Cqn-!_7C}`9bnN@bwo7XliHl_(PWvdcJOM9IC(?se*G#4INWn0pi& z0i|0HbD41E&%q%+aE9IBi`}TN{@OwQF$?lBbBk2@8Dy%H9s}ch8_4kI?13C+DkQX4 z2XelxHZ_L9pMIS%cn=nC`%bA?=1X+9oksek}|z@-5?+Df4t`+5>dwh5UzgYiT21n_NSHsW|UpF_F({d=_`s?RY-% zPlr07sh3U@4a%-x{mPX6xY%HZ(P1ge^t_1SEKCM-*8nadGi=*j1nE#l!ZJmD^Kt;1 z#3XdS$(@OnwioZ9r2zp~H-kO@=Bo8+!D~lR-?HVZ`RJlFUTI*jdFa_=HZ5NDaY7xD zf?;+f?Wd7}1xGpUBO3IlrpD zgSq_bX2iE;#_LL!5A!~gjr%=b)p$vXO}`-Dp4 zOI;^fT88Uvq5J$AIYGRD<0Kqk$%SVEiM-vB>y3!1#_Y4pdQ3H7``a{Q5Qt$!pr@&) zKAC&-LkWY2c#1yR7a&UJl(E##SIz*3(sV#HUgLgXrB5=WG?=h=DgVjU=A+BT`yr>S zyZKF`5jUB$Z^*(0{btlPl*-pz+CU9Uz69Wq(a824HlUj80Oo8j4DP3nv7aG z-u!yN%0MCJZXG4ADiz0zG1cQNACgy++w_Clq2Wgf;gqA0>L#T4ZNAo!>zP>(h^`%*KPtDNBd(oW*7GX7dEzVnC=c0YhdD2_ILd{L{bUG7ek;w`wnH-Q~T2 zhh#sy4-Wy3Rb&)8rxkPt`I&u#!z0uD0YRq@!w86^`loTp+<-1#@yridi1PQL*Onk3 zU`T5WdJ8aU)f1{4cb*=Po{WsT>u&+SeG-=uMin~QD4I9Nu;Xl_+sMCIVkj35k=-*q zUn(@aQf-prfnu_MojJ)^6WXKy#wCFfc`a_Ay_;jv4zZ5{!o82#p^%uO>NS4fb7o7im z23(qL0YorG?V)as>~MOJXcqQ|YX2Pr)XtyE-z{lHvw)CL4xQBdd<B9&I-(;Y2^91$JEVbzy?UCpxUBM~i|>WNj*Y5t2*6xO5> zu6rooEnw6;whwp?4?Pp()WWU-F2ln8zL}^MKC{+na_w=pKpeq|?ksB49;sdbpG}*P z3%Ao!&(r=XmOT-Dn;(ffx>6r<`}QEhZztK{V@)V;GDzh#%@)5T=-(i;3)+~FZ`d_e z90<-d9!yeq(s?G0wFs3(>GE%Bi=3H0JkPC{(YK2Qqy305m|-!P7`TG?rj2-xy@KZ{ z&Vz%8u#`VN-tj#X`4=FL{fwQ(*WX3!vs)JGE>Y3;}oodK4 zS1n?GSN5gZYM=go$j%4Pr4)FP!VnGlNtiwBpT3BY-K?+vupNH#k!?ITxc7~{!iQte zb|39$3=n&XDnPN%^PGs%0UPbHioM~(XwRj)#UX98jEVU@y(>#{z`2gg|-3jPd zhceG1UR?Kzw(tYy4(ZQFbv5vEZo?t)MZCABaV{gCi(K@s>*KWJ56@?_8Nfrp*wOU2 z=^*Nl^yhqq55NBh*zfs^e6KZc0ppT+$bE5qdU09Ho3h%O&*|l%`^jQ_^{3`dpPF0^ zV;y+kx(nL(r91f(x%b5)a`27}>u{Rz#rdJ#EC6Z*2^A-C>v#FP-HuVPUbOZutKkeG zi`9fyQ(0oCUs}#GHUlZ{4QNozSCD|ZZ|WIW30BFgI$?cy02u4+aHGJRLtG2Dezs3p zgPYtm%ZH<#?|lb3M87ue<1Burx&CM!Pm$TX_WJ;LiatwO|Kt|15hjaJxP2x?_kf2C z(#He0HikH2C0!7MP%WZDh5D!62QpCuPH(QG_Sc@r*=@Bepvud&+zQOrut{vi%a?dH zR%x-$KW9x+==&U5QbP~$5vNm|I6XVTJGOQnvYNX8-dPyYQI2QEdQWu94aCoqTkq-U zugNbqM(I%S?+?GUS^;bM3pcQdd`Z`Ma<)9H0DChpPOWkniKB}nio;(CBMoYwv2w;> z&W8dUksFw@R}BUsg>vTNo2?5BQ;jPv>hy1)>0{|rO`ALw#KYRn3p7xk zY3%DFUnFGsd%AW$Jo@9`$t~RUGV3cGV0Wdnn%ZU-*OeEL8TYGAzE=0Tv(p#5{2sX< zj_(1x8;p9-evM3AL04hcL`tmDOw<{YrR$zefbAfz6sJ__7Y-3vI!&sTTJ97~#%%#a z6|!QgM6fTwsXMLTexT;B0VM1>FJP~U@QLfxf4ZIGAUd-hRpytaDHM# zkKBjZzqML8>*|H0&=_>OAG`U<+|~c@q7`U4^~Sj(Y3w8 zDrJ5$0;O5kT@2K2hKM)KN8U%rish;0!09OPD=Z$5fo2w}NGg??t3%ViDO&_glkE34 zfWLqPp7)^0U#4)UVLJkLytPMFUk~g3U)Mn7Wc=9w@Lyg4L{k(uP+98HWWiKu!~!XO z!0xHYk1OE8W2bVOb~Cg*z{ut zmCg+rN~Hbj+CZ?co~%-gOqR^$9m3fGW35s9V4!2&1BYwb)} zQJwMcQzw7!Z_d(5%37(eBYs{sOf{Fe50{OEXLtqpo*w7llV7(X%fLkX{vQA!LEpZ2 zzx&-U(0J&F4{d(Y5dzxvg$#;!WSKMO#D*ua7kACTWB z82I52f4JeJ0e+Z3t z{#Yk=Q;*}?Ld8JEz;c0sA$4k!158r7zhk1&}SY@bM_hhn9v4aVPsPBXVF3T;kF64P7ud6#NsumgN0}!{ zw`2ZJce+#9M)vTs%P)&ZEI;(&4@F>xjUqd~G@5e#{O3PEWLZ!|fJT7C&Up)CAm&y* z)17uqc!MegNE#KlPy9Dtfuq$t~%{Gh0Q#(}cF82s+ z!ls*T+E~cJ!+;&gvg!izvjJYg!aoy8vc6%Mn`D7n z9y=KMh&%4MW9)>tKC1J`6F2h+`}6|CH`2lBZM(Ks zF;Fp3F|Z6_pl2SjdwKkVV`tZa9StTX=>QtF$&ks6T}x>gq?z3KaKX_(I(qmWO3H$q z@WjQ?A7#_ow2~`up&d>dr&1fhy8-|8uYbpmK)V9HU$FZ~)Qev9qUhrlS6mSRNoD&P zs-b4&b|BAtkI-KFR~UBS}zQz})@ZVd0*jqqe*9O14ehfXNzvFZ*Hgsg9kW zxpQ;rC6`9u1^bWdyec3HcK`I~o9?Z8UNJBz7{K@WBTIHB`QVjZxV~!bl@kK)WP#lh zcn~llJAxC}{`=Ypj_T1`v9eZb-enzwTW}Al&$E*MIKmXIb-~}&;M|X9~VhvuyQ{4sG z)b)7KeL*lg&+%ybeVIo+xiFQ1HuWj%2k@rp#D=`V(?j{#8bL~RYMal= zF0xfefiQ%3bRbVT#z+=51`RJj|0S6oqAN}C;nqbYJKR@m(qkfOVc+@Hb6w8AQ zvNg-2y_wCl#s4N&Ciw#7-ka%BD3cfOG;(f|B506-0%iP6R_tmxt_0W;2fozpv0bwI z@ZW8C->8UOOMUNBP$&vCbgLC&m9y3^Z(n%+UoMnD; zc*6}hM)1#$3XkXKq_Mj&ocYzcyzwjCC#{UX!eC=S5M9vW$Rm%8$9;YI8s7_Q06_v z@t#;aSiLjQLQ?MBQzt&7xACj%)c?tUzPjrka4&tW$U79AbN`x4~|#k>6U*^?n)6wQly$|pYfsur<46#}x)aZ&zgLs>z50Y3}G zK7!)u6Zp~&A2VQ_`G3|o9mnoiN1vD0r?`*Z_NHU3wT;2Xz@qF;s|}`g44l)6NdYAZ zLO~UUGagV}m|vOJNp0Imh0?u0UOjW?&WYREc5hy7q>xRdU%lm*`|CoM_Jy#$m|#%G zr*UtI$++&)QhjL3Ft&U&F+QD)ehfk#`iA1-*}6Q3AG z9eupOV~4(|`2P35zd7Xnhs68N>~!*87!xPEFno>JN_T>HCr>9{;_OLx9+JtpN#QLw137soAs;y<4*xTyCZyj!^dtCJQgT0Ctu1+%8d!1yf1v= z3nSRBjGcdihWP$D&v{M+-@U9Iy!gd0j(0iTP-J@R^2n7(rM$y0-xcW5C$g41ATr>X z{3H;euO6SWFyLKhr=50M>{e30FGa4s_FB;=@0=o=naWd;&Y-2tJS zA8^F0@X#-Bw_H7+It+C6Q`)m^t$WY8pq<}AWe08one<*xL3>AF$2zb8C1~hzdtX!) z^bnwT^tkrCpHCm8LwgPSX z5c^3OC}?GXeDD+7N6S)H#_Om&=$0~+GNq0sg)G}`f1*C+lD0XS<=}(=wdIyu#%oZ# z+tr6O66`4TsIJ|7bTeK3%2&QBZrg?GBOPoI9s`LFfy30@bU%;>?yoNIyUbTfNM|?r zWFP|t^4_-uvG?D9|9JnU_h#a0z@B6~f`WOTek7JASKd|Y-F|*P7-Au-wS^;mZwzc1 zo5oMH_yjC$Wxe@|8Z@>8Qn~=VprQ8@@+|?m^Uls&Z)?XJiA(rL8`*xh3VrDETK8U_ zD~GOrSx48`5nJfipLrHlZ`R*?>@BaJZhO7?m!<2}C2&0m&`XP%?bC=}EnGWpS5_!a z;q8nUgf1yE4c>bJtVr~Ndl-|lv06QMu9)LU2Yd5(uk8%cCywoSlR|Bn;4%Q5Z0#v$ zOxeEG1L=(QSRik%-gS4qWd3ry)Vo3`q0F0%n0e}Pd<>vLFK(sXdh2Zk_wA!fV9WvqQS{uN%0E@Xz%Ak9ACv9pse-!Hckyk(Iha6w$_KctE6I}zy z2R-8GmpB-!lg5NLE3fRMNX4Hl=X8_bl0q-O^p78+k8pl_@gXM5ZY^maCsHnPr|;&_ z^u1kf{3bk#uN>*?41&3rKAv>=b&Y@UzcLn-;5Y3I-t)m5n=j~mdGN9JldqN4mTPrt zZ^a^ecU-0AVX{UK>Z9`7R6gY)^`v^(c(fo(?q^vzL4Wkh{^6yxW73=}V?4^E<+cC0 zHrmpr{N&i!-Iw3Fqu-K3_DTKD6O0j`(-BFpyq8D$^;bUlF_)hJ?N+KGUCw$*!~E}^G*C>?brf*lFkg%?~HTdA#* z*ny%Q3PN7@4c4PKzy0lRQZK!OKr=u_mBh5d2fO7qD{pDZCW)%$I$0 z-HXqO-D_9avOdR=a-;8!mEJ8oDChc$rko+GM~t1Iu%CB>2~gmlq;KLb$Jl#qT$z?* zEKL+>6?gZZI>x%jm*|fE_`(;nJU;1>5WiHe*~aL4^Z|YPx0_`K{iy$fe~hSikz8^4 z74gW7$7aaU8f&gGY6wXa9+vTgHm$wx;(H`-n}_1|$f(s#k2iRK9HTh`qwCDz6FE!V zck9fwET3&>o__Z;@7VW7`jB}C<*3j2m2OP=K_|Nm=p&Aw09wj{ek+sCnQOT5qf@1m zOV^H>*42G>MtJ-QtZnUc`hlhj5S@KwmRbXFU^qvM%hdc<`e$vfnw5981=5#+hft?k-<~^^p|2DZ4f) z%PW_4jE9%Z)0N3?*=*mj3(B#v=azsin}(Q4L@~d&4kAUFy&SsGG99Vd98i-vtDI#@}XXBa2Dk^ z>67NZe98i8`rk{-nZWmCwTXx5C_B8ov_AEyqj4LvW7;YB*k+q;LZ^-NVPPB5#ZfPx z_PZyoU%pK1S4R6$PIM!Dj}d*D^L({@c$`q~9BaSx$WZj}}96F%sOoBeHzWQpz^4Z%LGHlKra@ie3Z^o&)ZV578 z-3CBe*aq$0I^L1v(G*GyKyWZZQ3M3?PQ~zgf0Zv2Q6gTV>IJIa$zyB3a<=m4Bvl!8 zB%wm63uAE#eU%oHF2A`gEzR&`n~t%3t#v`{P2fePF~FGJrkKnn_U_tzi2P> zZ~#HloZgr{K;DY+D+Xz&C-1aSw*_w=|G3A;S6<<+AFp=PoWqfy^TZw8P&`&1yw@ag zoHXg?LpO3OV8m#8T)>g?QfF6olOCCdCfOf+5E3|!%*da7V(_l@HT$y=LS`sIzwn|7 zkC&PEg2y&q@{*T?EX?cnr2s|`2qLf*rex>vakrx>)m6$ z=G));cI<%VZ$K2BCf$uOWrB^%`ry*oyZ7c6`;$1t!w3SNz17YZCCz7M3X>nr~{eg2q01NUa z&%j)Oe|G(K*9UKYxad)j=007xyB^UZemj>w`kd9s`_o^{q)VN(PUJg%?I5b0%~ zF-X1=u<__+7oPU?r#1V(X8&0Hpv%ZcFTWb2MO;3Mqdt>|KQWRGkx`!KPb?| z&jIqI%iJPEIhLfIezo`8k9v5=v|y)vDO*uV{4wqkdo(=Gk{7tn{zSr1nz}M?rZ3J> zA6Hyy#m1M6cinZ@g^Kcz#25sy!N_=9Io9@xC!84b6|dzG;Fe~bc618D`tZ;WkJ%x3 zn!JlqeCku5idPfBBm5>0DvKtr6OY=J=AOCH;fEjIoN>k(@fs5IW>3|yRpwXv2fAgY z`6-`msejbmHA)TcAAP^+=9`9N2*3XIuVY@AxWZ5JRhu0aELadev$kdiM)a7o)`RHZlX(U>y`VdbZd1P?QUDNwF?_B7 zB9?2DPCrIPfB>^o1a>gkrC~xU(yqMs={U-dL8M!)5F}DgBw0E`LV$W9n5yJO=mZmE z6I&?c!~@QLf(WZ}CNG$!_Z|ize1u z@lFOBDNssZy(YRG2tibmM(svH@OIg?2(?|VPueS9`TJ|Ff&5A#*a?@2ob30(I zx_dvBppwTqIaJcfyTg*twVC|yJZUBE>tFwR z)Ts~3q6a#q;~|iAhtkfiWfx5v=j;Q%iB*o$C++KB@{e}VD*KFncm<%RduXiOAc6ks zAJ}fY?cz(na6(UT$lTNKfBn0>^1#0`@qkY}=@<8gbd<5Bj&jfV;WgU``jh}1Is*CS z14&os@&N(lV~_n=q3_*8j>(YsFTpKGNIzOVe)TY3?H~ZD1IZV<>1Wab{|pl77uzJ5 zWwJ&lICqB?huau^2nDYj2ReW*uH^^bd&AlE0SJ)zcaEm;4lih{{7PjP%JtX(JI?J^ zp%3wTKO2#Jo%hrUxBAuMbA+$0!UGdLV?rbLkX_}ts*5}rPu8bz$#+&{Jz6A9f8=N4 z$(nxqxhLJ1slCKpI{-iZ``XcZTfO=KANnhgcBR9w`UVBY>x=Q~KRqh=XA#rW0~Wz@ z@nfYj=`hY-oeJ0U%43h@j4S~3^Fu$uKlkJV@B;VxBMp!B%D;TtQlES3M;H0W8pl}a z>YB}fr?%R1tLBF5Z)hw&8mA8+p%dJF@Pi*L6RNw%JF4inTx@g?UFA=lyGD~<+d@yc z2fw~5Yr%src;~y^IdmfXhGuB0KWW!ot2=e9I$Yx=`art6{peO@weLO|0a;dE($q2Q zpoqDC=a}^W%rno71q6>JqL+^*fHhWMBl5xtJd!5>zidpVsS8ekG_sJoEPW7dqPfXq z+9kL}^VCW1!?FABWu0gtT^)W|xBjR<>(O@hMICkzf$p3o5@zsE;@*N+2LF7Zf-Sdj z{+(}sr`h5`Tf~khV=*TD2v6{C?9Sl?pp9z)59+swo^;4`<%O+;9H;G@P;=G>qq^O4{nF+EjH6`>!go7?vu~-+avP~{7Jlw)$~~RTXc@t zL-X0=%1*GuiZ9}WH-2y>An4t*{1mnae$x-prtzmffuFP`_|`doSLULNE{ZPN8AldC z=68-(iObY^($Q29+&K7!uEE&j8W~f+e7)s*ucPuM_=6{aIS^k3kK!>t8hrWbJN`9R zI7t0_!G#w@+1J1R_2Jv$D{{iuF~OCAoj$Czy`KK}UQW3|v@W(|;Ri0^;@`?0dM^3Y>a z9&Zxd%Ac#R{Rj>XCvSgX3KJ_Uf*ceYgeLd5?91mp<9|EIU#y$PQxEQ!p zJJ8_K8oNM@?X|CcZS4H>qFIX8*VhCF;Tlbh%~zg8{g3(aF{8!|2Y{gd{O3Q9$#~+# zsxTqMH+HdDxgxAqlU)nmiq>0kwI%y8k9kadInHFw%c3b4g74Z(-Iek4$ew;O0JeI2 zL9fWacHLKQwu7BoR;PTGHD8+TaYwxR=}&(;#%a8Jlt(%2?xGmI%-1eKEAsBa1Nt$d zuF>(3Lk=nObyeV0fRRkVG1|GGKXk$S3@Knha)*2JJQi%mtA&=^ZoYQuerE5 zob=tG(ZP;}jW^ynb_=mHJ_Z3e+VlfDSn1Aj!u81~pB#7)6t%mK^GNTQ)Usjf$oxJQ zAi=jcGj(2wJ4r@hB{@tL$weDV{)W9mQhs3V8_LT z^6X>ss=ljJdln1Wd%;$_8|dEbb98(_|BzF1r_aD-46s2QaC}d0&^l!TojH@7aeTqo zanCPp58BdCUVff<G z2cAEu>?p$TM<0E3k)gB0w)sjY-wMyAoeKOFS%X(HOs|=UB`qBDYqDr!QnuOVt$$#r z8o9aps;h&hbhq;4%S-Li+2j!a+vQEB)n_NQiJ(5yr^>OX?%@kZ!ArcsR{O}3F)4!& z2Tgx24r#ORcGY<51`YrjfL{QI>7yqe;c}mS+mCthMO?E-^3kj0XZPKAk3|kNf$PLK zeRcCKH#e7Fc4?IJYM?j2`OV=|@b}C!*eN~+{fiIC5kHeo&wB6<9YEh{UtsxdZ+lzl zv&TK|abYX)6&|#}%AV`L@ys;cv`=RX8UZ{-AK|~WcgAPV#2y%zG2+G79r(JiL)|eX z9n}RVWQuMy|5C=!2P5djR{xzbO8=?fT#k*PyX*u-1Ag5l7he*ufg%HZN;Z&P)*nBz zaPcJ<2kqHNwhm3v2@Tbuud@~47Cz|?{0PvBAJ3N4`+&a=_x!HJxg&n($J-F$n%z|n zZs;L2VOPw#`F8w6HiwTVKO2^QIbB9R=)7zLU6Q9A2i<erV zjnC!?^B(h5K{)Y&6HYiGbb(h#@cYa?frZuMioa|}v&|-aT;Z*@Sc*-(m*3*sbM^{dx z(*yX&Tn6BIa~FKd_qL#JJkHS|<=aziXoeQ zdAWDR75|KFu=#~a#9)jmHcVndMF8wTppXtLt0bH#yZQv{C`ONC^#UX!C;_3|1glJZ z)Oq&V=fry$1hpt!?*hVD?o*(DI`vQC%n^8jCQReK00f`V5>mlPpGy}Aw1wNQLI#z9 zQ_KXHv&ryr7C7=0uzK`cd4VWS4kx5Lx$7OvOkcw#95F;_z=0r)@L)ns;i8ktGi3)D zYbz)(eaTB>G7L{>%MpPKkmws3EYI^$1a6I|dPKtI5-A+S~s@el*a0n2>)$>>oI zj2ZgCxvx(NLUXKb?Y0%3Le4LEz3W}?9-ah8L$mM?o#2P(DOlkA$3OmYI0hVHGUTxk z3R1v>j9CHWU|TI#?yw?XK+uQdODU6~mPgwCxG1i?Qee#9r)SLem36K2gjU# z`i7wu2n8liWaYpEUmMPYNvYtD_Q(SVkOAc&(sOo@39iy}K%Mdkupd+=+vH7vnUj+| zVFEz6qdf=fmxagBJ;xjs4agsTqDSx^Jfse|r0|V*lnCaSpwMxSzVgb6Xm_)=I7J)I zn#qVqI>-q8lP~XG)P^5jhTiGOvkP#`MxYa?gPhSvb#or(Jzz2h0I6_^! zpSY!S^+CJp_ehDpS|l-{%3y{aQ`$y%HVyybqxT*BzQ}j!C6~tJnjX+U6Ky~GG~3cX zr%O5S0%XJ3YW#W9NhgIqL1wyE88*N~6A$?)5ndc*&}TXkp5W6C0uuvAy38cVkG}DP z2a{S(EB%CjOu__A|MxZj8~TWh<0bZnE<0q{|@VbSnC0+~k4Xr?)Kjfq(qtg5gQ3T^k-*WTz~099t%Qd^`v}Nw2Xt7N6-d3oe3Ed;|5;HE?aGG~b-O3fQ5M z*V)j&=*q^TE&rAtrSnX(`8?@I(eL~elX~MYAr*us|7?T$*+*^a=S1FQE;) zWNv_uEpoyoyG};TPx%*cPZkFi@H-&;c#XaN@|V97IIwWZk2A-yfNL=V4$UR};E_*b z>^4z!7bkMOXk!N^{FwvO7dE`mU4Y);Yq8nnj9%g&>5KUaKMpM{CZZ+(f=_61Bo{`| zkZz%4EIiOb`prk+Bl1~+*a80F;{o!V_ab4I{23xy_`uthU?|Xk& z783wp);vQ1mu|qv=2YyiSOPoChO^IXy2V?(yx+_Bi}@{?+W0;j$6^FrqlE?SndR}3 zg^WenkAZyzcr@>gJoZKa5Y1#3;VAM)Z{M!0Uw{2|;lxo=j55JuqzMUOGLeK3L?VC$ zRPX{Y-iX$_>nDvc0VUiZUp(pj^wUo(I~ukLp>)l;w>yxsuxfzeI0t|LGoly-quyAQ zbxw}8g8}pLW5EYT5(r+{0mWILUyNS{u_z(+Q1m8E`Pk~Bh#r;B;2+zSDOgTcf=P@Q zr!riW9w7r9U(t901%QU=sSdzs2{Zu4hQXrzlz|V9B7l>mrE7+ZVtC3^o)VKG{6Lv= zMu1gBPCsL2Qs9R^gq#7e(qOAK$Y2v%nqX0?%2Q0G*;xn1A)sLV44?^(@sK&dh@pWA z6X%u;V)G@XzpGfzk)|}Lu>S*ggM_^ zJa~(!Kb;TGCx<-wfCGyD`eo8Aa6oZ`*Dwf0HccGR(kdG#6KIQ`urkLn=jg1v-MY=q z*Ny%4uP8Xpf6_^z5Bw60iEaV{KXl)Nws=qkkI;v{00KAkh81+Q;V^I(=u14FGGii{ zdQ&+%&?M@F6Hka8EF3O)`n89xp(U+6#n<)?5S(b=va!2~vnta3O_9M~6l6LbY+NF9 z2pMpXf4~o+L$@w^7HyN)IHPPRNcpF`@qvX+?sZKI@ZdoX?NX$ z8+1qNgVRnuEgrelPk`R!lMI^d;3a%TF9UvI*XN1ES^Q_SO*f0heiK)dJbtyHDII}- zbBFti<0R=I_t++M zpqur3_p(FAyhU&Wp3GzV=@xd&t|#L+x4E|Xi|PgZO!7cau??yJv`=T6KUw&vFR6Pxj~+^B8tMeS6pPvFmu6?x%Co4`+AGZGdE6$6R&gRWUDN z%iZTwqaQlKKd^WsK4j5|T+k^VZ{J}42Jt#8dXWA`L;Q~R>guQWqQU|CGjIBdJS1U@ zK!W$BbRqj`i!DLO;0q#U-ZYwt_zW)Gc3ZoWCa-%Y5gY-|UMi%lU!Jo6X}D?E94-be z6@m!}FiA0K60njFP^Q{7G4|sGU@kDf1V6N6qQ@Du%4H%5IBpyhiiCooNEtUyg^8cl z2Ef^*F!aTbk_MboK{8_+$cfPqIgMXn!59uIt4{u217$Hj4&ZV{2T00aRC(PrT3=AX234ogn#+eYI7kupf(!ImM zVuTW`rsM=hfR6)acPpoYLjtya__oc#?>jgqt?j@7oItEXxF`uhqQqY zfN}yDV8Q(Pk(V*If`)hOKJ{Kg3Z5b4keWE>yELNU0R1smAZUO##)=mO2N)~6z&LFg zV7L0mkv35Ti5C+@x<+|{MD+o|yM&Yv*K`r*W3LzQ6}*s+MC2{4YnylhU_t2KzQwQ93ag#Q}ZV3}za9G)Sn>$X(Fy}`(vO-q7G>HO3e@v!L zfY3vE;}e7c=bUqPIEu~%BjsU}>{O(q^$$qbZ;r9xhF~tRE1w-p-j(m4Wik!eNiDmX5XsTZ(jC`il@%Tu+nK$iQj*)y9s}SQE1bNg4cm#q#_*WnCl>lA( z1n#o~^17e=oIZ#9V}Y@sRP-Slv3vZJ)bnVT`fsP5o?LWP>qn$L2z*H#0(B+LlqDN* zor`nYNE)K2-~9RWqjUyrv#!~6G_Ed~Pnu8B9mO*%i*4tHuPZQ^IthO8FMb4Ymw1)d zwaNS#cpJs19lY~R;2I9e5y0!K+;NrRr|Oi|&q3hp=wP2ebA}ds1hRdg4KL}pc_tao zxh4OG-84q;KQ^xNIAzpme0~|1=r$AS9UQRTU3|bJ-2&Iz9 zT`&F73y?#3GI&T{GcTFAW1)}o>ZS)nHb%s$+x3AzPn}FJ1NN3Za7;*C(^ct5v$^J< z?7Vp``>rm&Fi4qjo^8Or1w4>^?Yti?q)#u5#KgMt);-Vu%;^p;6Q}k#aqfalfM}2m z^f!O5r6*By(vxE%K<*Q2!8(S7LE^NTyqcg8bdZLG(e_#OE)W`l0xR!UKI~4jwbV{0 zkO3*@9Da&dG+qSSYF0WSf);5wO@{I@4dv8p#l%jS`Sa&Te*`25CWpl&63C;RdN_e5 z19r*9<8mcv(~rneaHjus$Zn#?@DSAep&@!(VSP_|6d)al6wEZ>f=(V4F!80-r_VhP}DAF83@keC#xtPKQfWXV6(v@l*Jf9i+S z3*>jb_1c{^Cf?c;^utF2ekR@MYxTw}0mwB&PZy{w>xs?`&>s#Ooa9kI?fwuv5pXe9 zy1~ky$7}^W0mt3A=njDalS~s9_vtUP1(L4t2b94R(T;usy1_Str19FRZRSCbSv1%J}d0@(sE^gX!%7MSo9-lD_kEOBx_8)o-l$@B1X8Fim z{v?i57wZ@OMox{#0vB89(K@_AA8-~0|LmeL?zD00Vh{DzN~&FK9>r50-wECWW1c^x zw*^Z%U+fw%u{Z979Jev04#<0hdW2&gCOS?{nYKvmWsRc!rZdF0 zP5^YGdjdp)uohqh6s4y=ARqc;VTSG?7wjBcsPFn0zguq$9YDW+FKx+$Cn%@Mf}Z@&3zY2Nb@yD-&&Vx3K`@ zyWjKf&|7>|x-WG!JC^uPG`ddw`Y2P{H@e$n-yZ8#2fAq|p<7St>AZ&*ecUO>oar-h zG&Xq6g+4mmP9pjO@57~l9iEkk-r~>M-Iz}stXIaLV{z=B=lqVH^JE6Q$DfC<43x7U zss9c=^uw{RDWI1&OIvvkM{t|C)(1Yjxf|aS$eVtB(jjTs_1`1&Ecyel?BwdJtsXkc z0zTWp#+-A`+2P0MYpXJl1Sj|{pKODhUR=Tr`oftu;0)x>&cvCc_T|U(fRFIcEB_fZ zaGm}jp7$F>NdBZd(;teymZ=Ebu+!|d-E(v~U9U|3a!l}$xar=@w8SG{31qq>{jQ9* z1poLAxi~BD+@c?Zc;v;~e5d4T_W_v#A&_Dj^kInzR<^Lim>d^@JGm*0EiGVU*44rYWwf0)gM-Kf+bH?ds z4DXPD(-hp-7iaM!Wt%^z5D3z`XUqFxhaDDMswvrY961;F-gP7C0GGge+=`?bTr786?Z7qAk1f8(3p7>>K0qWS1S z(l(WTu0%3;+m{`(-ti~E!uc2A1o(&J?onY|yKSvEE=LY-uR)1IGx&#GqY0qD{1OCN z1!WVTb^zsWA&-K>H-G~l)H&uy$HcWAf+mO=<8`16r6e4c?GGJ`)-m*EjI zAwVyPK_@wy5R+5&z$cy{=j1MT%vniI*%7=C!P?!F~8D2X6_+Jd`+srd)M}0MEu(%*lZoy=q zz4wW)zv6Ft$qqfbQ;@(D0_29{$!|b60US6K^s^&ZAi|;|c{hQBSAGY-NPFxdU%~Zr zpVR77@{d2jgEntJh?I{*l1ada(bt@GMB;Mr2mkR0O|sy=3viCV=|2Fc^ib+m`ZN7O zfocH@&}&;>UhH1l6FSx|4m`n*nn04*3}~@Kd>^t!ZUk`c80CAittOi8lZ9MJMt3^k z#+z;&=84<|Y}etk+irq88&1eMjzri5EN0Z)UIIFekny!f?meFo`pMK_q?$ zznbph!&toF`@<=H3-~(h=G#iJ6;IIDerTMwCv70U0cn@g7VsCheZ;mQ!xntZUDQRV z(fv8;W&_lTcHp$~ZcdE>n@Pskuh+;;mHH)i1_A!r* z`}CN8kULLO0KS#QB@6k09<=a5mjV8B_sJ@B@f4F+i|DsaNCH>DquOi;Xm`7}^HcKS zI`vy*7|=g(lkpYjiCg%GyR;XnYjZbb&YKKNdA2#}L4UEk7VO>QXC=<~0c^k5KCrL! zI{QIZ_zD*6(vI`JJ@H1?w5LCV40DTfe~`%-L@rHd8Lc#8y#rQn?g~lf>&?@9t&F@3 zGe&3VIa{txun^bI5!WV1goOg5{N3klFfACKIqi@;hfSAM(gwhQBByQdXG z%29C51SMxArQ@M%N839541 zW3U7w7)MG)UnwOWAGXHJAMz|%t> z^3dW$Y#KPFh^$nJ$S;_`APlzgdo)^5G$)>RsR{6+7kuyV=yp3cM?swo6q=@@)FuTk zfJj*33hp@s^9%0rkvsxV%HSU~KtDfDzCLj{)X$;AL&kuP=p&6m^z|!Sk8RVQE%86H zMsdO)T)+uqKrgsQ$)=-B4t*TMZXk*g9+l+?!nt5IrHE!620RLv_?n`XR~d95j~oWP zEU-Zrap2v9PcpNh(B-~`2GS^Ka-nbJYWJdO1t_#B4gSf!_9@_vHrhD)MMlw0eF84z zk?}=ywAC)!<580}4yZm3+QeA@j7z`C068))yoqLTL{Gty$s>Hx4e)Dx@(Uo~PXP!x zAPe*u+^C=Yp`D+4=sV?8M#vnV(3ao?x;v+rICkX4wR-7T^^g%XATRg`ZUvDAzO>6} zK~HVSN9M`8y2;tn+Na6VfX1EpHc{P2dR7NgOq{fDEXEjL3^Va6!)SIo&UvOtDE8J@7Vqst^5?K^v1w_s~-vz|l{? z^8Hi#^@wdB5p<*r(Gb0i$9TzF+G0Bn(2ZWjBb#jUz!(cYLq`(>{An_xFK{y-pWgog z&4%~hFl;9Js{`NS)vdPNDkj1DjQ;8&hx)MNj*pA+<`|4^&;UNs!p;?awo~8O(H$=R z@CUlF{pbXDa7~`*RrKrH9z0+Yjy7}~yucfPA9@hZmBWwPBmZPiP=xK1Ut8B)eNEt- zEkjebOP>c3ms3Go<7Cgs8T`YSAO0t!bSYax2caL@(4+7Ruk4v}uh{Pu%_f^}5;(`> zWSDIs>lT~nXyxJFJ#^y3kQKTZKX^nAojv)XPP%{%CXdRKYh}@%>?uQkl6&d+%y{@f z0ws2QxJQ5Ji*d|Wy5dRtmh2ldpA0_9f}pxIbY#Dc8NT3zY{02=6Lz*7UgZ^ZC3oZq zUFZ>Vhra5AZ|#I0DrxKzo2E|p;S;X;8GIT%LU+-{emRejPSz}TJ?vrIgg(eMc~Ilt&fW0^B&ZejnKlS_PKyyh&%%bvr5bbJg){3dzQ-fwj8jY3{5V9;Z9 z6`fC)8=q_Va-Q@;E3~nQZ-WInWMkCn9=xUg+hK=ChrS{s@GB4esh>_&FZ`jg`^xDz zKUDxqIY0d-W6sfPqv9uSzF9k8n5{B{E@TB?ram$@x`kaq6MW_;_yJFNklht9g(vfL zx``hKck~VZM}PEE7N5gAUf`RtIpj}$x871@Y_(NG2f9WRvc{)Z2fk;A%mdJtd=CPo zu7NN3qr>@JVhUth->)pY8R-$YGG4j}-{B#;9scp1{O}}hK-QI|W8lI)dGUA3J3Pas z`}7bz>yJ9vZ#oN}*?2UmJ*4X!o2FhgQx>k#*jVf~XJgWrLKpo7WZYQU zI=h)Y)@(e32yg>uf}HTFpKygH(&-ztfd}|U2RZ~k1PLu{3+@Wm!L<*uIEOp9MSu99 zhv0SoK^qzA%{ltI6e~iqa`cH%>KjLu0=fC7o13}w z<_3`%4ue53Z6Q8zt&DLg;~J=o)0AL>1(bytZGfyt5Xa+fS-ng(>M2W{OUFqdDZ9sb%nWCDP?XgkAd8L^I*Rp3EJk) zZRt47l!3{1H7>?na8!^IG?gdm;~r;C8rpCqZn^oEcv&fWxYy$Tx`MM7*NHAp`qcmc zKmbWZK~y)maxM=V_~9A2Od6{9mSVhYiH39SxvzcYwJC3&>oz(9b?bw2>dEW4Ig9@2 zI~)Sz?+3;RcjU_W;mEaf_%U|;36dso=NvAbCr;&)Kk??Cdf-yMNmpf^YeyORmFvl+I`SH8orZZKZs z1dO7|Cqv(*0X(Wd$L$`xNkgB+GyX_kk=Hf)$SYl2^z^(H+sA-=X`p?0R-ZmAlQfXm zwYp+Vg`UlTkiobT|A`~`ly3a+AlzIPYGkUDR$b{aq)1@_z3aqz@7#{o$@3Uu3#_=$Cj)-IMf# z<1Qb-Man3;xtH`y+OD`Fd7abTFeLx-cX5gz;1eyf%pl=zI{K1w<=BO;Pcd)aiUqeT z29LuNTF9U0XnZ5x6#kuitzJb#_sB}NgPv&YUea2-WD*_ZOL^<2Cw4I3%aqJ)y7qJNQ=j!`3p5lX}8(E}!oe&>hx>-&CtK0e2eJ==Bvp8Gn_ z@+SqDIh9~PBiA2hI~h$R7a=gnnVvxA*ckAUM1aj7aN*u}@b1RDkXO~^qa%%1#TJK2 zil5Jm6T__{)}iS(p>;PC$#6ir>UMl>p%!g}bk<(Pr1#4`$|#gNj6H1qzEQC5MH3i^ zThCr&I=RH#90OG_))8ACn=mrgO^gk)H=h>Xy^#gS*}v zo78I7(svxve88L0pQytD;l*5&TTR6nzqrTQzGL&I_1m72e}~9lQFv5#U`_o3&iSC9 z7fB1qI7lY!I!Tx^%J~$j$q$khmFqV=9vbC}ZCmEH1QvwMZx=YXnxmwPEuiC^&6`_? zgL3{}M%3KVd#!&q*&0jfJryX|Ljy+abM7}@ z%vYspWg18}l8tP}cDW^W$yr4Rgy?K#IfsWP_dTvRHaD#s-*wwJYdV>b)=ghAYcLjH zIE=jZsbel!2s1}D;W0P1u0PcdmK`%39&8wk58R%(D$+<5?|px{YiO)IFsU*Uu67bl)3LCM*lXQu zlxv#2-0JeXZMr&mR_!%7E`9n0l{e&aa@6!{xgRw9Pn-l9trX_eA>%nYg30NQ0De6+F3lEIv)J0I*M_tYmiKvgdiXqKBZSUW!RSQQ`eeE4q^(8oLyIuoSB>Xi+`x`u z({1PTE%Sb-Vdrlmg1plCd?vk=6SFy!+)gR5VsEFZw|!nV^ZEG{e=xo3wplKkH40mp zL3G<>SG;348lm}e0Kou|a{no&5OR*cyg{7ZS6)ytn2^Lnt#c3d{<=k(>vDJv`GA=$ zA|T3h2LrUuxAs5%o(KI_vd(b&yI=<4_G@v#{r!4z8=MfgY$YgWv;cjV(hFLd-+uDj zRyZZ*B$s=`pdOYV%i&jci5-{pa8>$lBn23KDVx=vIguva3!QryCNmnY(v$UVu*#d4 z3qPLX@GgNhzv*#k{nD6uzb^&{A|+Qz~;uD5FN~6>aE`Q zC^`P9H)ky(wIgc`!Tlcv)%_v2he0Oh`(97k3C|<=oKBUz?mw^Lbz}lPw}V zv#xoRGP$wYlt39VVPmr>aDI=mDJ71~_x_*O1^lCs-sR6#V>LB{SZP-h=a2=im*}4# z&d?!lg7xBRP(2=}&kOp&eD;i+SO zmo#*r|7LLrZzC7CdV0To^g#lrJv^V^0W#3vI+x;3nW&I|8h zzZkBD`y41S=F6HiPhVH?_4#|#63%0TVg-xS>A7!7`&r^tEVN;!N5#B>Imtp}UB_S~lx&v!N93{M!`xmS5DTj^>t4P$GvIW! zqEdp~nlPAv0qsBcG;;8la2agfBj@IkU@#2&!Y;pKO1DUoICrR?7yED zWVC_)YZaRMjwd49Y4H|!*k3*Cu8Yh8Xo> z7CoZ?{p8q0Cav$N7HdywuFdJdb>c>ISiX&cpU-LR>F-HPuH-jEUs`O`t?TziU7q|y zo5~T@)Si$i(q!t~Nk-;JEm1@O%JTPG@|#AVgO2WOEAs6-g<3lo>;-&rnx6Kb2vXm2 zs%>jKs&Bs($5GrQ8q>qW1B{zk&6$rmMLEwZlO^|x?IfWxHu7A%t+W%)E&rsRnh|;l z*2?w%7T+3Im-XLYFI=@J%#K``du8e8oqXB&>7d?T+aizEiEu`X=t|yzovvmkG>0Eg zJIn8fPByUf8#m^M8%n4>iMzqKBnJ={Ic#vnzl~FuyWj%^jP>qA2=v_6wTUF^bdHL;J!FET3w&NbMCHGhj$Hd7_i;q z)sa+o9{gvN7jqm`4qW<HuFb&s}Dc40Wo== zmG7ZbtGJ%y@V?c$+SHG*l#tNM=ciy&-O;-$dtCZx*^%5U@#G)J=NFOo*!T#t-@`Ng zfcx+;`0TB<;d`OI<~5Y!{`&5Ef0gbBJ#<>PIBaI*{xyO#e8+(Y#BN`RQ7I~#RG9q< z38lZnWb8y>$avW3UkgewnWpYGug|1K{sY<4H65IUxxz1NESG&gwPl3m3K_5O6Th>$ z&@E=pgWaiYkYtNg@S}&(KmIXDx%Tg^aQJT`th22{UHjs!o)#@anq7x~AN-@_Dy+SI zqAvN9;8BJCr7uMIM8FV*=2VJ(w_86Lzu%5+$=(df4{5>=)`}@{>3GaY`LEE)%fSd8 z;AQ;kt{5C!I!JjB{r$y+n*=(>f7Fd?^*>bd6#1#83#P9_0{|&DD_3;`o!9U-*{n zQ?9=;Lm|$*>~AM4K9o9gtS5SM5n~Orb~cyZ$hm%$nDV_F2R2W4{hGKe&fl3Qlp(DxdkD!)uK9Fdymqg&4#*b8zL@2pATv4TE^f^63pTmemP1MGJ zpSv`!#`L~?UHj!9uEyv6=ks|#=y`Z5`jZ4t>;A~7L{q@FhGanLlW+76 zZze~LTMDQ5;tyFe{s(0^_Tc64`f-RcfDI(5vzH{y>~Gm&B&oZv;A?>Rq@ zC%BCN;<#l0=rvaT+0Q?~_6nKilY?m?Qle8T%!nXlR|;WK`O?D3&?6$!57Oomrw!x@ z_a=XwBCvT#WT3)GL!jsMO&7VrTg!?EE@N7~P4V&}YReB4LtT6IH`)(Uyty~FxJm}yPR$YsNvU7UXAJ2zuHi}s(WgR|U!j)Ah$Zol@e9li_pM2?$E=C?N*xl3 zUNNrAK7mpyl?kBD9fvKK5T|>E!jj%!SJghak4QUpKC+g<|EX{LX?|_Jo#2rPJHo=y zd%9t}*-|l{DraWz72h2_8F3#=OuS~P@YCR?SHu>js{s!8%*g%3jdI>PDK`ChO8R$$ zW%>dGgt0Z4mP!tF#@QUU$XF>8d2&&^eVHNef+UX=n@p~rRfImP8P(>{YP4=@OnWhZ z{HEa43Hd2gZZ#<1qh!UMyjGSHe@Y~6jVd4Ij<~n|-SxV^c=o5>J{i@M)w+*4x&M#h z7=yxPv~26{9|BvQ!GZ;t1#<0zaxqu%m4OVoS0>AkD-J7bE}^4;j|c~X?#gjY-Zk&< zPyF4cO01ddAz;Hwh1W2uy3j-6TMg(Cle3aKzhjUiTuRe}Q?0!?i-K9X%3^_IuAqJ%@K zNp6&4NBXY|HtXIKCaHzQmECl5|+#p zx~fre#ggR>mX;fgo781qCJv1gfLEz!SC5KMPNu^O(O_cNj<4&&ZSL$vM>3toUVe7|H0!P|nZ$+Gz?Cf?HiPBYzpaa)+$|HGPnj^h2RoJ_2p=c@2wj$m z=^p)cVlkY1+P!{0kPkfeJb&@5W=l8n*YN~meg5pzCXeo!qlLNWVJbI?r)!hQK;2_V zh`6!7Ar&~}W2Z@gf?+gM0(Yp3`H~9XD=j!9&A2z`PL5pzi&zd%{4b-=M2IjfIv(me z(wBHFdNkDwtqVcNa8H!Aoo!WZxsayxheKx~z6<0`#J(f~ynhXk%qhf9r&4S8f3hsN zKWSNGPHdK!a5X!$SwdBIK_1`Bn_fch-YAtEeHH4)N9dlQqVt2=?9=P z27q|--4IL2+fWuB$hQzO@fJ6$IzVv{y#F_uXGON01XYu-t%+D_vA_Q(+|u!ATBQF` zP2pwP=~3Y|CyMC`W5xr~0EhHxM8})FFuMBNPj_3~ThD~N7dJuVD`U`%j*F>64+?1& zJ?o}l5MS0%;j3eU-YJ!j?Huk{y${%L^Td%*KpCX&P0Ip^TyaAI@5r@xrttv(dkQ!6 zJ{$k*?B2U>TDSQ%vt7m|iTJ7XP&KiDXmy~A(b+8`QeUqa&QjblPayA7vp1okuT$TR z473FHaVn@iG5X3?=v_<9$l3~`sO=y1)*bt|e-V47-$bJRfma>fi5Rxm@T-5=W@fAE zE&#ucST$ zN+kQ~F3!$Gn;j0i_bh7jY<5zq*%oe>Y(@U5DX=1hj;GsHcfXh?CWO?Af>EcfOMEGe zE0nQdT9Cdh{|4@Ldmzz!hxWs^{gRu#C;E<}im2v2DxU094qFv{8GXlJw)N}9KOX-J z;^UJvPvWlxJYh@=);#JKhDzhbTlIJ{^%XPdG_MgERab%>?;gluT!_SbkGeVEL1ZHB zYV3mI8Mfp@b_@P?N9owojS=h6>CcR{ac+dDv++W1X0ayFJXX8mi^k`SAI>ch+@ zCcf}AYXZmHiBty-a<$aU%_=+5rJL7tCv7Km^E%dl%p6iMH!nM#S$YbH1_!w)==R7j zI{5{L!*1;ijm!{5#{7!L_4jD$Fl1sCyQxyMgO`jEcxb#H;-89D)ag#sveukl2LEP>zf$vFFI@*j=Ae!Yz^F5hMwCmdKKgsXJ$1 zM41Pw6vBN&={<+42rp(db#|+y-GR@KPL?voIvLHojxKH~8}VdN*YcZg{ez`z5OpBq zzka2r%}Ng(++NCpsf|>nTyXmHG5;G&N-B0_6-yS8*v92}n!Z-|#q9gD%I+VqlAOyN z!QGSVq69e;$^jcWvO=0yE21qgTkylvQLyI5^QIuLg7(>?4?q7{i~7^&BK>x5wPf=B zE#a{kuKQOfrpb?u>Su&eUg6`o1(IAoNd&GUz`?dPzSJ|GrWYX}6#9x9Ic!MUbxS#x ztfPKK$P-P)>(Nn`XwHLH0d={db3&@SJ7pwp;VHlxsd1LZ+ApsVF9|(vJKvKPJ15Bh zZN19al#JNa@A!Zxx7K29SWX)iKxudp3GZ=q%knip!X2QH@GgPVlEHq8Nar8|iFbcs z4F_D(mGM;1IP`I!uyyItW_Dgoe}c(s8rZ=|l?A5|Wq^!S#C_+nB5v;s&)ew;nroB! zx+r^(WFvrz1%?#f(Ox*PH4{u#9{>1{Wu64ewBX)qFPng625YF!d#Jxc~TU`gNwE zww2-BD2$2};i2hIBX!_4=p$!fzme>y{@~P{;t7n*xwQLqBcI2^PWR*o+%<_&i3kGM z$Y7N4XiVFr7AlSQL*DsJLVjCn@|~#_yT#5O5UTI4%v$lBf%L!|9A!xgP%VSm5GEzDQJ|i+a^ZY5`%08awE9M&nxAJ6D9#fvREUX^%8neusboUdjaN z(7(l)OYGjM>OR{DlB$aw2=S%}G;lA9Io~_a zhLO?gVO9JELK!Wi!-B(N{W*PaBq$gO^FK#Qqj*sY4YV1b3=XB``I21~h2dG4?KwYTK=V}B{9x(8q@H%R@+o$5Qk_}+{Zwz?^PTxg8GlN+QD zz0w}pGANDBN|YVu$(x!Yy?DU{kkBCY#4xnjbrmH@5f(F`YFSo?^ZIkzu{vmZj2wo| zD&`3_SCjwr<3a}8eWZThi{Kb%%p-n{B_2#tTTFQo1zr^2p~=Y++x9P_Tq$36n(J~m zF$|JAFfFx$s+Kc`pXW^n6HQVC;2r%s>4jxL5UwURb1w8`%tx?{3K;|>4O z-9lz=V3QsMIfmbt;j&iG?l>|yM&3+ib2r=~X~%Kl5e6?JYf8Pzts2WW(F>>CS0pT} z8n7X|S8Xw#85VuQO!o%EX;sLBmu43%6CH0e_yBsG#A zQy=p;@ZY6sv5jJSM zRNU3iy24{xcxNNL!*F2lgfHnTXt_%o|2TRS!iP9eHHIUG(MM={Zxo{DMGh-dM zQ@RCmwJQzkAL?*LX21q>N>9VwB(5aod|#@3XgWt3>sh4$kpMK1dabL}(uw;OHd#lm zIn~!}${wcspo82!v7FAAan%vgm%fu$L5-ea7m2<3>p4K2d%8t4hz^*G)v`{SKgqM8nXaq1Fyl%*s5) z3fc(%H)JDX+_&~CT{1fu*C|B70(nfmMKatcgc*TU$yUWw`J}5%sZQzjg<}9bWNvun z(2PdW;qeQ)Q+j=O9{0N#%JK&f9G~d@!ALoK#{8hz1$+cPxYZVR4uYEakn_PL$+mD%+yfV7@!k@@r8XM5bkTN*XtE(c5 ziyldcc$vgX)$uVf>0;y`P`+3j5{sor#urQH*?J1ymg3`KN;YPv_4o)nQ16Om1HbKH zSN~v;W9J!rcSK6f`5jo}RtfuB|0f6@D8O$i!0Y|AY6ihnV#CHrMM6cBz>8AuP64Q! zqnHa$Qss(ZR8cv+f+#?8SMW0Ft6g%;C&LeN!^s#aDK>3hoZ3SMagBTtuYnExkWUOp zPoL&ZhuBcYa0b{epTWaV$Xj;FqwxBIQ14_+ZKoY+IYX^-jJFyl9Z9CnjEH4y(8X)m zJnW8Lu2D~@)?idkqhjU>(tKmBqd_41fsn&6sb}yQpf4vkwEsuYMSrfBG0zI z%)?pbue4S63FKg0_kZucUqD~KIbY^^S4*86*i2rR(+fv*!&ZW^t2wjKe^@ z&!kSv(|ThhLW>@iX1O7+NOnmPuG81IbW2&S3zOA7mG~ZXNbbxlL&+82LKca;ohd@= zN-IoYu;#O)ttL$_>moRJ(hh$+NsGED8B{(@|IC)%r|Lq+9YaZ=s~G1dB=oY8QFE`D z?^U(3chTijL5szOc={}8`GtJ*l_qPbEO@m3UQ0<}P(V&TrSz~qMov8(L-1{ikXVTl z+Ui%o&q8F3GE$~)BI$s47%3o(>1t>d?-w#CKOBq4l87qhW69Za_}@1@`kXqZRsruO zjTQVkQfYB1N2z_JOebi&2|5oofm#4~OlOs}wwsh%TdKh!96N*-uK0?$q+X$L7IQ?x zaJMQ2U&4Qk<5)t0>^BLicKr2~0L<+}*bPIC{U@ac0U^NQD(WQ;7Mb*C7=|lVuYwZhRrhl*q}3eNsVm0i)-*nHVUzV}T(6=}O)86# z!m@o%?z$*#1zc~=c8w=!<-rA|bKh+|AmbkPrn{8)0O2(LORX=P`rzr8tLI zk&)%8;OIg!^4wPZlW6;`3bvboRxzI7%$HaWF0e{-!6OC=zk92k{;BzGo|lTf;=Z&T z~*HB4baG1n1>mD!;ycQz*4znjTG+19FD-$XZ&4gx~Wfnn~yv4$uDZ&J1H#6a_{i1-aorx z^*ZzYf$E4Dl*GXn*$|v{%GgBGq$N}tp)^!lnGx*(;vvU_3Pf~Nrl|Vp4wsa+G_F2< z*7kdP7Hz4qkRF{$ZIOJ4VF)8BmGBs?n5VGWN6SSOZ9FcW_6D8VhEKKNgezkgik;3L zsQQur17d+8JV`eTYO-FG&%K;JPbEF!QCo{5T74v$dE4Yp z2&E2naESyteeHxuO@=Y<;mfjU8HFN)BAtC*vQx614)BUb<5Hz6bu`GNu*gt|Jvl|$ zmV6;tLeS;C;=?T@t#Tao4l0FW%^Q(cMUQ0H1`&u@4ToC4Uq_!*nW>yyUIj|CEZz6+ zj-U-GD275UGch5_H(jU};*8Y0$sZY&k>rawR6g_=3yd&G&Hz)h*&0-uA-5pfGT|8? zqb|VV=Yz8r^P@BJ)FNPT zM%V<%Bc0S30m5m|Bhp^ke{2ov*1^PvC*N4*_D?wIoVvx&BOPc<5}q!JqoW6)hRhO0 zcp|5~gW5R%3z|0j@2F%Zq+jU?z{;EK{1f;V`9Tv!le%)Lv|hUmpOZNY&> zjJBym{5;TN+K_OhbOiljn%CAEcfdn=r@jq&=lKlpy^`-z&x<8pXcQW}JJf^js(nZE zM0_rf&msMxvBGvS#n8vdPwBlHT?3cL-M~=}E%g{x^C3A-q>d3}nXW>B)neuj9%@B^ zNiDTl;|TDo_|pD|oZu`WI1#yn^ zuvAoWZSu%OOhLO^B>cr2VuW5z=$Jl9)#7(&ogt^BK#XdA%RU-%CWsZrb976pY29m9CY1g5LFC+ts{gI<2n&#N!?ur;8m1`%o5wkUpjUl4?p1DkwfC+Vl#B(+h>0M`yC zCe$U3+`5R`78DuNhA{q?ro01~S^cna$GGrY0+$B%wxhr)WOCFi8N{sxwJ%vo@AmQi z#Lr;P=}?BrcHUA1I8T26$o_Ev6UI5+emU_d6*1LsD_*wF!bRCEmET37^$zi{A+*izOJ1Vg92(c(-^vx zDctfG@+Rl!*&ZwB6nQrgsT zdlduqE_??$S61df-m%Fb@cm$-M~-{|VaxXZour9$u3#DSBY{^wmg+kYb2F`2hN)^Y zyP}KeqA3NJ-!Y|{e&~5+Ll*?A=Bv@6m(0cWlPigH=cys{4+lorRg$0{I0!a zEKcE+>SmogCf)Y?joRq3k90zGY-@AG>QW0{{q+729oPNZ8~w>QOdAZ+AOEb5t)Y7F zcrzOvU`yG8uwm$9qejc&hWq;ueoJDyx?i!jAz91*F#R5Q4H6Y8VIJJTp#3k9o!j*N$LK`&y7k3ziJb>He+;bCSlfge8s~@vMV|;)cf&(1T2I@-zmnSMCK8!B2{Ei~2w{Kt*qX8qE&a#LSFyK!$@0)% zGj_fy9RQn>oF#FVr#YOqI6Fdz?As1p%onNWUu_JD#~nLJ_F#URxSPQ)*}wabXMDBr z(zCh4N+-&NXjvcoPAW-q?wHgVPm*CAsSZ6ZL{*!s((yZcrk+3TqkK$KU2y=@WUb*R z>iCD!r?~t6zr{gnLLL4?2^HNI!>|FIr}%1?W#vp0%!{n{uk;YH$2ikO}1p#kNZTeX{H%TL{bgd&!7D=D9kO06)&n z4)ft72z~k!&2fMq%W+YN3Et)g6cN#zn%^Q}d$#(-_$-!2xu~n?rsHi~@1GS8Wl~cd zaOe)GRh1b{`3Q_Af$$N>aGDf`2>6gH)EE35UI%f0d}I2{+J%dS*j)bAQ+V;f}HNo&yjQldwiRfoJBC=`d*0Q*@m zUDRBPVh}R5F3=9+>oy4bv zpuVzdH@bHpf8NKctaCva(*I5*g@2QzZdAJ_a(r&Nzwnor;ckp;iJ{!|`-Z2cXK=~< zYKIyWJm*rFK!ee@*V5G>n8a9ZZGbV;;b>-jnjxSN$y`fKPe@7WmH*qA#}S#c-`VK{ zjCup-1C31HnW0hWl@KR<^xKe-v+t&=*GDR~&_r&GeAv&h#@z`AOYn0}NQUSX=J*xW z_?X$ANT;dW6dhI3`D(`W-DFC=k@u^Q*87!b$GWzB3~ZIch$&E_c(Ce{9!lV?Z>;(S zm-H@$a^6ASgfv+{fhtDJV4~&-BC2r;03(j|HZjM?S#sVl9iqBKrz9uzx`q8HSVA^I zBXA3BbUrzRS$>a+mdva~2O)|lvuBilSzKRY+EobTY!32|D5uB?#X%WB$eYIa ztOMpsILQy$eLDm4O4X5MW)A2_SwAjP10=I=LQ{wA5f3rf1XGtPH37^zqJ}82%x51$ z?#an3$ze=gaw9*kjJgFa1e8w3tt4(tGwRLE<9^T}5EbUi2w-kWRT$XfotOJ9m-o^K zcF=yv9pI0m?4_V!4t6a;6&b2|ggX*SsjWQNDwWXD+cn3e_(gm#hP9xpiXMtl`Uvh| z^rcXIQ4SKv-0Qy5ZY%cdP=VfcS9O1}Lr$Qx(zGzO@%uTM0@aa3vv~Zm{`l7;K)2{; zu+p8!Pz&!oK=><9XQupKj$8bi%K_xJ>UcXDp7!>d$qCR>rzT0E7s+r!RXW`Dy%5(N zXhYwYT*~zeOiJ=Www}-seWxA+-B6boDpoB%1I6|zm<`3tWgP1L0OQy_D)o?i>Assu z^C)6Tm+P&-j^Aoae6yHyIXoI3D}Q*!bhshXflz!joS$S}|G zSIq~Dih|a%uMK_quw=&1J&vpZ)@15eH`hqZn+CpOP1iB-MmtX1XpDwyi7G>uln9D~ zl=6}AIj^7&PMJujEXMO$7cl#`fGjeS*>Q!;kGk#ssF<4klE zoEc9)r-!4grfY~{O%BGgHmz}wJOs*!yw&0+)ql%XOUH@iY4?$^-zn~MVOCU?AeAIA zp3;aTLCU~=`>70<>zET*W#Q$8b9q@t7yf35-uVRGRXSqz=mR(df=_6xY2{e>&j1l3 zK(`7GCygM}M^S=#Ymk5>Wj?hEG=vayyrjZ(2vq2Gyg6m(PUa_6Ho@T!lwk~xW?kh_ z*5=N8!OH5je@q?gl$| z%dVieamKFM($V|z@#AofU_b~^xeEdZC;|$oyql+u%g+r&}!)T!xF=VKhzD!NnWw%y_VuU15g?l0-oZ zTALKZpu$6-Zy}X*XLMn0if>Q1c-s}Y#IeEK6st#eOmbG}Yw+|dGZ&>z*La^zFb|Y+ zLmBKoP1CX;d9JuW#>!Nk9-5;nAd6}K^JCU*Mf){mbEfBj&P!lY569P%WKimkZb!2@ zymV3S%|Qw@k)3u=z54H~fpLrg;ef=jmK9`zq*E3c$8dPV#iEB#>GDgu;5WU=plIq~ zp|pONeQ4|DEjBO~h7>Z+-8sqi|7f~o5zMT^4FY(4nuSi-Lr-ziyD@$R}6^ECnwjKS(PW z6OSrS5te`gv`Ry)WUfAfjKD|?`y}xb04UlHBQ(WJPV0}I>TtTzLM2%R?^C}OZkSHu z-D3hE2Kud%C^W#on=RdWLZ7Se0fD{XhnFus8$XOq*x_RoTHZHWfo}Nr&Rr}F1CEF> z_^77VlX_S+?$hpZjFo3ommd{+?P_2u%Sy_7{PvjvQK^?+)VB=3ECzi?>%Ho@tB=OjC z!RL$xz&$|}sj+|q0#K_Nf+Dvp7T6IUAkQUR)ELClxNzr@h+>SP4S>BqA#Bwrh~lC@ zYKWb_P^wq`WLziDaLK*BNV4+wCb%*t%JoC6czkk)HA!2Cwu5KB&}F?aGa=5p=#DKp zEu5m7@k%FBJqpc1pvKcBW31LMk$E9N9BuUtHnk6L)p{KS1Tu@Y2!$a`zEs?O8Es!8 z9JzELXt@x#$+7?)9{*S3Cs)Lu*vR)N0yT^Zz1U)RMXcGbCwK#a`Tv?msL-|JIn%&IO zj9eYSCURm+i1ShRS00Sm;sdA-ET@+!PcA{@1y94Dq+Z}?BZ{F6`c@Z0W7IuyWa(kW z;lc6Bw6P>%GbNq_2g;YiX~r5x$uT~pZYW?XTtJH41evo9*@NqG0xc8H0awZ#whuU{ zJO(mE$RtRuMOa;UCnzlYfndS%Q)Dgc_FO{L{JCV>@RGI5hsehTip%$&JpFnsQ`Z)q z?~FALPFPyZJQ4OqD0Z?n7;`5ctJC=RT%P5y z>BFVH69-e#&W8wN!Y_F#P)lz>11o_KNA2*14x1H-=^%-U^!p|M_eg9Kd9#6n^Raxx zvaIny_U{lA)kp8&(s`JobnuKVm5Titbokr&X6SOsmk4`hz@KCovi#}AlAdF4Fj*=* z2+le}d5hlr^$H9l__kPiBwGKF^g3PV5|bRxw2Q9LLZ?! z%;jJZq}U2Wwdljs5Z|QE-qykHMCw7}MUN7CNhk0=G*}M9Tjep6@B$0o&G>j#sa3tC z;GuDiFf1}fbrIN|;bb95+F*c2WM%^o@zlZ$u3rQo$d?mWs6)R>_EnG=V+?JOjB6rY z_3s(ezJwLJfH|d?1Rv1$D$%PRHs};$c>>VFTPxOm0x%UWc1{m*i3|bIB?oGi%*~eg zFE;#axQV7xpUAd{8^WbePRUyU0;{&c5>t0pkCH{K?iFq}fG()H8|e?3=Q3GW@0~(W zl?RF19n^$5VpdSXUo0mpBJDH^q)kadj^C|YjKB|(9% zS?|ASr8NyMWJ+YLoOwF$j-Rv9h=pU^y8YwWhaatOE&$KPhpi>`L|G-uVU$!t*M zm))DuGWh!#L1aqXq1c+aDiy9oIWc?-_HB+b$VvvO(Hizg_M$l_W^m2=!ylu1hWsQJ>)x3Qr1^^+y@%sZs(zr zc}qQlvvh&g>X@6z@(xQ_HNDooOH=)@m;Su#hQ{!__=07equ7!>j;8Wenlw^+Zk91G zm?h_k^Qfxwe(d7ACGlF0y(6x2XL2Ih-!J2AX#qBtK!^|5 zn;0u*&Bw?txk?5XGd=n{$b_bqNeqz+qM_JC?-3vQPzVEeGx0SuRKvz!1S=`G8%90l zwU$Fa4=#sBdfoXA!GnW)&biOtL*k|O(s`nUR^w!fQz2JO6(P_Ag~%s5_U1xnW#v`; z*;AC6;@%wl;N9NsS0}=j^7ws{1d-QqEJIuX44X8?6yV!T*nz_0b2Z49plvaJ}m^|cGZ`g8T*inz4K~Koa{{xiP@ z6n{rep2lzMM#i6`)f*_iG)Z|mRv2j~)Lz#!uf?`}T}Wreie7lSECQ|$B7qI@EhMt2 zTgHG20OdiGy0r*%LCIeCS*O=P{DwOBh)2&i!Io9!+4V#denp^#U{%UP9p(0Fj6p$Xf?5U`Mbkd!!%iRt^qy#cSu|cS?yQY}7S`^aJ4|dAE$3*@pw^f&`xb5M_ z@nM6h&11F`lPT5uNBa$|hbxyUE4)*8mx!x61L_$#gUD#p68mo0@pITU7b=NIeD1F_+l8(zY5 z#zT_t!pBw$M3@sK|H>rr`zi_x_imRM=oaq|V7O;MPTzuzKcUk|O3)j@HUooie~o@u zD!>u_i*WhV;{30)7gg`%JN@2vR3JS8c`AZ?J((*d?&YeHJ)!kkbP=y$&86jJoLD#b z?Ma`8?sJv|;HeK=tdCl$&lOdGaHl|R&ELi!GOwDtB4&zcALaD1rLyQ+T7m)+q+>Vw zE6QMV6+bj94b!;i=c~-k^KWv(Uk^`phM4=`qiv~9sLKYb2HpVZ_KC(D;JQ64+VUHL zyP&$icLCW_*2&)KHYMcqe{dPMe%pX)$V#|6Z!^*-w!4LJ78_&eTN*uoP;+B>z6p(J z8c&?Jtk|#a~oQXfXC;g1MRzX&CmtVJr+lY@G%qfD6#_4xmhy2 zN%3X;aS6-Pvv0IN^e*q;nI*yO;PqhN?^uvtPOhQViD@x@@xE)#s3k*)QIw?VeT+9f2~9^4%pk%^^b48R@!!) zo}1vi%-gU) z*>eAQB_*C&dZonDgROfp2K@%`6@d7y7ah^pH5Jf@-@tIKY5&#^EE+cZk-B6SQy`d> zrH1V1Hm~~|E>%Z%2*Z@foEZ;SZM}|$N8-WngDlZEWJDyg1rv1j*jH_*j*aO88oC&{ z(hZvFNQuI{bJu%)9~#PpCEX3nje5tnXV?=~(u|Ip9H9MgV^x_*^{52-(*K`}pJWIZ zX_s@O8UKY&v&lP<*OMMYHA=AS*Z1|di{Ev<_Hy}e8ydc}z4&peBAH*bZ`T&2L+n%R zFwIss@_UZoMC3N#9Z6NOZ;06bu;F69ASNGGd>LUG-P!49?Ps|pmqTk1ohp-uOFtZ9Yp1rf^k#y8X+@hOGc&_x%voT6zV0{HuWuh8*4wil zv3Hl8n}mOZK=QVoOif9*f|6O*JNtY)Ysl}cWOK<5BhJ!N(`?(+yNgeg^!UrFWNyp zj<;gr!=st2sEa7Ubm3!WZqoj%0z^BV%}%G1E$ggB=3u*c*xjlJy^~<{CDab@lx!}t zdpj`b}m%bjPoSYdf~@}i+YAg1$#_o{WC98*E*RnU2bNu9S#s4kO-TQ<8q zboeLm9sGzqjPo5njL7Cl!he^*zlR>)lA^PPBsWcqlq8&c+na2JZFx!izh(#n&hSZa z`eEN~&*2ny@uf)DMf@e3K51{%4Cvb_y+w|1$46PvOj=s1@KLp$U0P+Dq&1KQ6xOF@Q3^ghCy|n{vwtE9vig~x><8g!Ncum37uHlEID83 zIy}n9mPY1x=+dErUXMMJysTvi;PhLyYL(ZDJlUSUtx40n?F_)ssZ?tbdEU3Pk`>A( zziR>kt%-;~(_}QHr*qz-7~9>hTkA*@;SdFwTJD|DJzeu$Dn^}E{@UoRH6*Wg7X(t| z08BOEQuwMW0x(@sP4S5pePdM%v?m>awT~(INv=HcO1h;9_GxnVZOdai=Ts|Zi2^ze z9uq!OQ<6MZ`n80!pe0DAD2POk>~w5rnaJDN&dSV8u$_4lrxf$g__=iCCsXZ0fVpH{ z1?ttDdv2gd6=He$@{3yNP_hajkOK_CmjD^4Yt_p<`qKUV{Q&m4y|HfPIdQ>hC)iVbuf2!106}q2sTSp3?V#8ct3GtYm?o)M^O3g@lmlW?wGYS{|e8rNI?X!%8rt4Kbu6#~BS?x3tW zJR|!&JQu#V*8OF=iblWnZv>l)I^2Bj9KIfU;@iX^k@69hnWMbyd>-at~^PZhr| z@4g0CX?}Tu>}K%(@wR@RHGmCw^m?Stqw(nc6WO_>RPShen*X!-LG#jsAji!zSvIi*fw~n zYg(=A`hi|q8;ST&{Jk@Pu8lgj+ioI4G?qF~yVyp63E$y*XZyUX&sW)QB3!F1xb=od zZ^oYkPVvvyqLp6xSOQFVPN}xWS6lT&z1qpYaoFrc727Vg?nEVZ_(-L}8FkoRy{ftr z-0m?4;5L4zGG^K)zYKzD=@|AhI2D7Pp0VvnQWRrNnPl2E2q1*`q?W-m{NA-%>+Wf% z3*z!?AwggDj)rz}Xz)pe1b>m0kR8f|aq}In!#xxv^uXuKo&aNw6JRTY|28KdDBts{ z0ByiUIbISvK>jwku5kyyJP#y*uYBOHcM@(^rHfcLi{k~|lb9SY+h!*g+cUp4&Ml=0 zgWWSdsohouZ?>gy?i`7Olfx*(cV!K_;jIE`=sbPmI?t~KE0=$4Ew2J@7?$v{(}ns` zRk_OAPs|H-B<64TxB4G%6C0^2`mIepw>`Lee|JzIg7p@MJMfE-VY}mv-Q1aHVvlcg zxs8n8rbLA2%IwfeitbVtV*^Gc$0>S!2QZCF*Z;o(Z_s;02ixy6beoaM`9}hQU=ZN4 z{ihoCT_5Kz4gq@BPQ5a?ZKbEGs;wz(sXskKcuBN5t7@Qz`HpAd96CV`JKYHXwI#=> zm%8dK!LRZ91+Q&*IDWr2Izk(}kOEBj=2N2tZ^rcG_HP;*RTx*yT9aPY+f3)?L z?;RzlbL<3Yv5am4d}_)!v=wNX>pFuIl~*_I1Wc(qIM&2TdsHs7RW|gcvLUl5yuJIC zJ@ZA*s|Lx}!SE$dHkWMix5;?zB0A1eE#16DZ*yvM&)7;3Z#pK`s`o6<+jlBZd0P>fErVmgqmR@h{PD zy*tE;g@d>O2#ykQcJRywF}VKu96tKjky#21+U>~s1(lXEcx88E^O%^^{-yG(dS_NuBz^xfdzFz z7bNUb=s!cU6`(LC_;6Q}%Ug7{U{j~OTt>r;2OB(YYm`b~RA!g&?6^W3JNrD(x&0!3 z+ko9ExYq-vZ;y7t)9U3L zH4lnlQn0?*$Axc#=UgUjhqn?t3QQeNf){n;*I?eZ%M72`P#ypF#ZL_e=Nk*KHKCQ- z?pk<3Mxv81{4OqrmMc<0ZTF!e)hE*1y$Sy3K<+93TVb=u=DDH)IZVRFzrDmPRjWw)+l-9`SELiFyT3Vs!Vw*tEWO< z`OSo~Az#lUaNm7&zRel8#?o|MHk44JVjCg1vcBmab)obgyKb7CpE}%BG?!RksA9K# z2iS)1YBoxrnZS;JYq`z-T>PbRkx+F1dvc*BEt_OeZDo5_Z8yrX_v~M%X}nu(+?&gV z^JNha>N%Rn;F>XJl}&mtw>+OZzjR5!s3AJaK?H4MfPeJNLR-DG!0DBnI8{G+VX+m+ zk>^f_GQL1YVl+Mc`>B>M17q~dOYPGampCq5nN@@S%NzfKU+gSS085HqU{EBP_o;BO zE-#wUgNK53MfTof^L-&C;04}-cUCXmXiwcT!+GkJf6lQ5Q`eTspD0oc$KMk-PPe>e z;x(5`Q4hfz{5buyl{V(}W!uOsmw#pWca-s%epir-WrN+OtUpl2pHPRMWh^*b=1*Q5 zIU&p1t5JPbG_$+2%Ru4HvhrM5RAk2;J;Fu|KiJx~X>I46ezG-hmZcZl5fK;%Y}C^T zpOSxaKz#DzBD?<=6YPO2#|t-0%N;Ek9C(G%#8>r~myHjY5e3{y zRya;4t@S({%#YtV)t1lO;IQNJI#tllDIL({5)_IuvsJ8;o#M=j60cQFxuSeMq z8}SBk|LEC;9z_}^3SLg--LWgD(<<@*4abbO8Kd*c^!%ZK$*lFFD;#HK4hxk_Oxx6(SfG}E$A?;@DuJaQUOZ!+z5LIa_P{SE z*vF$5y0f9&2^fbJV^sOiURrE_`_?#z$J&*fqPaqub7)8H1Cz?&63?ru%#P}=%lp8o zrf{Y_&k>=7Q{nB0=GhZBO|?;X&ah8kUgUbooq*yUlEa`3C%}Kj!j0vyrJnLKT$KIx zOK&4p^M&Ph-_IxcB62Ek;8Lm*uCeDsyXEDAU zFBB}9m2WTpeRk}LSi7-yDijDmbRS*5X~SlF_!`+*T4+T!hVh1Cwe?NCz!v-ajR)sA zts}3{$J0MqrMd9xNM8si73eTFjySw3>sOFZ%QT06`{8+!eorV^RUMvRR+hd#E&B$i z?q@G8u`#d6Rw;u`g}#NlW4wjTWUet!a?1mHB*XrE+BnfvWb-ndcw37D8JTvi@Y*OBy#H?+8SM}^R1!EaFAIFXzYXt=bf*rQN z)_(AN(V|6m>z{75rAwFkQ``?_LN%4=g}c@JuB^`LJz2M<68lAKTRj1F+jgw>NWiu1 z*x25GVu744#V*Vt{QvxRsx@z`xATYrHWR@lLpBim=8{r(RCMj1ZRcJyz)6UEA)120 z6-tpOsEuI59c<{49ULZmM}wsdo`HEo`5%ja*eMmEXFKcVnj0`d+px2_S|hVJgS}gNIZ+2Lrx-x zJx_YDg4|R-Z9*Gf7QQVj8*9pWl;57mH*|%})^kh>*XC}rNB=O*okrn#oXy@g#%BXb zi9N;9*S>9AYumb&HEY_$I(6)zh?fjsnMRgXNPt6mM00-h+(Pl-ay#?a1MC~W7+`Px zdx3rY{32^4SvldITzl(3^X#l&4YWf}?qauHG{zRsloLiWHOR#k3kvME^FOyf`?j`A z9~frMT4mZTXMQH$Ep%H3JVdyS^dr}ST@6*c8xn__}dVi(!Au#f7_<}d%i}1`MWwE__ z_d@&Dp9fi%_-pQj)izP~4LEc>mUSb*pd22m0$2r_2rvodXahbDG!e&1%|=#trE3aj zFAwNMXZdolfAYdoJL+3GcIc^HZQ+#lT2z#yLHt7C1PPjRzR-g_Gx>vDclvM-*a1r~ zQ&uPWz>j;(+s3@Q#J+jmKx@;viI)S$$Slf~!xjGV`V;6>G*6idv>fUeFT>w&{Cl>X zQJd_NzwT|r&*)}<`~K&`zZU%^KUf?kQ3uIs#((?Ia-QIq<6M36q~aVE0llqTE_the zQ4MAHYx7GL(=2_&;rPlu^Xz|`Qz3uJTQGT@97!7-p23DdKhU9a`K9N{3wWY?j3@q~ zE*2kWYO(&sJLlM<8S7m}hB7?kbpZ3S!E(>@;Wed5?rJWrT~)}RgHGsTLywZ2Q`^W^ zo(IO*4b%Y*0K*`+z{!TSMRwm$C;OZuQ}d9^9vNb7yEO4Sc%~djWu2(d2ZmkNH}BB) z{#3VItPU0mNx+JQzr}Ob+Tmw+cm6o~;-1!`edB1sMP(Q-i7{h?PyJ+tUGkT~)~;Jq z+vli`K2IWG1|A~;_gVTN$9+s13(qpQjNr6Yz5{0>D<8gUn!}68_w)Za*jlt}>^cR! zm-7TXs8j(?o>K>Zb^@mKV*UE{_J9BPe|EtI7q|nCyoi>7!Dfv~Kq*V$0NUq>mc&%D zxx~wcXX9IXc_!E_;W}Oij=z&mI>{Y<@p?nslP6EMU;X-5_V(Lv`)%r=9qxyE_#N7& zFHxDTwZ+SZT=I&v_#9HGGvx6*^gEQ<6W?K6@wU?|%ZwMO{cC_>*0E=nEuB;(!Cqjk zI<&Ujh50t({I1qWO6kSF&(ee}UzC$#Bfi;PhG82QFgP_v{p`+J{-))(Ac@FxN|v{r6YX?ehEfv#tYLNaC1XeDhG7ujmG@ zaaN4FbEYOgWFDy`Z)cKuXqlAR{nOSe{CGQF<4g?Qc7 zE?MJ>W8fie?X`c+_sJ9v3Y61Xzv(YUlr3J8`wH zx7glaX|IUf<@V?`)9j#cbd-|XWCIUr@4Q=gz5jyNES$h&7y&(pw6dE{8!JP$hi~s% zJaesm<;}iYFC#t8j{m>ja@JGpMkNYSxpwJ#sL{^h*ZBa{0vlITWk55o>sv{F8 zh)4Pz(8e9>&)qiNjqY~cnptsi!eW#NAWe8(v1o&}@6pV%+cx$|49<3k6&0V| zs*xRfT2~uzP#Z-4C~lC%Z@m=hxhHRhvxYTJG61~W&Ny^?md6UOgrj= z98LYjAwzQY-o@Gt5Gi<4%0`@<)qwVvxj`oq9TZ=V0c<=EAE`P@=8gb$D zwYFwiksHEH%9+3+OBzzbuq=_W$%jdOF=qe@?rv~aG7xaMTH83EziqZ%^Wt!8*R`ph zGyB#Jd)t4mnP3Nw?Bc8a9p!XEMz-$U)UJMExM}X-^@D%(4R{-NLL0%iv-9~^PVb>8 zY;6hFWNfUW3CF#WD@R_bopfnGTclkKA1D$#MYD^eznx=)q=VQZ_5AHKd@|d*V-qdj zaK4Zt&E(X3T28$ZIilNkZDz-RzmHE^UcGm=^lgSF^XqKbF&%8b<2u=RMeWarlRS~r{Y!EzfUd5vT6g*#_klNPDgvTYOl`uBRf6WAwkmB3_oWa`oD`rJOpA zY{=n)@AHTGYcKDgyWuvT@6JefsF2lF&VuQ>TZ!MXbZ^wM6rwtYk zhyoTmePY|HQ>Jf8CDQ0~Ifk)2SIjR^d;J~nuRSowT56)$sdsbhHZa?9v}r?;HENn+ zr(WLQnl#T)dx{K}v!&OtY#VT3JA)^gEUs9*LHOxz%jV=Ok}1y)KBC{ZTo@3+RTxM(Y3hea<=Guur?CVbIfrqxSF0!fKdSro3RAlOwQgnEZ4f$$& zLoN`#wPCHCJ6c@&+66sb)-aK*KfE0E1>Qh_w(iu_+KR8v|NRh;nnh0%1^SXAyVA6i zznAnSHp=IcQNZF;MFFyiF#SLe45!_q!eYT8#g6+|-MQIL_(9(?nk|*xlcs(Y*n4uwU;oBeExTPK zYomF=cWxc3h^c5RFuIy?5%u=07S&2iH;Xr$*r`A6?~axC9$RQ9h<9*Ojgl_K5z4rq zym^}DD;qWUY-*X!orIkKbyass_yC{X2ez;`?q2K*heMC-=#E&T&X|i&d|wMr|DEr< zc!nO;!A6|j!=`BG&4jmC2shEu4a}K(4sGSGtUw<)=zs%TRL8%zQgfy5;-fs-n=Re( z_CMJdD8I_V|NN)X*G-!?>8O~--j`qe z;un^kooz#g4Dq(ezvY%&?1K+Ju$C=bdfp+29AY1T{IOkq_0?YIDW{xbKm6ejZT|fE zcF#Tc*s4{ld<-|sl*79dfc5eL#vKkQ-goZD;AkP< zE0q(rot^&EfpX%u@NM_-oUh7>2w0Wk{6|(+@4I5EU3BYSw%@Ux?9=C0x?-xmUVe#c zDl`0;^f196ey;GcV1uuofAnOo_1(XXOySaRtJ0Z{8 zo<4e&P5(64&imb79^t??zctGX?WKRrw1eazI7LncqGIxvZt@A%xYt%FB5kl7$KAB; zbh=M;*lrA;qyGvw>HJo$!qf0)FD{du>>&BpUy&cvJ)+`J$>$z}TgW-mL(dj#%jq=x z%4t39WKGy`c2w;!5LC5j;Ge1}jQhJO0osZQXP<*0(g$T-*|uEtlr0M|L7lN61;#x>FNd zG=05gwNAG)elf`9DvqeLem&Sm%9;22eREw0;owTsqS~2P4iX(^Yk_K=Pu$o;zYX^lWA=6$$a#OUp!S zTWrC!HBPTMvEP?7;P~(Mwc%PcVOIzXRow@*uwyUk?M}OY{BVMO^_=d4_h9?r(WO3K zMlfFsTR7gZ8UFjb$v#oV0XzOpIp!pnB?e#@wg;0GsjYYFoY_-}P?Cp3Ut@*;Y&- zC%u*Dcw<}enAaA`4%aR&zcF!q&PEq<+Xr(9Pi&XQd?P=jYMPyHr(Ze1M#{PL*~^RF30y4N!C7+J6$7*o zmu^r0d72y&ePwIzZR2zl5zcpbZI3dE@U_c4stRxzupm^Z^YftdLuF?Wc){6a`ySiD z>7}=v@E?y_BpW!(Y5S|vQ8>_%A;Zt;s)*u&z7RD=$HSnDkRL=X;Y{zle=B$Fu|Se1 zm^N)8cq@{cbETiXeX8hmkewl1KK{q)hNByOIakN_oOEe_MGZE#XSLn*Wa%fIRiC}2 z?RjN#+vT$sKY9&oDLIxJ$!CpWufy9}zXRL)c)%_5lvn>X%Z7ceopk6BcQ$@9YO(hb z$31gg9EHp07B~mYo3uu7-E8Olc5fSSXlp-0Xt&@Ra*~d2-Zs;IaPJUB_fGW%noR8s zL1$nSKJbgl!bg8!%y{;eIer8H{r}|orE<{r))+h5+y9;KV?xI>FCz*Qy#;PLB5R*x z+S;)f_wu6=SOD^ceML;BW|le+9DQ+)791D2E*tw=uJD-R_C%lkTWX<&MTIg!q5e`g zj$WMY5BzeHovNS?oV3g4Ztx>h==;gqErwkC=qWk=G~YT%3unl!ub$Pz=OJUBUFG)D zr*Z_cFmtZp&cfAe56tpD5b>SSIK@uCVvyr(`lqXWVXZFZ7BB_pGqtUkfZjH z2_6BxXxe%?Oq)rU50HacI!%EtL^9Tblqf^^&VS(qJMOsS?5wlSaz`6Az542_cH3>Y z*+2gA5Bup)f9l(FSFT!VzxmB??8iU;vHkV0f3;@Kn%TU$^X$F%-gCzx4nrJr2OV^f z<>lqs+_`hDurPY(15P{~fH(_pzx{SQ;D7_{?|=Whw=r?zL_71$Gi{%J_OW07@|W)X zi~F{gFJEp87cR65FTBv}BpQ%J`E$=b*Y3FE4uL+!=FOYu{lJ-svk<4{xN+kwH#gU= zyz)x>?Qef;_uY4&JujywTZ+ew8DrzekGGp{y2;Ky`)qd(zVgZ|?qt07+H39m-~YaC z$lu^?)yF>)8M{A;_ni5<50t=vuFMG}sl()$l@P*hIjdsfj5W4V4haN26BC}pIm2on zVaA1PQml`n1G{T7v){2@-1`ngei_p?!&U~75FX|(zw+iQ6;Q~vog~E0Ns~C)CEo5@(k;QIK51-5vWCO_JlK)X!Dh-7Qmqp2GQOvLhJxS%|`56aeRZfiUA ztj=BsIH%jJcs5bw6j6v{USFiiaIqUAtO6f>ad+$DtD()UbVKx_llc?YX*H{Z1Z$QY z(4DLxk6Idb0(KY_Lyu^$mDLrBc35rwhBw#brI{;aoO~aRTHr8B)xUwg4(D_x<@yE_VPj*Q3byB7l&b{R?bP_1%un25+f_8|5_VV1Fs1BFDi@vav7*q zz#t#PcYKJHXF;mJCgpj;$sDa}ckRZUfYnDT0y>!0?=fbg}J?t zYweLtM1FSb*TNmcL?a*{z%3I&96v0CMY?cpqze`G%^7!5w8*y5+b*njbW_yXQNDvAhM|IUAxXggRZ!)dvf zoRJe=BvQN7va&OUqqfFTH>3`oqG-W3ia6;$prs-QTUZC#K!d&#g%&X*i5#~wQ+ z;GazCgeEQ06zv(|v{5thwRn@r;6qQ2#=yiB8dxuVO~m-%;q7HxHFX)}3*z2-{rLmc zK_|#3?R-&;2&Hda*;n|)CQNZhdSl_4IRZODz&Xwh zqJ~y4DfTG&!_Vq!S(4d{rmwT^L$chigO71+@X@vhce>+<8F5Yzw`GaIoi{FD(c5di zOjfH5U(j*;cMpROceBiMr+7>yM?|;2E4V$c@Yjyh4Ig;NeUyG-r7E4A&d9#i9weK5}xaw)~_1!ewsgO6cu!Jy!~3g);QKG(w+sQ^ZwXRXJF3q-BFEX7jg{Auw&af z?;@X$x~Qw$d(i&T7v;G9PJR>VZeE7+=?hB~Q8(T0zjC5G4?)U%T4*4ekA=$dZ>;o} z=74J=rqMB7#8WtSM?bUH9p+tRuOKtfB?o9x_>mq02WGN^ues zjn2*jqMfIIx>Cp5EODC!dS$_5tK8CjT{@4HD+lMkUyB^}IN3gbd7blnwvPQmRwB2U z)1l``&{$n1=nDIQofSl3v+II@BOICpzz{t>>W@J%zW~Fv7F3}M(CBEYaxH2DTq7OK3CU~;=G;{Q7MXmNR zaKo`8dmoYQe3!0>SR&$?#|_hNj+NR?!s7Lw3RuBzCaqq*+MQ&NJ@%Nr^wLZA&_fRy z4!0F6R`|Byo;`cIL+@ul`~BB<*mwdhvf+)Pw>9{`ZvG!C_tQgmtK0Qb?w^K`|^Vy{J@=tI4LJhn&f@$(7wHo znaDsQ4T%`!1tTq5w6LR(KHA!}X=B%4f4#$|TeoiBhdqTSZ@h{>5p=4!Sy$Nza*u}5 z#HRo77CJP0w!-(@$l=pelcNVt!pGb>n?rY;Ny@QLAzF%VsEk#dL_m+irvp@kuyu84$C z79ol;_o47TU*}*Pc4`kfn_5LHP_(amPAi&B@nQ>k33mqie(Jaobt z8!y~7!-e)iBfD99ZO20fP!GbLKC;cPMdu7JpWQB+;GGrj+9%cvaw~uYo)&z{c$`W=AxEc1f4)&=cNI2_dFKwx#K6KHn(QE80-^g)CI1@+8 zBJ&(ax(4N)`!rLuZGk%>I8a>gw)A}PP6C&_tmwd#I%rE)wx9K~-*N5Th-)n;0b5FN zU=R(&!b%g#TaHa2!jS$k`64P8XTSn&{p8SS&P7@>YlEB&O=Ohng)({`1CmvEj8vM= zYLo6Vk4aObW|2HbHf+c%(Keh29z+P9e#Ky)5WJvc7w88vGje9jnYu^@j4CTF%(B9T zy>0W_w)&wlrO6?+zNMAqwsWW8mQoq8YdVNn)sNL}tt79l%4kC8&Orx5o&I5)ZKFnw z`~$xl35Rsucm6umWi-d0;CLoV z2b>nlQJ1O7M6qzmg4&^{C<66o1AOt#BX2ZupnoNb?1A>cHTmc@@Z|I_)*`#P9dh6>y^Q4$w?oRvtYXz_oIZc> zpZZDA_CVr?3=f2Y_Hun*ZM0$)A6K=PW->V+9K9lFAbUMFVg|f zs~3ykbPoq;{)$rDYj_8@B`&;vh!!K8`=p1izQ!V3+}632uux>&>_$~ zi(;HrH|w)V{}DCrurGs2zy)*$KX4D+0yAikvl=<_f(2)2b@7aRuah>ApTM5yz%Y566>>1TZh|;m-TjChOI~x`br%?036oo*oE#x8oBe9 z7ecYv=yN*RFTMBAlAVz5@(#Hb(G4_|rX62-j!X0u{F|@ysc$)Ttem~gw1BC|TshoH z;4P9{5iRf{7sh~{>u>SKc2S${y6e~_>0j>gVSLyf&`{l_G9=T4E|H}ykap7o4|W+& zO&0Tb;i!6|oo9*`bwZC|QGP8PgnolV682KjMz)+r+qu&v=dm$3$NRAxCTRh;xty$B zt+gDCZeQshi!@a4_Jr!-yKPtLKt=aqhvDCt__kgUBOXIeK{xOwbc9c2Po~J1VC7q7 zk2vB8W2^4);lpjplqv268$Eiocag|FoM%~C5sfTdxXAO_j*A0v@ZiDr>8GE19?^D> zKk^82itRL7sp>%V8rGNjy@cFz$Tt>%sukRBOW1$Q;*0#BK``C3T@dk z9i1|No)@QoD_5?xwmL_eYtouEYi#P&slG*+-^U++yj^tBMfQh3{J{=A^ic25U3cAO z-~H})-SNj5nlx!*I5XMWO!=ptdWuKO`|CgI$)By#b~kqj#$dI&lgk%lGT@9h zg!tqSb9GqiTwAqhlQRg1)*>KSsmC$FHk{$#>|l3aKE~f3H|n-IUd|bGH;<)0H7Bv; z-6_^YxPRZ?)~8pFwUSqQ$lyVKFgk{M0)O~#3|t(5$A7=CJ#_U{okKB4XN}FXyDy!n z6`$sQp!i8Y?ylcs?fJh=vseE)-?zH4EF-s&~l9Ec@x$~bfbs~ zln&4K-oJ%C_`3;mRL#-bYnQq5Y2c8l6|_2sl>uV#zya2+ODCQ2(BAeM#8yormAM)5 zp*I)<8noq(+01lpKg-n?m}YJ`uo8*EH%?p9p16L7by#L2j>DZkQHE}Gb^Ki zw`gi*gblM2WFH1Y>sBpo=w5@YY2zj~pkE*BmDAlF5pk3xju5=G&>3k3>x*pJEE%VY zV8BVxUaPH~Q#M9#Lx1tExvra#bJIT3TXcmWWD>mAUuX6`|JT{tP7-Y;q5d%WN5C>s zc~%otjDF5>Dg(S%{4jk-%K|G&_)n%EN6O#63UGTvU%R;Xuhjf@~<-sJZ&WR*mYOJ@|g@kj&{ zZ!Z4qmBqe@a`Q=_>)fVX$$}C$f^mdxk<%_kj=bXK9j$l?PQ4=AICg-p+gibAeXV4D zYfH&kZ^gOoZF51kBLC$4oYm9Tj~ZsBn-ul5SrfOZ-L15^k)9O+?}n7AeKC`#PP3V_ zbZGqAb@ut#@wPz+Lx)x43SB@(3MWJhU3Tw&_ScKX=%r-ybRN%KZK<57EmXZd$_t%% z+r^_@AHI5@wk*ju>7gyBz?MjLWGazg&}gI7EmK?724?MRnaz) z??w4r^oGW{?pS2vht0E(9M5cz1E-JvVX7ucyp3AtF3BP=pirWOj=#u=4?geQx9p@C)$#&iQJ&!I?s5D zb}i@}sY&m0G=Q9w;=@+mGsXXN-64>-P`h3*>9ez$Hms3On z<7A}2*w91;hIXRX>d9ZhoijDx54J%L({x*-rd+p*1_T_A5sF1&K@Ec@ND zA8I#8e~$$77mq0-a-wX(m+zS8aszopWZX-4&2a}i=cBD%h5lQjh^To^e>hIOdf@>c zn(=mY3=iH^1zG8tSI_c4k^hnuA$jgl6_I#kyEgh zoFy0EI>fF&{Ug1ddx4H2nr;*IVkRQ(v14a_x>k2w%y+BNbsr z;@A<+6YVbN^?$CKpd*U3Jy=dMWFdhLys;L(Mt&`u9la!p1$h>nh=#=p$~nSp)bZ8v z002M$NklP3_@prt5tD84jnzv~!9mW`Z5 z<13T{4To`^;i63ALARv0A6(?y$6vm8rslQNwIEwyoXyAitk=GLm?FH{vB8m4ny<>i z4E(7ACoRrY=w`-S>%G6NboS&U*G^RgpI!u_x|hz_=nTSQUQhAD+=+Qw^jK^kKeOC@ z88{oe4#;wwjiar2IU6=SXVbrM$9&;rnqG`LL1&caxUQS__F8WreZk@q$AZ*~0tXN^ zOxV8IRXF1wfBbRZ;(NjgC-~WaY|s7UAOC2*diC-sK(@~Q=tn=YM<09CdiLyT4?g&y z<>d76t-Cl3vDt|TuteCqV*&97H0>xSHvDseK_R4{q1jil;Escv+R;fF0uXg+t2&L8Gtw= zIlquI2&sp%w8dG4fBy5Iy^cp8ebl!Nu)z6= zGc+eB$NT2`#INelpA>m7w-Dk8A_Kr`+C310Cl!QMmhg;YB<2^cwZDxyz#6CZQuKiY znz)>m4$dw?p+~DnDLSlF`|Fk0yfrKMTH({Z^)lKJb`U=y-yGh_gk_bKK87#`B4;x- zRapC%GHJq=no(#QmUp&=&-b&!^!4_`i!Zc|VubfU`phmk`*geSKabk@Dbwxb8?d?;ZEef+Z8W@Q9=x#%v~12gpWuRX3||aH?(-H-RwBb& zH*ubDF2$PM0@abBZEUO}rTJDpgflBB^dna=_%_SR~+T3S`y5W@AJi??<=QVcf*v@|cn_u|tqRoYN z*XWZppD8x2tNGYarkoYR`8pVP%J%VYl%u108*RDQ>Krge`Lq%aDGwZhKasV$+JXjt z8UbsSZQP>K9)(LH9CqjLEnA2XDzG)P`r6{xx>|axV!Qmim)OK9Q*E8zg7sBJyxjHA z2W{Hyd3M<)7ueB9jqvWxUNzqCpS+KCXmYajySB{>cR29^oH2Y@)yq{B7_u~MIpDBr zXdPS>iguyLmYV3t0Bt~$zv&;tFGKigtVs{gekqg7z9L)v<^i^HrnbHh>uYD6dXn9K z_rL6%(@wIy)objbC!Vvl>+|i-TmB$pKoM(7&rkiUP00JLwa7SJzcld(c#%=Z+vt%6 zIPq{26c!X~6z^5n+XHf`>TB8Yc$22>ii2@ExqTR_DG1c?KV{ z>W*CF?4(UP2X~cL=&6U_$TTLX=r^3d99G^!=b_@{;F&e5i?STMz(jy^X!5jm(6^bF z^@j+F&`-vK%ws|Z&8*b{=*a3$eX{+V=m4UtkrQdUU!uUh)J7`v$pMzua-F5OUS|d4 zdRz8U@7l&0`^foMVvV}%O~xPZYmEnMH8)jn4V=WW$D~^p#0D}QzFc=Ib^lpj} z>b+|vZPRMIw)g+%JNMny+tsQqY7QJ}-@EVLb5EH$GiT16IWvm#E7}F5F6fJXHQy<4 znS#a$h8i2PBy%53yr(0cqEA_4$bwhOIhCbFfM{Rys^p+F_^afZ5Kpp9)cuUSWIrLH z1z9u4u~fe5)i@A7eZFMDxR3htIa=DzcuGOJsRmXS6SbIeD;}HkPS0X6WE86L^4huv@4iP&XEE_yh3t^7V(miWc8;_13wx} zK9@sim&Q}YcC75drQ{kZwZvB>iwVaXld4}9z?vTf1JS#b^$s(}k@%EoUSmxP1NnZ- zp#Q9yoR=L9ZV#0g`y*@Z-e{9DZ?yN%`ntpDP>Y+vlUoAO zl4LTqU)Hr6+k#s-7i#=U@h+U}{-~l%ms?a`9{kW{PvEBa#DDj}FI7)4uYxy@40p6k z8HDTujYu&p{#jGjG-hbCe2G4_dM>yvFcL57txxOU7``qXBx+{IF#Xs z)(gU&+D8S>Tg3}Cr-_~<)63dZ<;a>^^dOvTzSMXSZ%_anwNGmkwNJFFK05B<4N`iF zW;B)>BQzWG+gPmJsP>>KJ_alQ_CMLx6P~m)#$EwF0(c+ng%Dq%{5LA~y}+^Fd4XhY z!ACF??^l}yL-Cy2a*lS=XN`SXzlukQKL|HIwj=ysJTh#q_?N8eL_g{9E5S@S5}y}e zeS#oUlNROK2;4KtB3&++RQGScvceW!r@$zIGBJlbWofK=OZ-js2_}*|1#i)ujCY2O zNoVbb+XZ-==1o}*%9o~;irQe*nonzX@hw@vrE#QK_r;^cD^sC6^-t|pT^cWvm&7Nf zi%4f}BBh~VGD@+4#| z@p$niDXz6iqp_`ZvNoJ0AL@C)-vfRwSgTBp6Y(oqw`xr%nofl#4>e{70YSf8+USi- zY_qbL7FgrqU{O(#TL3Dkh^z!f z%R1Vd$|j?}l~3=fyo!nn|JHp4ThrD-Gru{MPHOG`gAmO1-S(tL0+k{F2Eqsdo_`a{tz zB9qm3CNM$JXDrQPP#y?BVSnNaa*UvmPG5q54HIoVI1=9CQaDRUJ(bPimUlCNqhKh~ zYp3o+CeW~)Qw26BvK<;9{Zbz=G*}KYV0g)K$9FX}rd+Ymm{K)6rGjrP6I9AX`J)NO zq2mQXEn#GmH84(NGlPwdf#Y988=F;L3U>9TFG_kfaUA@CZ}BGKr5*kihd^8dUgC2RZ~=Wc{3jt#n+@#f?Sfxj`eTy1QntzkQrH$Fe$r_P6YKQ*7tHmok<5GZpZ{InJ!HiMOKq8g`y z;FWQ?SfRFOaLH^yn_^Qq`dfn%tOYAT7LBn<_!C+&*AmC?;pi`Z2HTP>As;9DX(+AR zSYXqw0GevWu}cHX6i>|0&89B-t?jX~qY#!&a#RqfFcZ9x3UY|9uGl%+B?285@CG4N{2)7aZ99uEBDSO^MlO7VG_L7ONi0UV}NUn658 zE{Bab#(+AWF*V=YsCH_u)O;Ar_~if+F3}u9Ue-`PD6%h6RnYnHPBf6hdy#L^S{so^ z>zJn!SmfsBXF1$jXftkmZS$Ia_PbB*vdh0e%{nshCkBzl;;=S>c{^uxFn5Xm*z1CJ zP%J<@^;*a=M8!u_DZi7lL^E+L1Y*(4?a`cu%oxk!axa!9k^|yUNYnsp4HG4YFUkm? z3sJ-=^}UB;qDu4vttvG~#)0TMdqkGs3-OXL3R$wU-Z=ueKo}528OXGwW0T)Z;eBh>tk_rj%AMt z=t(lYnSw!P+B`ZH4pr zf+Sxz>Rpwg6o=a*@dhQ`SAQh)Yc9+jo*BTF`}Ay84rIGUwpAX-G<{& zt!PrNwXvbtK$|)l<4Y~q<}& zGH2{xYiVsKz7?0nT!f6FxA_?nbbE$}UL z)rTJY^x^1}kimc8-OPLv$N1OQB+Uay)a$$fWgfpvYjM}WoEp!4%@>+$1rzl{<6LcoU8#uSpKU`-a7$*Kk^6yv0EWnbXy`U>rK1*7#?9W=tXY5#_3WAD{5IIA|o3 zI+P?!^kPgX8gO2(ISt-vhOSmDVg*aCgqVbEqt!~x~KA_+|pl|bYJDqo;^Ff)%RUkSm@Wv6B?fBda(KmMi=zu z4Nrqec^M`t3!{_Dk#bLeVbVP*A9YkYOuCnlkkGF$;j_t;C!79G^~Bg_^qk-%#{RCc zwU!hoQ9EGrzT2jzh(P@Ap+D4Y;NO>|^yun|wZ(hT^1KbxU|0;m69G~btOkNdkK#BA zaMc7Ny#hz(QcFa#5>8|Z;tX>Dyj4aY4k$nylNeo~5f9$e^MR=^KM!=B3J*iUZ@4S; z-_iM_^SZDRX@9@_Q7`Czn0#C)zwU+Kk%!UmhmXVe!f)7-Evd+6QjRE3!v`nhTd<{} z9ROB47RfNrre>@klM!H}`W!Y*dE2{V?81V2OG^kW71;Q6Tt@dj%&+ed4$;q}ucPxW zfxc9}Ch)goI-uKqOh^Mwe}g1mLhiKm_#Qj2U@w9#yKc~!U?>_p7_0{=sb5}I9gn4G zEk`bw?ae@7dTWdM!Rq@ZYxVcSvQ)29_&fO3|8uZ0;qOt_z&Z!Z+gBQy`|69_jBa=I zwc3*q*JEp{vRQN|8ZK<8i+`P1G$yl>?qa956aPi~u%Z}-l|l;^Avqm9$GLhvt~+A$ z@cYN2ss(F;0*+*=p&a`f*xtUjy~T?N826XL4F!D(lLAu2i_iv1S`3T+t}d*$q=fw~ zl(m!>!LvTN>hXZeLYRg{_rql*f8YC&OtLQ29LeUZF9!8|V4kqN!M@dmu%+G{KEisB zrW|!9p1>}v!SmiWtXJOxj=UX_#(LYr2I*e(btI3z)K=D0HZ8rwuE?)M;R@YBBs#7r zekd!xi_)9ziyN?z%tt}rQpuuX@ZzHTt+s^liK?#evR~e4*eOS(BVm&dnm78rsO!E; z!iz!1Ky;a5wnKiaO)4i+R$t!me&3D$<4E=NFvlb!Ul%u|+va){ZOjdU$|35dlXNNh z|MGElmXXW`0f1NcM0eWoKN1-A%frhUn)FB9Q*`Qs ztsWev;=a6*0{Z=qw7U9b$G z`)?ooK6#@1t!|>eu{V(UyN-v?{IQj^3(HA(o%$2q_UP-d8`1arT`R)? z{Dg2)J|+E@?2nGZuKhKZ<#El{6N^hN27uZi7+iTv5=y8BEIXOsb%S@K>rpvMM|v;F zJ@}`}(6S|5Bl;SGd(rI{4@g7?*;1EjJN6}6@}V{_BK;h^wu9Ye?ZTsWXyUw)93M|0 zzzjgrdROhx_|rTz5DwA(kG>9T8SLKSo*nF+gWVrkp4RLu_GVih##9Mh3w>`n38qI_ z&_LZ$^lvE#2QyUhaR;EKJPY%O-@2z1J{y=f`hHk`m`CsFI=rvnN&}w{yrSEq9Xj5<>1?F#p< zNmU$OWH)p#IGHdY;}CzYs=CNpI+;Wfj5VJ6=*zEzM(b1U>Z31yc)qYses~_Opi8E)vA=7=_}0Iufc$S}8iO1kin5_{q#|vgspM`}21` zWc_=V?P@~!1{g8%odo&FwbZ#QEjD|+HNJi}42fObvE}&u8)I>K9Ggw!Xw0H5!Jz$kBjIkxX7PSRW0Vn`FY+gYyua)e;Qj&Gn>5GtA zfcL4Cwr|4PYL{8zWX8e7pk-~yMoXao3oh;7(o%TEIz*@|uI+#SSo~U!%-@049KkFtBgRXHu?muc^YwNTDlt=gTG>IX=6@My$8d`D=(PMp2Lx1`1_$!N6&m) zSC`^^3p@3}vqEo2nu-3C!Wg zBppRDp-io4za=Fleymj1c!h<9z8+G0l*f4@Ko<`U@98^QNfzdj?5=!z7CsN((>u}E zVf|qpdM>#`M}~ET_x$tE*R6i<_>BSgqRSlkJo;Jmb#%VL?uSah!JdWho(kV5+yYP& zngq^UmYsu707VwsYd3v%jeYBZGcZHW44fFlf#o0?)VYrj`D_yp&^dVR4r>QP=l1n2 zzZJRa{1j0w zaQy6bp9+{dOdIyI$bf>?{#wr1w_|S5+SYE>oJZGrdhh#yvLvtI%ESI=)g`v=jY@m+ zf3{iAbU5^mN;{hfkqfRF@9>bn10DI2uL8keJ|tA0tpDT;_0iX=Y(@=^_nXq)d|&h~ zdm_TXf)^KrAXakAj0458PjcI;W+%wZMI7;JlFjw6z@i&6Of~lz?6Zd*`2Fr z;R7MgR=redzxcvh`_Xgfx=##5hHpQF7RoCS z`bebx5+-VEYdN~m>{gl8Tz5xyeg?K&!R_|8#@nx!UgZ4h@!PiBn#HyD`5(=}=T+cK zNZXyR>YZFPR+ME3^)l5&hha7M>|8j4+Uv7nb?o9_Jilov9Dgf z!lqxHg9B&$wQbmA3$7k-rxC4BG^aVPTao%0E22a3G$rvo&3kHtXj1va$0TQH?sAz# z`6xqkn&!+VB9h+mXB><|Yx9`&3c>0Z2`8H^08nzI@RVoAthY z%Sa~x#O6vn^KXi5&Sj&0-V@z84M9}Gq2?pUweZ3{(VF9s?+5NIMS+-X=e=tGBp_!DLw4mrCuDPtC9y z7mTtu{;<>XC#2i>xvYDdJKcwyUZ2w zmT)Fm2)^>y=!xg5M*(YIy?2|vxU|J`CgoVw>MFbH%3M45LldoHcdLEtyF2aH;WM1q z>RnJ}n>RGu8_ODP=Qte|491AldMF!lSM5`~!!?J-L;02ltHy`mX;+N#HJ-O)z{l~F z`EdtpRUHZTjYrP3+rPQhzIxjnQ}B*(K2aZhtplLDHHUyi^}&5N03P(Zz0@z0POS}nifU9ur1J8}jPe<9bqt34Gw=st&V=>7PIW|d! z9${e`qe=?0p}-yA{MNUu6h&YbK}Wy-^{>0HzQN?~!R~oMkq?zSSRRc#rGd}G`;pge z%a$$n#1l{SDFDO!?|dH!0j7zQlUf+KEvyaJuftIeo;=pANBAou`Wu8VMp3e~j!C%3 zM&hhg4qe4?_Q3q>s&Gz<6XcOZB~plVg(5HC-r#xjao$@%w4=R5)Dht-x|f0)$jRmi zCc4U9M5AS5m($x6{J4yo6p22IB1%p;lX1G7i~pD6HT5{8#hG_Ong<*4neF6&X-Kt- zKvFpuanJn^vo_->2&N7H^|MoVI#| zJ^i~_wzm0i!Xz@=jGeGFUcaPM51lkj3a0QPP8I~NO`NWQ_|zCl?7AjwjkPO z1`f8RARIA1EfBy}dcY5&yK?Yrb@?dr$NRaxgBN$Ap9ub9bkTom!{A-QPZ^#q>cQum zudoG3T1EuJg;$Q^I7pAR39eg-0*O2(c*+5@=t9vY_Yu?}11H&|iApPhq#hhsC^!Z5 zHxe2e#==!j>?H`x`LdkVDmraG_^nkGLg-GBROPH$G`DkIy*+trF+mj)h<-ZCCzow2 zf(T=ZE}f14CkfW--(Nxsnn`>4C(FNI+r+U8BoR=ffSvb#I1Fq4S0{A(x&*2Q%wS7L1put~!izML?Z5uv#S$HaN~ILa?T zFk#_ayQ|GAanvokEg-UUZa&e}HtlmK!rAz9tgUGC;1Qyw(#=66SUKxffSXa|FWuB& z%bzXv#fzfi3D?_K!E+JRM@`J|=xhVn#3_#+Io(dght95&Qv2Rde`y)`2D|g#Ke#ZF zfo~Z_h8;M}5C>h@?CN3B7(NuQP>TMo>+rrm9OQX;U-`m!!+Qh2qw_>x56q|EVZG61 z9`2oiJFG1LB|g$P(yX>$|M^M2 zL9u&Nf&JivtL&5bWh!KmQoe1U6(A@0B63rcI|0`*L-9NXjL_mn^i);a=nID4QNc4w+#LQIIRPHo0;me~cWp_gD$fHNPo1N7?ou zBJWr>pC!Z8>}o;wBSI{TI3+oKA2A-^WGu$Z!M|{sH(K*04@3A50^7c4UdkXJ(eFfG z50Z7r^iR35&>id8Qz{Af%^fjTI6u`s^beCfFvRvX1$NWNR@vuA;HPX(HqQCm!A-r- zN5ZXwM^x=p&<}h>vPrK9oMWeEx+DGU6nsS?k2H11qd02vXuy&c3z$QlZo&5$XjlvP z>f)db1u#$@+VB^%lWbGDi|DMZIaIC!5_B-<7O!sX3j(0PFg0bZzNV1OE4gJ1dAkU> zvI--DL>vezu!RB?9xIS*XbdUwVhm$;{fZX*?N6%hhp(RHbNVZfWY~^UB6cG`+;R^} z*LkgW8S+OSGT;`XxHe&$s~`uWF$K7(BnX^%oakY~%q$Onuot;Q%B9iZML}trwFcV( z&qBaSCx{WQz@48-elOcr@Aw+QI!=KSG?vBN5|EeHFRQcP-&}A1`RoF(zjF6z`_@&< zEPWCiBx6(T>@nT8byKU=>}l~pJc4!ButdAyYywv?rzl8P*=l4X)^l2`iN2+9a@hzO zRk$Au-zBrXLR8yb@QU8-3>!C{dm4lSZWN-9o6Ij>;OABS(>zpFN&p+@S-mD+ zCZE7v@Xcm?8NcUqOek-&W@L5YM!avA*4)T{io~rT zA?52D?XHKb>`MGr&qYR50F~WK8+@InKsw^BQsA}GcHvp|=d&hIU@|FuD>gNHP$~sQ zQ#*T*ednBua*_GAk^Xl;%TgW=#DjhxKfcB2qx?APt*Y*_AAWj^efpO(ZT30CXn&7A zcH0j7<8RCDs=q5l7H?*Zr+E;S@>0#$-L6w8-M~7Sb&_-jq5&xgE4Zg}6+onDPLAW$ zr@g50)sK$J+c);2ulr?+{Lpiy=&~aBj>Q}v6h8D%1;_Z0|M(C4+Sk73n|{|`d#%0l z$}1k(cl-A39+X3V{}gREw9u1vpMqq_7ogtXy?eI@1Su*ia(R8{&Yd1yLp}iK&!6w_ zZP>8EX3Us@jGt&bcI0p2f!tcWkp~3Ef_~vBB>6hgH^u(r+&j(tiA*#eVO} zo3`2plydF0?fusQ=;nn|%lHW%AvM zwP6{I>Bl!L_efU~PTQCuMBGw>Y+YVs&)iYWy&ik;dz(?B5bXyB?8F>GDkRA8_o?_z zgVWP++KSU5Y15_rlQM9yq`P8bscchS@re<(_>a46)$^5>i}Tixe0eg*ATS18UTr`7 z*b=KLZnFFS-&%H)>S6Hp_VbUwXrbzL!}P+o)+1wXUsB~|SE8u+-51x|);IQAItsug5AU{zzqY|j zQB3^!y2ZBsrELajA*naAECWQ43uAqA1o??%#=)0LmN>fLg?*OPAn;QeG&%{Z45)+alWo2e) z(iw!t!doCF1yjJCD{HNg1<4ohm|+`U+~YWDMX`SOmsi}x6HP`QDsYhzssKe^;U=PD}N|)C7=Y~9nj2@$I4v6 z_t-Bt+XLU-?0C83OKVVSAk@>5mVGFLiEgPy@#~M4*rqpXh z+7*1<^Ta|tE)zv|3Y&W<1&@dFFKk=zjfDZUB^-xGN5b!3_?@o%7-qj012|^0F4clX z7AfOd9A5Xe@wOXzq>~7fw||_oK`hEdw=4d))GD!}*vEqOXE!Wy{`tm(JMDpQueOp^ zwf4sSJ8kvTeI)dIs#yZ`HJZ0$4UwtaE6J^G`K*2M**t4E!CPKfET-siyo3hZXx)-X|#>y1?tC zxmot1Zxq_5m-bp0a>C2M-ELc6+iMlz@yVOFKvUf&IZu`W}VLyL7N3N=22e?5Qbd#nq%e)-NF zw(j`~>(!k2NQu3{9J&WZz`ftv;EF$Ovi<0zZ`uwNPk;R3He3JdUOzF>O*`5!T#!=g zsOHTOAP4y#$cqn>?ZDf-sFNJSM<&|zvl8vKhj!Vv6?HcM!hAdTJ!}Lwb=V{#e#Xl3 zk8x7GqQ?1A*}6Kr`Nrk8@y~43<9gWQi>YhIMQpKl+0W&KKps4?QepciZNd_t@ueos1#{ zzt%)a9meM7d%swK5}r*bHYB$$ueaxK+h)6#Bb$DdwFk0K)y`(S>#OVCWx&Q)_Sh?| zIU0$Mdf!)9TQ|7Y82Ik{UbkJ#YHSt!dhvt1d<-Pu*ew<3bG_|EcxCL#XWBrTIuMA* z=#FrqqQvijOBQi7!ny^I82F#sS%M7SgyF=Kzu4mZ=7rn0vhHp4b=gaIZnvr(``Co2 zv)_JUjWrX6_L1+dw>lJmlIw5!=o|Lf4>nq>)>+h{@`G=$))kA{C{Je=;qwnzNRAYr z+kjjzzPaqN-S!mq?qVGL`ZLR{7UiS(-e~+*^e|Qu@x{04RZbHzHp{`F%uut8el- z8axFQrA_ow=7NiF$g}BZ=K4A$o_h;9@wRs@Yb7F4-F)LpYpZXgjb<5z@=h6A2?ghO$n*JX; zuM8VP>$}j{?B_rKxjpc}1Aa>2h8u3M zZ+zn$_RKTS*i~0uWk3Ak5AEfbUv_1nP7joom04k7p*{E9bM}?5e8qnJ;~(3;efw@0R#Q*1JpXflPCF!=tjPPGd@G~O0o z)5sSUC+X(=*(;zg|)-YpIK|CbNoRI zvKqqKfBZZ1+~Q>S2JL$H+6I)aH+*NNopDux&BIc!lf|&CE{d16*w-Fggat*MJ@k_e zz937_A$k^g6Ae3kO%8Tmkrx;bldW(T(fJ7JT(+grW}Y+L#!k+(ITwy_tH7;G8aRfL zZ!_3&n{y$SXDF+*bKFN?-bauu`qFiX?~uMkdm$Z#^d&1JAH+uhoVSvNst2MVocL6% zFLno|F+Jm5I;mYoS+$NB$1ZPjygh$ciCxa_Y!$+FI#!a`ercMwPzwzyOz-{IZT63M z&9kD@a&0=W)N!MgDCbYRVz^!X57XF9?y#?3_==tVzOn31rusri@YGQa;Ysys=Y973 zN7&qpM>?#v5V+){g*FYrM|cr^?d5n(dUmqS!ZLU6#UtFZuph03@DKT32*>dL!SLcZ z90;}W<>T|Mc6V!VlJ@h!pbb2FCmk&Wy0l6;5OTd;2T|@RFG@fs-a+0w+UgIMKQ1jP(A_2F5(lH-zsoxggOT}VAme9&N@%+G9pKp+1 zkt@EZqe0`QXW3o(_HH+k+_DPrDR4L+<#%x2M~TvxeKm`8oE= z110vpf1JwiT<4jRDgNfGQ|ywDOk{q|vh^rCH0M>YF#F7}7jP0Gg)s~ri$4NRLEl@h zi;&jD2X)gQ>Vp)*dmx=UkK{R4cL#vLUmU^*ReGEHUd8=@l&vHwWW8O7k}%ce@Q+K) zL$YX2VM9fVA;}H0FluFkwgRgoxhl8{i?MVp`%2h+R84>V<>`)--5VML3y%LTw$I;o znoVCc4B0W)p1HHw-uK0+_7sW>SwPFmdCoq~D0VGxgj&`|B@F z_XYj`JO341^xm<^Gov|)&|qU{WLb4tv%TxaBF0aH%{+IQy^Fbb(~>N^?`xav?|)Kg z6X#{yOZS%8w6pT_O6dlw0S5C?*7-cHv9Y$ zHucP5tTD_cL+j0)I_ggsLxmDB9^z0FTt!bhJ@x*7nPo5iZkIiM$5tZ0nqBjSDK67b zIz0~y#w^QcOh3i5k9~I*^51A=vwVB`_r=H)88+qeY`gMPQ^=F*rxC9B)FhW7wAQM@ zfTM_E1=6P;ey`Bx_br=eqe)%XAlkf*l2fn|9aam}yFB-||jRtrQ(PQEH<7Z{tb119N|NAjE<;*-R1X0M| zyW8IVsUjj~C)jXtIY2>l%^ zLODXrNCwb<$pPZ~aagXq6{7IMnACbSDGL`UjF}t0GsTMG8_Ap&+`72YuK46+d*o-E zZPrEk&^z!)f3Xgws7^A?y)4(RxN(YG1j{0GsC0XT-8e4UgbJ-;+S=RPs6j4tlmdU+ zemUreEb_kj&2L(Db+yUjZ``=bn3bcZEk8?ow2#cT#@{3_@=hg`HRmR2w8fx3g=pRwzb)w z`k!Kp%jmJ4Ya6VYBQx_Z&vCO`O$y^?VCK)!jwX(WWaZ16Eye}GF;gstbuC z+#LBSV5d;buM59ex~KYNeI!OBrAXHB6c;)YS$u1^P7_h+i$_O}=Ugz-uEpwYG1hAj z|9F!xuvKS3(6A3N?{_r38w;-u6WD&~WODNx<(0QHFF}s<#c# zyK2mFN<+qC1pn%zjvF@Cb|45(u)qDzX?D#Qr`Th^-0JrlIM%DKT~c0`-^R4=&~w=-+eWmRxml; zkGM!U7&kMMg;u=hm$0bekTVL?b|y7VWQ7YjZpETV3R}^a=uo%|7HjhV2Q4$5HPsf9$z|y#gMNgok4Jzj|zm$-YWdF;q{^CEDI=!mB0evwZ2rwcV5`8&siN-iq z==4RV-gXLe`a)<-eSi6&wkH!iVThNqqLIPfxWm(=zNa@bcP2yZyNjE@cs4Bhr}Q z?06w~lZANk5Dh4x zwuE@5dUkw?QjDT0H3eCK9q7USB%~f}7$#(5L4@K-i$~F4?H+}g3^tqEQ9kK@a0(!x zFUc39r=$l92kM`5VV<%(@6@q<)zj66^=S^#l6hB)iP{n@DOmaOC^F~8xEm5>)|@B4 zE7?a2BfNW$H$tL|0{(gGepfxE^;C-0VBcUT>C;{_cl(o)36#-r}8r$wP>pT)4 zRL1)UgF{frQGC8t{OWx=?yv{`;(J;=cJ+3-dlxN6(I5jVoy*K(2#6^sQ;W{%D~M zxub%)SK}j=z+W0OntN52kBtE&>je$*BW&N%zAiaHR!&lSYaMjmzs)PgBVV!bdhZkpDLwkryl_gNtWWm$ulWKilf3q@+NX5BCmayw+Nj z<0$JrFUom!U-FES;9iR2^uiBM@MEQt;e)ot+LT4vu8`N7O0d)hzpO2t`1s7iJ&f9- ze&iyP%F5E=9HCQwxoZ?DbLU+;$_iK$R&yd{6vt%6$7NVD9=;&{BL8*H!%qh7hJ+IN zmXcI$(Vt{9!Q}Oa%aFTDIAX5;%PQJz>cTvqi`HNjn}hoo^{1&0QO;0!((D*h;>FXa{_xI39y=MS?R{$sAMrG%f6tjmP&R;;P>CvsX09E!hX=co8d zAHmw!#?XYUTg4N#2GIIUR-4-7my92W3omV&>A4iNa{sfPqvuixYW_<_k=xWP>wFAy z=(Fia16+F``OPDs4~aSIO7bg?Qsv)*yzV}H*MPFR)W9y#V@QC|J;5;hkU9-%DlWh zPon(k`~`Zc==c<`dP~y3S!Al6( zZ5tF`6b>B)Lr4WPN@@AdYSFvE>-MXD933ypn7ooFTO%nB$ zZ73L15#kc;xx0#O4aXwy!vay0$=fx#MFpMj>P8s`7(z=6z}PS8w}h!3tLw1*OSO;w z=PVStlkJ~=bGki7I+nSdv*$r&5M{e5eO1uZfoAdB z%VM^9#TnL7HXgcy?$%5}K^uTN{Qv+!07*naR3!!VDL4VsHwp3@>k{0~{}7uDUz&>5 z>s0&jH>cx^uY$#DvORt4PL4-&WQ{z3{0T>Z5x~y8I@eY_Qvuzz*|Wdd;m>ECpKmYx zZl?<-Tb9+jrKW@~!CJTyUfy7HML1Bs6695u295+_DR#9e5WQAxZ?e{XT`trY&d#xm zKT>E<(GK}eb(aBH4)t~%_c?(<$o ze!TNO&0|m8TF$@e`L<_IYkBv)+Z zsNVzM-(Z)0ZY&!}DJJ(VQVPiOO0Fg@_+X(Got|yWpV{Mzffw#7ae1w5Yok5H5nyfT z&K19Ww%jUkbMP9+Krj0ANZ;(5fB8ted!j$hjr*zsx^)_^L=lhTYaISOb5O$1JZA*sg5zyikV#=CB|%8< zdpAo7&*lTCU!>@2!6IKu#FL%GgCvJ*z4U|kz3DJhUTp9HHVy1{$K*`2=c_U$;G!oe$5Nby+s=25y61{9Un^Eq`%S z&&md8Nj94kS5oq&v5wH<+)pU57MPBe<)c5{ZrgB)B7P{@@Yy>`Z1MuuSKwp~e*2a_ zQSJ)=7w+Co8-o)LQaWi<^o;imLkXGS7MLnm3Yb|~b>9A^_4KQOaZqPZafDd(tnst{ zm1>uD)%TN?gqPhLv7E%8sn(Y6tC{{hdFu{`t2P|qJPv0WJ+w9U+I_f$P;eQIV;RJB z<3CeYr-H54wd&7qe98(>(Mk6O*QpD0?TmMi<^<4aSEOnTD6ibVNMV(SK}Re>F%*!q zl#?f~JzQdA82h3VO=i1s*&`#IQTV%i<-y&Y=4!IVkKjL=Q(k(v@bo0s%6ptgKlSTv z?)vBI&yU53rUc&I=+72?AkSq^`EAu$IN3=G@B(}ocD2X&F@Ny_@u5HcVlzHzSxeAH z`OnTA7H_xx(;7|(vLTP2K=7AA$}D(7N;(^lz)1XR9}4k-@ITpoJevBYkIUh4h>rPO=+>8I`0S6_AhEi1y5 zloVGqN-3yx-+lMlHP>8Y3l}c5mtJ}a{R49W{ZPH{q{BlX4&Z(3^wUpwWE={~hbyY7 zsfmbf!Eu?v@`_P)bhq1^6}RC}AlEkFcco~4woTO$UnVLoVAD|qi>M^5z4>G*jIti4 zlZk+q<2!%a&D!uR|Eq$`gHTmcKbpecVxbKu`r+YR2wGwdHQnVn; z#?Q$1-7r};X`*OA2_!wPPh2%2JW*9S;wS1dI!(PAsZ!H;+XB$wr#4luR)kkYqzBF#nxHQt`*S^<1+|) zqNtdqQi-H|l7MF4$jcIqQwqc(woIl5kCKftg>RKvoP0cNq*geHoJXd08 zzGt*M9hVYLLf&5d5ox?nT95;r0-;lZWzF4x{zHgw2tK0pHWn99bEuKIu#3=SZ#(M9VM#ey8s^U-+T% zRxnkIUAQ(%g^sZu~-wY+l>;o3CoMIB`9L&SjV

      q@Pi2(p+e5j>)rmDcgYOANek-ws7`la*qBL0Cu-@7veZY*)VPV*CQ8IbJqb zzd>Z?7w}0mp7q?(E04U8cRo%U1Y%-{+S|R=#-v|klk(>KV*YURf}Xc@>|@URsih`N zWdn=x-PQp=YI5a#WpS&0;9sUW-_pFV<3DdcUWPKN4O&WfOEd9P`7J9#E|H>Kn=#^x z@+GVd8qrqCMuG=GQ@gidVSsYs{11!|teD`z;>kgfibS6;+i)B%OEwyp^JY(hCW#^Q72 zhmn8@TSvnqORRm{7>mp0*i&l5G2)Q{KWr=+W$jg1>LBY3lsUu?Yw8;8-IrcKlw~b$ z&34tTv*LXZS$fh`HUpcTw^d{5wF?D<_}ikZ3)}*u4qhcU2D18E`a}haf@-JZbN*_q z^S1)5Fqb|Z%wtng6pbZtf!tke!P0N@@+#)3cvD_2oHZBit7)~fuN_06f<#}?4x5;0 zuM*`_$AYEkkp+>0TIndN@Zd@dWW{aE>ySS(Y#Mb)F>#2s&`G0(6In4M4J*xRq6^Qr znZqyest-$d%q5}xpAeS|99g6_NCDVvyV$&MsP426e|@^ke6sGFI4{HgjDJl93`;`E zBiu@vpv^+bnetbA_2(wJRhg^=r4W)Vk%E$L`Lku5EZWEO$;@qRJhKK!CYrRYtlq;t z(X`|fr3qMw=~RO@t|xJPSF)#QQ^$jKI^tDim95CU1gA#!4Cq}Jh@q_7iI22N$WuB! zp^Z9OZjHcl=y34x$`A7q8^g(`E?f%af68)GN5S7T_6{!C1kYowV&8V#-0)jViJ5|R zF_y5S6L1>>{jg~tk2T!c*N$_ArDXS|tb4TaFrD?36quXe+>6qv*Dn0f1m{;xb?wN9 z$nMaOtnp;|x8`MhB;rayFc8dTT`QL*QnY2Uev;DZG~9^j*zhaBZyWwprNouxtt|7z zsHH5?iLME=Gu@b@cx^2KR~qaCxOvi%-&Xi)at2n}tQl55U(PY#bUW*PW1!&<+lmpv zLS!ff7hH_LK^;Zi$M~5<`C2n%k4#|QQGsmKf_3%?@1JBDjR`4gB!}|zsFU!~(!JTH zW`D#Ave<}re6Th=NDA>K`EOO#EtZiu4U0vLL7LnAD7uuC+wuEX$hazE>@9TQI3uPmrI{4M|P}nKDPijK$`!wZhsYn53Lil7T$ni zj`*-#W}W+2Zu8dLH^y%E<1a z9|WwC+p_*|x8(Q{wqVpXht3-HRGWm$DjsCcZUJtI%s07i#ITvQ%tqn}OgUqioq1(} zEBe)c(ZaBCNjCSwk!}d2IYI_UYw^u1<+yl))~@x)2V^k~Z!N8DcI9Okp%@G{!Q^XCCoMF;@7c4* zuXPkx)_k(eYiVw=cfb4HSQmHL-FMyPN<1C&m7-8bg%>TttrVv+bOcyOd8Iqj_1Ljv z{Wx%TcD6n8$Ri%n_tsl)wFwg@cwKr&mV(z`f4u{5^ytwZ@%N24-f$m*=bUqnmn$Wp zl!E_Pk`$)0j?|HArJ>Uen*to|7JOu-8S|@O{i;{a6IH=b%_gOY&>)aG=U~YhA&jJ{ zy}^FLu5@zTL>898f=ilsE!RXaQUq#uLfUBU66sIEc4)OH#gf8qi-C#3Nf?tr5bkJr zURMrj!N)EiyHz@psP=i@Ncm!rQbuVvPxqBq1@@3%=Hj~6Bqqy1m95E63*Po!W36is zJ28u1x2D(6wbc3Rv5rBh_U25>xL}#J@5Blwm4$EiUTax3%VN`Uf{wx>^^9e{NN(SW z@Ok!9Dq<2m#z|IDaU2P1t{i2%ADv%(s94w|{mpNWlK(vTK+aiPp(;!8o8D z#xM8@@DNz#`MBnJc+c@iCMj1n@#$UVaU6jc{nmY1NH~tbqpo#SL=Tl$`1f)n^rbSx z`%cf1`c#MB5glt>Xza!&A{cF)iM0wx_-1Ui=GSLi`uS_H?jw@-vLZ`AXSKC$ndr)= zxU>co@I@Ar&h9(M`qR#M!&=ra;^-SYy|Xq_DdYAyq+Wau#$$N;x{k(+#)|R_&mp~9 zEJu7+&9vBzZcCoL-Wp#z2fnus0}U*kSIhxNFM*%4EMZhRut-8FIE>P}Q222~XzFTf zS+M~BHSv}@dpW!^9X=8C+Z%DLJ~Vzf@>ufR0&6K{H`_Nq`WG$>kkX1uyZJ}|X(NW` z`@=tNyvf$qe$CPo&Uc#W|Heu91@1zg>a`F2eG-~@UtFSU-&g-$roTvIpl0BSmppS4)6OAZ|CIh-Fnk4eJ{c$53%TzJhGHo=fhk~lT7 z;!H~_+6678_{L+}S+82#j=3}@o@mWmtogMCmU`xL6z|imvyzCzu;;jZPBqM4W-V*Z zf`8Uo;;3RQ28n#4W7=;ah5WGm^?BB?9t(-|17(iH#01;CeYgGWdtbLnMH9WYmv`K6 zFP4AE;olqE=5tdZ1kxnnBzTEO3RdE0N;;t+*+cV{@(M?K?l|DN=8|ZB8OU!s%1K#> zniT7K#NYI;Quw~ERj$8JJz@F6mn^96{rYjt%HJc+cAv~jLM0u112k|*2mAT}9%Uofu$gz*#vW3%H zc_`@cH|=x={E%tnLPpkRAwB!ce1zreXmuJJ$IeS5GLY7LYKZWuWB#J)r*Gdz`|-p0 zIaxuIXp-9C<%1{H>0sSoE*~R$lltNOjm;tPN%c9DA)|`* zW;tHzd%u1I0_6{3ql}_Az3aGTtZOZ--^wStR6rRi6qVEt;X`$6EQK}$>6{O%7{Ra0j_|G~c#X}7>D*t>Tx8+vT?BUeYKkk|LS2apb@ zuo`R*ku{%m7GWAJPx$Qr`nQyJvXGSWbEt3#-;?rI%0ww^;}3_J;{{kY-Q9_^1cSch zI>GR_zB!iK7DW*-c;{NY>q%VQE%5o~x+6NTGQi>Veo!KxVfnhjj-Dr#;rI0m%I+&$ z6OQi15G6~+!xZrS*Q*6A3(oz`rhG-R!$PKOFUpJQwbrU*Z?52E!O)n3bqta5Pz;4%8WROwVVFMq_W$^?njU)T?|`N0Wj)dF%k+web4n2ODIwN477(MJ~03i6Q{S)8XUZf9%H* zWwy0O7`X~o8OrN47s(q{ZZKX3l)=ya^&wa=F4&yMojoc z9%w19XctyySl=em$ZpXWJBb{vkBPzer~BFLdoe8F)cB^0f_^j2R&Slx=qrS!?uPL5 zdl6iPylDWe+u(&Ul0@{5Fh-}vFzx*3HR29M}94jNMwIYoJO zKYp1oOs<2Z`&_~IdQnpMbb!HR6oSjfSi;D9j%=s$hoHxi;g~cmty_X!!^q3;d>sS= zq2M1rmeNB6FPi^LOInolpCb<4gCX}d7`}%t{18vuy5Kg@&;DXUU~@+|qvohyElhn9 zj})luD4NsV7hPA+j#m1i>-|YDMDB#VN)Lg(CIt)%B8favxIt*)et1up zlHVftRGh#>o}lF5Gy46$d5JQG3&|L=x_tAsdb{)sQ*0O~Q5u>5q+rI&bEFOLd<_)> zk}-Q(RPRp#pX<_n-R{G!d{YO!Wa3#Pu<(~$%GAXv8m1gqP_*=oA?7{dIEtpEsMxf& z$$GQWY}y4_sv?v2=mbt!^*|c-dey3MEb&dA&I8sK+}FITzi_u8k2WsE}w50pM=79U;RYUq<6Ud076IoY|nw4u$KUiU#N-OPy ze>DofXv3iEaNg3pz>j)^LimbK5j-bgIo2i`_ryCizE?7i|CS*}jMY|mS^D@)n@Io$ z=iA}LC|dXOl^OX(yg>bkUgL#D^E?S&dcqSOQLSosz{{drz&#&F!MN;o|Mj?0TG?pn z<2bQHAPv3Of85e%y6=5m@E48?!8=?d zM2{oA8;$44xa-TSG9vg+1P3bhEu|q9z)Qh@>x2(TF$&ZznIr8O^;;7zuf#v_K81qU zoY#mUxh$jlLU=~QAgW*L&r$V_I-nGq1c;+Pb>uRHWtaPI5%bz z^Ii9_s)M%W#6A$CQ|R(9EnLhICS1DWJUmX0{+%^Ow?#1Fh#fn?J-zrw9Ds!|r(^EQ z;HfjW1M&#~{V^E6yZ;-exG>r5dKfY0+P$&+P!z4U#k&^RQ@islFA4t@TFAVOQYi1} z`(V6Hy3u+RGM}5jnPVd*hor9nbOT{{AZ`L2D)-^@9vmIf<)Sc$?ls2#TzrPTP?`%q z887(J)N$Xq%o>iWaWt=Zto7j6FMb39JS*oIj;P0HatsX1zutBx?>*@ViEs}sjG2&i z-xc-H;whB?8ylfEoa1=c&3^6>I8mzwC#C(c4(>=`+J7&|b70=V-VgE~?6W^!Bo4)L zG{2^KESAC3EjyWDM}jx}FD738P_cwA9gh$T-(%;nt6>BLibXER2;#EvLqjl-?%H(g z;b^ve2lg~W!^gww?_k|I%>98746}!{6-`%8XUcG}m%^8i#W!eB00bTR3^zF1afcv* z(5;@L>maXV?L@RIy56I>c1r*j08+Xf3H;>dK?+c}EKui;Fbx$1n)9UK{_>*N;6ri; z5}Ya+tlER~zrk`x?p;937(hq&ZZPNde3VL)Fb_C7lX?Dwt?(>aLe=wp18~+x?jShqUsU9mN(|+j zu-yF__hW!O*C@!yb{ZiKRG2rq58-?L@99@8xasUpwOdv!;y5~^AbdT1<#>Hl&ymT0 z1KNDL#%&U<+6FuoSvnZEL9YIJk4@86rc!^v?8i;;bl~scu09WJ)4;sKvc}@wt1hsL z)&zJ!fZhFN9N#PTO#7zLPP*@o3yFB`59+dd~Cued(OGLgAb$Eo&M* zW4vjnkQ@P&!tvU_y+=#`+W3@VhpZ|kZ@LV~riEmolagpeXdy4Z^MSJN&@CCLSc?8V z*!5udRKsBRqwfvOGw}Doyn6mlIy3}MiUpt;Z%I8)G!t?VqE6C4KQvtYsamG?X$>R4 zeerp9*1nx%z_p_-c~Y^pZ7+mk<1KmSR_+niCLJc7+-fP)H=-wN=Lk-LbvMCC^2@Aw z<(c@!l4DA3y&QW5MZlCOdZ-DhVMo;%Tk*mcn|k_q%g3jQqJ#N@I8wNFK{}gTu>fqc zw0unb#j*5EfC?Kh@LKH&^BnG4&%^g4->tQ^7N3Hj3(meL#I#u*mJQlrRn_mL10f)= zXklC0fS)=nu)3tUd5cHA4y@&^-;wEg636Q69iKXSil4arDi*PMD9rJFHLeujR$~}D z=Y`7zK851Y@aZ(?a7&7S9R88>}7wdOhuFmON(%0Y4@pm=gJK+6L>Wm;l~d zh~i#tsS6OG$lt!J&^JY5Q(6fWl7S^s8Ej9-vQIst)xuuZ##@%ux&R`dFgntqNN);& zGvl0L?w>Y1=H+lwH^iR~mZG0WUx)dl?um~ns-6O}JpQY#_O2Tzx-VMQr%3ejQKev5 zb1uNoEXqOg;4MpOD?>>Bb9F58Xe{l*CLGmwRD1jJ^5{Y$c{E?B?d98=@Nb#qexw9X zpGTBGsx0+g_a(T=skr>{$^pETfk)gYl{bVW^r`+`brV<+Abby@jN|f(U=mrGasmb) zM<|_$`kN>#XesAYTi6&G39YTNq*(;|*@chTaSizU+hgrJN5dO8J3N!7!!z;CCtjF( z<`xw3+3?6@{1FpnlFgSBmIeW=ZgDCM9)oY&h9YZc@pUTBQ2~q?DG^~K4jeSJrEqNK z9r*jDbg94)b_P$Nodb2g)U{@hw-NCJ!YkUS1`5Q%XQj#~RKd?m~bZZTY;X_DS{%=bfRzb*S$QP5x6SX?WQ8 zp;mq>y+>c9=x@geNYk9UHsmyfmqnGrzt)hY_1V@HGtEkNG~2p2O6-F7;qwkzP*A_? zmnAk8dF1>{$6M8oGE2=Xu=r$@&(Y&s^((Vd@XG8s_OvxT8DQw!4lJJqJ&FF6RIqc_9%YNs* zQxXCvP!bIK9~+Ya@g>^tHy8Gu+BhX46KRyjeGW%w98ma{N-kiBs|KNa;x3LOYzXK= zL{ge;NqG$fGR3*R1Z;ftB;_O3jHu(7+%V3v;|F8HUPO3~A+q0@=jGv8wA*r0dhyvsW5hkhm{g8t68&8MQF1z01N7WF)l0YM)DhL8Xz#O4g`0X8Ki3JtlnAL)grFNvD zcq&B^*ny=jPUF)X$zOx@3(t?IusalBf)lybk!9xptetR5<3!z~x!&GvaMOb|QG5+Mx-Y7fuVXXm@>kI0O^dtROgzk~KFujT-?*UMIU zkut(Qt4DgLv%Sl1`{X+N)a|oy-p-g%J>)&0@60C-6u#OqkqF!76&&dY?;d?(*PZve zdz0<%4RYpwils<{1WQ@Di$`W8GUht7EqUx7YimKlj+~J)t_*pk0!u;Yl;B?p8Lbx2 z5n$^kV9%&({(^vGF^Qelv1hC$jcu~TOni{?{8%Ui7+oylz%Bm*L=FPSLGYvTLaYYc zRG)0G@0~;`ryK?b=}6E+DOR#|lzPw{Zva306Ck2HSE_wedXNd!?~b87u~ zFWom9;4{kWzB+^E9i&yq=eDZMWqd@~-JZ0TmBL{!@G3N;|{qPqlCLOEjX5l(&=w z9Ey;i*TbdgHLvI+g*C^c#lx*@XRJN{r!srvhb8ubt~{G|T9$8MKC-OUW+vs?#t|dz z-xt-}NA4JHMFeM&kM4j8@x@>Yst)**+8`d3i=F^i;1YKt{3_sK@)IceN|tpJhoo$* zE@`yq?k={Ee}Ar@^mso(a54yx;_pU~AIOK^)qoF5o`S(hu2Q~Zk;KF0SH6lE0gpfV z3{i9&?bX+pI3G<#@mW1cJsRWhq!R;y;{|KiYn_-bsFq%9>Rw?zF}0SONVLwskksnF zuNdrFw2glq!sF-xfhbUk@h8fF5GStU)Gx;tIg$`0?sw{WKqS3I%dL%La(zAoBDs#$ zmyRIE_3lNR*>Fpjq59I z-3xo%xo*wQCcETQQ!ITLjNtigHhWi{ZTsI|TXgMM+d$~}wa=Eo%;N3r>k5gMmt!y9 zwVg=K?d%-%*m)mD$a|XTXfUhFt@V~YI^8b%c#$s@pU0tZ2bM3nV^i#mtH;^PckQs+ z(tVaSBF!%T_#`4?HQChN+pOlPOsgmA)@Z`EKmY5Uwwq{hc_UKYS|*v5#1pq{bBmpX zlo)#tyTSjbl8|$hNkX_Vw<`OQk2 zx}6DEvnR7|C^$&r#9v${mIRq~NOu%;h=s_|8~PUCq@U`eCjF7g;v1)a(y;L(_JSvY zK$2%{;|{oTyog%_DRDxH<1SF}1%g;F$F`MXlZntgh2uKM!Q$B~7{W)`?(kK5=g5&0 z@jyuxd4g~=dSWVkEylJktF@KSR$3BPCyLVd?oSqZlw?`#oqok=k372UiE>xU%^_Oc zs^|B3^h!l6RJ6hwM08e!Ia#?WaLZZOjP-y<+VNG;hpj7WY&?+(rSKDA71*kLTO*c- zDSjk&R3Xv2yrDtcWC@s>8Bc`2c6;W|9qzbV`KO@}RFqRiGF?i06xCaPRId2@BC9HG zA!=PS?J2PO%65D4-d%R#_2X>In~L_{!qJlsqD8lPP`FT%^HcoyGk5Y% za|e+MhuNa{7I?o_KDP&$lz8;Ky|iuG!d$O2f`KFZ8i>#%cnfcNwvVBj+`Gxr6H9p` z3b;q`{)x;YO6!InHo^B?(U!n*<>~3x!jUlRK)z7ZbsA0!f=P?H53|%D>R<&D_DjCj z*sQe7UTf~=?CmkJ0HluI6i)Y-;nHd%<5Oxp)qP}1oI<|1Mx_K}{>a`s`MEUQ-fpf( z4um>mjqw+!5T&FznJ^zBxxyquV)_zanKTjWU`}Z8gECNRJ-U)R!*b-LgbC3?c-a?KXm-CaR)*Y6Lg%M z)t?-mA0kOH`cb*ft*NzDU|+y_O1i4%Ia*t z*?aE<$RsS;TTu}lb<|mR>uBrN+WytnRkd~1YOA&GIyWe-#cgB03^RCn1vmuv%IKhA|K;|D$?fo&ru=oJvg2dqB>?Tuu z9>xA0fPpvn98((ap!~3}FBuSyi@Y)=5Xt_XOd5VO*gv!G?4M6l4ovslV?yNE-^D;l zYELN_2U2TWn?y%N?olqQ)&aHb2Dm&Rz^$rmmmTY>u0iV`UtUjsFh$cK}HKL_N85`)M zLX@zsd^Znf$=!1P%@btxNBOdAW2GL?zGP9Zob~%8nS9)y@74E3O+)p)+p|&n(K^Vn zydnHHV`m6SIM7tV$Z?DgDUV@@+~0h_`_hj_Z=YE8uryX28pALGwcqgUAbwviq^#zC z0Y1afHGPXZ)3# zJikevyDmkpeSVTkeP6tJyClyF7Ban-Eh>_0o|z;CyXtYmVUD=o3E!5WaTSG)F#C}@b- zrawW}h5bkEn3XS=$*~uVl>D7_Qd`k1Ctr~)nOmTZ1KNAWZ^nXwSS({^1>yc^S@&t7 zquCTSdKkE z78;Ch^7=igGUMb(iHC6LwLhmw()2(HiT0M4ZcUNvo|>wX^sisalM^nFH?6<#-vf2% zAUSwA`^XIM2f=`X4^fV3wCN!c_^zxgv;p^=bGA1a=v_=Z4fK4d4S@VO4!v;T*H-rm zsp+bNZ39k^96~-E(}$U9LujyrCMr&WbqSHWrb^kJo{cpPOl8m&{?~wh<$6a3h^MEg zB*e#A_w7D;uuV7C`4$KZ8k^xZq6O!1!yN9dN77~b2~iSvM4&u-<2Lb&@s*%RPkH{f zH2K}4nQA8Y+|ApdnGH)DY*<}kE?iO4Dv#f=O@8~rOz{nLld}9qX~v-)Y6Y{u#=BkJ z4~0v11?ShHi8l_;7Vd%%IB&>R3QBXuuRafEtni6!ubyR_0`1tWhlhqrLN;iNFXHqh?$_?wAu+&BQx-(3 zivxVND#EKJH_7*{u!8i5BSudJs-Kbxv($+^L76e-;?j*i#=O_Ybj4%-rr$x z5ypNi&6<_2-R^R1^d%A)2!Aw`j_f6WGoQ`)GV#s*!IGOe=6kTXLw(j?p7!^6&A|HF z-`AT%_%Lbh^J8*zzfV>mZXN9%(u$*@0%z>~)J=0leV;sRKa}GPfVSY$IEkMeDBc0C z(7Y>vBm<^M!R`vOy!_lG{~Iv+Mz~_*SgC%SHo-Lbl&jhxo$yk^7M17=;?{&*J>-aE z!X+9+@c2s;WW}2W(3e_OgRNDdVl`3eIgs9oxgn1DXI?`J=y1gbRXelxy=x7?+mwG@1uT`TH z)uQ@7nG`mL1vSrlHdZE1e+_i_-jCb@W~SR0)89Swe6VLG&H?^5llTBvu$a zB@CL-H0`J@ZE z9^(t`!dx)qLL@N4Q<;r!Fq^aTaFU489$NPfoRm8Ej8S;EK&7>d@5=*?Zi5dRUzv7d zv{0ju=EncIJw=jdgi3I{+^lYjAMVFWe+8owD$Qiy}3VFUM7zD9xU!qpY_xSFW80l zD_r%4q;{_tAEy9hweMPhLoN4k{DY$fx}at1;Tj^v)oF6o?SB!kAo}p_J0rM}EGVy* z)8@~Xd;WCG9u?5a&cgg9ep4{6YhG_QQIehhlS^$haCr@c? zEtmiM)BXJ}ili0IEp0L?DokE{>JeoCnj-nE3%-ge=;VPl85^r){l{f89TpuC@W;o) z%V=UtT*dt_HSLH4tIHdtqR1P9D_A*TZ`)AQia4%v)VWbI1zO4M<__Y;OX4IET7Se| zpFf=|O?B-O8Sf{%AV_Y5^+ZKpi!{`>iC>V1c%uvoE-27-#Q`85Ud|FX0UCp=DuBcM zq$HzN1*Ts-pDhvbp1S{SZ|i_YVHE_i5qtVsHZS=-zR3h6^N+!pR=beN*H4Iwih|iN ztgwhh@y`hRdCj0W)$V>jSqys1al;rupR&Az`#@8hV2(`Z)O=r>8i&Vw0HnHuc?aMMjY#IfclH3olgv-%#r7d1 zm6~Ad%pG*9v9eQ=pmahZE0s@(WvYsr zaX_1k?t8felHNE2FLEEuy>iG%9L5M7_5NdNG95zIBj$z6)^Ey{ZgKys79B{$Jvs4Q z8|WMbuRGV3tNHJ-7e%Yf7Y?BqxWO{}U%nHun)+Bi0OQNo*B9@AMmijR^cLuZORpb; z0XY1_E`3SH`1ldPB z*HnQ}!Icm;mtQ@fCtKm?Dgh>4`8yhA6a2IA_wqOLHQQpG%*G8V=$Yn;?X!ITT&8^S ze1^Pm(+)5S!*xSV2?wRLB%a4#9w%?zks;~uN%h4GS(2Ytr}twg_{rN3rm1GjiNA`I z*Y3y^s#q_1DO>VV>olM3%UCxs@<@3>fUVGl(-KEXXCq8SaEfBny7AJwdxSJ?8jm<2 zwoc%v=Z??=C)#pjq&0hlG_0HgA7?JO9wl83STw*yJRA1#QleFZAPrMc}3 zF!9~J9tWj>C*ld4p-`BV%=&4Vto<+_Qr&V{{18l5K&KKX2gy5s-6fwsyBm(6b2LxV z&0_f38#^}`zG9qJi|*W8$H+Zrtdg}b`*`#I6e-VX))Ro~KeaHO2e6Rdi!u;-owL0L z=CwPdrmO|p*f^XD9^q+nyY%Hk`5OMUz65=Rfivpc4b4LjdG)R|_!7*NXMeLCQEKkSgNU(S-3Zc9;(8^$fkY*gUOwSpiv zX|A6veIrLT!_T=nS$*8>-cTuT-kT1S<5n3l#veYt>g2sgQ}tO%PLnbfNy2~ZV82cr z#vk7we`r5pyn)S&VTX&u;eV?IFxOjJ+hBD9-`8XW+yCKS3p5stHc7t?gUQ|o^WV~J zoE8rn95TX7C?I(8)@}0DOBwRnGubjCIY2kPdE4vdlV^9y+i*cZpQN$l1Ee1Q{-^=i zT;DD){2nwHzO;w~laC2d+KK8}^5=dFKYa6W3k!aBGXhc()t-P0g(shX4wP z!;jhm1}gNSJ9hoh26tCEYX8yP_qd0ut5;W*WvR6sF%^9_ zzj;TN?tj0=!6A7mwJHG7%n!f^m5dk;W2oaG1iCI36Q$n^41iXk2T4>GoxXK=BEt6TVJ0p z!O+TKd3+a|^>(+zk3*rqc+cD=ZF!^gq*9-0tEGO$0_keS0TT`IZvfXdp2@q#*{ecY zGAAJo+$)XBmiFQpX)6p9uW?nVGwlKoZ*GQlKprmaa0?7u3y}EX#suTHS) z0PuJYe4^G@w#ez%Ch2<+Xx#Pw9B9?xunjOS7hW_<{Gfr|hIhT>?y=DD^O3mme(IOT z6@DGzx=-d^lK}G;7x}}>Gb9`besr~VDjgp)H2@p$cDdv2*?OOn^s{eF2APCe4(PNi zH0#c|HW6)EFW9TgQ2^I*<9!trUwC`6f^G_y{%_G#b!hGF?=CY>gewSW7*ZS1BI4St z!}4($hYY=$Ii9S*1@~|`+yX;u0ktZ_K_5wz{Utg+S?L~gSa?CKjEC>hRveIY=i)hV z>*Ay2;193NP?|~?36Y?wICDG(k$T>VYS{W%kKY>QC#x!320{ zt$H~2;TAaD0()%%?rVXUj(~4@H@8q6mI)1JU_c*WI^sCelLZ%!RLh2L#5?=O(GXJ9 zBM}a@#35^OV|~HoYnO}uG)BVXe5A3aUCvSb1MGrjanjMq6YFCK+*JAEur}^bgWw&p!)gNT`1XeT$pJLjATr#~ zAEItbyxNTo)!xc-tmC2fd&rV_8<6K$T^IZv#0N_wHet>o)+wx|4PfFq!|z{$r_^zC z1}2$rVu<*G@>D~;*#&06(X)I(fxu6LMoAgsGmkb9&dO#dq;Zw4mHu*4Y!Eit@S}h{ zY7vjYH^C~azRA+w^NtG^AN(<|I!Hmf8tK5*T_UE!KNP5371Dae2FnQinK<-6?VA`Z zO?cJ_r>*{Ol)NGTE?04azbR**8tH6^1(OdZZ;<*pyLU)uoi~_$zT)CX|AbxASsNv7 z&<^yRmXP;IjY#KmbWZK~&|S zZBBNykQ#oW6Jd%Add2=^dzRwB4!3YWiH^j{X=sFYXtwa4vyZm~Px4V_9Zh8`VdlZk zcR{>}Ncv8LDICm3s$h;=F)CELf_$aC$#QMr3@6t9V?xC@DMU5>SXNm*XfGIu-mzYq zS0`?I$G`*`+18>S{)p>8TCjj~uV)VUEf_N#Iaxd<9F5mQ2?1qYZw zAqUR=yJT&HpG-l$qOiekL;6O%N4@$)bdkVu5XvA6W>X0#{?1;W;_2rNdXI8QKu{MK zIFOE-380KJkW7LnSPs$IM%ASMh~tX(j+%kB!7N^Dqz9m21>(5kI(im1#Hd3PXpR#$%=F&Cw1;xAAA8^T zJ?!(aAHUx>zy8u$WmxpAzvuh=o|cD?VV!#zOpfD;W8Kj70mnTP*%Gqe_H?e_-viLV zeZ^}%ZNttUAg_JxkDj~^LK@enFW9cABk2&=AJZ@Wz9-s*KK^`0`U_;bQr2k0Vz}>x zeQFDEpPP@DGSTHzaysyi zt>PW1Ln-K(=ScY3j|JYue%cutfz4?2Mt~+4UvKzQ_R)QJH?bGq&3^w|3p(cu=H-5+ zbA1}M-`3mXrWyZ=t?=Tk=l%>Pf97eeGy6CHA6nNQytAL*`-j%cF@1mdcbE7L`+EWVxPx7@Z_J5J{gpFV+C%ACe;b@Z>yL)voaaXP=*SunE>co7 zmQsGJpOmSnx2=iC_G4h*nQOh_aE}DJD-;e<-webFN_8-aW4;>6iq3qH2XoaNZTad$ z+~gBeHt+3Go{58Wta2v~?$}ykZ74NIW{P{xUd@oGctFzA0ZEE02zoute8aFIu7&@a z8fng&i4A&-xCU1M!BU+D$ylj_A^d=PusLa-=LC>K9~4&G@A*=UM?YR|gf$i>! zw5qu?KvK;cn|sZBFYm)Xc7-2Gt?y7OG8}PH_q|lV|625uh`u`*)Nf_~sr0Vtm+zy^ zz_d)Kz|pacA@n)N2Yuj?4r@O<=5+}Dw(km#-Ih*wnH1b6kq{JgfDz~g#bp<)im)7k zX`4lJyx}91jJ1|Fv;pWO+d~NsCls&k!X7k=&p4)CpkWOqo_Z(T7T{D>mc#n?&_L@4QzNbQ16WtQpt((rm&Jhn{lyz?8*mGT0Z*cjqk=MPvZxJ5ZA8WL%rm%`#}NeT`^7_$M2x| znx@{zve^yxIFr9Mf9A7~c?{_tkuUv!bM6f*PGmDWRJ5tN8SU$e^~wncPP9sZpV@!d zMPwpdLPt8Mzri#&!`tz%YvS+!>S&Oyh!D}-9 zQh}H1+nrTtYO?)7-#rEGdoFxW^X?|q-Z0VLo|}C5{eAMcPj9Y=Ql?2W(6@bFhCek> z+=JzQe{*5q(Akgh2JIc~lAQ%}O8`ZlBoh}K2dC#yeKi9d-{h>4xNh09MQUqn<=A77 z?cwgTN`~{wYm?4#u$Yc&X=#zwt5?hP>C?sEABSXg!M@)a21~Z`%m6ldn%~U(zdf)C zh!KuUTzAO7>b8o7(CNd=IK$C(* z!dGC3cu&s+rQsrnao6evh9G@wks2O?fvW=+2l}rlg>S9Knl>3Z&R-qIk_o3n-Zt*} zc4S6nz<*9KOtbyr6O7U^BU$YeR|&n<9!46;%}?%zDv6sID6VwoZ37%k$Mulq@wDdf zIB)BK7=RKJbdK4YnEA0xnidxBs@GFV3G)6c0{g@EDvA;CQLwWP^s5^_j-a)G_jc?T z-eVi?M%xBQdFg3lG+VIzijdwRPyJxtT!5{XvgnzWU&f{iJv4`>Y%_n;r!1ETM)2gb zkZ3PGftIJC+JhdgFUl}+D{+7X4}+j{;{TRFCR0tjryLPhD`Ueq=xgPH43y=mlcXu~AV%${OxjREfjf??v+f{P%3VPaQ!1`d!*Os;FI%H@S+fvD!epv1A zcn^)n{~G$l<-|r{oe)FIw`HU8&Dx~}*yX|XMh`Hv<;gtwTMz2Ny2W*pKAYUVh#O%6 z0bfx?84WUK7Bq8_wugCXmuJ8CIA-lC#COoT+Fr))k={2G!O-vCJXu2qs~zmqS@(bZ zPc~Htv``Y`V|CtSWaY^0nNuYb-*pY}i{(%SC*Z3NY`%|ATI=v+|Ng9MIZDc_yy40K zc?3ZLW>Y)n6nQoXTWXw5(L&3Dn-i&b_%SdDL=_y~wKI>#RmTmQ7VttIK#3N+< z(f?y9%H-+whN*_f!xXGh%{e=D;smLvs)B=lVC)gmvO6Pt&pPn6Y;90e3Pl67j}OdD zd9S*p1#UZB)O816x1yjKr&_z|0bqPrmSp;+4;BPHQY>gyrKe0XVyjU`MShcv80!xg z9ymCRm>YSsz8Y-pY5n8_7Q&2Bo~@zTZ}gK#KXXm+XE%0sNMB~FEf40W`P%ZZCFkv7 z4O~lOq9Y^(Ky6#QM^ z-4s@kje6mnwpnmfzptUZX&$tvy~M{A%wG1vFa|T8h-penN)*oo1_sKA5hHXQ@j1tn zBW5x8SyglG7{~ruU0t0N6%{FS*U!&SVq;?m%%5|G|ClfT7|fV9-#m=g#Ib*FuIG@jCP<2pKKf`m?X=T`r^#ey zX3DkKUMr`Za*9@g4Qv{!3Ivv*nZew1yfz)e`|LFP-@Mn@*eDAYEReFYGX7NNAHPjJ zlg8w4elyO0dmuq<2Pj*#<=8!l<^Fhg&coqY7&zVe=hO`*qT=Rix4EgCkY zZXgltf;8((IO;FhRVQ9PZc_VPvz&S3SoQHmMv@!+P%w1B*97Bl`?dtf*hi`F#detE z7>z!HL05O4^68}a3~(ffA&{)a0SRBcm?gh@a0F3+@^t zLE)a5n@ESW1Q;yCMx#}_Nv2c-PCH%sZXOtx0pbC!^be6>4yn=hG4l854vZnvBnv3l zR@#m1qs&nPIu|-kLtr0~x%$PkIda->5|oigzawmawh2Ku`-KCZ zag9`%_gn#xTVc+*_<;<$^luX+2%A=(pvcWE`-SaK3GvotB{KQANM$a%KX0YsZDaeN0>7Go$czww2ZI72zBE;?invg%er#hacr0}SPt_Z4w}uf zOkf+<;1DMFeP#Y3KC1b>0@rs2VvEyHKV4?bm;t|xUXquWCx83f-(#x7QC#s3pa|0I!Ppnw6LgSuu&N)(3gVUTRPE_3E>FL=A+nD%{c^Q0S z@*XIjc|IK9tRpoq0wGvE<-`S2Sye4_W=z%gOwY*1lwi;HA2=>aZ{B%04ML;k~J>Ovf}_a~PlZ8AwCTI>&jv z@rxojgCD82<$Pd%JOJqJzomeN0y{v{mYeIN&xyrJjHCrP2^$;j(KCXTcDjJU!b!t2 z4LxRAEQjTq^^WtA@5Nx1Z_RbSBLnF$E8T&)tLgF1Os@y4AuoNdbJ?1wEQ|Dl_3e2l z&FRPe;0)3^0L`aa)2D)l`ATtVxtx5$0(ookhmu!VvIi0AhEUZ5^ZUik^Px3m&B6U$ zOOCc$&=Ic#uqoc(??M9iy;=#0NZYG(TI7xUcSzVMAB-iKS{F6RvFF9(kf{(IQyfbi zi<}#6z#AT5Ztq-Esq5U7g%LQV9SRy|4BO@*-_e?j(3(P;@7~Ro%q`V=Xu*<~Tji(M zj?qJ&)_zndiBp1bxQn+Qa9}@{?dO7pgRHmY{55NqVj+Y+y38-@1jhWHF?>Y=ecz9W6Uj(xk4wL5`g_S2DBn^qCc_w^*iQ ze-vhbnE|1}36~}S>$b~>kEiQFTC;x|1OL3u^3|dYIqjM;I1wAC(1Mn*9JWUnXv$a5 z=gP^~!~qM!wFV9V<9cn6k6E9!9~a8zuZtxh#0!Ub?Uqxn9xbD%2O};7G-x;GNxDf4 zqFS54eY#&jyYs!2rh*KyuEdEAP#&P*m!Su9;#&I;G>3`YfI01HoJJnT52ZmkcxBRr zaWZbqXi3?XAwM~OzARa`LUId=^quXiLs@qKtU8`w5iif)UMm5k0>lXlNs&@53$C6j zq478XlCP%A4AuzjhZJ{#zOs$EXX1L2g;RQo;}YjYNE7xg#NEVuh+=79qJ7ZZde5|v zS&#VJ;6~DQ56sPv-YAh=9Ef!F&2if2_I2*>n*Bw*#e5c1*JWFQ0V*T4R? zTz1)IU|=>2m975#=RZqaTpY$H8P#k^D;T`;;)^fJ!i5Wk!cU`&ETbD9)&;sL=e!jT^T|{>;Oqh=L~0M$gxjOPL>BBd{9C|LuJ*fRoaNVcJ0!E zlb4%^Q^Zlu_P$s9D++cEm*~!`2*%BTO2kjVOX*+kS8a4-A5TpQn&R_-uuTMPj zM9Im?Q6?ZI@MFe|k;1}4)j*7hh)`|BtgI~MVEg!h5rjM(JD>R+%mK^N(5h!^CnhRw zcGJ{-r_Io^JJ7M+Vg8}i8_YcSk%jR8hkk5>nVWwV{wUGJB=u?#_qaA(1BAP@ixbR$ zEz@751@q8jbS``a!d4H=ssk4I8mOxacli2FeQUyTNhS_W59|Yzag$VtlSI?km&=t8 z&%hxB9`Y4V`K$nF8j%d2Uhvyh2*x10J}AOVwZO={tFLMUkgL*#KNO&iiylukE!qMYN-SuUW-?EnEXq@`8USc`YIHy(zzkl4K%=I#S!&9g z0W@9pbW}HNnz*?sNVhcN_%=K=!RkYn^j{FrCTtgHZ2U@d>t*Bnm2&U0qZGV-{hut= zcnm()OBq50=xoaf9J;{xfsyX29h0@SN@)=__6VeT`e9jKgO2BrXdjg*69kv%LK2U* z=gHc^BRv4*;8(7=1&8?XGp*Rtk=?Of` zFpryY+B@qTh!w-=)Gc{$^7d}(R!c%&?~Nuj?5^o@hK@OvV8e+2@VdHx8HtS z{`ki~$_F2Opi<{%fY}y++K`YCXnC~C$dPak4vU5S`~uZ@+r4|Y0>R0XC(G2SQvu{X zBt1PHX!NU5x>R0bu>rI3`khxn+z zzFwlDqBI`Yf%5Wl$<57$>8+<~FnW7?_sM%Wez5OY7cvu6kO6$fwF|cqtk3@Hp<}wN zS$40fmBy-e;YQdOzLIE$&l3~tDqD4}2pj1Qy63EPuW&a`jK(IGCtLdepb6_& zi!H8?($J!edR^a0zo-$zZ*Qz~CD~B9#UN|Mrj2Ww9}YRoO{tOfpBE^jWE6x?Zg4}v zINa!lj`EVTZXB=asfF|8wVUL&cjihMPOWu2CQKP}WFVI9Y|yogCrkQbevye-jIy{E zvYw%c?*f`oSJ|eAov{GYTDDhNUX#)f(rc~(+#GVwQyadesa=^XYy+M~PN5qaHq_cC z1_;FIlAgYIr zkeYQ{mqIHFg4?JB9|?l>K`Af=@B84erm#^q+JZUf>h6kpQ!5|-GfV!lW}(i#9MS}CqbZ$#^B#D4)@;XN1?8^aZg&u@!vD=94e&r5d)GZ!M^a@ z-LmlK@zRX8*!)Gg&fO!=8i_-*8gTk-x8moj;%3z_b_Y(5!21(F`{SUpdeDyS?KO%s zNIQu0h@Z*)ZvwOSwY$@lHpSw=#7$q7NY1uuiHCI#)3dM0yb25lEL3~+@ej$yaMrS+Xuy2SfD~sy%{X;?Hs9i`bLwZWVy??NW(p#1_9Knop ztEtfj7#K=}PyuTl8n_}DR#H+Ae4P*|=l*t__S?t*$(6U>ua?s;2~?a%<|_9}BVnae zi}6?u+~p2@9EpQJh@)P8w^sZET;v4r0K7MR_Yp4_02`v%FkJ&Ybe*cmXqI}kk1ys= z2-=;D*Ty=;#er;GyQmlu4%$v>uAjHF6aym?|MiTe0UDEIiga#o@dik~-)@s9^Sj^u zPVTzvE@l4x```bTJMOqco_XdO9IWD_%3Z`V#8*j4NosNN$Rm#^v+&YOFV#3{X=#dU zh?j_S>;r|YS6p$0;wB0jUw{2|`OR;BBX7R>rsheW4lxk514oY@tz&=~iArUL&%_g< zKm71RiI0!hG{j0w(*VYOL}Y|A63I7WeT$2WH61k>$Fw z^JMJUv2xKx7xnO*$djT_IUpcF-I^3yGs0Ty6Glu0d^2OlzAVjVW?oio_ctI zn0Vrk--qg7PrpHX&&d<&_F?7LtxilhnErNmxQnxQJ)A~Y;2LW93^u=i0=00O{JCZyu3Q)B`4`5? znAu_2^mob^&u7Y8_omB+&x+;E2U4US%pEd;-h-yzmaog?nX9(~WWYZn7P7S;7s!{- zWy`j2%H-XL!DI)};KuCUvsTG>@8H?9*~%6Y<}=Z>Q{9U!lM=<+}>`+l6ao%?CyD)&o0xU*;gZavT+g&akSE%-H^_ zPjFS=0FeDnshValxHw)-$OwdAyC+q?c{x{>zmYGWK9iwZd)|Sr^5G*HvUv#@L+7ti zFwUX*;lI*l?MFq>mMoO-7DMU`utEv)y=SkLRf`Md{YQ68*6KPn%O()q^ks2fmML?Rb^QA!8)Vgcg?OF@P;Y4p^!Hu|(>?Z) z>5Ja}vEZU(|M9LH#%6g+rJV80FfhkF0f;+g^prrk<&EjkYJxcvz#jHGa01vapZ_yO zR{bYazFU+jUp|p0PHi2Mx3NMtKnubLK3uw++vJN!Q$RnlS=nAG|Ga3mZ2vf4zJ4-Y zngO(F+Ufy`E$OT$G*oyd2XLP-vp>hx zU~A(}2oN(eGK4^s+IhqfWYmp;kaF3wW%`U@l|Yc;rI!}TC!c(xppL(poa1`7i{ALxF+d7XkK#z<|Td(Kz|8doY0Ua(PitSHkB@-x?MR|X;(4d1?=CwZwBuDkzdt7Yjc zd9vpHBKhE->B^9!@T<109p?Xyx@jZb;EV8!ObBj<`9kC7gvj}*YYrHORoFm(@^psM zUe;^l=OwZmZWTTQ?Pl9$Y^sz8P*%$Fa(VjNEs~#x^%^He{^$1X^7YGk^1)-fZ4rOT4MZ=<-c1Zf#Dy*B9TWe1+=tX zuy&Wq%6IZrfY;mh{r1*=zo}z|h4R0xtyl@_tldgzUMg`4HU%NXM!q<8*@peP=uL2CB zZU_Qfl_A{-CSdN48hPc;R4KuHeCNS*Wj=8}v0s@V8HZqlf!S0HVN#>aK5c}|I5}Dc zRdto^IGNcJfMsp2#=K2Y?YGzN-l4)`GR9y2(+>Ic*(_Q9b^)-P#;o&oPr zFQ(%=kV%#>%L9zJ4y7L_{+b%k@ZSr@eFN6&(KCY3b}jPE^;;wzu5;c79?pPJo`lHL z*IAzbeVXFrzyD&Lq^vCKnP4oAbSi4Jx9q_EoE>m$0<+y?FNjmjzWV(_(3(up#tM1+ z!JR7nAgv-TTn5@my7I)O+msSh2DZpkhSw)g?UIil&j8&lRGdz2 zwp`HE7eS*kk=K(~ZBgOAYQYUd$Mo$Bj!CO8*eL9iy#+vD@q!$c?eF97CR1hxNLLwz zIKXhvoWEM$zYFU}UcEGyG|CIVS}SQ^6v}H?ZjzL*F&^t$aadflIG5K;du@w2!C~}! z_iU4OuVu@(&+L}3p4h2aup*;Y9zORw$y!k&uivmm@-~&j-lI#FJ)bU1pTfHKMz(zP z;CAHED)6Ae$*vetapGR~;fj~~Hp1Rs`A2z99t+nk1~S&JzWQo;_0?Auvk(_ueDTGy zb?a6+z?)m4hysI0bW(&i&i&F+D^EU6t>){Cf;a}HoYyyWh*v(7F1|Wx+oocwF^vy${OO;P{UNX45 z>|}D2d5@C%($Z4-?z`_4Ky%Vl693bm{!}@z8#ZiE1|X&OZ20x-*Q;cI_UzfR;J5|a zxl~nMvg9kxkAwBmM;}$mI`dKxIIN9xU<Ni<$i#<%?K7#ZPMBIR-LzsKIy1J(G0N-}reU zq^e$W`t_qBZEe-f%T1T^I%bd;YrFqd9L0Gzow9`w1F{U~uw+NXbH))2@$|6E9DM@5ctY|D1I? zRA|=2^_d$p4j1+>12Gc&t027w@6fH=O+>IUQ!4R z7qig!dB20~2WfX(dj~YNTyY9-2SyUi=4=u-Yv%M;n4^sGo!y-vVfWHL;%|<>QRpkq zjb`k^c%VuK+P4|f@LxVK740taFqqc4skPz_Z66+l!+Q+DvEFJPn2L@0HBU@c6Q4C7 z7RYvhKn`nW&l1obIGMa#K7MMqY5{Nqf7*4URXY6QE$MRgzm8Co{KD*dWwH~PpL%_q zoN#F(G&37z^+(7L9ZM}Be`xyUfx%D#?ZZnRo}y;Q&-`|?6lK<{3xFA?V&ivZl5Rqt zymo`kIkN>)Zfdu6%Y}lbpvK2Q(Ww{`lk7 zQh?HFg9#`p=5I=Y7c5wy;E;ZB2=<6ah&d>={_@K&)y;{iBenDHzWZ*~NW zg-WwdjfNnpTz+z8jQr$^L@*>;RExO^f{IU{%$7fYdbDcCWrC^D+}J7KzL6)FJ}^#Z zoib8s*h3d>l)F9(l;k7fUlo<*e4~bongQeYhzZ_u+{KXQkMxm8FJBL{-e#EehRH54 z@@Im1L9H5U*HI|O!1N5@m8?>a)Yqh7vyt7<`!ZquhAHJyBdsR8aIAN(s#=3Nx6 zb<0nKng8-KnR-H$j6EtqF1U4~uJJVC%-#W4Cv8!x9W@2(gub*@WmFz50AYlF6Wb{M z!9#oVTfK*P>hl=i5I|V**m?tp0iO==z{A;F&W+p(e_Ig5nnoQs`~UeT#CEOiEfVfA zO538p4cuNE31e5=TEA@=1e$;4&=TiZyZA5T6$4N}n+}2Oj8meqUWG!NtV0qe2P!l0 z()%YU6OjVkv{e-{dRnm31Zum}9QF4vPm?eHodu1*LTEDi%EDhHK)Wzdj+hrFla7s4 z4L;7P%O9SoWtHaCD{hR4_XY#eMJ~N>lF|WM8_?{Ob=$I}Qf_&3rZUB!ymm8Om4wT> zkBjB{XE2{;g-X)QKw18JevhE9ryX?c;bkGr?-R^;=Qpu`kA5hAoB7cv!M^?&V6fXK zXB7OAVHN;wuL;M5D2`5FQzb{99fNsYE<0CO>bo8>FGA8*mrKG-KOr3qhsNd8*QdyR zOODhwy7-%Yw^CfX0PFd%Y7114VN3uao+&89nrceS-F8F#Tb! zwZBYT{?IwApaq35LF%%z; z`Bg03Q^ZT@#SL=LnXBZU&ySWdbD`aj_ZT}TOcf=3!rkPY|C^w6{jP;;WZnhM&?+yH z3-25!)bN~jIxs$jz!_M#3c*mn@{#FkHvG(QH>n9d-7;~FVGG$>30G(n(qp}8H>Q8| z_8YM2`hB26AJ!WUOD#R}XArEKc#*M0kMchMXAFV$pPns+*zx=Z1 zOG}KkYuBoErdcESZFohzCKfvT?6a|FaZ$nNNhh8pmtA(5YT*&b&7VJC%i)<3WEN7; zN{b4*dLb?&-Xhle$xnWwbz{L~7SghVflN$dDl!-8+J%~etS51ukGGGysiUO`tvIMG zHgo1op-VgBIx_u;3CV*ZBa~^#&!RRY-OR8aY=gMCxW02lOCJ6YR~NkOum&^7Q7A#S zVfL{OWaiPdg`G?vJpO*L#Yf<8s&sM?oqO)N^4e>!DHr*yv(D;~rjw&fB1X_FzvKLTrR)Z^phHBXx75ZsgDcmMql$eJ~4gc9}(F1SFSbHLfxO>Z9lIP_Y;o>1D? zexUn|GuSixJbt8WPLXbC^SHRUL9N+$pGz@QiwheUXR7I6`{Z<~h6(6bFJ-CEH-GpB zNt_m_W)>vcqp>+56Nn5znuTHt!EDz<86hp$TrrdZ6cp!xLHNrAjav*bzzrK2el$NC zIo>jt=R75^lBTOOf)CpGUD|2++0 zw?rL3k3BM2ok24$K{!obp!fx|YnbxFY#<=iQ?fSK=tkK$2xf?2+%fJ&caKx>#|?B; z0#0v5ztF@ZD#=T0qJBqkrIK0n55Xb>CC2mx!#^i?^a~};cy!fc;}yg-m3N_D9$+BR zJjhpaw$@wkp{Wnf5B3Rt0)>KkQeIIBr_h1gH|!$@tLJ*_t}TH^Y;WmSvpi~O5`=Lr zp;>w$0J}RFZ=6%qo{Wt16E6a8fca6AEOUC!BQpQE8Rs|Km0Aomt%^$YRnx_AFdJz0 zj_UOZoj7TD0+Z8#g&&bG2nvQpe1}^(MbOg=B-7OO=m*uq#2 zWM^lq#vmDhWW?DAN`$E)NNqpn=?{OCxjDJ=%U}MoCoTcxwr$(Athl&1&6_@q8OR)D zm;}(wKp@Jx5Wf)UE?&G?0k}TI2cNMVew(_RXZ$A4VLCojK?cSy1K*49&-?sl`n?5> z!MHsU&9%dz$8)X|+(_=)SSu;Zs>RzIS}2$^G@+tdB8!W`MwD}kW@$95&EHuoA))Zu z3+;B&L;Bt$qb+@TJ$(1YsM#*ZK4zefdulUr-g14T3j_wv3oHJ|!L)PIdCWZMJ|j9AE*fx8{q~`%ml|?a4Djq^+q-=ReDd zPO=Vr+Oo6}8^#c2e0ae5KMyhBrf~dGp|Tbl@I16@$_Wu_64?x&uXU9$kKR}*6X%Dh z|6ZD;ajphnQ&02cxJd!B{?j7a2<=DG?pO%cc)zE+co-TE)p2rzRg7D+wmaLTy94dS zjU|{N-5svtr;sWDEycXDQ8rh?F`1%hghbq@8tEGSIT8(3D~ zJElIpajYvdAK7NX5k9i|y&~0Mq)Q!|*)E5c9Zhq&MiXan+Hv0V`|=0J==--rSjTmo zbi+Ty9qt8i>aA_AGk^A{C$QQt{yY&v#CB*T7s+SOX2{79{3XuvR`)ZF&|JIV&Sd1{ zrC5?>QqVzvf@9zp@~ane&~MI?01F5z5u~lI(0-;L#tHKRfe$QqK4YL=NY^4ctD3Qg z0AqMO3d|I&*oZDs=*oyVuV@!&Hrj?vY|90b zo0fnL=`vkrM$1K{9&EV|LHnP>blj|G<-T-6T*^4f#*tpz-K`7OVaqf!t+Xwn><@3Wn zjp74o25|&6=7_22vg9v+`HKoC$#kQMt_j2y4C~gflXu^FR|Ty!zjfrhFi-pZc}<2I zEi8y_XmU%u7k3U28yn!zw8Sr2L(vRnq@G+JmdUz!%PZVa?AB|c=>7fhuQf5Z=vqu~vv zkvZ_Gj!C9pNok34a(M^{IlF9Bs)w@i82D|jd5SO9H7N-vCpRG>K^cAI_7YUHvuIk( z&b{%*8W)gzEJZL7pabJp_ltyqxKY*=Z=ux`2?73o?7gQ>v;Y;`iB>3ZkZ5*u= z0P-|mE`X7VUJ{e!FSAY_p^JZHysspIfkm_6vYbX}YE(*oYNLV(ZcH|PQ3h>|W|$yA zQxKXP3@r^75F0TT%uH-JCeM$Oq-i1QQ-+&6XZX6=zN}2mKWM5zt*e7Q5IC@{&phoX zdJ zEChCB;xIk6Qn;y&!Und!qC=9Whk`j2t(!&maWpjb=m5GD{gMhvJ)KQ69s4mK<{b3V zNb?XfA(<~Xlk9f_kxm?Z!+xP8m&{u-9iu0CCCO3!IFwf>V5WyH~8H_Z#lXy?45mMq70bfUkke!oD+_2zF%VB%xd!M*}D zMIEYbdE^-}a?C}MvgV@#^+`7NNC5B{A7~Vf#BWbrd&yX6KD_kXbo6bxGVaR3EZ{mt zCLn$Ja5MGQlLcxjRRSjcXV1XY*Uw_$u&)`9{nu1$G3E=>Yh~ov06G1-F|rP3Rn#EV zlN%iy$-ct>rPs75sH?40^ApZTVi2198r(rf9{s;idP~9Li!Z#Wpp*cSV3Ot_QBlz< z{UykwhqaYPXN*=L_= z{&a^z=iUta0#rGVNcRZNIea)S`PYSe{iRpB2EjwtwkkRMrqR%RO_K9&!=XD9f-OcL z#{PSM&Cs=krfMtS$y3Mpl@$%D>0Avn#n0i&fz8t^dZ2QxU>b7s#<{>XkxYAP*V06nt{BK5)18^^lg|1{Gr3M~_^b$8 z@fkX2`CeSBxJk@Q!+|cxM968^Cd-@m?$r6nO*A+5OuHVNanc3~x<348ruzG$_WY+$ z<|qRt7#mLd@Otb1T{3E1pw`FB3;sPLeW2MmLN%-0JzUYIPU>rldu6@@{ktWB5xVG> zZD0llVIzx8Bs&0%3@0%3I;z5?IV}+zZZLwglBIF&9BIu?MyHag1iFzkQrb(Sz!ZV0 zW<|I(ZJmM5qldKRj*#{;oaP9I;9i*`D3A4Wh3`L0a}tas5={qg2-nQcZVS^Zp0O%w zYh^ywiue0%J?(w&7}xgFn%2ZM-+X2t-&~tC=G*?hx#qXIwvT6j&pwX1HqXtsV_Fl> z+~>E6t5@27So6EVh=GCY_!F(TL3 z)K#Sti$i{<9UrY&k(h@5r$2u-7pAP`Fkdf`uNM^nW4NkiN<}V&pmW0^5Q~7Iz`B<_ zH$YOM9Y>#p>e2*z@E!q}GP7N!B{do2*G)QVz-Zh&LmD^Dkgi5B-@)MPY{20e>G9H8 zZ+o_7Cfr{5VUC30e$vpIm~9IJLWY9bEApCivfrS$tphlsArwqqSpmkMulkN7CQtjW zO8xl~i$%isVp~(Uw$ysK%w1lAS@!7Z)*7NT64=5g zz(f0qIFkOqKYuP$)6MyLs6Ly0szsydM_8GE9I_BTbT;~f-Xx&?VQsK`yfm(#BQ2Su z!K;E$)vZO^^5dklCIB=jS{gRYk)|E6u4wj<_L4|x%}hWZ*50AtHnqFScOX3`4eG#p zY#2s52<_sTOU5PBll~>=oihr;&{#>HWqW5tB3`0@L&lqWQkZJDaxI}5I-E;keW6A< zT*sg-+Q7UUJu_Hd|8u79yC^tbwYW&JS2(Oe*k?4W-@3FEhb@)@bNR~_xKyH*6*2nK zmkZPvty*HCObuj2yPyuuzS6uMV;W4pwxUtefc9(NIT6GkvCuZ{#Sv)3XlbvAl7@9? zzwOg-*rhjUH+&XnLlcusz`ZcFtpdOQC-Dz?E48(?LZ8SFKm4#$_cQEQL_Qeq_gKrF_%#4KcIaU+f*HlyO! z^cmCDYJzF05XO7A+;WRrM-U^?k23Ka1ILRIsv5y4@fUqG)BiK$Q(KUxyx)BDjp8Ko zomdY~>??SW@5}K)4MD!!-FM%unuHVtfBNaC%5-GjOhbVx1K*A9b+7~%0LQzjnrJ4_ z_pKQ1s_BGru)r5L0GJIz;7Q=T{M+Sfp8L{EFRAJ$!6!T7iy$yuc-&b{~ED=Sy7)Z%FdqZ1qhhl7U%+6+AAwQT7!#dreYMBJb98mL) zn%9$Nuy;8apYdHefjAf$*am|IK5uHrMz-W1;^hJ&1Fe(8;lQ^5H&dP6aE$CaN~T7g zqW#Fe8tBi|xC;`X^~JAau5{`mPm`j}&@Ri^QYlR}opKZwIx-R>;U{Fp+qvq$BM@3; zOqO=oYP}02g*21<+~5^Bzp_|n}W$2 z1%@8mnUe9~C~w`IvQG($Js}1D?70j*w8aJVjpjN5U^?YsQ#xV${-AORLrr9wiz#{+*sjar|(|k!;QK4q1luFaQ?el+UNClkIceXjH=FA9y z7i)t&49&gIMR2p*DfQVg(pV{2xFcldv?;P~;})DwIT@#nb;*|PsW3@s*HcP;ZS*m{ zVvUrwEEPAWQ80^k2MF_&CGhQ62s6E$ZS``}uM_l8fIK+QCPOb_3QiPIxCaNVd;Ymjp=0$QK+ zN0za<67zke90Bv*>XKFf+74w9kjYObbJ8?R6N8NAs^Uff*ie{jg{y>mpPT&vN917w zt)07NgzxE+6fzC#SO3f=$7&LLkRe9!NT5eh$-m_*mdgeJ#JldiQ*j6xY!nU>a}dZ; z>PugJj7uTotXZ=ZGjQWa$?t*%3zPv!EkXj#jNKWsVBvxuX))u3oPt{BL#84@HJO3D&-(U<5BWaCbepzplcLfJ@&#m9 zMy8aM(Paz9eMXkfy~^rZIr;cwVVPlRe&tl{kb;(XrL{61^CMptK=YJN)Hw%&Km)V3 zSIY!!{yDxkeO)94sr70`PdXSo$sazeawHEv_hN(+qS#}^s-)EUGUUX zzhF06^+CQKmc(@}esX}C4pW1jbD0~}LTDyM#{1|z=N#I;yc9GuNEwLS{Bnbwxw#7Y z*4h~BO>)s)pSve5um&1G&Cu@d>%G_BqG&#o#naq9hDf71ehmu+x#~1?SGqe_Hj)-$7d!E8;tWyH^b;>nx&b0 zdeP5^MgMS!KwYNnta$}^V+;;wXp$oMcrDlse{R44c`5aB$$fAw0W)?V_!lnRO)OFh z=1~Xcfj4khkoG6nEl>FTjRy|nd`w$|{=}hG6h4wct->VKfrsie^i2K^qDEA2&b(%k?JwQ64+2uL9))`7xk@l48)mR*VP{SAu>)jH!i>n~XNuLbz8 zAuB*!fd8^{@+CVrUrNi$WjE+uV-pVVsI8aT(`gVUFDf!DJ(*Fh6A3EGn0s(nUbe<09r?j24V`X+w zGNm+*vsPXq`{=r@5i% zZLBRV7|-1}(5(sM8NUBeUor%V%gCH2lbLhD-OE`I?kL>Vfbm-h)Ad^TfE}w?m=+z& zUdvI<+C;1;!5F`*-pAesc#nN!PQcEg*9R z^?2|gz+fct$xoaB06+jqL_t&{V1ID!q41?GKNfup4cW+2XPZ{QI0uHah*yf>^?lHyEl9GTi4J}%C?CZ${#Q!}5$8?9(=R`|eH8csa zPB=#70XH1er=ED61c2YdK;{`~60r|WducI2AIfBW5ii^c48`YE(4uA>aSa(`RLmj< zA+LxBg;4Q|xQT*E@^6TE`E2h zJ|k8lwxW=eLRF@@=IU!yv5Wi>9v(s$Dy$>?oSt(tLNYz{Q`;JxaX$1C&fV z(EWk(HSxJna=|oq+~$6N=@^&s7@t6x+J^MOL-5O!UIt6sUw#M6J-!RMB4?x%t2)b~J%gXO*c*Xlv=-quwiVV+0H5lM6eYRz6QZCEbCn=LO)Ws{>D$b@Z!5-*{&Rytm31EEK`jSLcqwhkt$ETLrSm4O z`KCz%5B)HC=mkFboZx_)U5*U`YK|G!gZ)l0!uqg}@&Dip05{G6?uB2^l#1QZFr7MD z&OPg=^4L=^$OS(;9m1p@SWdn%{E_vA*u?GhX1o zmSZd1l*#(Be`!XnSHRI zWA^v$uL<552z>1W*It5E{t-(N>liZ;`*?$0GjHZYhTvd{mYr=EIB{_uxCC=jRn6H46w^Pm67{Q2{>u4F9If`a&gAe|b3#6vXOacmp&oA3Gj zqE}??=Is&ycNN?KdwM|g1g;*)knr>I20hG^e?IUhNlHx6>VBK`hAb_*P=bLu#0h3$ z9HKVDqI1SJUKv?w66g`>lFkd;290Y4=ai0n#3SvbDJ|CzXAA+(TcxL%d&GHMZ*;CA zt{MN#-|?Drf$8jp9E@YXzL9z3m>1`#YT2UhI`8m4CU4G1&M%XW`L~hIBVVPfHu}%s z4B8&};Kqw)l++9%jc1+M23CEnx^oTQ0mf$`7@wzJKStMU9irHL(~P%i?PT$qu}igV zr~&1D#COuLa=y4kG+>hmv+GTh#dprP(zI>1Y6*5XLfdLewrY+vd^=IR=j;-f0BDQy zz%=6;1@x90Rc*CFlD&9>xO&5kycJrNsI!N=8(dj_DGpN$KG_0BrW=WZN#O7lj*o}2ImMs|kSDle0#b1pQH{d@qKV4mkwXp7j;q4E`LPlv0RMRb|8?U8asAuGot`Znn4)1IGvmbS>2Yo`DJcuh)&c5wulQ=Z~`^ipU6E)dsX2pxQ}4sVMU@7ZanAedO? zkzo+BlSz>h{w1hrSskGz!ZjlYf08e zH)y#FOp6PbO@~qg7~|f+H?Y#O4{l(5W#$$FJO4#Sj)>7m6e1Eo^=Mk+t|NUizlmu` z!;Ge#$=e=Fb#&0>2-ZVjn1O=H&pfyPP5eXL#JOYw%Vin%c#3IwufKZp8Phn{f%nNX zvd@QQaK1an<$dC9b3wikU&yYl4@RAAZm9cDo5Q0l|< z%*PBaf=&`4`+ObqV_fszTwoV1S|m5$e6xaG#vLrJV_yG@zs(%m*P+As`x^Iuu|4ur;ly@ z!hT}{`?6_P%h0XX+)m=_1}UlDIk-QxUrf;sQ<`=+ZDO8l`$6l0^MHK?>n*Ej&J+0W!7q)86gc{M zOJRGRynREi$QU>I<@2+p9a2^(6QE2hZ!zNnnK#<{Op7(en}Qh~G@)m1qYRE0ANcAq zQS9sY-+FD2LCjpXzvuYghQa1|-vCOcG-z|LMJj>v1#R8>X|=Wk3jnxu^yRweCq7#j)S_b`N!W3edelW zY~8m_MXOBPEi1l_20GTmHobb^2RBTenNa7FwWjvWJIxT$Z0jU{n))i8M`k_iul2C! zQ?u5&jQVixwb3KeGh5T(wv(josFzpQw#m)cjFx7!NgL)d_U1TgydCR5G;yH0jnx91 zeY7&xQ&VY@_4c9&XaT~g{g`8!-lSF7-B+UF_k#)Ow&u`>{Vz4fZ9@Kxq%A`=*yWF{x_XExcjs*V`o+7iN8O z#`wax(O?_XoGJ`l<8+MxXlc|qwg-6Dcbh(fyLFD~?eT-=!#sg`n6|^)QyP4| z<(@y}!#SjjoOi=Saf`qK6t?wD)1q2^@dz`ua3X8W^@{XE1GK@MpjFo0i3z}J@{cbJ zt)|XK_`|JmhelZoH23PIC1;#;RQik0^zFc*uq6gFsk@n4mbP}#4EO%w1x7d1uozdY z#r+0miMkL2*Mi>J2m3bE`&wr!h7)jdiv#WB6QyauY!?3D4J*E>I-fhi;-Cgt#N4ye zp8(`n7;o@sJ>-MWc2#dm)#7!z6BC#JT}5aUPQfF?13rI|kH| z^=rf)iF*?51H@tVde$MP;XB}-3G9#FwaB__y(gl9{xkGhZ+bcg_pt^v_pD9GSmz$s zi{5#~;t0jLzw&}l)~-(aLPQ)V2-CXQccwCEU$k)t%zgz-btiYeBU7UNLYraoj{Oz! zEc|+RBMi9B<-ES~O^!sq|n}*gh7W;s|`E9U~V`_tStT+~4aExRByWjlLL0l7i z@Q>}cDVJrNx-c*1;aDG&FTWibdM2$S^N)Es#^pT*gZ)fe>+Zq%>1tknxU0v;Ay8%@ z80BCvzlT~E`*+X{-#%nu(h%f6_~3&*48*~bk~_?L57hC4r5&zkgG06cYGF6yc}Xf{ z9~_7vpHuRKW>5fXAGN>h|7Y(!0Q0P>K7O+IXxb)ix{~ezEgftsWrJ2Wf+A2vR76nR z!lxoQKv6(NKtxeMK~a$HVs9vvQo8pZNt>kEN!#!LJ8y3K^d)K2HZ7&}wt1iDxqF^_ z?zv|Wk6R;dNCL2IE8af8o$mpL58_glkiJR#EwU~d6(SaCBVZR3#t*S0B}o_^gVLUB z8SiT8;Ybtfcxp0p9#4R$5GfrbYU?Eqm)0oDs%*@<_0mBjS#0Eq62pk?ppnd#w6;!G zQnjIx-=?_RrASPF-6(~?8L4aSx%uPlndSN7Ox+-wRIL2?xbOcrH|6RB`cr?KxVmer zs`AsNtT;NG?Q^5w(z|Y|U=71*T#_VCm7ECH+g9ROwD8NgWTffVSt1o-Ts%zq)YPVk z^8y`K)JNl@a#C~<)N!AJLKd;;8q4b1G{HS_r$okhi%8KA$Bq*1k5dn@^-UsF@Vy5+ z#s!CHcHl1ZZ}*M;h{49n8?x+ZEYKXLuV~wr{S`^}KD}zC>7e$#qlNfg zyH>;wDeq20zmkx@t*z${)Rr}zl2m7_*B9HJ(*}qmQpjfq=3)o3-sMqtvgvKsFW?4k z25!T1N7HsBU3+n&I8S^Wa4JM}5INz-9vwXk7A$blWpvkY84B)&s0z{p5dT1?(KpED zXuJ-?tv4UMAO;u0v#n*s9<@%>_9MkLc4YsjBkOMKx$g^&>jCxSrqPY|yNh+;PpT9i zE#hD5I(v1|7<*D;Vg=&tNJxzx43qP!tai5aMRgf$8!BZ;VDJ)aT--+lk>w(;ig+W= zspgg4Y~%WL=|szwh~)a%{(=#awgypEiS7WcKBQmq~|ev0=W4ZKEKclPO8H_Q1Ob*#gbkOyMKwyu|nc1Sbe0jSKsU zfTDdeOI*ecnYwhCD8g3D%(?2>m7M)x!TzPj-9b@YnG`Dquz$O1i=>bgcR%Z1p21;k$ z0NYS5LoWTRq~ouTB^L?KG-g`eTO%xezd5$CTHNDn@-1Po->CQn1)P^1aj~I@jfb!E zb`m+>SD$1T@4vu`a+d0h1d(y`IJT2)mwSsMqD%QIn_oW2?w;Aly2)5gVum(KUBV>g z2)>s|H|w&YBK%3*cfe9>uIy$hJ=gi1uYFtG+M{NxFV%k%qqY()BZz>)|IPbv_qH#< z((v3`=XE4beEN_kiu({Je1~xN>&RvlUqH)uG@o{&wClYyY1_@TlLOv24nPo7ZlKXK z^OwK;#bvp%zQ@foE*_ZDnel$nz6hNiAEzzStI09WRG|)jp`(WRwNZetoU$dqB4b`rOK7-3SHwu;I^owcIUs zt(LOw_3Ik#$WQcjq%&GpSZf@*A^KHUHrl^_JKv7Ks5B<3CSqW~4qM}@eBQ%e+TJ_m zgf!7I_r1q@0KAG@#&jvCeesz}t6m`e8M@rWQdM1rEFShYJMd^B{Zbqrh$8Xxmj31N zf9p>d*a@c=*)Zu|X^=HqI0g`-s*ttPd+%6kpSZA(buUbI@ubNwEU`f&3ay}fp60`r zh$bS$_x)*w?Ke8tMjx1GbkRajGfll}3wW%lXMOQa%8eW)>;{Olsz|KMJ( zD+~Q5#Klp^bm=y^^NuBU*!V6sbbncn`5u&$_5B{+#h8UjR9{0oEl8Kcr zRg;@L#s?Tq^IN*W>r6jDe61Bhv!Yhw6Cz|oBoD0%arqAKB#aOD%pyP0@c6XR^t_XA zTX90X5Y9IP$M_^9b`f%?dcy9>w+C+i3He3qu{rd;Z}dZQQjV>cPOliM9iQWS)9fie zz^i?({T@Kw3JS3yHbB%vmkwNii1i{KjM^5~2s#IuTM!7*GlR$p>ClDK*^YS$Y;O<; zMs(f9m($)n4*v1+!*>YhiRosf$Fz*2pkk?|GIiy<7FuOD(m(E)c{8wNV#9Nx2dcO)0aKLJ1hnpdarp&& z9LtZhX3g?+(YPUe;lhP>%rVEfMQzR+%x{R`(YR#od!G7l`HJP1ot5pJujtx@1MRb) zy~yhmWljk3csby+g5$pG?SCE#leNb95RzAW8pe+ zwMzYw#2wQHERhieA-oFB*nhf=O!SbhIbDuo3}kJdCHJY8pY)8@=2%+aMm>eY6$nX& zQ#Lf5d^^dpOu5LesO#>R=%Ebn2bIxQk)hw)YJXetLsi>L7sA_nwwEsWhjj7v!GE)# zxc1ae+KXPsr0hCzS{7Qyuqh%;6G(#n$Y zpamjs^%VD-#P+G@adnvRG{Q`S^g9wqyg%Vj7p-lB9KGhECLLUeJP-=X5 z@DI;uczjyogmB(Nc|7U2wB$@l3F%UfK#8>{cb9RdHM!!9ZL-vXtE3mPM14{x{}ooJ z%XoAuCT3PjS8J7w-i(mMmqf9LEVPZf*cMQ+q7b?_F@ILRos|Vmg zeP0}#9tyQVGSN$eGHQ@bECcgolZ|(6`E@i-eA;b&NAnG=s#qFE@i(rm4Ld&1XdZj| zy8|Gd?(hEYyLR=Xx?zwU$<$|8+LO00vKwAJ+KCO5|GmsD(hZW;IoEfiM!5oBAgad8 zb${p@a0sdx1pgeSW@D6dL8IeWBrw?NsgRxCS)5OE+ zKf*{uar<1`JwVrp++ojF_P4t9zV_D3YwhhPs_eY)N@qz`vb{M&$d3ql^r7po(3nG{ z^VO#Q#nJyiezevW_Aar3n+hauDqR~ISH^Pj?DaN#iCFZP47BFOiYvm=^*3&?3(oCh zB{C2ZLvodm^5_f{jFT6lY|u6hX^6p=6~aQ_YE)`4Sm=ab>POv1CMy z;2e#xvyG&mc6EMjl@ae3zQdDtg?Bx9)%0+Y`#gzw^ZtQyE%k-lGe+iB?OA^;(3W)= zTd%Y<=6sFnH9Uj=-tr9i2}-gTELh$XOkvPYHc%k&3^ms=S>d%0AUb^Q8biV zV;~I|!u_L-@8I8&CmbE9rkt0Xi2`8NJp73vWHAJ%Hfe`lY-Z`la5`Rmi{^*4sc))&La1PQ|!-s7J; zTX-~m$UEw{t@jS5A)1Z`k`R$DP)VX}6qi&=PZ^O|E23aUf!>#k>ujakOoKI_s*^0a zrwC8tzRTEus{F;829aDumWKI56?a{Xb1;4)Z>zo?3QsWIw~8w+-G24f{#y(~hmwE5 zA|bUS^@J=+%NVfIiL%z5W0@mn>Ecq7NRl3EuI#QpZ?I%tKx}Htu*^Y=Y*PuuK&^Wj zBx;bpyR>5Iz7za0NwUN{pU&bobX5xRfi2%up)JSy;B0aKY#F}TSiE`v32URRL_6X~ z1-2tk&=u;IF3w4$Fq)C9Dq1Cu$-WYW&XZomnU>aPz6>t`vw*N6bCaOp{mt%LR(0gP)8mUDTCKE?L>v;AE6g>+UA#P21Y zmG5pB0cMlLq0sQkE3fn$Jdo6}W5;R&ruc0g1VAjQa6^WJGw_Hbj&N>42!imke3;`~97Fx@BJ!SYr+Nyz|e~fp>#j*yCmqk>AgL_OouS1xtM(2i!cC zl$6*lx7^~a{}3Uu>Vk#gd+xc%jyvu+H)D-CXRNqTHdbvY8)cXmTyTLMa>yah9r(N7 z{m%2?M*Zlck8T%P@P_RnKP+sB4p^2v?2MjLAS>mz)yX#Nq&Vw?!=zj z6ttVN`|pEDTg)I<7F_~yZTN^RSu9PlY$;Fb*4$`^P3UILl0$gy;YGG$cBLEiIPm1Y z)>YQU7EWDfGhfv0k}Us@I=m8)YH2*$R>x z?X^dj%Cg)#)gjp!_hO|f%HCw_-dt%fzOcyG=OJg5$m(-O>$or`F=!o|SG@1J;@H$x zFiGQ3E-TFUJ@mMBFUYt5KKHWp!brq1FUMhV{Mc+1!q0&@3-O`2z_!{SjY2psq-*P& zu;3r!hJ1s6d>rE8g8#PiCvG$^zN0R_yl7bTopSc%@r~A%ciIKQoFpA-xFkf%g45b` z7oPfv9?-df#D%AS?1ew! z^$OuUgMY{~`W=0b#^oIs%7}l)LN|v;<3_{6d&`q-Si`mYOK8?t?o6{0nO2W3Ea?Me zIk@hyycK47GFF2s3dMD&x^8L^E0u_u)P*#=&N3a!Lpu}^)f0(QSy9{E!6bHW^!Dq&10TT>?K&_wIitC!>X4?g&yuc0%}IK$V)OE10T`C(89 z;^n#Lp6eDa!+M}@uf6t~=Lz@WDW{xb#~**Z>)OORC1)N8o&yIC^mY-yvm7}w9OzK) zA+;l6=sHqDh)Z3FAHJjSgyBMd(Kz@=zj+VwLRiQv_{YZ~9xnJt^9%kwNzYvOaOS(_ zZThge9)eiA#~@IDa787cHbr^@WAj}^5rV`qn_RS71Vaddp++9mX+Ik!2Mcp!t}V6P zR1qbkF4`H?HGGFS(eLOx;e5B}qIrdM;Ypgd(niySIQYfCw|KSY5sjm;MsZPkR!Avi z>#WvahJg^NZz(fDIv_WtEp`9;W{GF(I>8!ZDxx+CW+mvHzNxnie@Mi;Uf+T~tySQq zwK$z^nm0<^)!MeG8sd54$PY`6?H@vA%j{_lji#a0@Ev^*kz=*mG7e$!X+pdZ7V--I z#E<&1cAfD-xM^a#tnH4R6NB3lm8PpO?v$7&LtrE3#Rz_iw@Ji8GNJ!~-zmkizB+eLuGMu(`$=RWs2D=sefb}@;tN{7RoG(Ayzxdi(+r{uA&{^yed$Yf@WBWBtslh2?|kPwZsqsXQ&06DY#nxFpkr}p))f87o^-~i|RTfBI&mqUFZNRk$- zd2lb5m6bU{gFz99ikDt`sXhGg!;V0(P&)gT&pWEKegrch#$?Ef)6j#v+Po#o!m)$njX1`G` z@nI42E*dDJ-fAmbBFm?`C4S?{GNQ*_MWkrf$q%5p&u#93*8UK{Xplv=P2w1< ztCJl#iQQs#5Yg=>Avs5!r*V0q%%1zlGCT5|zIMZflkJjQMq6IDbhk9xy?TR0RK-c9 z4dKOym&+`D7wgt9TO3szZSg$mZ5rFn8pW}R5_k3l6i6qE2)ty@db{mw@7NcAGsf1h zZLptBnqt>Jd6=bUrPzJf%(2UUdw^}yP11eW&#^E3@&LEk7(|gbw_@{KYkTktyX5BJ z_xG)3moMzvMVobO6U^)$Ln_}>F~tSxP&AE)IOx=Oj7z=#>SV2L#ljlP?VV*KPwHjQ z+`Gu$dAZCE{#b9j<2zIBtZxjnp}jI~g$SoTghM4ue0#OT^51wu7ZIbRBe74mRZ5}O z>?u`tl-3OhF`RrnE7z-DB7VL7e3?CQ*J3;Whx_}weCXCWcHxgkOU!Sh%35bE=1+!6yv4FG1$0NTiS@}i8K3?@hYuxw+r+_Z0ePzSu8Rr_=I7anbNcC^t~o@!FxLJavx?fSTh}%V zU`{^z=%Y?-$l5zRYoCBA>Qy2Q22QbnH&JIpb9Eg0V?txgiPU{%F{;I34 za*^6|&N;`Wh_G^a-g)QQ^5x6zu)_{>h5@+y(20p?{8?w6dew0-Y;-}B9q z_}s{GlLs;ID_{AF-{65Hz|9A74vs#!_SkT_Ipj7D!W>+Lq#H71h{pjL;MVQOKmM^3 z`w$6$i}1@|{<2*sLm&|LKmrhpVbh;5VS6~zXV{egmWjaEY<-62`uE#U>9$zMv`a?|sOd|*l*qTyj@ z_Ozjgh`UV0g!+~9tag2q&3kj5O*p5-iHTi$q}gkK7e|=fd=VBQQVbf`MVx2p_MM|% zwu2}3vEGC8ROTwHt=MQ|PAIZ>o`q;wr?^G7c4eJC`19G8UzlnGMiuCpE{@LFVcs*{ z_tV+~VPj)s)%A}M(b$bY;{~CvOOJHxIUvX8zEv(FZjG&+Uu$WZNp|v=2ihx-EVToU zF0w&m3S9gfBGMne^^SBmme@fbEB3LjSY2@A-TCl?Pm2?TN zL%0GDfbhWlXbT4k>Dzj0W^aik>pSYlJ5H-$3xD_Aj-QZcG(VCD|E*;e;&@sXgj{?( zLEPj0LY@JsCp_fU8pcaYTKWZE}FKp+fTuadtH5Wwnqq=C^xN$aA=L;AU!1p06;t-*S(0BUjr~CJhe)MAz z6`xd{zToXGEtM`t5ir~88&9zBXUBRV5JcirOT@k11=C)d_&j#-J3qOHoi^Zm(#@Qy zb))^J-HL2kKy(cg64rY>JlHZ->?@kKv)6yfJ6dkkFIvB-Kk?(gqj|)?hq%%FLLTG< z@riZz?8aY-`@apmJ3hk?>UW!SSECv_rmc2$a84&Brdmb)RQufV6D4*WgI#T97yP2| z3Rnl6#D%d6?>u*A-i3TZ9wEP|Kkx0iP@nK@FW!#$x0Pqqk9Sgq+f!^h8#cH~1XEe|=e#>k|xslH082auK+6 zOPid(R{BB2HJ}YFDMxD*f|A0URu@`I*R|3|s4^wSf$kRFZ%Y?OffVAFd;IsI%R63V z7?73}ZWUW=3C`FT|1Q-6^Qvv)7YAD9>X@=}fj1Gyd)c^?if!_fE9|8Qr`iSA9^mWf z+-ru}8;`HDVTV+TQ@6m@t&*Xh2?Z|Jy=Ypc^&Zlqi&5g)j0te7wkozB8)`TBnq)rU zYAR#?H42A#2;nitl_@k;7Q~v$x=9S7-mS51kZv8uC^20yQ*jZq*-)8nNqMs5hMpFb zDa-OCI;1vMXG*dBDv2aW6erwHwzPfUV_y$+Mh~#0Hi@GmEjiov8_`z=4MhD5#P5~@ zl5~5Wqk~s&Zcb~F;0}l#f@kb=JJ$nE5^vmIB5KpdM&Vjn63v$)z-7wedACq^yHII+E0G+6Ze}jV}|c}hztWSaN(>0?q6Om{G!Ei$kq80P`f@g1xTdj|V{c6|@T;a|JHz|AEzOZ+}rXCf|K zC7-Z4VBgzL_rQh(ohJns_G$v)E}gsLSXTaZb@d_u3VjlM3N)7Z!HM^Wwh~}!eB6EC zo!bM9OLQOVtlVV|w6n6>zI-6`-FDk;cIKI9+OL28YkT|cx1GC>%^P>`z4zMw`|q!b zS!WMD^pJDyq0o2mkii~~4#9L;;KbERPZ{Z$j9BSKba%{{F@6Jxl`#Cdp`#OV5FOzb z#0nWVg&+b@vw!)^U)rQelRVD-_uucj0r^0G$oc1=@5DkxeIXit<};tM%P+g!x=G9c z&OmM|Df5XZpKz{3M2Zm$APfX4e(`uAd(aPrJB$M$)|-}@BK>_0)}u7bso1$)({1XC zbxO&!pML69yXML9(oxqSabN*`jlnz5uCmu2Yqr9^5>I`% zK^C56e!eN&UVLDxh{ze@B&)Z|l}#GcY!MFE**|ZZr`!4@oBdk3_1iDktx3a02v^z0 zhAgX}R%#hzW?SRZK2|@gMC(PwtKu@t7&6;7RA*b$GL+G$S;OpJvKS`Ig%aCH?>AGH z-uj8?B(Yi%4&P5sz-^Am7L!)ux#F}-7dItv0dCp^;e~6omLC1}0{i$^N_>s|?YfzE z(8L}-E}7!)gDZ2%j4B&{Mn8$%XW7rrea*h}*F(i|TPg0oEfe${d$O--B%WCbBn-@6Y@4t60wjl6^|BA%b^cg8+!3Qd z$DvQ>*I{qSk)uiA;0IQ24W0-1O}l}2#E<&z4gImFwSn=7?k$~JzhoyAbY_kn%!`Qw z5e*_AnBOhvYr0bL9Tx>UE_V;4~AP#mt_0&wL`2+_f!|TzT(a?R<@|x zs+QMS?~nBoL*7RF$QgZY@$?Ee81uzjN6L8DChK0DZr}aKA>wAMv>tua?YQ$xEL|eT z`$_b7h%86fh=7 z@n;r`D^nuS_04w3#GY29{%Tm?U|+v$tfgtKFcu%bbb!RPt1L%`cuxQFP+xx^|NKB1 zJ4*Di{N_F5tf{Wi)-S8Ju0=gTGo@Q`f1CgITI<$RB2B})Xbx)rz;_FJQJ zd&SnB`sqj!633s`PxGP1&i>9o#n0C~ajL8clJskd`V*N-abPYeu*@;C;#Qw-jVlXn zQ;E2KSBdDCUGId#q}=u5_$wDT=1Q+eLRMdKXLb`;mM#T0z*!BNvCr-6fjzGWJ}CS1 zp44-jk^Y@Ke(me~J!w=sUKc-h@4(Q9@dlrN_St8h6OOr*CaySeI>KLg{smXtbI-l^ zSaw#ntz5a%b@Uy7!tt(q50PMSdGL154RGQ?5PWm;n^s*@?dJ(p?_it*5nj#-=nO=y z5ClBb{7^oULKx(Ldk>Dki=;{j;~d2K_{Tr)b%9$CabwD)Zk$25)JLZvgg_i|P%Fe4 z00%*ka|#9lIfHQim@8r4ZIU`U$F7$_g?EBekdmuW_(f7T!!MnI&t^3aoz@S}R zwGU19VIGI)ho<50Lqm5}AHQ!p0NEsA-)AG`FX~v_=;H`VatXt4#E20djkIk1INpOH z5r}?ltmMar9vlb)mcMZ11Mw04fBXf9KevZC-VZwHpw@Q?hQXmbgfa&V7~p@wpEPXn z5GI4eZ&wXmC}XFes$+2Lo0DWI)-1Cxti94LRx3iAke<{YIfk%Kl|(zC2c#6{`mIZo zIFj-QWmpviIg#>;Miq)kDsBuBc6yE}R7VOrw*csR#i?shAMMxOx{ZkSOQYh})$yKe zy~Y)}v5!hw7w$Pmq7n)#lM#cY^fW6yLV6TcO$>iD>DD1t#EZ?f4z=I+41EG2s8(W_ z%~BbVQkWwGt68Otf*=ypZFo29J|Z?K%umKHwJ661^@@!tx*RJsCWZTVcaG39nJ?>o zU=N$~c7-jp9IH!CmGKI36Xs=D$q|`aE3tlOZkWo;P(B0u#1LUPN-H(yS^e@g#?nFP z(*eTYMytYK#6Oe(Z&;fn(b6WpONX6kco6@R@+!nZhIK)48`L9Cx>`?(^HiisKV?4= zmPGU${ifnoTk~2JjZ+cY6?!37uTK3{);pAYOVu=ewT1+j^voM5;+&r4T4RaQ!_nuU zo~>1d(~o}7?44_a`eDR^+cx!?)>XkU=}Xd>)vEux4exHt=2u%|NrAW`vuth6CQIp- zZG(@^_WmZHih3oM%O52DnS;8zKmA``y~%P1bcv12U@lcQiHk~Hy$Xv-2V*fWRryxy znI=M_ZU#k!P0*do##za>v8F%-zHCeBHAftreS8d?%cUxzpu5IpveH2q6x09)>{zc+ z?GCwE3p*6G-I|1X%slOg<3=CY=w&PM?!1r)bq)3GXq`j+&VG7*c5@%lhWCv7dptVc zQeYu}IPilVb>IfLoyjBArM)~TgSpoc+=9G_PhK5~zoYHm*>s`rceIYtKHHxDX{+AR zyxI!yh#z@G+Yl$MKfa78G0Wq8% zu0RNS7~TtxzTmQ+Ki)C;aoq98gwKk8XVrFI}YeC+Har ze&k(JQsRG6KNtaUj2|Mwff$G%+ajSp zoRdwk$DK0Xo%>#VU3UAo`Z2C6cd81^hbWBLuFO;sxNwj zJBocq{S_Y4YA>?{U5fg5OB{b!#tbhmS=>`A>(XqE2n#8CZ}E-=cJMdkMc#Xxqe--@ zNkp?@`E`~qi)bylfhDwzWoxI=d7=M9M@IdkW3aJC9DHUUm$3+G&Gc>y{pcTL)zY7B z`A7YDXGu0~OtiU`x_OVJL+lqb_8S|dOH$&eyl<+@wvFo~mfTOor?f`PI&8Iw!ZlX) zuOp;?E~b;NwN0TiyXr}Q?MU8A1o1CjI{60YS8uU~fE^CMLcXnI5brF#q#dE$mb@94r-ucb-Ja6GL$GGsa^>bLBzaG4Kgm1 zgDM66Y4DP}thG&z+2Y!K$2P1Nm*?}tZPWhZ=8)dTn1#32jFe{Axa}#S&A4hBV(qvf zsE1Jz@A2qZZCHO{4-YAVU-<6GlQaR}*xvNS4=%ng!Jp^$lo9F>y$p@!wI{vP zW?ZQA_S7w;33=?u7?1}p^nJ){d+HI58`8(ujlC*_h4P~5w)Vaw?b=#?I~}%z>y2_l zzl1tK@bi8lPhg4&cKGoeJ9eyJ_(ySe`hq<8i@t~af?vS<@sF0td(?&aAx?PWA1#+O zQ9s^s(Q^2vE#wg`Ct3#YJ4$RJ|Lt+W=ji@`!M3>OcR0IL?R#7-lAbo~ZkXTUitdVt znwvW@<=<1IC>(fC;8r|Z=O#*<<-!~c{#!}9MNo)OJ$AG%A;X$yF3jjpNq`q7Sni-macadzc*TjP-&8n-J8ZZGfX zz{XcD0JUh^s9*Fwq=nTV&b+oFY@aTIeE9w`@i?%2DeGr~lVuheKap+4{ zB~@xUA{N1k6?NsS&AN)I@BMafEgNMI%q_B_bQyqX*^UF?4Rr$mx968E(Nhl00Q&6# z)FJOZ{mHgeBW|sa4t__<@hkV}>R$KKaZ-saF3&FF;#();q7?e36iI*FtWqsd-K-Z> z*oGQ$sfm!8n7P&(7fGCdNq5Dsv&8&*84M}2+C>scPDV_%bywfx+Dy%$4;7>}+ew38 z-s9>QtXPX%|13;9=M`q?#}o4S_s{8E(VOC;4*W>-55v5 z3UI<in71s$6s`> z=Nke5$Q^m`1P=*usaJ@PUvRurHc!HXo4;Vbty{a!2_J3cf$9--C zk#WJ%hv;U8Qw)_dFH4onu%Sa;oeX*4GEpsF0BS{5W?4v%2fr67ZG&H#33M51*4;3-QK{WK;>F?S{#(%`; zOlw^u`H?@4u(zj9wZ2kC6UH%=7af;qABDCNFB&JLdq1BL_vmN(0ZAZK?BKk;LSmw0 z&&57}p?_NAd5XKh4c+0QKRO%%hsL&A+Kd>y{EVkFBTq~f3dch&6&K`a=WE@`l|9q>or&~p992Z z@b#Yj_IbRw2blLL^~dUUm}_CJhq=pu(XCN`a$>F_N{(1M@NUlRIj#>Mbyv|f66PQ2 zLmr{55JrB8%1@pg+ausm-7-GwXUjT7(~=&C0Uq{HU>xZ~Ia}sMYk=G0f@&dNM(Y*g zhWvfzMe5$x8uP+;;D#N>ua06jo@GF zR@4jkkuf~sbZki*I9qzESX$Z~%`1Ep>gQ3#=K`6v)k`>3W?rhFPdziz5>Y>~^~eW3 z6U&pY_sfN`WBxFgnR~gpxvgs42xlzcGp=#-qpdi!DWqp!v7eGZe&AQ&K4CtDcf) zp4b{;Ce1E(@0$oPowX}m7?@p=_nw@mPaySaK#DtFS50(97C5te-#E-3x@DI2AC@iS z1AR3?S!@Y1PEcdNKI2Wh?4bi)PoLI-AA;HVIm99c5IAV42Y?j<8xEjIc!-N1-*CU9w54RelnsR2pzO@G}R#q!U*TWdm4oUbgaY zmhM8Va7}q?m31r5uwJs1+E}MnE8o4v(c^S`wnS_HK7Ev>%8-Ni@gCMd;99e|6jMdy z+bAo)$=%k;z=TA=%lcT_;5n96JJr{@~db}wyq*nHZ^8Q?0UI1 zE$t%F>pV*zGDo`qq-RjX*p#BhRy$>^h(#Z=Ynd+?sJR^AR|_0su4CyOI0LM7?g^Fi`s2%N)X_cMIye5@EE5;l3Ng=N8n91( zIQ&@4)ZxwlthCo2UG5gzn`HQ6_@RY1`dI17bodDjja_m8LvaBXg2d7uoX62SZ4LP* zss4nzj#U**94AuBk38rf>W}V9s^#@mnTuys+ML(d*(bg|Oez}aJCHY(p)hX8anyyj z;YXi2a-(=oxTKmb?exgI;HSOpLFnepnPcDn_P1LJH^(1;ynRy!1u~@Di+Z)7;A&HB zUU=PG>KOdO%`OJR@cYu2zT|CeD{g3B2;&J+4+Igbr;8RYazY}UPlSbdAsxEKCQO*H z1ri*>c!oMbWId}=$aW4;`QF_JK5%vc$4_^cz@ zqzrWpbqVbX-(g&c%NSmN{q=^ChyVTef7V0#mm!peJcxsf&jUa5LswjVeZ3uZ)KRu- z)hgFd$5;>+$|G(#1n`cFhK0N#_@Un#z0;_wp>7=1IVhn&`al2vw=IzY35-NM^6(=z z{)q9OSA1Qg`7^)1B7N0A|M}0`Y?o)CpHK(t72ZQwr$2XM=sDD3^kdktVXi}uwqJSW zl~z(x;`NU9Md1h80G-#Ko!4mSYF{fJgFu`21Lmr zj7*;~-3jCn0OQw4SUb_Qq(}cHy6q=Tn&i6eA9>^v7h{J2NZk1N;X6FZ0~hKIG4i$7 zUh{oViDMXF8~Y_`gca~;O&fiW=I=|ijkp#tQ0># z*2^H`M=u#@{YQ22i(POZ=07z~70&b8W6SNWf3LA~r6+yfly!db+N5*kBR9{p%kCI! z3v?+=ok@>>4A;^65zfR~i{XK+FX0i2*Ceh%@VIf(w-0VM{lzltCjI$Y`BJ^3wdZGK z#RDJ1#qhWoUJ4#Yp6{n)>~a75-~ZeI6Dk@QKla_rFTcE%$iz=eQd`|5qXa3I*Db?=Wlfd1umlhqWYi$9YnpS?03RyWG+530#@4ug zlOpTD6=n4f-~fss9(mm|WqG*C*6FrV@WQ(G6ahkERkCIZplhg;)mH)P9El0nmRGq5 zUQR)pB`Z#otP-zUB+Ia>D;A40#Kps{C*{}Ih^tJ%yGv2JETcBqtB)?V5*abcD@?QW zY*|)qIk0x9uRb7=l0?W^T%G2`K>EZT1I#;5T=0*5#eUn16Yn3=ggioc@ZZKa1*C*|OW+gjXMjBWptM<|2XA@4{^ z#syAb2(z0cqMejkYv}`*+Qufm%iu~{?*;02kVA3$6|Hd&O~wxn%#`j+Jf}?>L&SyC zhA+3IoC=Mb2!Q(D)lM~*;hQ8&N!EN4JfSU7mn{EOahkNzZ1=+&HV%%7wX%{8oZ^-@ zD_0zLvW^Xms$SP9cqEJ0f;(6!=TOvhV7488MsJ5@AZlxL-~u_zmv!@W#R2()L$E=Y z4cS8MxG`S2pxR#g=VHqjOzJZeO{@;I zbN#vo!D!V-*1JJAYbs<+M(v}F0$q?a%V`2-1T95*Nb-9NggEfY<~wiJoJ^L87sQT3TA_#tnkLV~9x@M57$^i9tXj zpCE#S-eatbqVFuKGnoo-AiLp)8{CKi_|}RQEBvsBB~myPX$NV+8%WC&;urM+i46oa z{NTWXTV=cPwzd|W_s-@Y^2d-GI+)Kn=WH*FKB7OU6VH6X6mp+F} zk1^zlo;m&)SNaaZCF4WA;Cu)!=%HS?XrU7Tr%#{mK|DFM&znErt;Ck}E3t2U;~Roi zo4h{sJ97yxnqce>&Pe{~hfseqqfgeTT}f&W^OCv{k9o%7o(*Ou^*@NX#DRl?I9T{)?y+tdcgBHnVJ@;3S;ajS2f_vYhh<*Y7HJq4I643D zhd=oEz|qP2VLdUw7)$zk?{x{zStO8TpS?kb+FFQxw6{`tIfOp;rL^>9zZ|bBkKyF( zOAtPQ|0`G3`QFB!1lQn!B35L|_}}c;%7tg^eDGm%+p)iFt6To9O8|&w%yYPbSiit2 zxM6`Uz_GA503U-taG<25#McfNL^zDvgmncxf)ko=@&y**$NoeatfyRwc)j`Nn@(^C z9swJGL%>KJd&=5%Yb`x3-F0lT4%sJIU#vk0FYFDh!{At#z#1IBlutP8j5W!73YC*4lFe7JBMiTX>c4NY3L zu-eaz`8p$Vj%?KVGFkY{%vV?2A*c3KSfUL*xU2A)WLq(Rz2y|9TD9<}S+A~9yQOcN zwIW;xoDy6ILx|vvs~6XJnY?G}>re`HvwhV59uf5+6?!U9nI?I0e!yh`F{>6>IaHB}z9vDbsuVqf>=H*(i z;$A+Ne)hAUIkEWcv(NT8ix)3;15Uu?qQW9?Qkc`gelE-IxZ{r2rZSgf@PCt4udjBv z4!mbhMduuQBa#KIA=0oG*aOHraNjbwsV8%oxy~GCBJ|Pz$=v+g-~Q%v7k#tr%gkBw zBOmrI)+BS3eFZ#`bwFK0{izf2Apl--$tAw;&=A^8{sA|k-sBzTJLQFo<<^Gp#0zI6 zoglWzVYdl#RA_c7;9o{daA@6T91tr^@Zj?;|c{cEee($f9UZTdTuv&tW-s>J`Im z=F4mBu^Z;t$caTZ|8>Q^YCp@hJH?lIS zc~L2#yT3SE4*Y1bO@3;bJ@|{ccEnl5%DdX~duMBrn!Wts3j4;N53)YuqoTWe^$UFfK2`QAUerKXDecg~`A_Z{G8s*u1M5vYDS=}qf3Jj*W<5O4k5O$X?oV?Wy6CO^K~z9Eav896C-&B-rW zVb3f(=Hfm!Mg+8=UzLL#L_;{5i?B~|osoyTK!3P)Ek4}5je)7~I zx@1YRUtTc9F1&HLM4u~d<}2may>F%y2~Yp(FrU{h21bW#0>O<9vGjqT&a_$~!Q8YD zKcYZwA8bozRobnWPO+oU>t|D*SZx!(+TTVC_U{O6+H!;pNQG-;9@ee}`JxpD8k_ZkGFU;N@1_WkdF-?_f9 zDth1j_xU`#>86|Q?YE~mQp({4OQl!^oiJg7a~yI*OneSu9LPBAz^R1e*7@sS|GIrc ze;XYbniG@0@|CanVJKZlEr{#I7hmjY{_>Zh_8aTZfBy4MkbxNYiBEjO52PI0K#aMy<`Bt2Eg-g@`Hl=+ zEMe;}{rIOp{mI)!yCKGMh#fLyh<*CgpLTqan{$xpxpU{*;fEh?931$j{*ONTsP{4W zC3Qs)^vyTl?1(uBN%{zjvk;j``-Lxj!4djdvt~JG0o;-F6$h0C3l?}i{`}`ZI|me{%(#zwJ%{YRrZ_p`{i-=>6ImZ6}_rKdg2Oebq{qKLB0~0a3 zp%P7o>*t||9)`h6F*cg+OaJS zXYK}g7@gbg^$T%;VWfHb>8HifdxLXAaV~}#lQn|NQgMJIsSvK^(Y}fp@G84A`*l z*asn)mzI{gwd=d@zT06dYx9&-PH`e6aewoh-#83}fI>TH6My6#9N!S_u)GangNqH; zEbH{RuiQrCHzMdG^k8tNn7gNB=C1 z0T-%`woI3?4KnIC;pA!?HX+}h zzkii|`>*5t;ui*(_fwLMeUE+E`%hzb<#(?1Z{{uYgL%oG%RB|HLxg+djW>J_oN(d^ z>hIaUM}JmU*q@Pz?5}_QYoCK*T`{k?bOS$PPEi*43>UZL17{%I_RMDpi0qNz5pdtL zuY#L#v2^2&H`=w=UhBrBm{ZJ2^2SgUdnlgE!A?|Tw+k+pc| zoxigupZu3gZ4eg&QiMU&2gi##a1EpkSXL6KtU2DTXQfMpdt>2gV#b?sEezO*a$2|JGZ!RKT!!Xr7(> zi&1`Cv97Ga=1!>)fiB;k{{1TZ`eTPW08PN!fFS5faqvC=;2OK?9|ws5SZ}}n!kaoY zYJ(AQJ^On@?4XbJv8V2t4}7;{&Kn?+yF6Plw~9}jA!O$KAB++KaFhM?Q?J^nqk1@d z_V^2W+DR7=lwO4;Huc$6cGfqC+o5L^I|pEI=`Lw(h>0)nNMG%VX`)*msF`5zmM;E# z%h0WV#ixz`j!(U<@c8%}ggihj3IwCj7>Ik}oirhwcPz{{x1{5HPj<9H&C?X!aTlL9 z{(DSU0LgK}}Y`>%O?X)iscaA(@8}*}# z+(5tj@NymM8pN$wYokudb8+D3{<_%u?Vn@Eo>%HO$}c~>*anR&u&gdAcAze7MhKqX z{evmiXIQS_X|apHIMOQa>dgEkJMWs24twvuda4Z=-Ng<&qpNf90n@wnPqD7ObP1$O zll?x@UFs7y*zdkR)wvnr3<;ve)Dh8@Wpk>mQe56&xM{3&Qr_~#*TuEi%ee^mKdP&J zOrkbpPAIZFuXxvnAJ$#B44dhdo4%A!GxIc!lr2Q$hA83sY7z97Ba?n8_tEeLgI zIuLr0c={GjI}mT$2|fcc^Q&L|s_W80L>nR=hhrRv1jdF#14J%}W#mO41R~|_zrEet z2hkR!JaAGXJ_JE6hz*~1`e}YJg;)ev4dQtq;UN7G{~$(k5Ty=q10W(E>JZ~N{JbBW zIh4mBjU*U!5CO>t*JWOC@PPP4U(XOHV3;ewqi}FW40`0qkxpQyFR0%H9VFnA<8Z^c zP#%Ykl9CcX^f2$>Hb6{@@n)`4UmR^-zHGT4O8BO4+ByUfw!0nk^T~fb=_1W=v_e>g zAj0_|j49j|j01-%4tG6GA$=ml$IR8XV|Y zXNaU_XXp63gSg5#Qx5BZF%D~HclX1tE|2l%V(773XSa_1saFiOWbGlxeWtff{NfOM z^|2*3@68JP)OYu{L1Xjn?Wb4UvFDfiIRH+j<#X37{d^m$OLI8JA#MQY_qo`9!Cc01 z{z{1u!P@H|;0tRWV%nNDWxjWCZUZJD>If0+q>rBDgaKeX{>)!s{KSb9osa@igFOI@ z01l@d&226(xLkPom6x4(#>GQrRi&o`HaL;-OP4xPoP2<@tSw*&@TyV7C&_Iv7S0|5q7;` z9PpLB5m*ahkc%6LC4>V9wgtbyA2xCUBZ3tBI8X4twj6mSCMM{Dw$h&X?Od%5^GnrZ zH17|Z*vq-?Zn<=_jXSBx_8SkEaDpAA_i-oo7Ev$9ru=WE<6-0to(BgX7n#kHRvU7V zVE^l7V!}wbOK%_Jk{?J=eEM23%c#tM{&J>Eg$zBon+?%L>mjG~)>ukIjwi>w`{h0eW`jvUW z*h1)IPvr82`3(^dA{cWDd;@}akD?ypyxi!ppS=yPScrF}rKPR&h;amFLl9;jf-|um zh>xf(7qVQ)QO>w=9|mN!Wu!pFr$mpCNDdYx?K$#~-(oPCCiw zICY~=_@m~7HLyEeasXbtqp(1ridPi6JIekrlmXCVf$WI${anBY5v^f|b+u>jTVn6N zu*S-Dz&vPTu|21604CyRPu;V?iic$B@VDLuAJoMUe}($6EFr`dk@WZ?!8Qj zgXa@FEHngaz_?>4$jhzuXJ0=p>}{X1IQrABe0B{;xvhkpi6Mk z^mP)+Z4x}q5YbJdZHgath=Je_()rJu=GrB{guRa2mA;+4*TM=GEBHY$Jr^BG#OenrS5?b6r2p=;Mm)?WfjAEG5|vKDnph zdWsH*tNh}nuq4x}*EYp;_(i&sZl%6;QV}uw*dohNT2wNO74nQa2s#+?8N{OzW64rD z{TKS)pV7u{<$cRuQO*MDSy`F>tgmmdd?9Uh;;h)31G#+R#TT4lMm!EJNGNb{MyDf$ zf*>XcVvA7?2r*qnxEVeA7)KgG1QChCp(h4H6n{7ld*D6469*j!Fpyww#KF6`@hvSa z^|<5>LW|>_wy>W+{@CMQ1_&VpD)QyPM;+lZLzIjIQblEjee)aNY^?|RP;RFBBjo4e zHR6cFA(F!ZkoI!8g7^mkk}~7jTD?Z$QQ&&QU+oBCgE%ksg8*co+ExN8RCgLF|XRa{%D5OWEJQ`f86x z9dV2kb0UZ&L3E`Ih*@v|;UIAy#u}gtLS8%$zyXiO_IYLJ)ya4pERWz85cEVm;M<#t28B zGq-SzEeE~Tt5^9qgjEQ!%zx&3h~qDN*$=R_uy3}w(MLEugGjO z#6ofJL975K;F#Zp0duCxfDnWZ@Ehs?ykK46fIsX#b+vVdngY0zajXs25#_TN01I*W zL14j!Ja{KhT=0XK&t8dWGwCSWKpYSF0k{HdfPJ4ih=U*v=N)CT2a$JXMy3<(Ae7_a#DnWR;DTYTL7-%xMQVb& zK(JoDX0?mf2V9B09PIQR@Fm+;{`?C4~ z_JClJJCyq-3DAr=p@-dm`4lnnBwA5PmMkE}0O|98UE&-hA33Ac_5TG$r0Bnj-N5MJ z(xizl!1nG7E2ZNq*A6?SuM_+r{^d%iR83XA&3dg&wziQPrcJd z>bYLx5G}B~rPX`KBaGqR(VD%e6%5S2!P%t)3KA8FE)e(vq89(85^W6yunQOi;KE=~ zfMr-`1F6d`NVos|da1Z6>TJO~mG=C7D_qny2A4KDC*O;IT_JA4Di?o!`p*lcXQ|%) z`^QD%s_1HmpWM$cCP4ZSk*yT>-g^B(T&u0z;9|AtWqMtTrcsjsXCRj`z^p+Mt8j zNyi>#6AnK_df~d-C(k-XoDo?<)F>kwdvghJV8IQ6h$#pfgd9XExv5S~Np*x0L=y+% zh~74Cu(`Pf$poq7CKu!ujxoesAT|&e#~}>ef`cTE0%AuQVV;6Oa#IW<3^9X48jf#} zTn<^>L?e;{fsO+eVLXWsat#8@jq%_?gI#1er1y;U6P32$y|JY&+(N@01=2}d5%J}K z7>I17=RitXxKOr#biz+S{^5#4OpQY)H|N~$!vO$6kiO)w3sMhf3jGZt4rdqr4Z-k< zC!TO38GRZMY;O2dl2cr4jRPg$a8*KpgRn&Y+~9MQABc@K2`&{JL?#ZZ94dexa42#R z_~$?W=^TiZ!{Ia#@R%Q=Jvw>$O=F680bZqlE&M+emCu;m?i?1n!aHcRb_2q18lKYrU{ zJMwH93>j5mOQ+XqjtkDW;N1XvVEKpD30rV{;q;H6WTQt8x51i!XPr7x#0#t|(=S^t zjsTk$ELb28rC<2^h2s|vR5+W_V+P?1ILABOL~uB>53rxy_m}&8Uc=?YTE{QIcFF_( zLHuSd!KqCcmk+=^))srnM?dyahxfoJ;3(^cKgwVqfDi}qf(s?!ADqY+ zrf#M^5c|fB9%-ka{85cef}MTFDK@BoiEx70p4nb{@VnUB(7vp7LSEIyIB5RQDWSCz9!H&EHzGCC7p>C4Y9K+4Jfq3V5q`tws@aF;<@!f+@?kz4sS$}Pz zNrESB(gNhNm$ikCW~59?56HJ??p@@nVwMP>eEWZ8u6voYYwRox+>4!m+iTbE^k@Dt z_TUTPK!~rybzNFg>fGxP>Av{IFZ%d0FK}zh*7%&`9n~a^KOCRT?XV{jh9iIGBYPyU z9N3Q^d4;&_4Xg?98l(vzE`vXDfrLIw)>bH+Jh^xRw}3d#I}ThBVm$i?_yWX3_6ybr z?ZP1$!F+{t7QKYDt#6;czDGYJPFdzZ#6Qx+JL<|G^#pf;3zqheiGf8$gLeY{9JrtFj!*1qH;ZlWB*Z(#!6;YKq=7{GdMI z04-V_vSSvUh@0rQo**o+UEhBBRNcg6TfY(cF`%z@?Q{Ejpd&rNI@xZwLy5M#ln;FZ zkT)E}pzz+2PGNW;gn__;iDgSkb8zW`dmN5>O4r`lGrHLyu6oN4L_-eAbEFOB%piGi z(|zXp{q4b1j z4YvEPoi5^AxscBd;?@{00-5x9iW`Hx<8LeA+E7-GFbYzsxWLzLwHA5F7+ zfB3eoU$a3*LS&>u7o@}ocH=PO;dRz~x;XP_+aMkA4m!7+{q3jI#6j3>ldco;Ey5x2 zbKtlxw!U134n(|zczDVcgY4PAE))iu;JOf#lrQj^3mp29A;5r0uR*zX(j|SB=es(1 zZnSg$Z>Vz~t`OIFvbYav7j^2=Pkr4oZc4sWZiBG$Ze0s(eOjt+bVb1I-p!FM2*UA2 zg!utt2;qr?2e+^soFLf1k%jm!dSn7J$6*D69DjtN(+{EC2Xe|y_g#10 z^&LaHXZCuBQeL5X$F(20{v9>?c3@i6e#(0jW22CYr9WLnP&paQ$`HJJ%z`Fo;AD=>i8G;YrC!-aZZ& zh@sIx^d*N+2zltHVyr0#A`*vAM9@yuxaaBMO&uXdQ8)UC@hs?4;D-VZ@r--uSH>gs z8T}LdLFzdO1uj0uk90xj9DU2YAU=fT!1+M^DWABs3DF@q-Dp1t2*#0qW6rLtSm#6o z>KBM&%(wjfJSVUbmxDCfNoUu zi(Y;8)h>3-{zG2q`g{86r+tru_=oOLF0+Uq+Q1$GJc&B$z`BJ91fh_!AhNTLfxEz1 z2z-=*V{QNR`k%IPH6zjq0f-AB+K<`;;AB=-_O{`c@+5z_{ul#bMUnRY?CebWYwwR% zwB?;XV6Lx|!M7)WH`^t}s@FBU{&>{1V6g3kiw4+3(w{u#sg-u{$9p>`tgk2K0S?Ey zNzhuz%8%`-aN7R<>+f2>;klNhb1r9TE;+LcQtY@3``gohp6^UET=>!tNK~K((*P+3+mQ^qYK<3@ZWwmP5L(*?ejMu;P@D2`MFo+^9*aYjpprEFXktgpv(`{ zPB0I-h)NMRCVLb*lEG8BsDdjVciyMZa{?L{pop9Uhr>l%fbF3X;7bs)fAE8=eZMFy zEV4nuAIUg%o5aAgNo6zb|b2dH`ez3NlFJw)!`Om(?t{ zTi)trT~ZO1snt9HfsOqEi~u_9{J|f)}IJS*fx$760jLDP5#E-#tGWQgfOVT;S*(H_dVojV24f93AcBO(U<>e0+&i)yOgz63X@M;b^23oX2D4&{ zsu3#*hcDiNl^FH_#sc>?!z@qU`s1)zUzCRfPE%A!7qfhx>@XMoDgkx_3pc;V+QaPS zzz2*5hEg9a*!eBCpa}bf*V*?0FU@uOB`Y46EWt(V>iwv~cs9riJ8+nGc|AjZO6srr z*%TTQGVAD5IzSUsWMzJ3u`PLcur;Pu+ocyx^4sET#U2w~jr1|$qW@SYZPxe*(_~V-=x9=RlAcRC6VWIxvopJ-xOx*QV zBFLslOuL0+k@kf+r1gDVWk%~wI`Sh7obJxM?y*&S7;%VX&6>B^ZvM%4 zZQy|Z9>UE$hdateXCwU>@(<;~#R8HH7Ylt$pMbz~Ll0L89A1ne<3JkHQz!Z)+6D@w zf1=|>A2Ti?Z77oi1ZlnhBjZjR`Qz}63w;^J7{ebB_sJ*fh{qrO8JyQGNpV}&7WF1P zJjsLn2*;oF)f)dawLi?akRS5`zc6-`5!%jsG*7-e(^0Qg5~)RpQ%7Aq{vTgI`kyhT z4u8&HRXplUofu=< z7q}p|R?m&PHAh5vo|a~IpR=`(b$U2h*b;!wNw zcYm^(^A_6W7fYw=F%!HmfIrMd<|K2PIZmI4F{W?fz=L27aWD|+fJ2;@5i^7vn*EBo zfIn%&y!Y`_NnySNFLA&(9P!w*NEd}6__NN~vq(!l!hE1y;7Zt20$d@SbhuC+@6>@f z`~?^GLds@;A}wo>Z;Ub^Vhn*Ww1X#oMf+P}tMUu)Azz-M?-q))_xhV|wc5IRJ5$`4 z!-fpBn{WSvee?1!*nggW&YphZ73*8v!>;|_x4pj28=LIb$)B*s4ds@ckgE9{lU$4C z2@ZudV8LXq5iUSElfo$rv5hsPCiov+zev1&k{!EBs@9sta4KC2%xn zOlet%v;)rEM3u#5sX9gs{SM)b`55+Y#xBf}KxhkbnPY@8AMp$G27l5MKg?O?Ni+`iAn%ZWs8?7+ zVcrr>x-eHleqjwzKI1@q-kE1y>_McSFkynHMf?{|MYzwY8+8eeJ%cjBUJFNTJkG@) z18zZ?#0_-`d4&F<9ynkDcnAbk;>NcjqziE&Om>8}6HV9FJAFf4A=D;^%Cr@6Z}MYu z;I`FX;%zI=-qbIlE%eUX262aIZnB~C%{)b)zE4+v@D~Sfq9!X&@W~xr>v3YAu@5qk zOVA-k^sLQs6O*kxJS5dD6y&&pk zd66Z^76Fk}W@$?)bno4yP1Cg5qyO*c_r51Qefy@1judj*ywCHTz0dFbCN4#FB7B=9 zL-0yLfuPPJj~mj3O*=)pr)2S1OU~nZ2JgV1Xg|@sXkYAWa})F2*L)7wbn)rd`K!;I zS7rBP%y)a6&B-;*|U6L&GdAP#~*&j4uhPMnZu6o@1&0KdE^<_}OCfag@suXvn*1aXhJU-Uh2l!Y>* zVF3tDEGxwAE*(};7vkd=t!wl>8h>Bky?l*U^g@bXs29|GI8-Q?i!=VXe*OEou?x}x zIO7P5)-SZd$53TN$BVe6P3%+h371{oLms?yk>w8;>K6?MQJc)s=ln%oG+lH|qW;nR zh=akIs0(!nNabkQ4*A64v}pK#ecyQj?p5~Dy3(f5|BM?Kt#H{QEIPg*udw=#i}oSk z$;OH}(Y%tyA?-WGF)W;A&21^V+{a*g_E)Fj=&3uZIxf~)b*=g^_RjuITH!!!yW;q} zIL3va@OS?qE&+OyHY;_z<)rF@9`n+#ocujX$Ty^kg&x+wv@7bETkiC1e~(5;cn|wK zarxuY&y&3jBOlSZNmAAXhM(|nUmxmt(uDQHd(=hGqOf+7?RTuHXxxwo`Gq|*>@}e* z;zZYCG!6S|*w2GMaYNbUg@b#UcAt0NdHx;hPh7a9qApr))IaGv-4O2!@(lUz6j#+C zT1`u;)`)fz&3A`CMn24c-F2Z&@+bOmENi8u74c%?A9|3d`)glf{U~i%BLsrn zOBE6k`dC{CBY!1wLKyy9XXN4elRPta7Y^{4ml?{B$IDL_0ZoZWbEq8S#$R;o!@S`c z_Fn229h0bkbRI_IkS1CF_(vUaaN*34=7)cD9zke=;}9v2sZ*yC?Dc}X4<)1|ckOB3g*Z@iV-!#L8DJ2o4S77unLpWe5- zOaT|>*hP%s#JFC-WKmW=SFQNXmeF0Y+hn)|(&A1owjIXuh`q<6MBnkz_;Tr@e2s6c zc06(MxXb|o>QGTKQtNEy+QIhZ>OyfoifV;5*>`|TYz2EFz%mF6pO1<_``?a(f<+g{ zIE3C#PKRgO#6I5RRzwmq7Ez|By&V&u;wm_{R+HBtQ0jfWH2xvYPO(+5G>s`bMOdsM z-A?iL!h?FDtHgn)T~%@~^4zPaOz}v6ca#>Ouc|4}E*!kY#+EL$`sQo_Q$T=pg@AJd zDF`jo2 zRQ+$~df7434qqLf(@84cVcZ>ZjD74)+$70&@(S?9uJYYgSYn2I6E`t!hu`Y6K;;gw zS%-0x1W+gbm<0ghTzmt(7V0~C)M!_bA59*@qJF%`*58i49mU--R>xm&H+{!B?|DdP zsDsyb=LNXujYx8Ga5J1FY!AX_i%mZT$8$1n^e+hrw)Eq z(j?-l5yG@Zgf7C;QUxcwBC;@mY<96TFGcr&rWTNfLb~d&xm8?~X)Rhyu{g1KiYsY| ztn_-DS255YT-M8qGFsZf( zb>!U^RFQ96=5Zb1DDYHGmZ_)QyZVd8U>mkuE z7C+|ezq)s}wu#$aWvIzoSCXJp{k%WK5YyZYAx!?lI{G=UlF5IkeA=^&t;Y0j&Gx{8 zQMPiM3}dR^i8X4Eeh6N|Scm6u7&Bz{NZ z9?17Y#sLTmBFda$HD=QDgasO%2mp~_P<=7PFObp2j6a*lv(G;3R%2izCOjI44ef>J zUvO%}4}S0i&mTXi5z&b=d-iNs_y~(9a@*(&fi*Ie&A^0wdB^NC${$f+47+E*dZV)d zJtHU^MjoDcBuTx3%`(W7ip)dZoOsX6y6n*pEiZFh#bMBm?XybN%p)&a2?(g&%?+>XIgXr7IRxT5V&djg)Ra#sxig zuTNiVL&p?bp$r$HD=+LtiF=`1MB{ufYHO-f+8WEqE!nX(v>)eD`3dhyp7AhG!cRPU z7--$gVy^uq{+;OUX+vZJE4YAWXJ=`8Q5a`Ma)&q)%9v4M!rH**&HpnuG1=Vnl!QWN_uwsVCTzPfv4EEXLw# ziD3B4E>{U0HHS)eSn0suZ6kj;}%~BVZXzVHA5UYhoW)Fn{WO?9{AyQHP11G z0B0d$k6~Yor8+Rb)GcsV@lJi;mSfH-1LhF@$#?(qo}J;(2+`c;n(Na1V;6 z_LQBxZSmL#{1N&VV=suZ2G}GN9Oh#9W*(9zq{E*$AzsvfS95l&V76v)@kLd*gfjNz zN#2PZf}{)UY)|rdr^Gqv9DrevK>&X2V;^%R%g8meu?6<%un~qyKxZ>af(!o0L^Jtt zVIqY%JW=ilOEK|pk#bZ3j8jfI#W%Vz*jQoW5^&Br=NJ~m(1$pG{`_`U5*>%QP*4Ae|AhAQ8EsQE&cS{Mwbmkv-mhL7Wj}vkvwh+A5jJ3W z_ZSxs`wZdY=z*)pbtAxYtp8k;(}j?D@}c!McWHxN{v}ymk{&D9aiBC|?`3o50*!tJ zE@r%Y9Oa>*@qE-7v3KpQ&9ZjHa1%$-9n>HV`QaxoFQ0GffbOiHUb@Jx{6)DH%X%g0 zLmgaigQ9N{lH*rrEwrm19pTDXtB5@M))VXg`)K zV}(pR*tR^F%3l*5MOx8%&e*QM&pSPu|ga z;r$=)1NxbBs@Tm)3*V>kf2D|6y3+>bY zeT0tz^OrRN0+2b5l|9}aP-cu27Mt%N>$EsDFcmALze-AqeT+12tSelw=GSjnck4A! ziry6 z%(_Cm?)M`tLlga@Uo7{2tdrIAU%tOdd*LYSJ2=nV1p*gGec2BfH;{)o)(zi_Uazsg z{B47jZV#8v7wJD$SS*G|>-tIP0s5yvVl3%<$^Dm*jenwlbM_lDIwE3TRrMBoW%^9% zmZ@vMSVhx>a~K_4=zhW21D7h4lVcGVh0clRH)#^#jAVY46VCQ%{OJ3h`g zj`ixFZRM2(cKr|M+SX%_aF~QJ&NAS^W?&Va?Rf$vdld*a*e(yop2|8_~D0rEf7v01Q+%jzS%Dc!wN9^*U()?p3ykO>u8=+ zJn5tP6F=x<4QY8ENJsghFB0prujP_oR#t{BS-Q;6eqhR1UY%uY)~>fqA!l`S+aYVj zaJviUxMSf!`}H5pHr<_JpZs}$+qAaHJ~eE)ee92AHhf&Z!*kpvfoa2i71)ov62nBU zSmvc~xd#V8FP0`o@ZVO`Z2x`c>vq(C47BkR^X>cJTZf(k`{B=r+x*#E?2a$C+Q)uf zW?%eir4{wgvCBR;$n){>+M(7ve^5Rmz=w+aFN`CGEHM570x)qtM#s40xw$i3MQb~X zKkd2aygZDtg*ZF+&aQourDLANZ(F-g{0<5|=p2AyLNEXTdjJ4n?SuQ<-~Q$bq5=Nk zq(e>|u0RlP0GZ2|FL$a52s8=bM#3GatE(C0nAP1pRV)hwpN0@2Hee(Z((n|Z3dcGhqL1eC8 zz1pcdSgd2Cr;ewddaBnuv_F);zn_Vl-JaynMxt%mdS)?#cTTHqUAW1XzrNWw zzq&2WHsQ>E)<>2gtJl}r>#~Yev#G(#WIeKvF2`G*S!&tKx7xa6Gp)E^j?I0sQd~c+ zR?s`!5gH{*S2nJPOr+P?szqBJdGy*7>wM#^RJy_Ad-|n%>8y=1fnID!yr-8V7T$Pj zgRNO8Wt-hIZ1TAS90+;i-y57`Z%bvpBN&c4t<)AMUB5LeY~Fn>iZ{>^7c(DQD+TmT zRywr6MxD^h=1p5|MYhHkJOH;qNWYk7Q_dS`jhh>6dmkx*)jXX3=sH`oXp3d%W!S_s zO0B3*w!N;h;hx&ISsYZda6JCK;+_*llLLUwzcV`w7Hn8vYyY}=gUw;{4D zwY{yIRj#b{F`2FQfjAv7D&P8uo9xB=SIa<4vyGTsVk4#$d)RFCOT`K)yw6wvpWV+Y zl=ith*4W0iTiwDHmYZja+iaOEoOYMx)T1>=3Q7)-K02u5#{!Ex*5}C|A7B$s@9V%a zQ)ydulRb9hQX4z9MAlaG?CCpK*szI3R=>5y$FW|96t-41Y7UmldTb9}aJ63f(>O1D zX`{jA3GgxYq~3-F?0Ok-+FqT0eB9D z6EBrzONY^<5@EvChb1{6B-^Y(P~xa@ZPrVBVb82qo3DOeJiXG93rD=Cj~g-CQrTdy ztN*rYFB~ws(D%5C=U3XWV2Dl`)>Wp?-+w&* zv?G^u1vlJ$$GukCtEa;W(YT>po}9;6t3w|VdYG`{23H2e$!XK3xkW^%#UH-#!!~5- z5Jyr03m~z8HBpFu0KafjtXsFvPCxy0CpC&Zcu@-5Al`B`aBg3Ng?=|U1L%CZj!vF zz(({F@DYEbMvii8yjbc5mIB5rFE6+I@4w&s3z!Vcf>8f~=N^3ULGKs(6yht&xiK7q zWj!Q1F1h3qmjVH~3)}~>_s%=-^zneu3w%Zy)Pa5`Pb_ib@JAX17?pZb2Nc(HX-{^6 zNZ!IO-()=i;+=~l<4hl~UAxu^@5BYhzxCEz9YMl9fOQ7^&v*gPpCST0$YRzk;|e?u z*C^w~_zoR1)YmQsW8gMI8K%9<4GGx4znXjn1<9FK)C&oNIz5MjhAN zh6?WJr!%kE&%G8KI=aQr#O8)(oAJOJSxv3AK0^xZNEz+R$W0aZl$bDH*yu3#xT(El z={?)e`vtFVw4%N_HcD3Nfus8l?QXTYN4)aL8r!y|(TYoR1TXeA2yJtot8fJ2##Oa8 z{OFzze?kcLts~jwIpltvCNM0d*j@Mi!*X+Ephs;iyE7Ff zgDq3k=EgN!tz`OQyZo-Bt(WdV)T^%q)8^c>(8iRHwpssNXA{rr>qzXyGb$xPChM_B z7TU}Q*V-mAR`eW@XGfjZSN)k{Gagy%cf;m}7CZKWL6Sy`F}o~!ezl$Q;cj;B=LTA4 zUYe}Q=h(x)o@*H*OcpiQ*;j5Xx6vo|va*30_J1FJ)w+MS)VXl?6lMf=>Ik+uSYyhW zjLu$k>v6UM11wv%%n5jKx^kv6=g&X?d_TjnE)D#Ib!z4z5*Of1n6nt)U@f5kmpO~& zV9s6kX67->Rkz=MyRQp$HnX=AZ*TYOWOMMHj{Hl8;Os`n9SX;$1LXrT4-R`aJ2os3 zZlC`2ryUsn&2N5Vg9ZGpTffeMJ^*oma}ag_cp%*HV=|G3cYpB)->6DztY&s?0iAbEPLp>g;pq}=aDCu+C$ea5kf)DKtSWoup*1%7Oj(Z-!1<=)02J-&!siuv2mN#t z&=3xjSlg2{jxLEiDCAGww$7frd!?Ss?1lSR`FNE|+~yzGFSa)X49|UjqXW{*->9}b ze=^VdsNW03wfV#?OB`S(53G`{UA)z<|Ib<0Ux+mjhkw5EH6g5wvg~6CiS$Xv#M>O0DTb7fl4}PbPp>TnCl2k>UrO9=lQxBD#ZRR z-+aTCzFw_-TI_E>TOh=9cPklyWw6jY2mcB91jj_1&ZF7SZnWps{^uW9YcC7)t!pe*W=UR<)tgp8V@dtJ>6JKfZ9I)X}{d(v~Q=}gOqk(M?JEvJPXeCVgdh!0{pR3+`mt+*nTAc#JJHi zn{|i<5nx~d-~Xm5-wzL4T7LUlHpH(`jdyj*#VLQ0Qln{ z|F~b~KwR(+i~&LdSOUZ%2th7z0LWke`q#ZWzz%SBK)eLLx%~3W?f4Up_Y0aMsx%in zw^J``KWumH?-9TDz_(t4#XfwFJN`K5a^WHjEC!+n1S*$@k9_1JU7&^-#9olCa0!kc zJ=$S9)VzQkVl23DaDjN_;YS?CgnI^96NdtNkg4Pk(hmgFgb5SuyWjn;hjZbk-+>d! zAGi;Ajd_7Th+5pf!dag9o$|BmVclgb5$*ok*S_W#$D3}t$zgI}clw(3GJN=OSGB|1 zV62%3U;N@1{eA#~?h+w(8Alu{dALu!^zutCPP}T>s&-g^qT6w zs%W%pKRZ*>LV`caa_!l>R=M=eu%nAbV9Xcn93v#Z^x$egpa2Kl%9MZw_U_%=_e~Ir+1Zj53F07;hDPtm(RZRGeurco`G@cW z@{D&kW#{GQh~QW3#c=iq#89$wnO`gBZM8usim)x%d7IV->U4S!$+zll7_~{UH(%PU zIp3f?qs{LB?NZAWBgBj+HrVoo+icwX2H1j`LSntP*-`}O-S*=Jwth{6-$4;u0|C!{ z`i&Q=ZNT_mmMWm&d-1*QCjui4d-3AMW?k`n4TXipf?WqczeC1%Ry|lf88I!f` zVEYB`R5)7y>%ac19goAl3X*T?)Ts_HG2i&(+y#-x9uHooRxlBSQjpabUv#m3%v{28%J_AHU#e)hD#~{Em+<>G(1Q;q|-@bjFG7sRv zW(ndCN7(?6P!T~wqPwq5W#WRB8sY*-0Av7UBCf(E0pOD-z$u$53xQ2%ki=gAB(Yfc zsZV{%^9p)}KuE&b$m9ml0Z=8~!KT7^rIP#rv$L4sg8AqVMjBK-4)+@_n{CHSlyuCA zB@!)NZlyzVZIqA(eI;(Va_$yg`g4Rt$`WOy&W`_ZslDf-fsWY7E0lf=u}5>5!|I8E~lkPRBs!{7p3^lG(Dy?BrnmSzhHk}Gb(G}Q?`k6UcRN^zzACX7prVEMqp{ru;EFGF>SHJgJJM;5HEmKIs6D}NJV@@a$5l{&sI1UKCV?NMV+{OANtlXn<$Qj1|cu!JYDG=ki(>d@uB}&V*Q5a2~pb9^)ha)YIePcCE|WWx9AQ| z1}{VziFx_E1}$tPF1n`D5T!~{Je<@rn5-0g6mjo{sIkDV-<^6u;~pidHS2`c2XUaOQ#30ND*EEQnPQ<6QRO41}N$(i~(ih&sjv#0Hl?9OE@-&K!sBQQHHD z-*eNRb51~z9o!W_(&I>j*d*%^1To``+95bjKLiKq^lfYG#E+B; z=_mCgMQM@_Snp^3hrT(?;c`SFAui_%?kEx$V3DK+kOtbgdYi|Cpj;*H!81QST(EnA zW&a}0UU_u2752)p<1g$ZLUUisl>TDiZ1e{9=$)m#oJvr4RYWQxM5T+pQ!&oQ;JPWE zh*kc_I{+`~qVFN@etsg^5F7|S)KKioF{eQKU48Y{#-5&|`|1PYVrCyY{`liv^#nws z+y8pIpDE?#<$i}n+z|&ciaRFEF030=SD?R-wBP&Q_ngS|{qKL@_d4#j%x91$+-+YT|J`x+GYfX*nB&Y#M0Nwh znKm@mxA;6h@uL1V?}bg4BiJ=d@H+GPv746auA41RSeRPcY}xE8N#zvU1TUCa(MpDwAKdCzaM&;4e+hXW21?{IWu#*A?yCiC;s zOD}DgZus$!f9&&~KDg?ts~k?EeZW_Xg(PJDa?Z}1KhNPH))I*C9|$f(Ed=i9$w!O8 zTkOa~h(N$ujCq&a_Z~RtBEX@lY!U##V1q&8MID2W1279N`VO*?G$7630t_1u)I*SV zY@kd)`~#woO)nXe4VKfde)X#kY=c+?5CPZ#8A%;+Avk2alj*U_O$sOjh;V|}5kqd-c5>5fsyf%MC> z)$?oYCm(!8BBqmd$=5|$yH;oiy2Ef>q*10%7>EwU5}iv*`G9O-(`^xVS-OyIY?RGH zu%T-KeF|*Oy$9#Ea|xaBp@E(!=>cG<6D~ay#lmeae(3p0kI9pNkw|j)n0Vqci7}Ig zI8CDDIHE%BgmcT&s~)biL5&M}YWsBniS`l(;>@G#d$*^G=Xz*3;n4KK!6`L1ci0n-pEAkTS5!Iy zV@P?Kz4rQ>yQ~89`slO!I2WD+9U6m1i5BSL>xIOPbpl>uML1Owgsme~6-Js^{{u{< zII!X30?HS_gY`qbx@if51V${EH0bdAw&iX?Ck1O^qzE9r2IV+c1AE~& z@0t|rYsK-saEEqjf7vMR<6?b#`^H zw$?3$?w?vvt&Lch3r7_0dE2^T?z#sUCxFQ>fBDPKiNQGza$vc{5TQ_`j}F9KIMdM$ z2+lKmfwo2JsRHECaj( zjDQ2t6kLEa_-2g-SSEybs;8zgdzQmNdZDhgsUwvn0al=2qwpV+8(dm}t3c+`2Z(nf zz6KH%q#p>M5hF%8f(ST@JcvtqlpFf3p`qTTIp}M+WViq$A`BPI(?awz9v})y1BV%9 z0;fSR4h{k@V#dsga1rtSj>f**9sBG)I*@cA)*2WQAPzxho^)(2!QoV<)BbBl2fF3b(SL7`dD()hrpd^tBq7>Ojha^LFkFf&+VHSzeFyx6U=4*NwHY zb1O#7Q%jWz=RH$BO=mhPJ&;By7B?Zr#umJ?N#ecr4x6wh{GaB8BksKK$U}+s=P%{}&KkTU>DOq>C zvrgF?!@dV%p7jBN21gw7Vt)qd$hrz~<5?b($F8;~;L*M!+}`=)c~X5d$V#Qkig~|D zDy~+)*6i;{)yxvd-|VL=MEvdJYL2Q_HA#h)?!Y3ZqY@`W9DBgXtOuXNf_2@+&%^#B zyNjV>iyd`xAHN$RRWzsg&>YO>xDE}v<)A8B~u2zY=Kzw))NuTXYq0AxX0}kXg zbAdU=J8K*VTtGZr*qfO*%v+w|USOhvnX0U;%<}-(62<#4X2b;_!<_DNZ@&i)x(F~E z1CA$D@H<4Ag}M$!0`58vd?DE$)LFzbz!6D^{-X^1w_3kh8IciAVqxVKB)|J~q5CkpbkHjMVL0-};u9!=$E;P*KnW z1o9Hy429YV$(wLCURbV~#IU!*Q3yvOKnh{7djo_3z*6tduu;+v94TCa-*|e90|^a6 zLLjP_q5u}&Jh3uU*XLz{bm4ULd*zZ$2YRb?<7L?6H?ELKVvPd>l@gg_m`OY0m?C@b zZ!29X@NHMklL#Xw*0;xW(Fqs<@vvc8t&nfL>kwH`t3ykhvvia_^VbSzn_e<=vpD@E zf~(DB<(#d4K?k5n@H=!mBsL5E@Wyr<~Kr#-VmIcv<3x0&zG? z2NYr%xMC@X#>m5F8MBytPN}_oe}($F(N@meA~EUB4lu@-cqi|reXpLc6*ZD}o^b3G z8!>dSl@A(dCmuIN^CegwBUaq8<;Au=2NwQy%L<>X=)-~f2jY2#=I*9-GNkjTiT3M{ z&JrhWy^OVF*aN>_VlVuCl|6p5IL(g8a24DM;UV1B=gZSpdqPY%IZ?o1!qbR~qh3N~#omngBMSA#m%Vd3dg*~fv zRJBx`o)Vo$jC;W=RaPRZFFPpf2B7Z6yDD6T07zTkSyM%2UMDV#rTvA(lS+vhA=f-u{U1u`|uYk0` z0n{RK0JjmyB%~UE54OlK34klyO28;^F@bpG;s^WzXHvN6A@cHDaj?O;0b&9KB6aPY zE~bpWQ5=fv#c5UFAR{cg&{hgQ>&5|}#L=%fF0ix_{fDT0L9~bVg6x4Cfc^rWf@^@j z1f~K8W4!(<4z54^;SYAl9e2beDFnb=fBp52AOt}Rv6YJjmtu4UU3uk|J{IIjpEE{` zCCFZ^EQ5%oKH-8w{eas*R)GixQQYPBPYpbw_?$I!i^P7hA`Oy-G3K7Z7;}#R=>lgUNPRAr zAQk!M{cv|IJCJSt#fg8;73KElugrD{0mO0tC^!(JJ)*k*zEx_E?pk5b+_7Bhdm6>X zp6f6G#6-@%S&wgYiGoxAV}Q+kY=axNn)$?f+bmdRw3q=N`Jd%dr?bLdmJYPP{cN7Y z+IbRleEiQVZOKf|&o(y-k|C}qq;~GPX1?nd{{3fXxtb6VCoA5l@$RP16)Wrg9F4&R z5ILKyVaZ@?t(EkG{Otbv5;82xF?a|DH|%#HFW}tc4hVufa1^ueBN@h>H7_^M@3Rm>n8%2|a~H+s zch7es2=kQvjWF)K-~RTuosfhWJ=}#zmtimjj&$z0aI?c{4yQV61|%K#UXXbK(HQE8 z`YYBXbtOLcbU3I3QW37)uoj?;AJRQ@1Y{(S5W1{a5o=u)*Y`~aYe!DA8ctK(1&RPB!P;NWIc0U)C+1~@}l zVi0Fg!2#-+0Blqo#)x`=MP@QEK>*@-2O$TL09F}GzW{RpYHXg=<2&E^jsph(dV>ZI za$uo<{{fCb0{O?r8ytW)06LS8`cW_bpl(2!WP>DcHek{Lbg;Q@Siiy8Y)_FwVyG)n zn5hf-&<-Xk3c;xln>$oR($ml3k2<`aJ`ZgOPZl2iL;vD-mp9>c&0B5ydL0Ow52?;*2<2;;#~ID3v%eiiz_OpDY$9h}xPXPD1pA zQ9r~f^%47{gAb6?43z!|aj~Y!a#ZR2_qdc+nXR9`_6{{0ZirMHd{ht1k}}#g^Q$di zMmo;DLi1DOvt9F~r`Xv+VmM$nI$wy{Myp;|XCo!bh_M$R8})BZWt|P5SS;}l>DJP? z5Z0!30$Y4PiCPaFohOkE8Bh`DA39$U4Q|stRa5I7=rl5^&DK~|Y+IK=X>PM)CQWob zLhNgU1`cowm>V}&+muO1+K}=x?}N?t8|<~p8!Rtw$$0)*NBv=0aff%OlgGgt>c z`u(NWPn5+zLo$8MY?7XxzET>D*mb6md6O}+BCC4263Z!8notd@!yHU=~x~LX{k9{J#E{0Al@Hnxxt97Au&$<{nIkqnPNCg08 zBhJs-z``)&%n@k$J8% zKuh#(yOfkPYie6$lS{9%taR;tszalSQ$$tvofvdpwWS|{o=wbLzRt4_3M z@KFW67qSN)d2)$u6So7LvuFP2V6~5ZDpQE@dKpHlwbQj14jh&5d)VOdQg|*SDX1mD zz(h)FosfAWExq4*U08Chc~z0+9sjB|ukI}_K$VqUtBcDZ%NQubJj(`(OHhdP9yQV- zDC@Yz60u$-D~iPp(jy}Zewz@1baa>VF-}QswPtZoZdp*Q{?U3$;Pe0n*j86>!-tgF zxUplr*MK)T>$wEsINyOMfHhbfoQwJS1+Fs*0weGRB8i;u{DCy$(uBS~kbWQymkWsm zLg7b0`jNvE0J^{iT+)CEFj9ejJK|CnVp{;kz&Ri&s0&ChU=a{qz#m-NfIlEif}{YZ z2wWGtJKMcs2l$6N(2p};d)?NF3tF9L|9bj)!C}odXYN9q^X7bASo5s1s@l$c?|ak_ zg+pzJVBw0S*Yne1BY=l^dnQjd}oI!6^tw zAN>U!38x@q0G!BpASR5MC-53&p%V)!4G>3&`f?#=4uD+Z9S6Ml#1l{0+2@>XlaHS4 z^Mg6n<)kmVu675G)!p?8a|Ku!_>}&KfDSU3F<_h^y0Z>|yMgyXh$AA*8e`1DS_6J& z3_#$ruDB=Qkf>q(uwG#Z07=2Pvv!$FtRKGNG9?Y%xOtkNWrM`IFT@30P9WyF$H0Zv z5%PL>?c87C%xmBZ+RJ*u?P}d~!AlVqZC%Y0TTp$Q;Kvb4AU)f|k9+Luhh-lzS)a)%jE69eo3_uw$W2B_BIOb5omkY8UJOhAk`Pdd@Y zpT@b^;BfqL=l2(9p}2l@b`BX|U=3TFTvv3d&Q)NF0VDDSL#JEamIgcN!~I>4FtAEL zsonu@=U6M0VLo8ftXxTjrHC7DTMuho(9g0*FSF+LGW3$uY+0k{TjSz^mfpKc9D!LL zC%t!trKsN7qhGV8C1sZ0N2+V`>#T8pA4@Nlp0+fICvW%QjKO~mRYkUKsq~Hu{!2V> z*e|NK)Yy~><7~*_a)!+3JoD8#qVz;0ojs4Z;k@B}>eQ)LUS95Vn=^uM_A%A~YlVG` zIm(&B8OD<}!#M&&3HN69Q`QN47#w-rTOlT~-q<(s0WkX zF^qPr&ZKOuol~ct=xc{{{pz~E$-mxJ_moKoUqR1wTRl&b7tO79))$5fjuQvC!+^3D zEZA@SdrMr;Hup&wD{>1`wGOuGewgdCW##*HPf?yo+IZe|6sUoDY~1tF0{#gzGAr^|%%UCd|08{`wyK8d@-&niWuA9}*dSsk!b*bV$!=N3<+{D}{j5XeP1_)s(q^&?a7 zZ~(R{46Z%SY{nK&LntaPI;b$j^vHuSl(!=K2;kDJFkBFYRItaTEb0+B`k;VP22@VU zr!CYKCCN~SLOtMeA};At)xQ8N2ii$sLI{nGR+4qReQNyg_qe!bjo)>zo~xk|)wC5v zK}=j4BOaMPJ`%xDn-Rxmd>LoPi*Lr1{-wVebNbCq+s8}yu~z(U>Z5cac3L!6a5ymr z%mwc|adD<;5-7Wab$;z}-|UZw+eJlA%c!&J#lvjPAXFqADojTQvU9xeu-7@be>zVNZtJ_{5JKz;UA2XlOE$Qn){mb0< zxu-t8@z+bmU6^I>{m204c4e%XkIdI5_5F5@K`P=i$|F^M4h532W86>xPQJTb7b=VV z-dY!$3z`Q>*M-J5x;}kfFpq>JW*!Aco5+uF>cg5O4)X`cS_OH}dTMOYyi8RbkfE{Q zefsT|l4)C;|6!L+sIVT{5>?T^aM&fwaJwct7o`X1{np;te6?kyOtrRj5r5+KBQ5he zIws6{+QuJa#C{Ui4VCxxp|;_CKhd+BsGrJ4iJGi-`q7qi)Ld)XBx6IB68)L*vXFw( z`62{Xdaw0X|KbIyv2jKe3O?LL_Q|;pyf7pXSKs7XqSX5XPjk-@T zP_lDAoUI}A=y&uzg!7F0`)be-C&Dy|@uKMu_Is!=Fx`!}+-5J&nqxikV`9w!@d19J z{}(J>Y1jVjyRyzY*sF=*1%P`llgS);c{QDW$&{h!5g(Lb#a&tcw1+!&Uc3sbUw3F2K6?) z2lycd569GbaF)kZ=fvPamL_K-a0c-m)(`;V=b~T|&P5P___K;pJpxP-g(*D`6$o4k zJPC}#yBg@Kfl}1oRGqOY+S{8e`->aCzvUkDhSkp)X&FO>)Gb|UHBU^j>?2oL+g9lc ztj)FDNiPc#C?kX~iV;5Mryv?f2+f$(t;J?j_huXR)gn$(M zmw4Ww190(*)pq%3J}&t0WFIQHme>zFVvtE3*TiqnL_dlCiQmLa=GT#bG;UZk?A>rw z!{h=dAoocSmgwaK`2v#tnP;E1b48qDUxeEhPA?FRAQsR`2tfYqmek_^>s%ZL+3TA&(V_xr(6=)<&A&i*(l%Y|*0m zoh`yU^Eu2<_88#8Fo$DzsQA59YbxBKLffe)^P4=lGr`0HT#i&7_gmm#9QkR=TY9Uc z?)W%JE;S|Fs+u0QOOIM*C3!ODsItR8nyd;TJaFvo38FWoA-~5Sdt3;1(^sUmAm>OaUBgLgN|dvWHSPj43)gB ztjs3_VWh<$7bXdQ`~^q);1}MB%jD)exKKvak1&967OB6-7X@iUo?($h^9yw$4f%z( zcqVbb@E(0e^CZ8JcQnp{dyln|9vPe`u{`<^xIEsKDcNc>9~zbv`Fj@=7TdQhMGA&P zxCQ;U3Qx(5Z*1|j9zUMW)6loN%W~QFeum&j|KiVkj^4v~l8&=GgokwTaL_?Z0GqW+px|=Qm zne?GzX?(3C|<$N4@=TmvRDJ|c)Jwq2T0eOfY0clbx8UJXjRi?_X zwID5s}3M#FVZEuaAS&{N~*|v884aIpRh8l=da|5#J%dXg>tMkU#MV$De#S!{Flb_qc!P zL;RAZ4}PHzJ#^tkJhcn?7kWAJj1GOodrx0OUx%>>W5XCm=LG&CZWx!4hIrAt0A)wx zhq~bBa|7a!{v}I?AMwchaCX!lWI~Q$g8_Nc(Z|`Nwuw&0!yV^7jy6YKJ3N3VQGojk zVr$9I!&p{+7YP06>B%O*+2QOYy~^}FlEIXO;V8qyHFg>w&dkb|Ohbbx9Cl=rlBV;q zhX`ZM5bL!s>o|mSzG-zIan7&OS=vitznPYI!t+)?XM$92^s%%OxPxPPcscvwXUE>! z`wW@K(YZ$s%s2c9V=jm9Fg85HybSS(lQ_@u3u(zKyoWr)8uBt(1-i%tKk~wHALb8- zA6$MoI0xabMMYOXad4rQ0ks&pIl0cki^woswUia=?FkR`&pr$Y^NBSvKzF1J8C**f ztd>(KB()IObx4Z~!IvS!huNB+H8DXl!DggVSafbvw&M6Y0KkvGd&J03=#Lb^yBZct z5uMD_u=e!dlcuWs>AbJeITY|I)HcjP=3($Z^2l-G798P?iKe5E zLO=0j?j_D|5=G}J`G#-LuP@;Jt**c>Gky0&$$_1lmNwiUlur;=|(i5B;W6n6>RepBq(e~t; z9#%{rIp`+15Ux(REjj!;XSeNJzo;#-wX3Ic@b#XgeY6?FV10yW`rxQ(wy{D7nf%fO zFz3hgDDPDM%B2b$Zq_3viMCVtoLOdLk1*-nlC^RH76rvSML8@yUS2uT9$6vFUP6Ag z9ON~{TG`l?V;7IuY{N^Y@Av+iwtSL3v9hQ2%$Ko`EUkwvd6t&HQF;dZS?#P7t#y5t zWtFeChDC!UvLq3vEE%dQsI~feqa5LvUQ(kAk3{OX3OP04Ft7l--+OS^875h39VXB= z*rDT`MVw^ax^*t*#5x8(3Dj-QTVRK9R+Evhbv=V$_+}#r=W`U^2;m`qfLWrIO7u(o zj>hdg?|U-}JJ)(wZH$IR-$O3R{OD)k!$ge4hj2kV|yQ;wHv9oW6lKWV6kN_GqwEhDyG(??|jcT+_45!L_bM?dPKpwnNS?ss?YuH5OPYdMsCD4rdSHgF$A z=SxSvX*n5{;_fqBy;AVDB!7Df=Ek+jZ{=!}PVLzDf&OilO8WKdqysbkBwN>#A%eK0 z8V_`_`z8PA9Ey&8GJo(Q!9~M6n(xs#Asx?XIZ^+v_l|oY*?y8%7Z+RVIN5;-ferDJ zOD?ejt-7@IG}obX(@i(I{({7c2H-0?Nh&KV?3!z?ah78MwZt^kI+|SyKk-+tTxq}i-S6y=fBd5>Ooe4S5dlcNkO%LYEi+fRq$0kELj*c-x?-^jsvzGeZ^kj#oK0P6 zLR`d4K`c6FpW+k8#X$t8t**_q9^(E-TmpCtQSF(Jt(OkTBI_<=F+mi>Gd~P})bg04 z3)GkB7@;3{0zmO>j}wo|a)N-kMItCS{&TF|{H-}wG9uT~+iGpXq#PUb{v#|cE2e8w zohk0I6ubU+Yi-oXEIZ}QBJZ;>Zio}qZf&&>p0>hn`FlTmMWNZ(nqcn&PYqv?ysOIZ_MW`nZKnD$j@KKymFP$(w zY+3a&z6b7M(hhQrd55;G)_##E(c-q&3|aTxVvWmWNM*`8%bvW@S}LS(Y>F)LW#|$k zBwu>3O6fDow48DCt+_&~G*pp{zRPv7kywU+(Qa8n2D<*ggF8;UZ0KPW*wMH$|EEox zX4hVOts8$pm(69DUFJHKPf0r8|Z+m?&N{INyHIJZ;sn4QlT#K)GVbg3k26$iEu zAq7Gxl?=3&4JASVu95yfSzWD_e&GSD#pO3hctKdUB)VB#X*oxWYkQOQUXNTU?!UDn ztf6;zn>Yn^cD6|0D*)-+bdjxnuX2jc_2~OvWpa=rqoRv55uJhPU|X_uiR-)N{NoS( zf;gCRaOfOFui%WCGn^p@eU+V|jU9~@pl)7zn?1I4q&2NAv8V5xYkzzy-%jdXW9NOc zw~aY@T5mz7jYtY|7e&mZk+{Tn{ZNLJ2I)JO5zmCwtEk)4Jm^LS+q@-P_fXO znJr@v^4D~A{V&^UP(-b`G5`TLAC{as+_I(Mwo&>l8pYn0BZ#xER!@l?Z*Q(so@s6< zqDqEEZu!SNKb+eoPa))%ENP(~RpM{H;Ix^5ZE@0ni zsuF-Rt#3`W87s4GLyz9}{?CuLt<_ETtq(7-Gin>{nD=h6K|$S zr(8Ez-i^MII$5X9$<4AK|KAW>o0e@G>$ShsW!a1>S;*6vZj*H~`Z&KRJBGMb@#I^t zam~ra$bsf@cL*l2@n-CDyNj6*LLLABKmbWZK~xh>O27e34yI#HWlJnNU5G&X^k6&6 z&yZ1;HFeV4Q`0>*Z2PGa-Zt$Qh~c;CB9k#tB<2($^Mnjc&EF)1pjbCG2(8=lbx9HF zHx&R=vnr#}G6ybFEi@SXm&kC|=+zQIk;OxaMeUDE%zkQOr^yC=j+rvHg04wtt&P+y zRYZ-f%#59ocL4?f);RIR6Afb@C^^UKA;df^&!Kx5SOa1nO4K>~ffs-$(8Ypt*h3p> zy$p>2uK;5N_=SrU=Q|D^$(-F>lz?d{9~j`>>bL;mI(r{<_WB*F`4dE|_qP1dpW(T; z>ECVff$g|=?43(7Nio{C=4_i@QQ~@N55@VqcXjsT&fx&yfh@rVoT2D6%pSbK)n=r2 z%d*tI8yuc8!e#U+V_1b?D@l!sIF?$t#WISd>reaY_ND^Csx6kPZ)xAt(JJ`nZ947P ze!K|sQ$6>tM+3)FXP)<=Zk&gR`r%~KlAL{QRFaJ1zKOCW) z$LTtEcXGf_ijWxQaG$2boDCWF{ZrT5IaiOdU;nj_t&;`nD=&P>K7I3G>sg%Z_njx_ zxgfd>-emeci4%Kkb+gsiw&?y7Gm3{^Yv5?61TcE83`b_=rixJC;`agWNa$SeF6-Dr z1qcyH9!;^h`63d_e_c(RI1tmF2rVdYFK5?IEk7t8hr^scC>?PS3IVPRI}Ufv4%e6F z``+BK(=v9Wqvb%h4a6USH9&Fzlz;M*pV*u^bNm|xqgaW-Y8S|{PkiDN_Tq~#+QSb& z?2G=&E3b5}y^Alt*pYM`mLUD$pkvee#V>y07J=b3yycc##LE1bxa>~fftnBZUU_-B zQSPIUKI#ZS5Nsd1-~zW=L)lyo;Lrm(ciwsDxiztc3m3^U(lgHe2S6W?av&37l|J&w zBkgNn`Y1eLrE(LRQd?B?o1He-X2V0t6^iy7q?26OWp(Y51fBt5hjnd|9nMTa^QypjtlPI zI5?XMMDW~HRcB4JEA8T|M_TRDjh1&(59zlsd;Xpk_R^o0Tj|j~tb4BvJL3x@Y_qJx z-tncGR(fQ~Bk# z)X2>JQak@!qwV?Y=3B*TiPHDWvQ=|x?Xo|Qx3!BwR=3#fr`EgGtRAu?jNuoM8;6~1 zAN=+g+alv1Y`AR54MLRWi29k#kpk*Almw{rx_r>} zlPToFQ@1U!s+C;QZixX6+LC>&TR=s8Pm!g@r_ywg+qNZ(c&7su7m<}Eghh50O9ml}OQ5U<$ zmTmUt+*OuaDsD@OzQqPVHkv49pS@(YtaTr?W8(N%Km>BegVf_(iycAN zzdXmjeb>=4S|g;Q2(mBVz0RbX&ng$y*pTCT+R2|7Z0nb9v-^JdrVTlv(AK=M&CdHK z>RPtjp9H&)JHL-@n7`GAo=|LOUp~_2KC;@L|MPMibV8A>eSM3)_tIfDc4}{X&{%{`~p#9e76p^iO~KQ)h`r=K&XkuYBbzcGg*E+0TFea|ig3J@(jkK$bd@ z9HgKaM?iY_dovQKb(8<(=xXX$0Cl6^!NYsd#@k;a_g

      P%r4yDC9bVi@i+a{b*YS&#l!^XY0 zp7X{Yy=kRgapPp`UX)>PJXdMk1Z~ZDa-EI)&;Xlyaha{0CvintWm_%e-2>Mxw;w)o zqEo+a|H*7yICHb5}K=Y4gkIQ@$3;p-PV@@dTRCDw09 zft~c>GV9q_2rW^|!rBX!_Va@usLx26NL7;49T zV1Uhew!$92b& zlvO|NZ|%gAw>pipG)IWMs0(`#+zYS0_L>vzjymcne?n+PpD*V#Tz$tMf4svfAow`@ zUwGjK*Mr1GhrEF;uzbjw|C!Hx#$gBiAzDKC``5qzWrGF{vM+!6%gzZHh@H{;@Xq-i zb<{Bmw2^1<1AgipZto{1Z3w!ec5E|w?bru9wlP_FqF>_ojyc2@Qb%P((?;JD^WZxg z-qCxqbips0W>Hd*hh15WbPr3G;Zz^c|HM zVkHYt^h^8>X~T0@;nA?@dq^97M#DRLkH$}YkERJ>JNnT_4&&`%KMOtO84buDYai+L zgmge>>s({ckoQ~LVJK|RpNVM`zZ0?#+Zg4>!MZ&!D-tuLjppaUiOZMvC2>2XOH$_~ zNs@cT)1u}kD=Wk1S1h;tn_sjNS#tmi+nr%iYT^Cdg-^uAWmJKHY2M#S>` zbo=LxOKhbG?EQ!3Tfw*-n|jF*%aSD2pT0WNCausOmyv2c#unIlUmqi+U!~1?VWagQ z)5C82@qGJ#KRLpBm*v^*KY87j=$@9N{92;?H<9YL*SnLwfU5xi5}OwEH*V)Kiuou0 zCX1KMFPbh{c%on8cQifky9$qnMc)(iNX#c1H~O9|UGPg5FNt4#J%U%-BBJR(9)D62 zEl6^4`+Li!#Lw1YLk8Qi$4u6~uX!Jx^NPB|8i*%-3nTVcUI*okg$ck7M;)RvIE-*W zEuTGmwsYI@4WexM^5u5<<(KBMAvW*`DK^e0F-_l7X(Ck(XFsTrpw`c#Kby&IFN=o1~y&d zOo$s1XUdc*-cFEya0VhuL|wU{;Gnu7a)jFvn0BwOpTn{TSiI??c-Gk6_y5znNt7`0 zUc@}Bt#7m;gZk}^0F*w87O|qgc>fyZV^+1M(U!knV^tfZP+9QGlyiGqpCNf}nB(ZP z`dYJC)axWVI_Z59Pm?HU`M4gMgQ+&>xeem-E43cIvm_RrYQrYR~mT8a1EA`IL?BkT@(sRCX@?@jzb&;>78hX)gXsUdq}J z71D@BS+Qa|?Jy(~^lHQo9S`dKKQt7lwli*P1T-w3S!MMS5%|PU$Ev>zZN;0_cGP?O zSV4(Y9>nkVO&XVik}P}AXL^g1a;wdHywcwD(E$QTx>AN&0Ved@!s}yd>`#$8` z_1xb*5L+iZK-dF@0RF(it%C!GAq+8M zRGYvBh^i9^j3=LbvR!!Lg&vQeaAtGvCsKApeI3~I{Wi8S&<6Z)z(9waqg^0Gk&FoK zINaLsZmw^be}P!Nr+vX#1JeWVca8h*dyTaXk%9eZZ(Me_0-I3&9#`d(2siFcK3#E> z^ni|!wF~O3S!{(dgzN4RfQ%muE6n|_d7q?D_tA@eh;uuLAn!>wB47B$gEJ^k3=j*Z z*IR?s>ZD7}4*AvV9@J2ap6u;*+=q1c>6PjCn^DIWXzaGTilpcMw$ciErQ4c?TWt8` zLaop3Heh6dl?)WDAQ&3S9bkLla+o1N3KsT}sBdAq)k)3L){RYKuGnI$7F64iqYC}r zL*6R>uySQ(WnEnS2WiAO3!Zsyn*H|1J8e{1KWh|x8J#XjQ_Neo+AhE3LPr4l1$qxA z)FDLxqF;we#1n^zD^zw&jKeL5s4p8Q06HQxguwv_&<+<}*i2ct_~BUCypJ6_))9E8 zpMJWF&HnI*KXj3v5Qis#ItatBe)X$<$f5)2#g|^RaYv4Gg{CjP^pbPi!CeT_j}83p zyYIGh&N;`I zgRHTs*@}yHHX{pSZo{fNiFBsgDIXi`diw^B$+uS?S}P8}LAK!KDqB6T#tKWb!~s}g z!zUHH9*Q@_A=YnLcUw8P+7C5!Q@r}Y2U})Vn!Wz?Iy?J6M+sTjWD8%ZvLjCD zWtFRHbzsI3>)Mf8n^BA_qZs%IyMS%wSHNx>Z|=Cy89(|PG|k5f5bL5qyJ&UMah5P%@45ZQ(3 zhjal1!mF>o+6k0!_rsOX*$%P~7l?Qu_&BRkWy0lzJmCI=1B5aVDIPz5yr<<12hKpP z2e1y(3=j`NDgpzL_w&y`@4A;DgrXC8#E22D@`Q9)WCVVoJ<;}gg*x$1KwO4rC$4H& z)spmpkK0?zDM^f-y`popYutD4pJYC)>9AKN3s2_PwjI7S_9Thei`#rJhbdW>U4GsJ z^rY^WZ9@L-0L<>bd&1t_HSc%dS9=o!X({g9^lSX6k0s|Le*V+<{uPintp* zc(7X=g3}ESIK*%fGq~vDi-grY*0}*u%njEblP{!Y0|*P8C&)vPV#GtNcIworcF{!_ z`9=|K64rm=5(L4B!|XXCKZy69amE>L8TgLd@357tR=Vge<)Pn?d@&k=qEwKQ&c(-O zBL_eaR{$c#S6y|Lec=mV@N(b({`WgK;^#mAdFSMVLvh@=aoz?l35Ysl`S)WV`z^?EV*RRzR+Ic?Ja=d747=z6@{~} z{cD4$OGR#d7o<{=C{XuF-1Lmkq}qEf8e}(rd$u^wq$pV&cH^X%V*IInWvpY4ZQW9D zYv)Qo@?8^q*Z9jZnTxY357!}!|G5J=tuEG9!!!o<)zu&Y?()m|1AV-&3 z=Amk$YEw6s1LbDOXvnFb?x(nO?Gry3CvLNBKOCzo8f=lc;1EHb{>WOp<45!CivOKx zy$0sm2C?6#WpuMeuZl}f)H&Xtx^0EM@6+Y>!u_koIxj;&r8$lmj4!)r7j*h}41K_% z+147PGzQDPbfC8tv$4^Y3DZzGBH`#8F}c{ro>pvs z{n2b6)8c+PHeghNjXb8OEt|c?Zu{OF1`@chkgOm8-}mVucEe|8+c6(4v1PMr?Ze+1 z;pG9W9FBdu!=N7qz|#)(?fTf~9$=^gpv9(~oJWkftgOu8i$E+SJ%~n-f0O|c5`%p56^gzkDZ1OL|u1@{$BRS33k^{=1T3+W-&f&bxytkqqyTpT8aw| zL#@9Up+3cqet)Tp{?=@&7h%1^MjaosgiO>}EUm-c^ValkJs-^s%nRecl!|nPn zyk?U=(9>4VuC-77a-8pl+@ZQ$R}UoifX^e%A)ZYl2!s4<*+E`BmZC|Lr#@#BGuXv< ziYVXPzxc&3I)KSS+80Nmh^7Ke@5%uz!@U+n0QiQ=PPt)Y1i6K^AuQVhAg9Vm3D`}L zZ1`gY1EshiK8QbdX7#hejI*tEdwsH~ zU4Dn42U27`w52}Bmfd%x5HmX;49ty2DYz{ahu{yd{<_z&skPCrfAw6a{%#j%nTzNO zK@?nzILcCW5OtH-Zrv6v`)-%Gt}IifvAbaLx7E4%GKC<@%n?_q{5U8P4~EMOBN0%x z*oZ)2!TFaZ!xA{eQt?Zbz6``k5!WUEG;x--iR%s4`V8fnqV+mfM(sI7Zqprse8UxdVqI*bl1ULjWO&wSiYJN0A_TC!=j-TdZJ)+hS| zsxu-z^oyux3T0%0QRrt7rtU9~mL?&7HC7;ViQwOQ(!bvS($SczJm3-}9F9Qx91G3N zja*S0312a%+7X83M;1y9e6v0OmnHV;KOEzT!$w&KuHV+IxS1{jq4VRgblp-iZEN#C z?6L_J)+4(_eX7f)_ipm$U{xDr(S!4TYjdi;V|nQ(NoR&Mg?G8bst3BIWLZt~BR09$ zpY46aKI8hXuui%=$2rTn86*#g&p8ceJ}NbW(tVI_oWDGQJAgNc2jUNy0!Kca^_;;t z;sU2|h9dI7)`|i8XB@)R0x4-?Z6A2p)3%D z{6R=W8UilEOD?&@%RZPt0e%3Ux$&0U?B!W=tVh1oN}w1v;xYu^ELgJAuKn3}ZRn7} z9zuKQPhgxbcX;*y>VgCt!9d$(rhfu&C z685o<;&=J)TMzu>(Z}r8yC1N=y?RQm)Q&(?GWd_ZpS_+lBaG3$mE4sou?N;~SZ}?1 z^=?0B6T=g~krKFm#)VQHvdPlB#jNroS+se5y(0usU!=_Z&Jy5p@@N6x7VHhNzE--s z(Xo~#UFeGHa5{Gpm&y@9-yDytBi=7d;SNN8>6wBPl(s>zH+P#{Nm-=}PKPM~BqMqQ z52i~^$+oJdhwaj%R#{12|J}~dFn=Lj0zU!Ebh(4m1Jj;=(SHBG|7WGWig!W)rs-b2 zcEd*d;8~~HMHhas9llIfGhkX^NtoRZ+32w$Mh_?eWhNIuAqcFf!yn`tA~HC>|37=@ z0cK}W_3^VMThn_byJ@5oTIekxq9C9&L50x#5CyS-4K;{@4V9)yQ4o=)Qlu*g1nDIW zk`Piz?{zoH?xuYI-?@7>Z!UL}-6flBAoD!;zVADI&YYP!^Pe*_2;31qp11+bVTcbv z>_E*+n^6|q&qaqG~LVlQtGt$B?!tlPWjFR<^&Cv-W1*zC&b{Yz(C0UsUw@Sb%4LX4| z0SIo?w|0nFPNDc(&gGT*u1FOvJ6iyquDf5WAREf{C&K`jUC5wlwi>@FYX=vzTBQ8K zCmZGFZCHbt-@2x_FdNrkpJQ1?d5U+VwKCndD*r2V^DNqdXq>g_k~*ND{8g?^t!}i_ zg&}!5mt(%P0T<0)?b?WdWNcMkv7o}+f+w&u{HeUq5v*?Ux@Nv@abrs3-*XR1aff~z zDj+5+hPw8hx~kq??cX>#JyU*bXifywmlhJTo2Mq#Wvay7_1U&0yU=cXV5!+}SDE$9 zvQxjjhb^v5T`8Z1+IVYSxTJh-RQNXe0v&e-dVXB;NPSoH#x^gqN4(8r-RUA^Or_m% zR&Siw8-<8T8{hatHc3BkC^`P(hcHQCG2%yN;FoRyMM9R~J!Bc|04g~Sg)P5~`78v^ znKQ>169EN~B@pCxW&?dNK6WJDn^Kvg4wHFpO8MJa^AdEeE&p3{uPxjz`^*$*O7u)` zOO2j4A4^kxeP-%xKU+z4KCsj0VH&;c+o@_S=U7shQyRNo%uIGBH3fO}NDqd)_g;hri7t zOnl%ML7dzC*s{xaXeUOT3GW|xMF>Cp?6X}MPo|5opR`ZrgX}45H74BB(@Pa2^FYMF zkknjB#zDl%?|83Ca2vdkH?UDIc1YzrrJ0n<^9K`%^48}5!4R8lwib44?wevtz2Uzh z`ACmvXa8pKShX(OKHqnawJBUB&`BVV!w6d_8GM^+UYmQW&3?g-mT4niiYgVkwT?!XzfrFdI)z@$%j7*l!30l7)+y41(i3Ad9aFWKy$I6QCCENw`< z5ywaInLbui##Fs;k~xA8GL64sm-G{MPA}?%5kAqrSnP|-LjWMhju~s+x_9$MNa8`8 z5Us>F-+a>-0#82qWY-Sl7G2C{@w?5=^_R?lyi@LYZwjS}yu`Dq<*zBwsJ?j!T5c&^ z_}NA8Em3L9Zj2n!-2^?i9Af*prssw4My+SY;~GkApE71jg)+L9dQ^%$HG0`IWuy`8 z((9BYlKi(VlWb_bjKGL`WmVaBTEBVLzIcUIt(Strw#ZyWQh#yH>6EKE(j!w!Y|+|g zmZx1`4Txr2l%hd#MBT@8YmwB|-`3*!IJm3J*i2^JmSqMVXmTc)Bc5b1`M$LbhhI9| zq}E_v;~{*k#7A5aHj{nIEpx7t;WzoqO!V3Ys1L@GIXv+E$KX zSLd^F{+QpqDtG8fr$p+gLUWTT+X#mo)=5tt#H#QyxnZ&!erqPz#36gaP9L+(%Crr2 z&m%kATB$<&R!7Clq%=<#8ccp=iIqv!de2XE_N|emje!=)G{_99)h|CZ$MzV}QMWb~ z?zCsac>&Y^QpHZU-QxF#jak;RK)1UVE!24dI&&{81@vq&kQ}4FBFW&gu#fQR?qMI# zq`SW>KRMYtmovMqr$L={=vkyoMHZ;;*p8_iz;!kT^*&?53hUCVh1<7ilV|_FeVVJ* zAN8eDzrlFPoHaJ^pw!kncp`Wq(r&6xwEv_8DNVf@_U21Eo?9RfTLchB4mhe*GAjOxj13Hwlrva_r{)zF(rtn5+?&Po}bj~PVo<6 zM5nqKXvr4%+3&6rAidsiz@|U(;Hsl(>ZjOF-MLrl)@-82r1wMMhHT|{<&iml_9o!= zi~pEoCtbR`Z*_n4_wVVJ=T0{8!1mRkAaqtl@NhNwNOdilyIN<_tn}?6tvlyiPxZff zy1*q>@2R@?yd~-++1KKcKJ<~B-}4*1yXqnswwHLG$+yx1Z0BrA+M5G~X`pA+cY6Lj zk|y@&d8})mw!#Lg>%osl!h4K#?G|0Egq2Y*0 z_3>JiP(O!V`ZsjshgZuW7XITsS(e)Dh#T9Xp0tay5eMbw7yfZe#!Z@(oueo?lm6>p|9Z+@ zEW~V%u*tZSd7%B$UTLfF2qT{2CeAm?kGp75m%|6}Vj`~J`YKVa}l{W+GyDAa2l}~j&2$k2{`{~~G1Cg&TtpZy6(Cj4HuK4|Sc=Id z^v0bDCpZRYzj2ua0AQJJd0n<(wVzX#C$~7yjWZHBPmW6>7U;%T0Kf=Gxrl!=znXM& z3Bt7T%WUwW07DHaeG?8-&+;&rZ=So}ZX4G}gIu3Y^vKZo>s;#eu<76F5oK@}8yLsg z73J!z3*lT`22!l;#)}2$wbz9e03(1C)5k2=cHicHjz+Ixt#xrlD+e^t2wXU`+;6kx z)~o;y)01xO?^Mww2&phBVQBLTq6|4Y197vSR)Gp-wXm|8ednS5?Dqc~YsY*)HF2lS z?AN@L0J&UmV_-qp1!x1Pl+xzX*&+gR0C(IDVk%zz0={2!??gMlb*XjIB`V~RvmW6E z;-O7k{(~uY-WNOD?t8ViscUpDsWkrHc&WL^oy!@JGWj_I0~Lris@=riez7Nxol09Q zRUEQj2cxrHM9X(yTWSyfcB)ZmHe=jY)RdKlZkET{((Eizhnk14Exm-ILE|oUJLl&^F|38T!KJx-bUA zR(p6T<(_4$mQ>iIH%+tCzCXbG)+|L5JVqL+vT@7?XWpdp=Mgo*zk2oe_2P@hEo_X9 zTo%GM-x)gVucV~JMvfdQ0KdYDbVLIejl=>bT7X~v@|PV<0x&_?Ua(++9e@1sp3xmA zmoTZMzu^KFO-57AqlS3c!RP6ukBKK|Al`oa?S47R-FM$@vuDq?zuxs%D=bJI3sDo1 zUeaaN_@=+Bc~?VG1=0 z0CsV~8z%CU9^M_({?g+jUr9USc;ST?JZ`{^h&%G17Tvb}Os~{>#10^Hu8!s5hHLma z@|}$0&wu{2m8eZ{5gz=KEO+=zw@asK&>`I)nzdY}!zF$n2Ls^5B}7ctx!fq7kAep2 z^#D*B7a9TVUncOp_ z2LQ-9wk&k8ICaDkNBGV5M3PjgnkuS|+8eD$r3-kQ*&-?ufzxc&3j0HV*T{0#ebkIT0m%(f9S$};0 za(kL!hIlr1+L=1Ax};fK{%W(YOPr1E zr=fYH9Rp~TEn8>zUp>XX|M&f@mu`^lvsYVbX)W|@GpT&z$$8RdSz{f#HFqs6fWH}U zFL%&z;f!({dPFDdT-w|Lxv@_#5V%vO+ggil(7_!XBwR9gjZJudfi4`-c}7dCtWDQE zTRL~GGzpj39tx|TL6hJ4+V43^37O)gu1OAnj=ogPCi?pVWX{Bm`m z?%tp5?C)F>BKgs8J9fag8f00=p}5L305EmWB_w-m8*r{b;*A178eE?A{MPkb8Rznd zs`a|4XqmvsT-~~~`5DlbuT|>#i)yY$Yv1BFY4m(sG)tENwJ+37zwNDcyF7dEjYZD)faL=Z=xD8^J-Jt# z_130fqvfx!vbUdKC{40*YuT>A21`44&g7NW_L=E6xy@?p)~>g;6ylC7-?nI@O&hyR zT5e0!ezL6h-tGP7;2F9&WUBtrGof;!7|31t^@mJXBgp4@xtI%jVFUJn5v990)+8Zs5Ry4wf>3=0@jdo_WUl z_U-GMg#Y-*Km5`)G|iZh0LDG|;DfH=0;tOE&VY^pBnuZUw0?d2*@zJ%YVt>Y02)w7 z{Ky|5O22;n?7#p0uZ{^wL`gF0Dt(0AJE$225Ypb zxOA>T6Y83hH|`7dUQ$xxbm1}^=(T)>j;Y9P=K1HM7=RM$h+DI%R{)|(lP39bJ|~=T zg3|}hFy=5^eg_!NjoQ=!@f~{Tp*DQ@a6d~EttJ3->WDg_UXy2aHg0KmT?zd@XN5fgW40?2p%`R9Av0`P`!4>{xz*GMkZ8R!6XXz9X((49B|WYOaM z```cW?G}DxA%l85_~3)>p@$x_Y15`zNzW2H?lZ@^W>|o@0P4T_&2PM}&=~sEr#|IC z8+A*cH+uAFccZ<)^8l9A7j1~N;dS!Qg-oP_wjSrZ13KXk5CTArcR)|-`LBQdtKY_s zMm6n&_D=cfKPeM^3TLd+UjQq?@w_`_ifa|p_G!zcO`r6<%6y9Wk_8a} z&d59c47bBmPn`csTi`e=?CASgRDk#Ci?|$;zJz`X+5>vhuM!6rV(z);o(}ABt33X= zAd|iXx?%_I=_A+aHaKX2Ax-=cH=144Ep&%ZxPYTi?>=6C_@OSShYK#a!08r?mCru= ztZRsIo<5rGv}pjMdGqFZ-l^wfjyc8w(8lhw&}3Ye|tBZje-UtAQzLJQ+I{0={&EqKi}*ZA=! zS6+FggZ^mS(*D>5K)ZwgcbRkwq;p-md;PyP>)G~^)|L$_6#<9=J37SL{O+=^9|dTH z2tKR=*UPBgE2vNO(Xu*YRDb*RX>ZuEmz3DxLptc%^R6DwwSyl4YVyh@5M@g%?V)QY3&_xfw`;N8 zcl9K@=;pnBd+;B=`j&m+ih%+V*VvnnFR~LZ+C7D|)QbR3)N@*YO#OO2X=0D?v$gg^ zaDcYWO#1g`j$8Ri51am-9(*hAXoUK$SqjHHWy2J;&{kNL5fgU)AuIR+vqQi?r3?7C ze#2^O+oH3z8$M8|k%T0v?k5d>T$fHAtab9h|7u$JLxpLdi z&DPCe>m3Mx>)#8kqX3w>Q&!r|-;!qEZwJ}rmzQcA%LW@NK<`}vHvRT(=YY~vcTBg> zezU*wCGcBuFI}+KX1`bF+wx!h=WNRtJ-heQWk!8lSf{?Nt+;Kzz5djE0Z@fjq#MYt zIqMBO{YSgI7UAvR9cLHcy02?m-g)`kcJ8l-3UFF(FFr8KPW-ys*3M!e^ybyF<(ya7 zPoKS7+t_CoTAw}JdfmMK*h1^nqq#KuL|64Of4pdnjW}yJ*IfOL==PH*4%AlN4bl>P zOIm{cZ2q)zd;adZcJN6(ZRxx<_T)`7?6e>Dx8D1<5rA8ueyvD=>r%e~yQ2WT=>l4p z&08&SO@OvHR<&&{#Be+IqFE^bcKX$DG?& zi!!t9)ko&pQ6o$2*}GT%x7Hl+8IHv1|5D&LZ`VZ^+fj+Jd z5zBlw(Jgfpl5$=+UjK?Y~#0wDt;= zm(BBhv=3P1*0g_g*gx6MsN3wgIF4h}IpNLZzjpcJm+q=o(w!``-5) zZ~(-EE==?7bmx4-Sc#1&Uu;S**6JtnAZWdr~LNV@2viyVYtG7TsI zD1-(B01;zt(3Jc!fq~9UdI2M2Qck?&ee&eVcG+c@***8%<9+}#nGD~3_up)WG&{*N zTjQwT>#n=b1`itS* z*nb=hfEd6LJPMtdg8}lPf%mhY{mf}QckW#0yRTgE6@m2|e1d-SA8&Rc@{T+1@U{VH z2i=*Vf9E^jaUQ2G0Da&&;-($}WdR1!?t@obv~1zDXMRFmjh`^yfjz*#*j7y40+a(H z0^9;v0^$+}d{6r!JbXhQcn2T`grpskA3$Q-0t*79+fIE68lL1IunSO&%N+sm;V(2y z0XEs@OuM3e!%w5skI=4(duxXBcweD>p#fQ&iT-4zK>P09x;u!69eoY$KffT~k8}Wl z0}KI3<)(M?!~(##Fa5UNckg}n>tFxc=Xfld{Pd?k^|I1uo_gx3cGq2Zd4Ed(Ntvi) z>IB+efBp5YbwyhO@C6(M5M&|c>Z`BzKJ8e6bCcAU0mzdk;5mIL3k>9o^oWaojP?Z3 zNPB{}NE1Vx0LAztkL6|M4$J~Tjur4rJ>7citq#5tHrhOVK))9>sf~^wu&-wyq*;`; z$=TD^Y*=R5JMIqD4-{iZSwMsAoL1VMmD(-R(0nA@3jG1&7h@(sGaxd3FIs=#69CO@ z4F@CyoM(}Xu^fK-#y7s%#*Jq{_8EM#)%+h(o z1et`|hQ+!o6ck_}p%bmYNimf(lC)fgAKT3}MdnOdVOO5`lAZFMezxb)o$cPAPP5A& z*vGo{ZD~EVEt4&1)5a~c6TZ<~+l9O8@`kl`#faDJs52{V%Iiz5Ri}JyC0j3`Fxw}+ zoqB4!p|sMD`)WVqY&ULpWh)%p%-VL9R)cs$g|Id{_lij{8Z2lE0uWAkZi#@%F6z2B z+N_ByZ62C5b5`3KR}8R&PU@ja^jiD(A7*U;q6&Sm!J0mYmUA31Djj-0WG{=0nlsRvA_;JZ8t4wg;u8B(djyhXfIw}ii2JZCrt`3B863t9BJkUsJ3UWwolb+h_gK@X!9{w8ZiQtLg zf83`(Su4PoOgmG4sSki4o&alXiDQDvL>>SKa1ZSS?3u(ex!~+Wz%w+5h!af`CYxyU zpv_lOQsUYqoY(in6Hhp3$M$L50n$oKOTFHam(ZAFJ0p`_0FrbQ`J=1=41f{64CF<_? zzyH0B)K>Ta00A-pN<+gES_0&v$;G*hY(2#9k|j&*j5E&gumDof8rnl&+B%a_<{kh* zXdyL)wx6U$W4!~iKnDz3HUTQr#sJ6AM*X7zc6jHkk!QKTBab}N7vYgPM~%9|0d^EO z0EcLI@GAB2{qKL@`HrIspznYI104LJ9%*0rA^pv?dc*>u$xOR~C+Lqc0E(Px2_R2+ z0ADm)sW-myOWguk0@?w3VF#Fq_8xV8&N=7Ug%@7vZQ!5-5A1oESK0pndY_Pu8>}(#X`NRtrSV)glK93zcgttW}HV9&c@b#IyH4 zd%G;p;sQJvv_N~6GSTm0=wr}SY}dA(-EsRJ-Z!vlg$5pVMSY;1$$|qK#PB}AA$=jh z9^34p1B)p170kUch0-twq$6$m5$MIXUFh=u`|mq_>8sER1jvI2s3$;F@)}!}*+x$v z3uyaUX@9Z60sx4g&`M_UggT|I!Z!f9XnhqoFLt04zMxL1bH)L9vNl?K=BxkcMH zvE}vX&fl`aqC%z9usD+W*qPsw5O6DzQo%H$dKm;owKIUYvQ{nQfMB;_sqIPlX(>&k=F%|Q|M>3Gm}#ahoI>;E z&*f5uBRxNNN|~*y(j_3dDM5hqu;`WmHZ&l@bZMV*LK#+XyG^V;pwdFV6nQzXNY%9&< zl08~U<8h9aEvd2*XZE!D+B)m!AIej<_fhg3q#z(a(JO=%z_Q?B`nMEds;Bxy>bbqn z^6R}<3xTgotV`bl9bceJi$rI}VSd!pabGJDDBDv2Vu1sUfOzYq{aLI&5CAt{M=xA< z_kOM|%h3$$v~8F?vE4V$M};38#O&A7d1>yHRd)UPIs@sqLllRAL}lAEs&MTGNa$Am za+YcbX$JP%v$Zq}=WAi5!t)mzxddryCTLxke1)vDK>{jZ5EIE==EG5dNhK3E1ovnI znPLpur@Jv(U;@sBAA{BlfB{-OF)?OK8Ybdk;*6ZbWRpoUAO=7g69*=&OoRap&OZBW zV_P5^259^NB2ni|`jJ6LNz(@nK)?hhp-fm}lI#iUk1_!;p=E>tU|`Y>Ajf1pOyrI4 zc;^}KD)M!Z2aP#vE9MHlqaWMIZUI2ld zzZ9TKq>aC(Vj@pbUiu+u9(1SNl#_A+kWv;5-vAFxBH3yNpa<_Tp9s3)2hG0VML?mV z;v&~3gGacSpnbdcHE9vYN7Y1I1gvIjEoG%`tQAOw)*D;Lp?S~_{}Be701#oQi}vl? z`8(|~{KKQrpG%0)#6v?94KCW(41wTm7p1NMmk2}Ka{g6JfQ4)WTwAeL3)-nU1MPxs z`-G<+F_9mhq!-^24}NIBgh87O5R0v~82rLxl!Ip`UZNi$kF+!50MH8l%*oa{acbl7 z9Z!$E`j3UAeTEIOMYF z^?@7yFvJ1>^JH;?u#^)mW#~=6e4qeO;sE@NwzOo)Vy7qJpjq^@v={u~KYpYWbZ;(j z6A2OxMKlEItLaAxvrZrnixHk*g-Jf+J>ucXR{vz1Pu4GKHkKjnY|UR=w`tW_N$hm- z>NM#O@LhchLH!305sq;YFr9@Q7Q+DP(Q<`XqRwN{5C3Quvv>eljh|@W!8iEXWuO49 zPjeNu^PvO#d!I9Z;bPlskHI#Pe#iT~+9{QZo~pal09$*oZR?V57f3Mx06+jqL_t*S z1bE-|+cq?ymgw{wVthWUPM>j?t+`L!I#oAOuCOU@F7*j3+9bzZ(nH&CC;Ay!|GZ|B zO`ovb&#PL!veJ`ORoYbDn8`$R_x;-0`{P$g(kIztlrMyg=q*Cnr0Xp?HaA*?J;DK9dXEk>Kyaz=pzra9^Jd@>?P4& z?z_zPra+43ke>Rf?N^hlYMvw%V9L{X%(U@3r*GVU=i7wQ3w`@7+v*pno%9;oM!uvW zsN1y%9MInG`2O2AQJ3;OelzW6z60%x=T`Y`*GuQDwYQ#F;_YSm{51|Xl`XH5rdXka z<&$1oYO4k6qb`ot*gLw60(aWh8riee_31y)^qXs6et5Rc7+WSSwPN31U%ou0mBV&x z&I6=Z0|EfuBf=g%7k15BvOX_K#mq@ryx*>W1@4qorL~xlx*i>vRs}Qk|=sqdc^;yMFMF zJ$dUi-IzUH!g#8dmM>i6@k|}F)bmEU`tH}#`&7;wocQ7r-%1QW&X~B|wQ*DYY*wQD z{rwk{b*5{3Ew)ILTV=tmDVlmzbxrnZuQ37JC4V$r{(zv+5qgH%YF`*0tDj67*=`4T z#o2fqB9GPpzy(`tF-!>1@cP!bzNIal&-?a0fH)=#Y~utVLn8@bfyo5hk1%MO%$YmK zK|lZp^IV{5GoDRPA+6Ch|nS(O6`=DcT_crZO=^3kd_5$5v42 z0$|0tVekTg4O*boA@xTX3~}-u<%gfpKH>bd0FBULsp>p;3}AsRy)C2?y{F?*bap7Dh^A6OA4WTeG=w z7;uVqgT`fOcHxfp9RT5_-@epAdo;uV*x^~u!~^t(H@GMR01ItRKziB)X`?Aeo1lH8 zAqO~yf64+F4j>6gg&pB(Px$9-I<~)#kapv*e)X%G^5KvCp$*6F!qAMZs+2L#G!1%^ zf5!LtKH|`WZQ$;GtxsuBJL>R5H0B0Sxq0J=z6FqzHVS>=RW#(F2LKp6%Jy{tLNqeb ztOLxWeMdh*zet^6qK|;z>7y{T0cegPkDMt;|Hi@qG(iIz0G)P$J6e8($DrLwTS9XX zO=rN}GqpIwHgWpOGrx4EgS#xga8?_626%3mQ`5g z>MA?vbKU)7fezh^s}IE2wczr@f%u(DihY}1OKH3S9F`7gWwYO1Zj0V8bI_uF_aX;4 z`t04x=E}Zfk0KpZ-_hd(bVLJDMcb(j+nqP8Yi27Zb#|Z+#J_FZHul zO}F=F&9Syx$vXUygS@QkrC#>h+`AQ069B2Y?=st#0@+!4wtD?!+r9M{ty`-;qBDJF z?Q~ALXW6pV3vA4yo2+?We}QzB(z41I2)E8bINBQRiLIhD#_P-sUHEa-$WrU3Hq^dr zp+KVMHh=00-2z*v3vhH9hXC`E!G!|b7yEYKeUFt^M7Lr;TNCZA&T2cW1Y|9lQ!an4 zecLZL$YM|2t#lS0mxiE8*11=6Z7pssplX#1j>lfu%etujqJ`U`yEL^G4&i_;`|Z_E zbF^}*BD(;*Z7KWVV#~^s7Se_(HoVKFR?sY^MYE;8FY0CT;+JjVnrC#GONoS!4Nezs zpyqOn{=?f@m)_02{LrhLE*=_ua9e?)WdaMUv}LxppQBeO&FFqQ<8RKC<+>cH(1sn= z(fcEA-fb@pJ^=WhYu$ke7M@JJv8-Rv3`nmZ+^V>X}4E(d#t_V4;hCE2a{VSsF+)xjVpvBc4~ zU0VkYa0d`XE0A|&%_SB(DGzXyN%*M>V{-^dQ-9@Jc184v?a84Y+4|5Lu#hd~V z0^kC00$$*f0)Sb-QR-x*fGYTdG}!9NRXQC(@1$shTGUeGEuY_^tH+yRTA5kCMU z+DfTFXbf!)pa~ELz&wC++5#Xe;3`^zoRJ5Q6CY>1!P^-8m#D7bL$=kzx6}b=d~r@3 zZH0D*dHLm6yw0$X`oW&M!45Eh`sABS0mviiu$`VQ@RXS|!N>=^gFE@A{ZIz#4t@u? zqR!zbc;b{(PVvP9fHD>h$TK`NaNr@Q4%MU@I=b1Yt2j z`zh*!#!Q%GE!6(@-*+!tB;Km5tg_OQ-R!kD#@OOz%Wc2C_psi*N<3U>A4Z=C_=z2W zHgN)sKugL+zTi{pobAArop;JWpMd|a-MU)0uH8It=)sS^0(#(=_~{S4E`|)Yp+klm zeGhGb@}iZAU+SMUp&h(JJfVe2y43MrYD0i|0Ca$Nq=Wy7;*$m1&WYwVaRJieM!iu_ zkoQRcKQq2F+2c$wnj_bSqz{rq3!ac?XZx8ChSOo#sK*k`dStZ0K3u1r*D9_;29Qr z=vx@q-qRw%3~3IJRR0`)2*0(w;OFCDL~@%sYqq`m<~TnFY`?vSRcin)vLS=|+Z$uX z+k(YQZBYL{I%7E152VvB>NezG#@#HbX>R<=S9I{JRt}=^)t8_|OeIsXTQYQdboz8U zg!zC`A=Ml|VBOdjk(W#ai?q|-!oDdznbgq1)0swP*OtF zq*CW%5k5C3l_M@JV0+wpZF%ENG8o)zU;RJZiQPhWghgW|Tj5|Cys=FVLws&mt@Yw( z3Tk$pip#z1w0~Jy8?^1O$liZ&n5`^dWuHIkcnrT{uOBbyRoYv|N@R+R4JAS}(QQr7ns~`rBQ^J$G`3; zOo|J$UDI*vb0(nd|RD2wuYj)#rDzIYFoqO z4rp&`N3=f=59z8a2EdN?=IuuI9*+os<{#Tsu%~^}j%d%M1%0sRVikH~vVt9LIohMQ zWwl4Yq(a-!Q$FRfiJ9yyfm~IO+1K`3XsruVV@uE`Q&yv19-jC+8^82&E66!ih14pz zh)}7mw)xeU&G6og_s!^1tyv?#(26R6-uU62bfGbErMBT#*NyCCWy=N5-g?axfe5YM%?zF5An!k)N$meS3#&;DO;=f^yqI~aNNz)j>Y zJFCD}R6c6^b-Kkq+4nrxCfd@LdgcE%8sfU*h0boBXsj_w@LZ z-ybGyG9KhROl^5g`mM`5`GQ7FvY9+Ep$fa&!iPH(O2C|$Sf~3Bf7owHE=~H|QXJv7 zCI8_k`P`EK;HA3yPx?!LPo}e_@@^?yecaOhHsqT;qglrUzOE)I|7Qvl{c@A+ESR>(%zDN5`|?N|uVZ;ut}3&`4nDwsf6E;`nM^O@PUbo6c-F^08E^7E8Q<34;aJ2ba0kHrOl>t&9017x zp@d21Ir*L`TvN0o&zQQFJ-rN3W-tT5cKVD=<61IYgyAedno7_S$RY($<%0y}~p>+13DIFf_#t0!7i2d2B3(A$@-7 z9e?DZ(VvN#UDx6&E6623VmK*Bps8Xyo3~;eTc)Zzc>xJdvwXT=Xr@Vply1;IEo`R4 z?-j0Wt=u+N2~13R*r20pT1Y7nKWkFA%UiP?O(4X5Rnj6P65??~;?guKP+WO(UsX}< zj)zo|o;MF8I~1@8;xTB_y1a6Sv9xD@oBdUnH5p&Ydu1g>PqPj= zTG3bD-Bdra3h_|Q$JIrm{b4q4s8RzKyGNt#PztU zMUX>PC#P^AO zI1ed9Sp^g(5wCcL{@mmjATuv_tsT8@u9Xhg*+50av(fuh`Dl`+K5aXb>=1owLks6) zp)yfhJn8Orkt33Rh_|-5>zZfsu*2kwx@J=TC^tVQ6+Fo^Kj%-m$CD_7F8ITQzX*pr z{*z(CPi=O%Ck=5BU(!Ez_=A@s?FbX$llIAcy1N<@n)=v#->PS%6LCkr@t=%~biyv; z#STB%6E5C8ejFRqq`J8Vr9fU;utw_y!^GU_qxUF-mq(o*pnlNEJ?k&ZkKcGt(hYyf zGkS5u@C^U)3_JIrzsN^?$20s9F5N_!@RRPoqrQWd$^1cgw06iVCfx9g37X<3-YGNw z`Qbm}#h!QU@$a-zwAj^*lhr)#k?Sv0T)3s@13TJTq!)hRmB@dTA>1NAe1{=?THbPEr9MqY7`cbt>&xB;qgZXx9)4yTVg803I- zT16g$Ch<+U$P;eZho8t&x}7-U19e0kgyZRXgBPj|-^3B+OvcB1T}=(uYhLOaGP6JO zRTmR9s;mFH#2J2wyRI|{`bOAo^`yNu#E_q;Q)m5FtmihdF6^thbU7KtdJztP_e^g zs<3c_U!!1QhyQpFvS1e`>4rTk(%7Ln7luIwZAI)^sScH4zLW7syvaCIagg4o{71au zFXG^te8*q-;XUH#y|D~OP~{7dJ9FrBsuQKMDeL}Ty_;mK$(O4-1uR>;O=PSIvvjf2 zkgQi+efBDsA&A79bk=y;?4?5I1uoI9o2~;kv)<~*?_N1llloKp*1>8G|1dUPH!;05unT2kp6rfe_drso=vE)pk5ZShw}#}-T1PK_|tPadSP zWG=Vknr=qbA<1I!n&@g?sv{ymCOe$d?W=>-_dzsLCbNzORd&kY=jt20N%)_(q`%$z zc2Db4sO^&*wh>`=aLL3b(&#Ll9>`OAO1N!qR{z+AJ(vY>lh;0 zl)szbIKoy|X{$$8btC(*X>7~zA2Le_r)(o)Qj7q}cP2R`#^L1HOfj%$`zoudY40Cru{% z8awqlIleNg5Q%QI#vNej<&=c%p&EduBhQ$4@*ZyC9&Un6aCW~@Huy9Aha3LU-onIAG5^qCgyTEnrM;z&X)6)ol+v7>wKqD%-O+DyK`pNgmci8a^6JFh6WPn381U%VH)>}|82s@g9?t%ye|3$- zTId^e3%YVt!tB|zt+ceXhTai3&xoIQ>YM%={^!VmsEhE&)92WmvghHk-w}pvR1X=R zy!Q&S+?4M`M(dfu9R>h$_4GwwyGVzurUY*ebLFsF_J&hg!Q_;OfA7h% z2tSc_#6h~_#*H&>s|%C#6XC+GF`mv`nhihr+A#a;kH%PwPO{N>vR>Q60O~&bwZYb@ zXLAQqK<&vB1`Vu~hS)~YDBGTWYN<_~SZ-gspqo~t@Su8>_E>?o(cN+5OdGggd!5t4 zxiw~Eo}Fj9{MYvXq%O127D%?s!Q~sYZ7omQg|EM`-2Qp@V!QHsowX+ao-UDkWLhzyUij_VJhg-UF0Bqh`T{N-44$*D1Z2iO^G8(AOTFZ>RlWfQKbsysW1l6c!C655gZ-vge$*_ugEl8)|jN zoX(wN8!7Q3i<9;nkIhw_^K7{;vKVk!YdiAHUVio(Y386AD8J;3%O{B3c}&qqc)fZ& zKy&e(|1I{j>^?EFSIzcD+*AC^i{g|&%8q6gdB=EqsikC@qUxx6CRMo-_@HO)KSCsNItPoWoMH;cGdaX%nkc=6Jf(X8F!==Zpml3 zMR&u%m#m|tzp%$HQ+ny~;V<1p9LZ<8pZHG3=l-*7?RvG7rU?F#=b%aCzmCrs z!vG&R*KP5l#p)+>{or*jd*D1N#^LnwH#s&(QpgX;CtL=BN%zAxCC<4)=;Wqa1ZK{# zin!DLb5J{HDgh{Rur`O@lgIS9YYXol^%w5k0?OG^94ud2TI%_WG{aAPN7%-GBHv-S zp_j`EnD`=)bN1G8pE=Ho3XAL>U0A@at(;kv%pZBiVD|xg@k6>@@;kzL1l4iG`<7@C zZsB*=^TSbq`se(&+wZvDCQY1VpZe6Nyq*IHOs}(`f6_k52a%gh{%}i%3%^f2`IMhS z^}X+Xug0D5*IxTOKmUz0&Cu# zt(x##c?sIE@W6!^T%y62J+GCP-#Q0u z0vT`bg3!?4tPb zo%B=NdxT-04KJK{;)xk~HT-?lpU|H+48LD{?X`Bp4L8(mo3D+APe1*%%LZ|ad$O%( zs*9ju#8;c2s&!TN?0=v2vrPf@!e4~v8FrB-^~eznpZUyZYTT0k8~YvlVHm?XQe?iQLs`&y&J=mGCIGpkjH0(*B= zrOhqhVE>)h#_cQR)}l=_Te7gy{_|>c-Qx@(Yl| znO9soFnOWsePfwD_HJ`OYYUC9Je^eqfa8g0AO`SX%Vw!gDTDJ)X+^_sF1~p7g_rD= z*WVQHY_MDJxXYHWSY?IP14Vkl=m)B#a<*`0nF}NpYt|`T^_g!v*AYYAP>=aVxek;$ z2&U}<0BHH5wQZDet9nWaIjK&!Y#9eqYpb_zG6is}RJ}13LlX}Gmop>RiYK1CXQuT( zpsj1)krrV94=4U_kv)FPG`sMIy{tvseEaX;X4svVkGKE3b}v7NjGJk>OeU{D2hyTN zsQhpiC5cp3awcW2YcwujxYquB$wa&8j-h^&Drv0Jt+n{0JlR@V;xZY`T4^w%VTfP` z@8Is8r}9JGm7-0qEzs@B;Y}7hECr+#*nj8fVC@ed;dYHd zkJm z%mEMK54iw8q>CGdytqbTl`a`kJopJ940B@{osQS z_QTa9ZsZOOtL?}^A@?Br@C$qLK|ZnLhTD-NN7~_sAMUaWEAxaSP5k4B@?a<@tK!Hu zjcKCJIB=iC{Q&*WJ?C7{FZn>eLUuyl3rz#)jvR>LB8_O<&@kjc z>W6P=g$XJACd>`$ipu4;V1yzxyXYHPPnk(iYuh~GP$v991M(Yf&pm!z|3q5& zCP%X2o%j4*bt(-g)#prI%18anQItv1Kb=GXKogFeE6dts3YnN zIui%=6ZJs7L_J|YXZ9RB^UO2-7G*#)@CkQ>Zo=#cLzhmkQdp2@ ze}CW+=c{t@(QU#5=o6qrea#L703l{cX^A&78U>lBQt!U|Zoi3&3i{PAe_69K4BE}A zIJdd6lFo`c9cgK4sa<#7b&f()!5AtTf&MJrM#E~?qmMr7!o|@?A8ohZdaK=a*WV;u zclFgU2KyK+J#gZWfs!<7WapiCo_+Vb-*qiOR@9yqFo??O?|%0?UtQ;lb2@dl0B~Cq zVgK=ue+am!vYY;RlLMEm5?=P5%dB17c8)%uamE=Q4=en)|M_-1|I6pw3!`5!>{)%| z_A<%~^EbAk*|aGXn%pwa0l7W8Wvd*zNwPzpy?EdI_V$0~N;9y)I_cKP!@gK*OJ=XO zSMHo{MY=I^%5#hCtQ+>RmiZcdigk0I2E>2=?rq!sK;7o{>26jwwaj{U&asxw*`fj< zn{B(bN@<35DBfUij-GE%T{Y2Kl;&Ge+XDOScL!TL$s#jGFR{_<$JxS3E3C&pZS7NE z?Jsa>)7d4NXtG`a#Yf7h#RHx#U%ASbE?c3_sF}^2JX7IM0nzaD=*{oyX4rMQ z^>eLt(M`>OwUb|2A`mXmMqWMC-k-4C9{a;IYtyB`COo;!4m+odo$&SDy|)4ALp$$( z|D0(PU(~J6Epx2bur_wU3Ek|4f6TJ6|6XJrN(&Wkg?;0mVFJ`P*tn;c*b1F>)~#;~ z2j~EHsg?iUIn$2&Y9HCRbWr!O)3l{j{6s=C-&tWdoj=~X?UAorPR-8w^$-D#&Fq$M zjPZP}((Tc0bUP~fdiS*@rp?L9(`-BbYlZgOWAkj{ON$+t>^Hov9db%f8>`C^*#6vA zdARM8@z!H#b6cuy!9xz$wdv>d(ru}$?cSeFv}Q$Fwsdx-o%fre4lv#)KAiIMDm(ZK zo$QFyOFWJmnXZA1wO;38E)|YhxbbzJu{N#FvC!E=H=dY=aCXFzilP4h5ne1{D^!N2 zXmYYT*wS^2TmU0~TN?;{wXC`z0Ggb8T9C7@DHg3s43-;!aR zPwz8X3_w8Sha7@?L4JXu9rVyc57}+E-DbKd&4uv&_uJpj8hMr-s9Pleblacow9lXB zlL5wOCi@sx!$US{uglK3+w?1 zzx&JB=JMOxy2N18dmmMU`G29(1W_Y;DQTWcKqp2e`>${ zzO+)CpUBfUq z)YF8l9qomQ7Htl`W;YCzUSw_Ropu6v#SN112*5b}&4dx{4cY+w4_J-{AzE(8*fZXL z-_BG$q1gkEv*i&50<_-%8EHrG0w4+PlF2Ibf@nMN6k1tKD48Fi?Zf=zU;p}-_XG3? zO2iTu)Ng z$vblw<}l1jFld>fRZKf!lFbdlv>)0D8qC;HR{9O*Q!GLNjBsl&U_HtT_}|6<$YWVH zciuvu&%nbgR|!PcV*Qp(0I1NJJ_SAx^Z4VBJFjp%Dsx-re)P}G1JPXKyN!5qh_nY8 zV*n=}eDFbUH@N-fFMn}6>We-L{^pi#`c)Qn0FK~)F5yIrm2rmKm(jMO&)k{nH0076 z;W&s`&nJD(9e=sQ=ke@9gbvgT3s8&`^cl2w#uLU6#>nfgz0MacXw%dUbwPiC_8INv z)KgFOHV2T!xCE$m=bd-DJ(_3ST8*D$KYgq#34tfjm#|ZS{)@g1jkXg%d!h{+I?OtE z>Fi@WZTUBu^qrcE4n*kRr-=m+V`v3uf) zC%hd|HqzLh2H;QKi%e?3rLUR4Xt6IGfThfwGtY|E)*E8BEHO7E#;t_$z18wVAyB6c z%{l~M8V3Rv6~y)LAg>I>bW9ASmtTIlHzouz7y>nF06qjgm=NYcU;u=p(oR14WCNIk ziCER5aWnWbuu+jP8caYsd?yW+jNnWIrqib595rf`uUHcI?YH0VXVe^b+;J{Iz(Ax& z@(QzcD`utL z{fo(V=2d%G*WNAc?w`JG1oiyL>z3Oe7GG@6AI=F*w$CXA( zx@J}q_)Fie=5E#SiEh_T8NO2uDp~JM?!7vj%|u@z!QK`M3R0R3Tg$6!OUlzaX_F2R z{f8XZ(Qd!|P3yLM3;W6qd)qx%jklQ-SGp$P^l>Zfi&v^WU7T%y9W}-l3*gPs)?o|) zUhh5I*xtue8I=PGW*{6+_ z4r%Rvs4LfG?4Z@3_62^!DL2=mNjUttu2#0R(r!9$oPGYPel}qL4))?hGwr2^XWQYY zmDtp`R@hh0Ew!G5TG@?Xe#;iTUuJu2+xY1F=GiCCDit8vOn_u-+edjTUr}j)x@^37 zq@#D3qyY^U&o8&H-L|J|Mc#AO1l#X3-E7P=^R0APD{Yb9&0cwQj=lWg96MBibg@m5=n(u@uc&r;-U_v zEn?eb%ccos$r4ay#1V&D%W6#rqKsYuAaIx2xhSw<<2ozO8*0<%PP8W{KWFQ+D|}K$ zDWd+_o>d|B_U>Bn+k3BJA1t6e!WV#PXhKYRZ;Jipj=#8Ef!x5viZj0uA^{4RI0Hmr z&*T}Qmq{Eygj+xf7W9~OA=|K^2{?h~A3`mHDu5tz1^$tF5HgV!5dN8vA(tQ^GwDE( zMiya04lsdmi>$*$gE){Sn1CP~Au}O+ATO|;7R>`>BqlS+4+ys3lpnT!A!DH#NSfdJ z*0)?9W9u{97y;!l$Y_miknIrC!?5KS!-_UC6%&ZJ-g--A|Gmpp=bwMRmzjy!H^2E! z2lSZeA~Uf)6FNXcWG8?>XvP*KCL0(g49I}<<}Yw<4i=NC59BcbU1&`mF+oOV16Za0 znY=JT_@x%5G24SSo={W%YXEx$-QdqB1+oLCQ$K*NOo{>V0eByH-~n$p@F(*2KKtzB z+iqE8XF>^Iqd|zQPn`l{!^Z%Av^`{Q>b9h$#3z}!1F!=$(r%bH0NkH=!if%iU2@4K z4)$RW4^a1jVx&*~GogeR0p#IV#n=p4}BnQigJfZf=0>mL_LRl z(v7g;9`Wp~&;0z9CMo$Z(1QEcOw8k`k1A=2hk@td9mW;MI(Ql2 zCeB0K8S18{>#2DOO4jem0s`YL3j%;jEX2`%kqK&ODQN;NKt2H+Cyj{XSQfIf-(iEXsx1*M>2 z!-n}7#7;p#e89gM(q^L%1V4apcC>-_z)|Q!PCEG{$=5Ai;~2~aT0lo+5a^0*!~zdv zI*UN?A3XYrqd(!{i3d;?0|-hxfJVq!^h1DtjQ6C8;Tbf5x8ZwmpobrN*xGk!@AL#H zrO#t5NA6+FK=#5f@)>kwahALx8;~yJJ=hHS0ZeBMVqA%~LD=NGXGVWv7vK0xnsoQ1 zTdnUkJYMr+`RXGu#9ts_+9xu#Mo_y$Zi6yZdwg4UiAgaT2l+){V|5RPM*WifP*D(@ z)ekBg^-P3bkaW(pfT2Lq$B!TH9Ty!MzmZyDqjE7Y20|U-c(PK0K*?YZ3e4Vl!o-$> z+A_|HBw!yaV1RK5$*c?_q>u&-OlLv9IlmC$nTAdN5inqSRt~04o9e;k4D-9OhlmgYMs#MyIY3On(C%k0w^lsdCAA#} z3)d<`yN|7#Yu8F(soY?D9M!?P_t$o$+-w0*ZMCJf+=gU#Ol6M=dluV6)dBLFt4Tzb zI)#k_$=1_2Xn6X`UzX1KayR+gSS6&KbIcqFgzlR+&{X72@85G--I*jipDpH;^2!5S zXM2c_X#Vva&_-wTHTN_6+IA^Yed;DYZLQw>n9kOryS5#u4*Cm(dw+tq21w%*?LPoK zF76ofj5H5@3$eCqyP%O}UHi1~?YyOXw6<3S+O1c;HPe>xxP_PWl?|`+Rf{C_2)sqB zP#4O&A>MU546?E+%XS;kN_or|2-x2K^8Ja@GVI}7i97Zzw&vOvKJc(MzD1budD7hD z979EHD;8?I{^$j=6F<$;c0Er+=dp-hkZjOF?X9)62YK(aPitHFez`4I7`9Wt{Kzb) zK~al5kGp;E0_!ZT#Dd}+#go!fP35%V|M^+XZFtEit+=IluZe2WHN139Af$L{P1#!e z$zQLrm&d(rZCkeREeFY*<*Q$QY2tKyb+|N@698b+&#w2Kivk;TKy6;Lwl-(JwA^l3 zX2o4NregCl!fiUT3{AQsNIRv2)*#wXbgOHE> zzycxe3l}YP`2u+ZgFp{p$9NZ-9>@gv#n6v4)}w*Jgd4%PN-_n0kXynJ-<%Un+Fas+ z8KuR@HLKTn=gQ6oKuivV!|+UYkiv{&XV%wh0L+{`1G zkECR%hSRXFA!+~Q&E;+dg5JzwpdEc1dBcvm2nM=9`!KW-4BNE`om!`TUUa zWWW9Q69AC!U`S{u!++EpKgJG#7kG?CA?lJHWf;<@z5zs7@Zxw1>Xmi~0Qhk-)ED#l zmFjn(3G@QAqV3`qJexdo9a=(P#tbyUS-_wjF`oxaXB=nYj{br+Mn6Sg(Y!@-ACu|h z=mWqHkTV#^7<(~{dBnvy#JCK;!4EA?a0~iO7N+143<^c$V@DgnQTpZ)M~txlz3{&p zTm)X@A}@H8g;V+w_!9a-Uue$R#EjMb`t9zEKDe{cf+0L(I5YwH`-(tX`qFU64|Npn zjy6OXXv{)I`}Q3i%;P9FOsPQc7{7Vq|5*WhU%l|F-bSc53^c`^qbaD9Lk~SfW6Zto zpY}z1q!a1#o^EjC7d#a1nfk(TtL^#0*i*7&_>X+VcYU7OA0}{p63XP4GdEC$rsF{^ zIfPyq1tFDHKsrDegi1vK2i?UE)IGHAh7KL-jFl8#sVFKKL&HIhp98oN;#lFL!NOSh zqXN?_k%~ebIZXuoaE97V7rkYB9NyXX|IBVaYGn(M zTdnij_B^Vyo%Wp}Hs$qY_VUAXJU5@du+$Ed=GFtho1}81L8voVT4(Dl!9trcVYy8k zmuiel=cI0FZPhW~W=$xwIq$9%5L0E7US1-AD95$Z#{OrqEt<7jfMcc2nzYi|=|)%A zY7^*})l9(AGHIddOf?~TR<*c`t(mxoty?Mp7$8spU)B6hR<)?3?7CUS^dVL;ZLn>u z&>1l^yV?4cIxj%ye*q9SX|qYbsCPDlXXu|cY~WVj)ER%!&@Xt=VqtcUcwYd@8&Av^ zpj%t}WhWI$!UPUms%!sQ!ne?I{$CxH%sWfRK1mY|~k!qPx!P zlh!Eb0unFO6^qNixfbHvFD-PQ%2ge6S;*tJO!cq@+B!aehO|Cbt+VOkk=+k$rA}B8 zC@dO?q(fxHLwqydOx+y0dS#{EcIh}9{^{d;hLpCy%7nTS{E%twL(wDOIBfVssQm%CX>w-45PPu2TA1A9x@ zZeDAdkpUQs5y$}ul5)s-=bz_-D`PwE$R=n8t*uz=V>ov7g$S-~+oW#eLpu$_iZZ|v z27wZPq&0uue7D1$#Yi;S00oe703i?>kr6PwBa5)O$c_Xi2g{eQuu%d4^Q8$M?)W7S z0DGj7G^C3Rg5k*|67#|fFL>OYJ9lxRH~hHccKRc4AvXc8Ko7J9kn_q!59$KBk1cR) z(`0oXtx4)BKsy9>wr4V-U{c1yF@{ML+nt%{vQ-n!B_?QqGNeo0VUHZigctyryfD6m z0e~WICfZC!Fx1B`BMKzwR9||$J>hMi%tCJ_xYPj?aCoq?s?s%Hi4$H$D-Qqz*%^Qk zuov08q@={P_LxuubO0JsH`HyCuVPUhIh$>EfL)ygn3Go2CGR?P*|@D;K+TL5X( zY)QjEJc)mP0hEzmCW9Xo7h1J!{lmLc-gVlcS%k(8 z+DB-=06qZ%VbDyYFT$W<#=HlOM!<05z%XwiUfLWQjm&qrNQpj$Nxutz^2eMDtt#SX z>oFiaG^8H`6u?9s_{YcO589>k4D(Uw3q7E3nD9q`)mPwD&{+XRN_Qx)CSo0f@(Uq`A{PH<78%Sq|C)Ch`7ljlYKIXRynTEE91}BET zk=-1a;6wk|L4VtSxi?WzI;ShH7$t^p?}IWcx~z2b19W4Mhsgo#sCd-rQKv zL=Ae<v7>|A3xKYtD_(gas2Zo_jg|Y6q;|^b?WF?vl zK2WQsF|*P>O2Rk;JA*8SMjXt89YQAvIUO=9lL)V@92{`K0nS+Xq3jH@Y|%m32XJKD zGD81$HPv!V`AQvvEx;r%KgSL^t-HPY#2lT?wn5rfYc)yH;lcuoe*LAfcJlYQw%&}h z*H$c+n*gN)Ki9+NzPHMrxpSIzDrsRo2e!20R?P&Q=GgDgA7cle-pOW9EVlzr>}CK= zN1xZ*{`j@AHsH`!Hs_tycC5~cTOxoE3G?CW-jya7njKlb4Ru|W1P_4$8>_OdVoDFo z?>)~ptZr#*UhieO-OFsvTfMDlzjDhisI5X``X+S$#QjJ0;% z3axv;mhzkGL=QfxhyCN4$@aIOjI++#?)~(Q^X$Su5B4qIXI$0KZu;7IJMff__Tv4E z?ec%_>mcy7msk5dgZy%_2|!-1E-xAW*>?8ewUg{~-|Vj~$K8C}@bU!+r>P4+);TDd zT7_A;sLIQZCgW=HHCvna9MRdXJn=QxVtxDhr8=9iw`(BIn3NKN)h%p8BVjKjVgweC zJ5vJbcJUq0$Wrn<`Hp*hZ|xazC7%%{Q#`f#OZrWJ-_mz7t%y6_F23WL!Cy5!q3?Pw zjnUZxxdQp%&!mC>E10}&Zk_b9>wPDs0Ghni`$mnU8+BuG(lCax1sK6ElcC>27GO1< zMM&fX1XTom7VPf7?|wgLhwZy;6=6%<)jz-5wKI?nutSRmZGOVD@(iHC!r*hyJ?H1v ztX#Fy0R+-#k&jjH{sa13X=$nFi!*>YLyWkPDbVO+D@uR_$PZ}VFbUv%C*+X}q^W>R zK^{ZsM3w=l2%$R4i)<4Um~*8~!bBdSoa0g08rG^+OD`AUx3{5Q(6pQC=JUlE`t(wN6?9Mo1FO&>{8mR)U{s#^pJx&BMLwR z-~#?ci<3D3?PB`$=~hxw;%$KKWAFl+dbqK5n6`<`%{Q7N@IUQ1CXxVffOkyn0H8SY zsi!9Eu-+kv)o1$5CL(5~Sb;-HP)ESaCV1^J}z0~lbarJsObm~X&4gl8@g2Jo6m zDZKgUV~_flK6n;If|xIa-^O^7ALbFvQJ@iR0ziZG;d%P2U;paY_UGIG?6f2g2dbQV z?zN`_-e@ykf8F&y*J9qqj34%!B3CuvO|8TILvx-0aE}UfX5jdSZH9Z z=2!vfjX@h75DS{!r?$hw9c~;80?^GuAAnF8#_kwT0B3n8O@K1mBkhu{^|S%%i~f*) zjJAP4Fb+UTjyywNIQ@*%eNh7WfZYQTccix?p6j$=K%a;vSv6 zdX6+8PsmIx5`nX@lYllwS}20iKhgG(FBo%><5;+0EWrS9GA3XML)(G&^!a>qECuD| z$=CuN7_(TIqTi$506l5bEIv|~JY(_5Bi=!OSt8y>)Kp=l7%=Ob7l;5N8!F_rg=fH_ z^M}AxFz6_QAmRCL+pevze1mEu2;diYkZ+g;L6C}MKu0AOJA^;JgPC9eOn`w@0&(+= zkVvHw7JoEW(!!k|@q{5=!r%{KfNvTzdFP!~F;*5SGYmml_$EFEe8NzMU>xG6F+?Xo zzJmcMCqL|n16q>L&Ye2@O@hI6k+<5Okw@a$T9|NOTt3%se5;$a$vaN+jMRzMp^D!f zJYu^i+iwAixP$>P5b%W`+jYyO8OFJ5MY=eITU`O10F?5JoB1uOXb(R6+ljXCXM0$m zecNe!sDvwNY^~JR;a1v`NjMrlX4TRPzv;EOm2OaOA%IS|u>$sNkmgs#8r`NQ`#jys zS|uPbJGaW#odU0R002M$Nkl0`wQzGK-%0*%)T082kNur?xZC;O~y zfn95gZ2CWSO*z_6X$GESV%w#22fN}2m$_@@`U?B~>&K%H>AR!XSL)_mfp^pkH{DWi zXjxLHZ1n{ULmO`LD~oLM=*4!#IlZL)rkf<&{bYdwv^7R_ov7xD}+w{-4muiLiL3XNNN;RCjslfUNTB`)xQ58)wh z7iPO}h2A4=c(Qy&g|%##+NQi}sct$`+Tp%lyo2Ezppx?j;cenb(qfggOW`;87p+Lr z_uGF3A}OnzncS>mTU7C|eWv7b+qcIt4oqifZLV#T3=nOMzJb1#z9j6D{&u}LoB}~l z`rPaPaH~z5Ime0$xs7r2HUqFSd)@;3{jYzjezt=r`0&Kv>Gt2tt$DLURhKEvhKA>4 zSIF&6fsNAM&S|C_+~#++nGg51X01L50Oo2Op1){`9eecQ_NCKL^(-PQ0E!`3FlNF# zjLq;8KiVk*B7gzod5qx*uS{+^$BS_sSpfNh_=tze7jhKf1hPZ86L%R4iIP9)=aw!@ zO$r#NktrDa0ioz0iGw^aQ6_EV2IMC4gp7hchPaU*kQ1;cAB3Z?Aq=t&-^7`eg$N5k zfh>hQ6f~fWq>cZ&n24LWXj_r~mcmCE1bWg&)`51U4c(BLC@1B@FZRSod7x2*V`6}T zuE=uuK@JP~m9p`}UrdOh5%o;`q=SL3#7SB#4r5P#FvxBg=nKfiq=Cuahmn&#!jH%w zG=uhRJ+G@t%KwC+{*ZOyS->G=dw7+JI9it>>r;o+?Yi~r1k%l|sc-m>dZjJW{#vze z^QKI)+UpGj!&9XvsKaD$Jjb9j>-4D$e-hcM9pGw>HuU9)HsAxbGqB+OfSK*^ta?p8DPQ-k)t3o%coi z#F0n1QzrQj9)W)JZ5Zk&$+N*%@Eh$U>V+`ern-E^a_gWij_jhtz<)8Xr5~e?0a5@( zpfx{ojGsV)1^6P_mwG^Whd0d&RC7HA`kpNzH9 zCg5+{Q;Zq33;fYGXkWAq`VrzG4&o$k>K-~1AMeD0J>f!TfbXea;-)X7pCLSc$RmAh z@Ckk>GyWMT$rt%(h>89J8H6~<=hjSwA)m-Blq=bf!oyK6?D0=t>Bk5Ioua(B)5lT{ z_@6d`-~VUtJOJ!0s>Oe@ebY8=)5~rON$4O1A%Fp-wn{sC6%*>fH zXU?3V&cH?ijExieEe@Q6I|Zq@Sz~FSi@*b~%;pVc^LC(a6?!@8y7lV}4r7Wm z;E!@pHuCoJ(N>fTyihjq?(Iu{2x!sJBv0ra%3Ew;QGc`#IWd4hmok^Bsg{5K^Eu;D zFbf0Cq+Zm~@!1&OS;@eaz4rQ4`PKc8$bi1R6~_&asAXm8hSlnIa?a@|%4g3%$NC}V zOysC9^n$wTs3gwmKezR8P@fuqrjii+&r z|IksQj*bBXf&&KMFzh(uhcF0t_`K6maJ>7#<(+g)e(vzYQBSWc-yu^)oK%S$X`AaP z$=Zr66&}SpTZSHUu2X>s>*9W8@XR|M+8f`V2mkGvH3#}|i%YnMCs_Et+P*#D}+8!FN0;BHA zmrNOaxV0F^= z*0$eFCsCK#Q&r(OhH(+KA%oRo)ZC$7F@rS@=s^FNmHvf3KjJ#~wqC((pC~i^@ zjZE3CPpa^5txD+_ADJppCJFtMveh3y)_T*2w#3U7#YIN{&X%rZtHPlS`8rW+UfC)@ z?2)5KG1PBYI3N4r*xnsu-SZ9WL>XE#Z`w#f8cgyD>lo(S8t;v^CxLW=z*$}Rj`#;r z+RW>AyvK{%4$8bU$lIZM*6(7z(f+(c+<3;!>o8(b7tY)MPCV=b@m*Y8Y)Qx`UkFR^KtFG zkjEpA$HNaCIRC=;?sQSUj=a4tUT(fa9?8bA`hnLdKBzP86m3&*7uFe=F!<5*-jb!10I+KiaX+SK?s@_?(m~s6Dc0}m?19k zSrpR8y`PiT$2D=t*TcNu;U7&Ct|dI2Cv|ZbzI&e|9hyXFiLm&*=9({Af216{vQL2r zeo^Q7LW@FryHp5l(Ql9zn%xuf0~k=JxTCZ2k*j zJG^91%7u&e<7EDg!2w1p=@PJN$-pM{cN~+Sm)-qH6wbkX6EB=I_>Ru?v`+}bX$tAX z_i&9L!uGL&UlcZe#= zDxSx2*dd%meje`q+|zr0;kWzo^mM%MPUrOx^9<{Sf5I{cxbryCbned+7uGQflkhM- z?<|fvZVbbYP$x`J{Jq|JCu=4mqHPb(5sYvl2u}~kpPzqwcKG2M_^X%k1i|_OZ3~a% z&k$Y+$NfXUMEQl`iPD7Oq~|C(2K>2vgoV8e-8`P>(b7+^ZwQw>J>O_})SvHY9EZii z*9BQ9HgH)Erj5|PVWWg&a2$0*;5lvDG&@qq!u)r?`<)$cL<`09bC`SjGg{y98$A1W zqW3V&@s!BV!w_I$P64wO2vJ<1?yx>>yAXQ!u&lv^dm3#=e@O@mx;18_3mZ#xIDcMqz(PQ zpr#Uh^TNYCz31cKVLJT6aL>d2!npn(!f`)O=kVMgAuNJUHV6^ovB`n@&si(frP*}rsb)j)+{vD3M8|u9#^RAC#6%=hEgB3|JQAuYL*R?tilCa3q4A^wx?`)>15Rk ztC75sE2XwnF96BY%OZeLr{cgicKo*i>Ko2M4T2JVfaPu4m<65IO1U1F897$#hx%XK zc`GsTPAjjP<6+~5Dq38)o_lR`B5XMThKCphgRYEcDhA-`HwdAIB0D`&v5t?2fJc0 zgnYA;#lnQ0DeNd=5T6OxX(#bLA7JqA@co@{4F%W;=&_Bi*-|*PvmO!Gz7Q`Q<)o-o-|OIh zMB)Z&oY#i7Fd<@)jzL74L@=U$z}g`n{8ZpaT!emaJiAdWWp@Y5fTu=nH~ShPe=Jnk5o`X)x_!!r8 z`#j@@Zx}-~H8`?0apFXS?Jzt~w1|p}i|t|rFPjxa|9E};n`hK7`kg3Fn0{BjCn}5Q z7lwuJiNf8FXQH@?{F{nL+qkAi6whIPd+mGjVU-d}65$`5hngcHphWQrPvjr^xdv4< zZWt#F3;n});^0C*fA?pyaQY9lg#{wc$G&~+;y+>8qFE&i3;n})PfvZ|6|l$1f)_18 z1WX9`SQHm4ec}izc1xj$9F2SU;fIaS!Oj`96duU!Y$eLW^V$=h;0uT54@U+4XgHVK zgqlFkd-;4pKk>AVBmed|e1~%c@jMP=$u*A*7MwtQ+|mXd3FbH>wq@y`tjXE<;Fu|w zyI|9de7s!14)f(3K`$DhT)^b{;*X6s<}<%lH!P#W050zcgW-QE2lmot&z@};IE8g1 z9&m9~!QSF^G0!yr&?ga0qp^h}FOKL#^C=hjas2a+fCrm%+|Z28IQl>K<6e2?6}zYd z9v&F@^YkBO<`=C$GL9*gY_>F}(6*o-lxMxnGk7COdq27ZJK4^3fJF#qpuvv^_!-xAL zSZkeq_F2}>jF;opoJgupn_KakYV7plwVD7BgkY4B&d(wkRnKRieb&xR(;y5ucOcyd zf&2NBFppbQROH_Ee(vE7mzlt3R}{9#^|X8XQ`e?y@2r#D{^n8J32PgxG=l)emY%t4 z6Qf3tBzN5`*+Vz#O}_<_H)@@9IbxO`OIEuJ1)J5czY6>Gme?#k3#!^&U5=P8+f<{g zQ=VS%pu(M+72PGLXuS#mRoGdjHaJWZu#HtXUL3|kqQQ@!g~g`9`og31(#esMqs8tl^pH!D zxFiVYG%b9G0SIYT_)a{B9j0|Ze`53-#++N!QD2Aog!#fY50@>4`Pqm5@q9dgho5NT zgc$-phLNe4-(v1C9Hy5i5e$#BTb|m{>Cbbfu9H{)yi~q^{}E~fGus4e>z0+vFE4vr zKKuPK(zmFKjghQugrF+0RhyS~JD8^BawGabH&tT`6M1-Uj&4#gbmGD%{IR=Ps{@pH z**e~Ej5T0pX2<3`gp7UQFyMXl1s%fSciCnd_zZ`xcUM;v~r zygPeNy}&M6wGjNVOZ(gV?lU`G7+L3b%w$Jxy#E7_evFVkL)#FC;Esg=0>E_oJVvEC zCW5^zw1Ye?Z5ZZ99*i*@i$@2cHK*Rx zg>raVe0(; z2P~ZPY`iCeh2|1k&fL<9L->b-Cu9yh@4WL&pcTURJpIXhG;!iY)BN<~_y`aY?sAzW z0>DIdBOixLzFdyLB^wBnnL}~Wbe?BDhU;G}dP;wQf#di(w%g!)kwbtB`XmBC%7qXv zGb6@x5ueL+=Zm{qWFS9s&N?@TR=*5;$)I`_MmLSO2coi_5OR{(8F{gN;Ql z0dtMoFkg?KsQo;wHJ*;gU6r@PkK%Dx<(CRvFAFlOH{W>E1c0U zz__EL58}PC4d7nzCnsaqF?B78zD_Ez+g6h&xr3MJk={IAxW??SWOP-dqk5r7W;ZqD zI+k4>UES8j7G|CDwO=62sms=jKvt3MLWi3whkjrL*J~> z-J`1NhL;!Ee5i5r^yun-J@i5reJ-A^250pGmW`{+WWaDWsI5YakLPZd!ogi+MgWU=O_sx?JYI8N0D* z_(8p-uiA7(AQ9&|TCDziA|NIRm}4#x;&wK6gWSdiPiPtRkM_lgEYHc4C)?2)XdJtv zFh?x@xmupxWa#IF2@_11$F4ez8~H#V*`eP)iNu%?HeSY$A777N$^+95EkqEB78CY+ zn8Y~J^NQNA7^KHZVC0~o2r8NM*ac;mm;9*`Aj{_I#RP*oOYedC zvUJX7_1`AL59}!`7jBi0W~sRXb$kyP-c`rv7TL6>QZ}tFmocBjKzoMFdwZSA=Q_zy zh1E~T9CP>lw>Jpo>|d;g>{Zb>D?28T%ur$eR=uQY>FmwQkf>p5z3gV#emyi^7Zdi) zS6CZXl}QgRAM}87b5nbJ8pqML1UD>r_(40_;E3@zy7)HiZvW$B0u2cIGDkJ&vp9GL zHX~u`(GZ|-van&yFcudtUTkBQKF@AH#{JRSV-pkYTE-lXc=)4LfhG)noAJ&KbBrT2 z4-mvtPHwGZY(N8u=NcDi9RPy`662XL^7Mt8Wz-J;_+qB5^H^Tac8KC#T4eCjoVN2c z{!CQJ#=;WCZ_2Nw;Wd?CvT(|gYFRuU&nWFm20!%oe(P|;u$Fjt_z3V2+PH87J_5(Q z&t_(>(kgf1q8H%_f-u~!Dx>Gy63?)V%r9Hjus{4aTIZo7Y)fhEf{)O@{$1OXP0_D@ z^{eIuy+;@b--K`wVH!Lb{1NjA{2lxm{1fvFYty&ie%p9G<`j5Bcs}fmF=w!jCLZ6% ztCkUS1#4$`Mub;rCjkrClC1BdHgCg7Q!&x19-0ctrdtFT%l=TAPC} z=3l=V-U_aNChHuJeK*PouBkr)x+kA}()v2`12)d78#v(<4Rbx3`S8Gu0ghkOcJLQm zYJ|`S90QAQ`T%@1x7(5rIHxZlh{REEczwR%PmpcUrlj{vOyEaoqn5&lWt_$zAM zNh@kN=F&>I3nP1(X!B5W*ZV73pM28E#zT5BLb^vkaQ={Rhv#vl&xYa6nF*p08-8ag zJ!%z4$7O=xrWbZWSo|SXg;{1mLaeYC!8^?Hlqpl}nsaVf>8>{)F@O-XF zn8$@5nYmk3s2AU*iEC>i++#6l0zZf5np}F^H>10z*`{e)emr?@JN<;HXJ)9;>%n@< zo*hwcI8Yh4Fdw~p#V)Ezlpz8J(D2HWi&ZH}g%;y_$sLzZm+|KhkYW24$fMtzE#G|X zaJzkX<_oK3+!+I9+B3^cATajGKJxlsm#T1~RQ5Zjul)YYGv)Zt4>e7wCvW{wg%Z6? zJMf>sT`1>$dyI7H(Y}NSiSV_%{1DJVvrancBxC-3BZB_OaapdopEPNb8Ja!!oO6vy zL0||IgrEW%2_uB+Ij~^xX3Usj4AM1MUn8G6=QCCnZa@6l&wgf%3d|M`28$hgU^qj^ z(`CvSLW6(sgCEG8IdkN>=bn=>qsLfWXC7ffuf6tK zV|=gy1Oo)a!flSwUKkzMJcMzjyfCNWfE`qhkbFUpKLC4IGBpiHk)foX4h&Ht*!!=n zl@Th`MrbzUdA%*ZtKJl*+ISmQR_NGRE{C4fUlzT)NnTs>v7C5WvAm{ZgfWKTZtCBc z%c=jJCo4bND))c$eYyCDW8}5Jd@S$&XTALBe~*@FPcN78=L|N1`GV=2RO?S~A05$6 z{(k3&vj5RB#`a&oUnrN|e2^?t0pR14=E!HhHA)MqN4H;It+!R9nV2EZ{(8QA;TH$X zig|kT@l`YAoa;x)tQS|y)W5EhQ?48(@4u?I#P!INp<@f=w_lqjXMcU9jp^T9_O5*Q z|Hj#E-uLQwzW9gx%IsIyY8jWy51tvXnvX2jQY4B*ON7j1{&7^dLQRBGiHo!NWpipwk3??i3p1jcp;R+j}scqX9%(2_YmyCPa-sAPVza1I&(CYGNT-G z!wokGr&q`ac(gHbI10)9h9HZyk3aU93Bm}+-Fxr7)|U}>U48Y{Cg@}XnEIj!1Rwjz zBahhash9;rSjeUuf>GvB=1TfBbFufco$WWY6LT$ipv-)OC*Z>SQg7rF_uqfNwF%>p zwn4a!$sF1ZVI~4w+6A7Rcl_bkDfcAh(SbJc9PQ{r21K_%VF@6<1tgLR(}WM~sUJV|Nx8)<|joL5r7idwZmryj@49 z&h!~@fP?0l%t7C?va{;_EinFvG*0&zJE^vr=ap*wFwdsmRREX*m)sPTW`r}4I2(=K zJ|yETB$0TdevAK8Pd#N5ADy3LH7pA6x%VFH{A9-fWak|sirs)i4n9O?&X{SMe!zi1 zqTY++YI+7F3rvU%X&_j@U@+kbXEEw3%;wqgr)^`vH2Si1wHH}LV8gJng{W!??vSPp z)l?7cNmcCzDeSVpeDiy;KAcMNb{NTcC?0yL#?e8a8X%*O=p(C_mdNPC3gys~2gthR zrLy?_&2qr8ePzNW!=$pTT6*-)l|}Dul0o})lPSMnC)Yo7s0l1OcgvK;?`~F2qDmDS ztdpb887Lehp82oUCK&AATZKq^G|^VysT6iEi{q0d6F6FP93z0KLimNy07k5=yv!E( zFk0*q!ZcwM5H)gVq!0qK%gDrwgOOxIqo}CJn52@eCAK3;*cZR}MPm$MKsB0|2KZo0{6B-+=|Vg!3vUU{W4jqC(NPsi>%)@UaTJ`4}Lv`mOF zk>r6NnpD&S;UI8fcA@*!1-g&TK{T^re7IE$TQux&LhE;{({X|p?19G@s@7|{YRZ<| z(cIoc^5xjex=PuWYSZ@n^u%I)ud*Y;Q~t6-j=!`>HDj~nqnWCet^)H@t{S0&w;Xxn zA1malyAF^;PaGh_59uLm7R|Ebzy*cMWM-*GhYIF%JL?X6_e}Zt!!0uVmCbV8#YJW} z@XtS+E5}`=b_Z1h_xR5Z(>#h**t1OzI=;VbSzoTgdJGO%$wn1Ou3EfRKJ(3ya)QQL zx4cZhx9EjSdc&X!3encpW>89!Cr5oo8O-bqnf>xQD?h^iEAKc^4nJj(Y9H$DfLfP~ zOo&C`jHW8_2yLW7Z=Kd=>R3m++Wq|L{sE}n{;I`>{Kx(@o;%|LCf;lVYg8DsaK{!# z9HAe5ma)JB1|EfRgRmOG9ZVqF0gOq;6v8sK^CXZii?X)&Cr-3^g!ux^IO4MgX4444If5pRTB8xRVEzIt z4{P0TQYx&>bRo4Q+1?? z($`eeHWg2g02`~^RJ;}shuKA1?gBW}dtr<*vdLL^hy#`82oA&sqQii5$DsJpkA7rA zLv}Q1h|;oBBRmk1FfL3rN7|gZhmf-9gcvd~VX)a5VOQj{7k*YQ{oJKSEIqG|XB)5F$Z^IcA8eARem-B$ z`o;(oOq7?zb~Vd2zS|+w6Nq*^5W8o+hi0olLvLnQA;#Ap{Dk!Em#-RS%FwA_hf9nB zU$Apj;HN+RsqKQIxd#KtF7GL)o?$3!6X6ALTe(N01&#tWWY2*w=TKl5@R%o z1LNh3EEr6;V@6x!p!d)@=%+h`hzQ*%BaA2v4ou?bF8y5njwd^!?99Tzu#C2b?qe)Q!CO!EEs)9=oHh;lK<6z``M&rTC!kdYQ%wDOpz~-Lf*d^W0hT*S&Q-K-6yd%#ZVn=f4ys=K^yt+}Yxa|P5@0X=x z4wPr->apsrvGG({j+Q01{4%6`YqbdgIda>*k7`T64=9=#Pd)nO$(p65(zTZ^lvVgw zvc6LO@$0!#bWjiJt7Xi|i`gNhEpv5TqwbciwmLb&Yc4*eBRCv;bhnt7zV{iX$4fMf zJlU9MOveO&>KRXCk(EByRVu7n6P1UR_ z*;bh=opLKROmBSOqW)dVtW2@O?9RV20YfLP9J{g5zgWL#cQ&!3?=psJRGS(H-+@*D zxP_-+Jkfu>Ps3NR;6V!m;Wc~=3l-Ag;3;s|5abSO3pd=9HSGYr#`M-69dxz{!%~am*cGc)u5xqV1Rie9S5E7+@-Vh>D?!t zWP5d7=38h(Iu1M+svsvkew$AEj=0G&0PTk^v7i8IG?ZRpG8GQc9ACvHVEl3pMl_xbvOMHm#>4qg?ZS59`zo4sJ(MF7VpThyT>g!5yb&cpgx1b38^C-Xaw zzTtBkb%wXckq@^q6BnT%0!|$9f#p@%*o|UQ3E_aS;3zYL z0xcGVhR5n65?8Kv8Iarqm)#UJ3$bT~u#biHPk!eY_ z|F*n<=Vj%+!*yVwtz)2`Jm?&Opbo(S3w!K;aZ!iP9#W$3TwuV8xO7vs)Ku2WmUR`< zZ-g@DgSyDtrD#A^NEfyFck;FUetqmMT2BmALJ zFb4<{9)9>?vs(s3hwT^`Js2+X8Z>Z_9Uq9&Fqk`zSFk%gRgaLcJBy%^Z^Di#@y5nvkCLTQDB%Pc1fY3&WsR_X0PlW2_B{ilgSbRWFEsI`Q z@@i}z#D?b|Z=Ne3PFp9_v>dZuSZ_l3Dz!m~K$Gz}`!&7kJU%d2El?xu3h#)s2Fe3p zn=O-{SRyYyvIq>soDmTHqyNj_-$!aox=HogzOq$sS1+AzJxmJ_4icQQG8; zG~l2e2w^|@@nj4=^N(jtNC^LfW(Q##H*K`?wFZ7$DogDTrW^ zIgPmnVIC(pCQh7a{Rm!*H8yh-iZ;wY^e-HOJ9x9>^$0M+JB~5JyTNNxF3QZh8XgoL z66bZIjPRZCpJ?f!sZP1@W1eKKj-n5IB77y~Kxl?Aj309@$DQFtnJ*EH0TV4ccv3Xu zR;*lMJg4XBPb`@nQe{ev%fJ52}#~coi z%Un(Q(8i=bv>ADT`>tKO+A(MP0fIn;dW2EmdGqHPFV4|nOpkyU+J$+)yKXFEHV53` ze7#^Ft@OunL0vn3yA}trCf0>Y3%g7uLX*(AqXC;U(Rg_nIKKPse$gi#h7JsIVql|A z3j+*6K)o2k1HnNngq!&olUy z!MsC!Pmg}PiXvFsnttA@>D~we{ok6U=*rw zk7I>3RkhN4KxY$1RH^Wf!`-nOA8PhXm{G9T}G!IDXX0;qkCK`g9`L=4gJ>%$!8;u zF~$Z4LN=HP=p9FTU7Ls9RK_cG3xOK63qcr13SgRG5D)|+po0P7s0EBxQBjdGNC+KZ zB+y7g(11XWO_lfFf6riXd;!{yqb$%)1Q0N1AL(wAkMI%!>r7d5qgdm zplb>?MZX;F#A9B0^X(b3adU~z4cHd*(AX1NzGZ8voPN^r_4IM>x@oee{3XfFDpp~h z&P&?gv70wwWWJ0#the>;3Ki0IQ%$@<`*fFn#rZO4+8VnM=b+>I%8;?$Rbw_wZTziL zO~DfR^yiCZ@aO_NF3dPvv!q0i1m{Zm=33eB*h0N%qnr9|l?^LO<&YCqxI46q3|6=U zM|QRGv`UZTViR!CsBThGS}O&8a_zzp>}&QJMBb~lUY%tBWBS;!d^8sO73ax{TX}^ZH5d@TF3{W{9p#Rl}}xwNx+d zBYC6sGN$ruy@6e|B`Z5i^@?7SGia5@iD@S`Y>AfqQc9Vrx597jCY$H>lDw`N^3J<+ zWX`;gj9-}Y#@i~4tI?zN6|&EWB02DYn1(6LH@pHo0R4i#34Z|(z-A=cuJn86QoNX;k~DV%Z{{BQcgUZ1w0+{X2XWvAn!w!XT1NOa<_L#wK_mEe;5RXTn}Zkd zP9JvR4d1D>2YsG+v?1*YzXhK|`|$qJ!jEjt`{@%tZAvQ$dZ6>nA@w}9BXBGGd6FTPk@KOi#d)o@P@3zfkD|2fN`p0!h{KSF%^CX z?5}gsxWnZQ4V$KO96TMoUP$jL3vhr>eVF$sKXjh8G=6+@nHA*(2FF-?_3Wi(ILOxH zMLOqsI@Yn27dZeh5RkzeGAEDGJaQCoIB>ePbgK!~nra72pnn)kj1TA*ZOI%2-j*#} zuKei-HXn10nfaRXfJ1m?aOCqf%0#py^Dp&7Fp7{89vR-6vVeE$2~OZMkYm7KAV>xG z&MOlS0U~WWdY{n-3qNEY)SEJ*xCCzxuTH-K*OgV3Cc7Z-opF>Ed;pvNn2I9}{1WwL z?&rJXw`*}gyDa^9nY=mUUFoJ;^qlSq9qmw3S|(%n86o@cH`e+&ZIZ}2|4aLIQiGn` zFhadE0xt#?hAZjBjX4Mf$JZD%r11hKdrt(*owa(-$}<3{lBc zK>_VqrNDM==o%PI|JLSC%H%aHrWAzLz8WY=0s}K8mI5g=PBMb5=cLM@r|z-;-@+*-|!rtaLqgx>U?p zfpO0gsoj(>Rg3ybMoxuf_NkEk{pLu`+Cr&ZG+4SE`Ic4?hLW6jkyBx4hH501t{Nyy zpBW|D1vOgdhEym^8T?gi*Q?-nf_(0x3#=e4DiB;DbPxLo^CyfjF7!8#B!7~{OXMH= zh3`o~H|gCHFq+IHNd(UuO$cztg3A4pB&iQaqX8kPFCvLgT6aFTxSxM}cskF3-^n$V?F$1rU=>B9Wl+B@?G!VflZo5H7u z`zea3f{ce#$M8K-ox}Bc_?|3X)Ia*2D39j&g>b`ih3{dU=HwAgLyz=Xe%0z#%Fp#n znT{Y(^ILSIaHHSJ>Ja*Sn#SswEG(J7!%X%}lz+0gjrn{2$P5tnLNl6jo(5$E_$TIm z{6d%NSjX_Hg}N)&n}XFs_RH@vrJM;*hu_;-j4e^0lb z$bo`Kk~p?S(3avJcmJC zoY%?A&>%m`5r=1y^$+39kd(NwIo;zo_VhA&9B6k&{6r67iRwf7-Jf@y$8~s7f3Gv) z?(pO1xbrx`#)WtZ&e$jYgobWwS{IGL++|bX{>`hPT6PhP1 zQcE^)BuTXZ31?F(7=v5Pv?0N?lAqm!8c2>xS+p*zt%7M9Zm1y zJpG+GUIyNq<%|zeyr{6RKyNkPxJhq}(ZHp2IuA646(b-kb9l2h{_ItBg zS*Dce=#*mZ-bkDh`U+WM$bTL$a_?KmOPOBwk=bpl)NCry4Ff&ish4|{zdu?Di~9E{ zRfb%TZR$pGX2EL79?(^_1qVpgn&B$YBz&{l2h@wYSPyW~5`-W`IGMCTM;~O7#8DWu zX1q^E`zJ-Gk4DF5vVQAuJRQ#vX0msW7pCLgT?p6x+Vd0qIc@6ITQ5|}K#HwnQ#A$i z^YW!@x2ClVqxE;1hqfoMIXdUg+mDS9G#J?l$9Wo$m(CL{3gAUgx1$d?Jj3hEi6>x%auI#w-^OLXX0^d3TmO zQC?nV>f-N-;_Xhq?ZY$H>nWG7Ybq)#)sAQ{)k==p22HnISz!lDH}THK_XVw&!N2RD z@r5lFHmCL1C8ISA-_}UF%D~SZY0dG#Tc2TLdU%*7mVl_+Vfnk~?PVmc`Nhj(-(=$X z#NY7`^W_`oX=7g$v0>S*e(`b;*I`)vc%EUItUmF)9cFW$z|2y$k_{`%)S&z_`QVj} zdV^$7IrK!m8h)7D6x?1Xv;(vBsNCY&8|AJm-j#1Wbdcoejj}7|mq^h8J(LK*bZEhF zR&MIv@IAJptLsGqSTyQfZ`h#6)zd5sDHbkR?=4woDQOzd2sfwADnAAj5~^}y~ZHbh|333poKzKG`0D+N$mnY z`~1J_@#=MlJax;el=&M}kX3t-{;)~5m-OJsc*eFM3f!Hx={WAK7yB$2suzF^Rr`MP zO|wr_D=>G|M^d$Puw-;q69ZXlLZEPsY8Ylq&8ps#x8HL8{#Z(v9H}+~^)eEr1l!sX zE@4L19E#n}jolv~i{4lK>0`;ilRg!fP(vTf#7jACQlNWg0QN?I{p(-LYp=d0*M9k0 zvqOd5D{f2282ZU4*Y84YM?j?iZV!mPIo`2ndiyVKm&c!Y+}gt1fSaB%R*y|8E>_}~ zP938&3)AfG_Z2Hv z*d;?h``ORTc384_06l%+{s-j3 z&t52B{pwfE=3F}UMzDZ=cx!^

      -^i@iz2AS=oanSzBsVcP)1F5;0#9%;71F$)sqqo_Z4;VuU3EOK#8Q~>BW3~`=nnUclxd_6q+ z?f&G+rU!O1vBQ`wp2y#90@M9}7;WOfeOb zbW-eOTyIo=hTwcK)IYT`aM8Hox5srj_1`|o;!jUgAMOc)XBg)1o-T;CV|ilKz@k_> z&s%+>>7(Bb;KmukXx`B@;dhvy?;3`7gx!x z7tWBMzkal2s%BuV+PA9FBW2jP;@EGQ-i-Oy|1OuS?i?dU`}dHA?`)6<|9g(y@cdzt zr?%s8*rBUaEkPW|im`!(ATL|(USVU4uq=H?V2Cy$WpTCd9JNVRt#L?0p4hYUTjUI2 z$DbWA0RGUzo4j0iZS_6qiaW$@Nsk_CLoKcl){b3x?mG>Y#;e8szIPWS>5I5rx*fS5Li>R-N0-Xju156#y2> zyiGl1`Z~QR!v$6`aupjqiQXNEH*Xk+u<$#455qzj#IcSQJfq=!dz>)L-=oh&FvIj- zcGAV;_Q=*_uzcs#Nq+G<>9kdk_zqbnSz{Jz-Wq9Jw$y6B%*8#L1~ zKG?CI{GZ7-9x<4X0MH#{4};%~MdC5{l7<~`#>h3OM*sjo07*naR8=S>zz>FzxF*Qg z5;JD;N2AC!c7ex_%MgIqrkG5x_%42eLmZc<9Dn@rcHvubak1S_`L(Zo&2F^>kKhSM zd~iu8$jeo&F?~8cq+OtY#PRlk&Y@jEoSNDg{R9s9Mk@*9?Bvaj>$c0CL{_~&Z=9_PpmtK0wgtyp< zXR+__NlSj<&hZD_+&rbVss)Td{ph2QmbrRa83J0`j&@<(IZs5p`1s_B9kVEW%GTP> z_%AJlw@0G#)UW#>Zb95=n(*7xIK2Ar7zm@24PeD#d;IWOpH@BnJqJiqXr z_&dan_eX~nKI`*Lr~V3$_ICV+@WS^n+{@%okLUUG?eEbz78a>PSm*FPVcbYs;<&5N zGoAX!<3?fBdwaXY^YuK4?{(wpJeI>r=ZUbNam+lrLN83YKrcD`(wDwuKk&}jhMo`y znn`@-6DCZste`)PZ|FAhC_nUsbijaCxPwM8)`{!zYwL9WS93k&#k>tXem;j& zN4}X8;2)qHl!N%>!;`WBk4+)yf00d{$ z!w{E7;bKynG!pDgR2qSXqX9v9hif?uIBrdP-VCsGE(CDvmQ+ahvvYN#&6Fe07%U?X z?q$Nk^~=lTkN^8B79(u?$BhXwya{)~TE@Haljyr@M{|P#| zvKx28r#~$>|MvVTfD+k`|7X>=WGtqm!eT;yE%DPRmv38zbfV5UR=WMje ze$T~C(>2?wQ?lVlpPjhROF#5fYy;P6SnShng-R$-R^)do(#0WB;xZTDCF*gZfA~&P zcka&<7li}A!|*DvJyvHQJ%;QNW6@Lk%NXRC=!bJZG(iB1Ru-KYY+tx=pzS?L#THANtai?@I=-$5Dy&2=pkgR`b2X4aj`O*778)84vTQ9ju8~mYB`G2al zhj5Ou2VUs|%$u|;ZI9o~nKSK)Q1`LN9y37^Gr$DcmOJbT}L_sLy%-DPt(T5VTed1d|F;&p3lPqZz;&kug^1M9c&1ZX_} zSa||?4Ej2CLL-NpS0|}39Kkr_0L{zubwSUVV$+f^7RVDPPBdX2w~#{5LM=|TA}#l=>>i!Z*|@_+j2r!9=JPg&t_ zuD$kJ*?<52?Iw1P@1K79={C;MHew^;(n~Kj9tzqDPsKP5$G-vG&41|Ylm$A`vF>d- zU*SbU0b9D2q+de^pq2cXLwPbbhZPNz?|tuk zMt_(Cq3_I-&MPXm~S@8RwWry6dk0QJ(1uJLSY2dhWUBn&#k_zx-v% z@0>4V$Bec49$Loj)okWK=b*{>{qA?av+(oIJ5N6P=p&m;7>kq*dbf1xQUMlp4?6g# zKmEyW%!bZE!_Z!4!-Tor=cjaW(~|L>zl9I3iLYzIwN5Or^d{xqDgb1%XEI`kh=y=s zRVbCF67J6e#Nx$k&bx(2zcpeA!_tEXq6aYQ(?{YP(BKd09Ucvj^YS{;aaf)#>>v%& zkUmyygK1&Mby!qTRdEtSD@|kapmLtv@AcvhgNJbsnOS<&PmJj~3Nxuim zx{u4`f1h0~2OZyEK6q`t4j_@k)qnQO8)U@SdfI^c{7?6{W5W-9ca|LRslJAZ`LA!5 z>z+JZ`V7vOKmByJ?0ub_@Ie=_%P_onnEs0D%jFB5*|TTcVuXno zTEOqW{_DRi9t%g*&skJ*G>u6Q#v5T4JKs!N?3{6QiUkc!Gn3|FhaG0Z3l>xe6xOQn zkO`H^5a9xg(h17g`_5Q>q4vO+Sht6w8j+1Z6OV&YollT%)g$!cj9hDnJrEsxbd?x8 zIeN>{+R_sFNA0^(&?#5%D~Zji=~SHKC@f5W^rIgc6UcEl1b_%4uKMCtHa`FP&wm;d ziJ*vi_Ah_=iyh@(v}lnO6%|=rm`KJOi|A8NJJpy~goX(7`6&}&V{-E3$-=Q$7-AQ2 zrBmMa9+!4w(S{&y@!~}$ETB%{m4(RXKmU2FA{s#5x^*{Nc-?i^SsNj&MYzE69AL1S zjAMblX|o<(SJ((zp`j<9c%o^Uz4+pb4e*S~1O&DR9(bT2Y+!-FVg-Q$ixS!fjUxnp zEIOdS2p4>Vg*InFfgq2v&?lg^*czoxSya%cXj_CBXg)pk;6rl31s51Rgey<|{VCIa zv%>F9f8xUv9+x(wy+VhE7y>*Ng7gFMjv$w#Vzw|;VIA`#b0O^q{@;H4Z58fi$}`VA zWAi0#$2`kiiO`P4;fxtGO!!(|6SD>D0P#Q$zj@N(2-*zxc&38jnHw;5B@$fjwe)jCbC7 z$Ao4qpwaB%$S~s!fjl&fF@n$)f!_rWn^2Y!eRmd}0ebEYMP5FX(#LRsM9Xd`~~pMU@R-!^8CI_fBk z4?RY}z=Hm%zda>i`})^x{bmVU;Scp+shUw}9>;onY<=mtZ>ja4SIyv(5p0h>ZSAUf z@--{r(L6mZ&oJD_r@@G)!_Q%Py3nsd8pd~={UT2b({FpHaO$FEal8=hWw&@bf8s*; z^to4GpNg;k;u#Ss{*90?OZ)YaM;vaje5^0g`94|)OJ*sz<0s6^@q%A8ZRpn^%`UEg ztft$`>)-Y02yp0S_IlLUSIdY1zqyY3LOXsX#;#2H2J&V{jMCLboc9eQh<4v z4Ibuf)hz}A&UvF`=KC+pZ|-|nx(`#8b6rn3-szS3x`6%5 z>+i`k|MUF@0zjWIFgTA5KpbP19}^{v3CuNGA}m^1e4>WV;u6OE!V51n+KEQPE3dp_ z>6vI*eBfAsuxMf8gaKzq4!eRlv?W-WvS9KF%>wqoKSmjJ#`NQO+qS8SztXitZgA(Z zvfqFsb%CO(5=Tjtti!L3V1Opmb-%p5WtNoHPL&>=^3^AOzJeoWFsK}JL%4%YFUAo9 zc^F4{7KAq(F+q5PW)TZg7M%QukKhUhm&Gzn?XqRdY|)F>4Gbq*H;hjhQiKZl!)&sP zy*E1OA({j1^s_j|IYY~00(`P?&eY3i5Imqo;77Bu35cKq0RwSxJbU-*ZHo;w!u*0I z1V{*P-H|V}_N0?eGI~pUBNRa}!Que-=38&dtXZ>67>JOB{8>z}V8DG^HL4L(vG72s zg54w9o_@lH4GRb8FOK8Pz@GEr9OaL)Y@-I=7vbh!>6~?o(_3$I#|3j88W^-Ecmwxn z$n#@NF4g%E4U$>!%(A1Q2y+pvFlW+!Xo28>L%Y+~3l=Oee48dmWG?Xh{YhHpVKhsR z)4s!eO&dO=g51R_G(ccnR8&MXVX;czrEEUGTR*(){AG99%vB?N;0Up7hYtN1!Ki=8{?Lamg!3DGr$NG+T!)56B1-C8;WL&@Y`fKva ztFKu5(tflj!d_s)(~v(x0eBt89Dcyy=i{BcC=+n6x#k+9!?ZcVS?Dk0lXgTPzz;e@ zeZzLP0`7)CjCW`SW$0M*m|by&Dk`dEaQ{O2HRV)983j9bX)-wo(lXTpo4y3uE;M-V(x>MLvwJ@6*L1W1H2Tp z1TF6yZ@jU7&K;w4eg6FU^4Guq)#wE48O9W}opA*(HEPr-+tlEqA~u0gHsc+B0@}@5 z2|7r=gh9L693n1`aznSEH(oXii2RAxm*CJZq%om?1Wd}G+KtUA`7*~RaJ~Pgs>zzD zZ4-=|SSGvTFNFrl{@WFK?9DK3vMq5AD^*OeE29&&+UMJ{wp#x4*kbwAMZ@$WkDhYe zC7tBg*G!jFui7U2j_)pOKQ5I%gF4IFWo6QLzueels@Yk`v<|sV%2klZ1tA56xhhQT zBKKT1TfTJPe%e_@?!Njxx#Y(qRnstAetPW``P@(Tm!boE$h-ehqwy$GX&h`3V)rjw zg^JY`+vK3*3gy5F{bb`x)wa?&x}I;a&y#8`_l9`sw*20JlNPO`QsO$*0_>XCQw}<~ zNV2-?4s=}{>kwys%~rOc2+O%j@UAfu;WCBUu`FLdfA<%;{gjqz0 zg8+gZ?2}GD$pkta!)H9P;Dpg+JWZG|!I({$NX8rE4u^jEz7VY=j`pH`=|^u^u(89>LIP%<4Gw51 zT0$%e5U!$S2fh(BR1Wf`qNf7d)CCv|a<{4+2Ac@5V0t(`9 z-%!|QVbBzgg_4GHQ#Rla95~46HX2j(7X+0oHt8cr9(k0~_7iR4f#3p1dD^YpiK0_) z+SQ#4a~LORc`&}v?7|<1<|jBs*vj#}(@s6j1VoIr!ajvE`-9oGX!CK6wjh0kF^M)k zaG(*%=0D2gb1dW4G;~$VvryZOIk~q!i;9X&JI=Mw5HNDwjJEW&UZ2)}dVi(wqW$>m zU;Wwy&}hjZq(;EWBG-juj1!K$Ggdg_K5^niS*(j@+TdH?`j%A(9C|%DJ_o-7Ekq#i z{zQaE`tkST;$q`N7%SL>o%JpmB5m{r4MO+Qi1=4d0b9qsN$bE=T9_=jb=i+E4RG zScs!d+0dlDDKl-tnB)`$nnh?2BFuzdIKR|dV~sLWmyUI>HC>DT$<#hEX2j42{m(Oi zJXP1!N{@nW?q$!gA2$ftOFzP~8`Z{41tnp>W*oBN06l@9f=00BL9v1L2petc1-=fY3g4{r`GWZH8`OpTp&K~T5{LB6LGQiyp3zR~!6^VV*7<=$ctM1mlyk}A zCDOS|XMz4fZ&}B|130Wy@EVPyMKFgAKxiI6$`=YN8*9HrVX@gYn$s@)c7*%0v8+4} zPk$$V?7Oj)u{a(#_G~KDIANM-+%TS}P4@J(vHET=MC^OVRLL}5 zc8uB3hkk|7E>DjD=XB1H`@T9;UVL<+JbCLJnQ+k%)A~E%^TSktH&bo$&5;Mb^`4yh z6+JqalOgLrE;kJu1bhXm*_WxdmS6eH61`BQ#_aZ~wFT1#EL6dvl4I#wpmFrJ;X_X8 zCv)CdD=$3wkt}{^iwX8>s_SIa>M9#-XyqJv_E35F+jHfWKQGce-_;w6)gY+)BgyV? zJ7S;%D?8$(rF|fxb=$O8S71<9e^v2c{JpxmM#?H;mv4l5`((H8zWdtorPEJ4T^@e; zVcWUp*dPlVcEGtw@Ve`-lTRG>2|EtMM8&R@Pe@EuEPQcAx*&o1cHxA_f%#@vo-mHo zV6*46(@wL=mxc14>Y$5U{J|0E*QdUrj6BF?d49nMe%7&p~T|C5L`!~-JewZd2 zH;fmiPxS6-dHQ=Suh_T4vSaw$(US<&4t_o!IaY?i9bo|rSC~+Cl<~jiXSbM57>>cQ zuw?Pc@k4}o2#;9MvH&Iwja_!Gxy=@>7??;HM8-C|+l)=(AQ0lB5d?pXNtnmI(K-HM z$f1b{ez32`VgZ3D3jlWcSv0t|5sQfP&pY3QcG&G<$DcMpScrBdOgTa&78D!f!g3AXUct8&Q z#G&>698o&-&_k?z^e6fV$HEaJQl^ttp#0n4{MOnX0SYec*XGfl{-inPqV+|9hVT{P z5JGsgX3^q9=tG;L0ndDgVOSYDnK$%4%ZOjh=7lJ!XWgy%K z&s;8oR$(GX8@tvT{e`3ZXzS93Xu%;I<48IE(ig0ZUyj3)j(*yvT)b@%l+j;LJN-1H zbBr@g9ne=PKQsyLT6hr_xQs<;6toQ6dz@Ba?0_E@zbvlNuEX>QxFH@t9Pw~y?va-9 z^ZVcb-tu9wigqUHIKjYpV{?R!03QRl-g2vryn%I0TQs{n>c@WTDKl{6gn2 z8~Sbk3e!a6MqzDFwd0$o<>~Ll3crC@&x1QJ9z5ABfF}=~!}4bs7JU!v;$ex>h4l*4 zMB|3>9A2`gr{(GI#EpF?OBM6?_}ia5#@`+mY2Y2BHtGY7X0Bx;kGT{+3c3Lwg&-eu z9Bxw-GY!yZ)*)=@;26`;DK22bdEQPe0zwzqB*2jt+l7<~`bAwh0m3(7IE0hFenJxw7;Kgx zfW)!cvRSo_DeIcGYfOO2JWn~8i*OFhK2rSSea4^Js_i;`);sdSoVl`Y{RVk`+M80Q z<>a)4_LLN%#-epnglvOQLZCoMa~u@}F)+K0IhbH}oRG?rra8!H4F29826M#VLE79D zem#6$sTv}mIY@eB>!k!)<#yBWCO!VUc~!X{*Ugviz4cZe74#t>+`3UOD$rlo9=Udm z7kqEsptpAEjlVg0F`H(ko2u+~;NAnd=tFPuDXmu9fM^S9TuqzXS#M zFP9$@Gm@N21*&Q*<({|CQbkG?qDl;(sifXYx0jBshDU(2v~5?dT`y;xG(j%C=mM)G3th$qLIoD@j6KE;i&6T5GnFiM8H+5I z8E-yrI9j%R*>dUDy_*aiG|-OGu|Q=^Gwv9-J`PDwKLZv5Ci*L5mVDut;Dy>FALQc> zTtJ)Hfp@=TJ;}qtCqfCQd9(+@QfM1TXTcTiKs*Eo;1a$Oyx|Xi5z;_MiL+_bMs3U9 zMq|Mz3leY+JjOSUCwTTU(EbR6h)15ZFEpBVM4&+0A$rL~4=pG3moUog=_wCwO@26N zJYi@&P@iQ=d(}gR3?5<>1m)};0?_X`Yw)s>2B5PRnlE; zYtpBw3kzi8I<83r??9cs-$NTI3%KB&aOzE)fq!>i2FkoxHFUrsT077>@*yp4M?C68 zp5%v654&LCo45{>JkYFRjMA2*#nA`6kFe%(nn4(}mGa@|eag#4_|7=!27Lh7O~LeV z>Hr?;$L_Z?W#~v76YelR7OSS!EqC0VR0FU|=}NC21@ixXc!RY8{g3`ZKi=Eh!t2lY zVLoLnB0#c@@g$wh(;)Q13<_hK{>^*{4X2+&YeISjkHB0Dtz_Xo0Dttpq(;N6{{8wJJj#hbv;&#|ZRDF@ zNb{)|^9$vM7Q$;Vhj5~U{ON1heLh~zLXZxjCYsS~FyPpbVlxrpB6Nv42B9SI5GW#e z{jbwb zl#4DnC!svg+m`Y}$DmdfTtc?4+(N){io~WJ^}J zPO_$o@J^E5Jx|K?oo<%ZJxAl}+4WLA3a(P@>>;sZdQ}=$q5ilGm0y&W$KLtQ>a7#K z^6=FPVEI-RaOjb}JhcV5JqEGTbecF(`gFRT51Vw-q*=-qi%wbFLpfWl!fhB3lN=KY z3@tx*&@X-vWq$7PV^YNN&Lql@cP4F^>!>4)Nhk~>Ul>q+p(8FoChk4KX;n-BIJkdb zJ^oQ6eR}D_M?F!SPh|{%3tTt{fxBIeAI~>z1In-~^7g#KI)?eC`tEQ%{?5X4I88ml z33;_de!j4$E-;Ba!|{iJBNTEF4ucymsPTgl=H^m&_))$vz5Btq^6PLhts$6Vw3b5$ zu3Vr(d$Zu@=ZgyW(DU1++~b;8NFEsZtGUgq7qCEuuV}y22m(u?RTvNBG_y^Z;m~G)GEo%j!l;M=@>LEzWV8^ z{zU^d9eqvvV(dj9?(k!LD9@{%Uww&)i^h$>^Elp#EjS*BM{ZWFe6X&k%-N{Bm02w6 zEk)yhtdI?(VDFHNO6WH@`W^4JHK_p91R5<%k1^v?PGhlm?H@;TmzN6 zL93Oel{0ohlJ`9?4t>!3q5JU+{Sv+7hjVy*hw&^>|B!DO$J2OxkGCg0nFOOzqXID?OH zocKFsAS?{`awYR4Jeoe4pTpYQp5B&Wy}ex>cf|2`j|a|iv|l0^p})fm(i9OdF|GWAzX51PI4>^xeUS{e!q3A2{AV#C5od z@=g@yex9$x^?Z3o^A5w>!n@ZYth4(iDqo^HhJN9@rw?J{mncp$f8rvn!}J2q%jPhX zeOqMx<9T`f5Jnis-&^|`mb10XvZv?Y)QV?UwgvrmSHh3BT}bDmVY~X<$7q<3*PUlH zJoF3S!}K9tb$^E$!VCQxdynQ5en-=VVdTwst_t^ZRoe~?LMr^ z;eqgv3yd%^!pT}TJc!HB^YQwm|BO$#`lt;~y0F&CQfkCnu^*b z>YT;J#m3lqL(>^R9!wn$fA1hH@JP??F*FQ2$O3E=y95Z z+}21FlLM!hGlDdg5y=7l-j!ubMAoR8FfLUZGEAgrGf%24oUf|*YemK#m0nqzioL1g z5P5rz9u3LBc8D^2CdkuN+I~3x(q{T!+dSr{uNIGR+^U6J?H1yk{7jQgR#oV(eL=Pi z8Wp=y)nI5mVBYlk?#DTl$JZ9?3|+l9Q^ zr2}uxEV$#Fi2`+aY~dJ=p5e+|wLt1Fp(|S80_O967f@U${;E3mO ziRXSi9X4@Mk;j%5c8<`ZaJokt^6@t>|k+00*r;X4S4_~ z%oEuB+~4!}HuH9*?AWB^m;*Lc@b_|sa4CoTN6YK5IfgNL@?>L*xY-uXIZxyHIZXUL z%+nL*{=7%O!@5u&hlL?|?7&1dzlf8r^L)c}__+(;)Ab{Ms_7l}-tzRmz|kLQAN_^) zL?g+@m-ZKMhd)2w=?^&f0|r`v&@lQTHh$3TBODkUZ^WJ%cFv+Oyx#%O;o?U;oag7? zgn2xN&+%@K0Ff{8iQ{SQCGv+jdz4E?OjD>NZO*Z8+Kaa0xE1pcm$INq0gfHtPWSxV z@yye4%9AwSUVIZD8ik!E7HQCM7I1`lI57O@{$6~(qb^myXu8(=ZccfdN|Pu&TEAp* z68W=!bB)7jcvIixn@XH$`I`IP+%E5ZmLty0^&G=v4#qAbe1$vuugCTN9_`Z}hkAP) zPv7y}j)5IV@Afd>kU?O>7uth%D>TA2`<*7F+!ngxVGTr^kcKCw47k(^8b=?e&7pC~ zC}?}yk@oYvC==hL^)?UlH`vN^`UO9H6Q4fy@WT&Fv92As6v^qOhXc1Bp7O1k8O;+G z0Vk0opT=CG@X#-O58!)}JQe z0x8-YTefI6vcW+cxtuGkV|wo?P@fc{gn71_0FXh4g!FHJ`&+#VH--{1aF4;rC}CqD zMEz(a_rqYc4=((?(Wq=REewY{!hjPtIAMw6c$&8S)S9GSJlN`5O?TTX6Xc$oKa?63 zaE&a=m&LQz%kZMka`G2PN}k&JW1M5Nk7tb@4X)9ny_wm1yP67`@I&}jt$th%^42SB z<-M6Da%uK3!!33MDH-W%^$c-#ZiZ>k)v9J%mTKg=04WAbW0Hr$%2N3LZdz>W-@kx% z&z1~LTU`mWuNLo!rxA4nK2|RE+pxMqru=o8-eNq$1UD?$d0D-z$=-9>%2)5XPk~;3YFFBi2@G2hzrpwgLI@)Bp0^-3w&GB}1i`+LWx+%VAuwYCzl5 zAH`8~o7E>^7QBZZdZ;a0{fHa8L+71$p4}+OBAsB0zgj_rFR}b zQF_vl*6E+aAWbqj4zE2vleHi9XHNRz4}WM!lAe6>Nvj?>z}^SKGU7OXl+rZl$Bx@X zI7{Z|IEN9%z&%Fii;IiR{s>G1$F-k$;t9LV1?I!^cD#pq0?XmKzsKYGr$7D4m=TQD z!|d|IMdOC^rbUSS@o*TSi4!NtENoY%qQ zM9YUieV(IbEg=8|9_8zByB7ma4`G(ErGue=jAwIn21DQ+2TV3@qJ4tnH(a{myX@Zg zI9m9^3oqEB$ZO|)F$%-|JuUGQ<&VF|q2D7+N5HuA%sr6z9*6L6+SF+>civnxt`04M z#*I6CTmw1_MjYR~Cu@_aKi@d|6B-%NCmaIf&_(GI>7q0!jNjhg9S?22-0cDH)-Rel zS9m+X|FL<+B__~}Qp+IqXT#qxPuuz|xR6Kt?T z7r4>;#v5;xi!Qn-DZheUH{=Y*t1UQhpRkU==0{(ltx-(E<{%dlaX}56qzI4*ce)m( zH_6)A;OhEJSEFH;wh0A2r4Qj8ZWt--SE2vTyi*>WKX(RJTTbikgU}CwG400%O0+8i zW5zL?_HG)2ix=q|*dv6`<{}ad1$W6bMQPqyEn1HcrmR)LRh{(JvJEKiYR8P1&D|nvmzSFGbI2HAD+yNN8V+IFiUnKsS7L&~ z5eN4)VJU)5rSYxfv@sFPZQWQUbEcwIlqvI6WATVH2THXH_e#`%$?Q!=jA-Y=p`A@A zyI|%<*}S$wFMi1t>Y0(64?dc)L0)=vi4^qDmQS2KP`YRv$LEdK!Oc$Q8k_Q(55y-jj2SbG2_YQ%_Ufyz+5`ffbGtW8@(5X=VQ3H{Bx2_rnzvXDZlf{At%xu) zY^2PaKhKPPbBiXE585y>Bf0CPNB08x!5j z<{I8fU#Q>Xk2=bjdNf{Gh!XcG^@DNne90ST6d?%nmOG3mlb?4Lv27xJZE^amVs9&l)L7#M`f^fT<7&<`mi^B=-$-szt_ zxq*`#-Y7GUGQs5jL~rk8-h}A^M+h|O!_3>@76+aWIPd@&JZP{PN`6dlm2}}J^*|6y zKJ;7a0wc|w4&GtD`T009fGPY5+uiFyGRJKSAUdKXz(Bg~5CuWMyW@^K?6zLsxe1sH z0k{zm{*FG6fp7X38z;1v(KhW%^a*YZhTidf>7|#9zM(}(KPEjtUxd*Q;rD2NZVF^f zB4npu@uc4omnSeV-p!c8I5_>6v4(9RZZUO1l8=jMz4nUlo#1b1FMjaZjAy4K%s1d4 zoS$;aDMm|}ljvvAAvUX^#mr;S3f2YqqftY9(yp}4F~=NZv=Z7vUqAzcxZLzeTf*Z* zyPS0^1Z~L4%~3vXywM0YQsK$q_0SlE7oICF&MCDXJ`;Vcy{=6guXcB z81Q!RK?sJJ-=KTYLHKw0c;cWj2p>8jSA=6DH_o8f#_Jq)En$LBrs= z;Jx7M;Ju)Y@U8SKgi>raQ|Fc#Z{F`(0+u1BjsKxf(Dpd$j%>*tH^d{)!V$&~ULVK$ z&9!`Y4p+^mJ64bce_Bld2qG91Z@e+hCT4_xOzbdJ?C7$PKxLm}!Z2Jv{_&4(=N~CL zOd`Y&A__w=;QiS;xF*@+mBj*s@|)lMrZILflh<8$ok{x9EQD|(@Pm=#8v1|z>tAN9 z5oY8Yng*r-?GF}A=bn46X(o_gkuH82)H~OJ30k0qy>$Pf*$@$Far77MuL{-FD(Iaf zr+$8zOnc^IsZask)Tfq6#g6VHAIeQnjkECEE`Cc+|5A}^3~rIRgVxKr-yCZKF|;DrEiaRMu6jq#{oY6ujB(`l zuu}(WKM8Z(z3=cRXi{!oS0Pnpb@KHG50Q5!>$U48ea-(bKcAyaa)t~Z(@kD};$xZk z(*qUXTjV!inI-3admnlI&nx7p^9IW3alPeUDQ}WSJ1_}psb6yx@-IFuI^e`d&5;(b?p?(inxC}VuMu?3rYtOB%y>P z5JCv)^_$;$@7z51<-H}95HiVqpXWKf%$b=pXU;i4{=%&C+W&r3x&D%cW$eVRvR5cy zDQv&>-oKQ8`Rw84f8KjdnY!1Qa_HlyMf+V@{{4R+UvG$xb@$o_tPAh!&|U+$g)aDO z$Foj#C3IjUwvMs-Gx4;|6Qc$gIDrH+G3h-$O#5xoHQ_ON{on^bSOo_PLX6*J>A(K# zzv`-`RVkAt3M+mud)dp1?UEKZtZJH6o8Z3fZEq{bMA%ez$=jp|J(UL<{FSeKrM&B1 z@2YuIPAcnhu~K^S$tTycvfehCGLdT1#s1#ajUQ;Iq0Kloz&8HL@~}q7X9!)k{o*0| z6hG01ggM*&^c^Ao-S2vLIs02@S4MB;_$_aFOO1QNi%uw?`|r<{ugBzbLMRjQ8e22o z@P;>3enzR~#>2!H^(Rp38%j9*PoKCAjZlX-vO?4+|L_n0P`7L2N&3aYmQ`#EVR)Io z`}oH{US9N~7ga@yzLq9oM1F)wyiGsjZ!dqv%d3)@kV2t{H{!$k8(vYW*y8Z^x4*p# zkOZ5XZ@RhSnRI~i!wW*E?I(CQ3qcAzX%c2l$|*jzlQi(y(@s0BDqF=dfhQ1~(6DsC zvoDBko%k{Z(V1tSSy$-Ql_1*@(7hnMuuPeo32P!`e2@>}2@4Hpgq?NPSv4Ehxc~Ew|0(DG_}oe-$!2h$@`m#M*kg~abkW2K z?!YZ{7hX~LP>xfeqld=4G3~H!V~n4%$D;7O^UkYd!8kFFER>va#u-&6M5ECM^x}RC zn=y3shyI2?-V^XQlWg>j-$y?3k-BhUtWp-9dg`fl@!@ly`&{|L7rs#Gi+-ZS#gks~ zidWPLIo#2&XaL@cX5h1wDf;ud&wXy4NXr|YLRVP;?FgXG6sTzaPWraxdK9gKOX$<4 zf;8|uavNGjj(EpA-Vr?V>X-*lt-KQ+pKwQ zz`7W3B0~!=U-|22vIeCaI)jFZM<%!6L7tmYm2 zd*4%*EnQXxJQFKOZ!p;=Vj$AYBaEN<%xCIAyXBUf>i{6wxpJA%h^d>n8Du6O1Unjb zD~AL@$ZLhypcMY&AzaYL6D$x|X_l%TXmO~BVVvjD3g|#!)ESU zj*hgh{oNhq2cNkv6pJ&;O;;^0zdGlpILmHDIs5&8Ehm5UfmKr}$tz7oA+sgwUGc5=*#;gBY3J6<;y{oV7yUMs`&Fb=^ zcN|{EjO&VWuPV3SytJO5cl68li*3XQ)${Z|_LAS0zj@A*GJ0IB1jann-=c*ps^am8 zXY5(67@O_6E#H&0=sR1Oulm*PWxvBF#5s;*%K2x`EsuWYKEWJgYjZH87r!gc+KDZ{ zlziaYi*GL{f8?<8h^OxveXvK}(mOZKO1x{{n(~TIJfMsUW$L<5TvPu1+Xc1HSwN~g z3&`mY7*`dGT_Z=7V_tn=>3;B(XxsJW*6S9B<>ek_{|8Pi4}4r~X`DK`tXh5_-U8gA zGnWT*?+UtvF05R+s!W_PzC)-DPMEYwu7wT4903q>_|OMGRId5+HI@Dl@P2gekIEjq z?@<>i2n&=@CP(NXC82MEj(jO+@_Zu#1i`^XNnTcrSsM~kC>u?HOqNXA2?~S+ibLrv zymMh)X*M~cu;NCcWRh#kgB3~E6t)^DL$$sR1z;1z0ZA+K$u0fTpC3V~>CSI!LXMI4 zJdBA?fBMtK#L_CCNu@eczTp+xo}i5<;8`ncy7K&6Z& z*y&^Ku01ItZ1v7_k0gQzQK(YD;aA<=-F1ag+pJizvTkL3`qQ6Y`4_(Ti}Qa`jy~$> zI(eWR(eIQPtOWFz`si1SXGb1+WaWPrw^;w-x2$2V{qwc;JQ$O0X<8hktWysPxL3dW z)s-(2NVNg{0V`I9RdAG3U4VYXOD)QYPq9ppCM=u8Q&Qr;1W*bo$I!?K&UzmZwV`HGg(WDtdmc>aug`~oi^ zFHe{_p~}$s02vSup-&*kke@7=%8yZzz91jt3*=_^LO0XA!lZn-Y&Q@pNws{;)<6BK9vq*mP|%EXu^{iJ_9sS0HV z6QMxkX~;CeB%~1v4O)NR4WP-fCC=dd;upVIR{+(Pu#g9Q8psCDBOiH09oXuxECvsd zuDodPtp>mS-`-w!+qE^(*{lw%sc-$C&9MMfI+kPgT(@|R9Mu&{oY)4oZdh1+jf^eA zYvPQ*wRJ1-i{AaR-+X6InY{a$YGpQW*3zmZN}ObgXJ4`bH*S}%x=odXzPV%W zvU22e_bXH4TsdVr>`9X%T!f7}?0eX_O5`ZPT4(q5(<%`-`*cNYEuOsFm{9)3Ie1a` zDbwS;yub?@rTo@K`SC>Z}yJvaC(R*(F zj_!~{(uhFc+9sF&e10hFVq*W7z89RPdY~vjp3QW5Hu*$T}ITWMLWmHdK zTQ=qGg4p)F#{uJNT`6uSMBgqCOUbdjjOac8Z&=K+R)!m>%HSR*H!1pb`Q58)IIUlK z&K6`mHN$)1r`5(SsRN!KbU=4lY~5W}h0wNpD2{H8#f54l`LBymLP2?tD zf@NCkSa2c0sDm)dl|R{F^?lF28nAy`o~P>?E@)maKK3r5;C>rFts;QR}EEmtx=0RZo? zZOwKLtH|QxL%`(I!jnlUWgUfEg8Xa=G1;Y5NYE~X#nr1@ib(xsL5szJa=;4;5x8L+ ziV1}6A*Y;jO0^2aFZB^R))Y{D%k%Cfch@*s78a-c)G7NTh0GLUlnp;-4P_CI#hyHr zU;XfIlkMc`iJNc%9>G^2U1fqti3h@{FZ=-THOrCdi34}<0Wl<%eZPJ84!m9)%Irnu zfbRXvoKR}E_qlxJpM83dw01fSxdm9OYR^pteUHW@EVyGq{hk`uFqCb^Ba0Z}Op?$> zN@ldvLI-8Bu`qMy%wBqQaEy!9t5%m`qlZ-)FmVok!%<4UCQXyKV?W4=aN6Vwo}r1x zLT=wdAG{|n$`{>8{LMPtZ=US~YZEH2?X+_OS~Pib>rw=`g$JR*<_6=&x8yqGKNlZ7 zDSPz^+UL)Lh(5H)0yohGJP!C~%|qFXHtA;;qv#OW5&BYnr^oiRr0ca}JAbxF3*dwB za&v$T(Bxru6r`m*g&)g4v?eVLo4l8jiRJR^U;p}AgdG82H>WLI%)KRRPMbOHaKKJTN` zAR0$5B^$!KK>YJbivP)bCv2M*xc0j1H!q_OeH%MwhS=MimvzV34rtCvp#UZk z81x+r@2D0J6oiCygAo`62qQ4buo7a6l0SlixMM?MXi~y7*Xo~etoI0iCMPC#go8cz zoL&V?X_;tPRR+RYeUXn9=tVJ+XcFKWXgmIi^^8p_omfGa%H3i4Hh{V-I(I?2;+MCDW#FCV^tWAA_IpsA5g2E|9sH;%<(v=yIjqp)oU3ZJwyxYA z%0WQ!cIVucl^8jHZo$pV%Y;x&J?^=?$9Cdj<)DX64U4?hA-J_Hh;F&kcCJ<(7S34_ zLSIYyclr6Z*BgJ^(OiAktc>ly%L$0|3F<2|< z-latf<}NPqjs{w|pjfnh5`8DA09!1RmWe~)AZYL>z?>c12dpN#5g5%RY{)xlu5)Pe zU0(Sv4WO*HAd6%2j@D8rCJ?Sz)c|#8&5i!Ed}G}MQlVBqw!)9T>jbv{QNXb%|Kuk> zS)aC?0hdmkdDfZrzx!GaOWQ#CdAe3rT0_W~Aq0@JGnl_^xl!k?^ob1Y9KEn9Zf6{>i1VMr$ z{P3s$4u9C;b!&-!U>U{I)VU`5Rr)|!c#}&g`r0BKD|||9xTa58-ROI~S3a!fuekh* zx+RaWyEfvnFih|cPj;EKOT7%hx4e`&K^<7;unc6S2>&TaDM1tGGOXvyQ2IRWNlz$8 zKK6*R$8Nip=RE5fWtV6>=|&^;2Gt%JU)%5e+q5>&pxSYBWJq)fO@l+m(h0|(Q2TuP z9@8uRaJCKwknw4vW`P)foe&cymdY$6l;MJ~bjUtk5OSXFHpY)_pX5yRh9$(4p7f-8 z_A1K_!5&Ek}2>WeYZ_3ISGL?#0bluqe2-5~W~8fFLsQJJk8Kvwr{i^>&ROqr(ragTjmwU}Tgi(#{> zP)6@2Q??q(i#e|ILI{S!u(B}GG2n!81_&@{4P;Nkoh=}F0H;Z|y0bK7G7C(qSXGz+ zsu!Vx|K_w$O?WH+VETxK_638Lm;bWWcbDJK{dgHW@{nk^uo#Jj(787(F1LlkWZ*=gp}KzmcQ6%0Z8qS{B7kyLUvmt}tl1;qp7`HeBId(gF54 zbW(ZHk<-f67v2^(@7`6Obo~D1podSb3P1|9U!8qRdEQ$Nsn&Ha5wW#){|8U1xAS(5 z85Y|~C&xKUc8{JTV2XQvHf>_=pRN#mAfAjR)A5bHLKT_ zy$+ffd5kI(rgfD$ah~9e!)!~fMXEo}CzPMF>|BJw!fnRGCzWe{b6dG3ZV0xW*g1n! z_6Q5qy+_66ATgN^<>b>|a$wn`yLI^mC8o=Ikgom8!}omV;1PO4tX;ph{NdJb1Or?bO3b^;z7L#K+mb@iw&u~}*T;6; zUCO~nObdnV{Hp9b_>t4f{?TsJ_8J#wA+9Oc{qgoF_wagY3QNK6!*(fG{d#^q-_X|V ziVLCmmDhEDydy3=85QYGiOXNcml1I^ikp;KNxBGRX*J7Y~@DdF{PtY3*K#L6&ZWbEQHgpROvI5ESg`k0Ep^@kwOF@$ylT(u-@zF8X z%M^y_Ct8Xw=C%R!lt9U1i?D$Hp`96)6&ZR#=&{gZ%cbpBwrVO1A(KTl#Uy{_@aJ9G zX3UsTR{_y>iX<0{phE;ELajsml~3I%h?GTKlV}rblY33ftY?UB2_(@08zM_?y~4wvA{ni%MVn+Slua8`@f% zCePJ&EQ^$ZfKOSWZSgR;qaPj~f41{dI$9`$BNP(&opj&>ekyt=KjqmQNHQ(oG8~{h=@6=0gu_T@<6;v^QLozVmEYK~b!*s*%3>Dd#1ZUQ(@a zjyvw}%3ZM%k59vUpzXCW{Ii{t5=a@9OIra7Q+fa5=f9{*0Tz{%k8s|(hG`vm%Pn)t z@BVmM86ExhxJN&-mU+&+`Q?!hduX}j@+-@{+v0Msun2hQLt6Mn_Au5`?ogkde;d~Z z`bV2l))-r9;lOPm;ExWWOD49)o=H$HTG$rF8bUa@Yb?NLcnaspW^n8L7Pv=!vNz>_;kA|imxi_m*?0O)|DpjuKKI9!Hs(A4O|-D@ zPv27F*&c_7P?YFXTPe{{JO<4`TWVTAKCj}BcxaZm{B0o~Dh}6zZi64~lL}^Z6%2-7 z{LKO2zCYhP|F%pUXn#12f1n9qDE$Fnfj(RjTT@4m8C_*8i=Ox^V-<1-JT#^#o_teO zm!n?S&_en?Az9K6vTfVH)9Ak^p&H|&pFkT!V#;O>9>JC}TQ846Hi>zo= zx@m7RAKqn=7ah@8coe>tpp5!dU!gI=Ne>SqqoZNy-~S6aYV@elwa?`v44UQ7f`>He zMQ)gNLp|q@3}m5NI`ihwi=7Yq)v);6FMe@;@UfP0mAL@C!|#+&9YNx)Cwd|M^vkmM z_slvO1Nffroqt=m4fMrLG0*t@pDr&G$BzrT(RYHQAMRedtXjT4#eN z>c3%O@vxpY86ip`rcC4G+bdvjh3F>azuym0sw>tKw&PxZ7^(Y`|Zhb7O3~9b2C8 zynQP|i{q?5)`KG=otjp>bK{rp)mkvpWr4^Ip7WO%P=_^Z0;dA6lu=!62W}1r7?*Wz z#uJu;s#VTLdQoQOk=FnMLH)j($kTS`s8X~~>wQi5D|3x6?`CGTR73xXnwM4U7L?t_ z{7rf3!%rJ>#8qoomd{-L?6|pjRoqe>Teg+2THUpZ(=|HUWmT&lweaDuPU^3()p=dK zJKwKv3y!|mMu<(2hj@>$jsB=xti#Rl)u;Tqi8~_R{aY33jqG`^L`&d)fS2~&USa+E z;bp|AW#z8x4=!_lvQO!nvbwzfpI=_Cxayj+*o5N9$CuB1;f(UFE`7yb5k<&&R3Gpzl_msg&AVr*?*QZD-apUR1U|J?G$Grv);xcV>UxMQAHPCWhv zHA})U#TCV~G}>XXzHbk|Dc?2Upmk{EeG#(lDQxt=@t$t|)hGQ;x{UKwxO57iVLSP4 z4Y$Ga8_a)elxcfTQ+uGF6m>&|ru;8H=x?kIrM(9W)AVn?54F7aX1FXbzJ^W@g)e3t z)=MUL6sYN@F3tCQvu+!cw=#qN@ML4s+7e;$ja29i)}HA-3#* zJ;CzRMgf7aiY2OfHG`Q(3pxxDpt|5AQ-{;$d}esxjV zZ?Ea)z3+Nkl~E{gS<+b?=npdO{``mHo@wM$9Pc3eq3KsWdVZSj&G%-QPVXBNR{RW4 zXFy4qO6^W*r(4FMfFwWR{eXLgHkl^fv(BwR8-6pr4K97(2J;tsusr&vc;EZdvZTac zUwBbD?TcrXJ$Ij0^$t;SDu{|tBVrN#*7*y{bB{Ty9RGsnR-TbEd3%k~FLaDjx~spA zX^*s}zja!6t}^7eeDXWrJ+qUWZt0$Nz$iP#P4}i>dtB*juuft6Ye;GAP!QNedDjFA znN-TG>rn*qx4jcgi!=D1_`KNSMZp$2v3ybjg_&55n+inX*Q}(J8&+<=X<3=N``Gg6 zV_G-nLU1<)uZ@0?PE|nlq-hKA>WG)_>!lmvZ8POYVVC~$P={LP2vn6@;g)sa55%V& ztM5Jn^4q&|N*iQ)$_KdjhK;x^|D?aRN9oX>SB%V+IIUD-1v`|I-!;d=t6!!~&KSN3g? z^>&p7oXByaV2Kl*@FM-P|LZsi{^lPycm~#mK)}ua92?x*@h|a`Uw`?v$7`0g=HG+E z!tI2OYk_R@_I}BJmRk0;_Y9YA8J}PC-8X2u<$Kb&KKRnWomR{p=U2TGn(yh>{?x|V z&h36%;=9@ILrE{otW5bnlz7`~nEvXaZu}DRJ!w=kUcTqEzjjIYd}i7^>~jOEx9I;M z71e$ef@D^04#VKV)EX1GkhS*{FICv{j{18?$O zn0)v2x3S|c^B(F`9tqh#nRmK(dN$+r=b!cIWc<*a17v#O!d=bw`iVOYblHneiqwD8Duh1uA5 zadt#7$L|WQ(Es=7pKpBiT01v3KHj4;%C-5j!#uxy$;`4~MOPUWZMtE|Zky`Ge5l;L zdU$#D!~a|+j+_(Ys&Bq)*1G&5wxf=2ZPD)Q+s{{2V(x8Y%WhLyi1rhvALrW_j4o5B zI8eQm<*TQZPyFGLWo#%Rvt4Wxri5g%D+W{rjhQQ+}iW#6gKl3TMqQeahD(7;RaWhN^9>J+YkVb0_78*EYd9N5R%yF zAn=}|e9Y+9*1nBSUQ>vR zF;4mmx2f(M)7Hw2kFsR6C38mrbuym?+S+&Wn{Hza4T`3$?HMgw7lGoVPtZ;uSku`#6q)f4lxh z-rAXkGdZ~#C(Fejq)aXy7Gy4BDR#h?sc!Lxuv^3`woM)<;<4i z>*65IUBjf&R%B-)I8@wOGR`Ps>X`8)(tO{HD(o;(5fgKzE9V_nMlcV9aa$YU^0vrl zYuBSa{iqk~y5Yk%D7o5$Y|U>xZ%o(v^2fhSDOdk|PI>Gz4lI+Wj}J?}wV_z+DwqHA z=CbgP)n(>!hqf#mt1c=Eoy;=(C6K~6>547FcP&~|o^$XunA zJ8W`p0?bP0rPdv zpz{MM_?$)JaAjxH5kM*XFlomVyzqrDtU`fv@SOMN0A}t4BTT-NFtD}SF8jp=C9Dyh z*_Zr*V(82>&#Y${Ixi~S2P=z(rPxw?vxv=QQg0*|AyL4%NN$ zlR5JeA8rrV{@rgQ!Hu>-ho4#qbY>LNkq4vG+eQ$Zg8{SaQN_DneGfZ1n_t{Tqre0lLvHN87 z=z0N^=P*`L1JEe^-Z3=p8gSOEGlrk?l&4h1l5_u^ne14z2-XMsYr}Ncr!MOt1Coo= zoowkMB6$pi%NEJqUmy)f)VK)F*@6je#YyKr&!L3r6JZlR5~t~Bz7-b;TC{eqv~w!S z{}ig<{qA?GY~`HYY=?Z3w_o+DSCzBQI;)R@F#YLpTnzT26J8YO$&V}-#1TS_y zXFk$Qckc=EObvdz?WoVLVSxtg$CPufn=uf*+)=B)#p^X?R4Ci=*;%Hy6&p%ynD$N7C9{ku73+Od<%Yag_C-Nx*U zM`NL$mDpo3gW*|SKyE1MVt|yFeQ#>{<&rVw|E}l?S8-bPtN!uPTUQjSr{2=JDsJ>X z`_FrnJyuOD>p}^+OI)I{E{Hcj7COKC{w?LOC+<-ugc9(Hf4^TnTam2f+{bm1ucU@M z$1%dnqsFUS%Oe4KZDUX#f3eP1ElR$B?oZ0XxGCHXq`BHv6&Ae>(kfsowW{AXF7wvR zu2~-k4ioSJ#fCpXsp34qJjk4z_Hb}JAPhSo8Du-vk0JbI{_tWbpzoRh_kqKlT`1s^ z4;M@T7jnG(1bA zS9@!i@V@PBZ>zT_y9k01OLhSIt-W8R!+p)#=)(~$`m7H?_6>jGntf9P#838-e7D7x z_sn;Dd*+zP=k`{0|GOD@n_wA#HtX(tXlNCslgL0x8o?y5&3LHEA3+x~}Ku?OG=CT{w!Dyv~Iz zPkriB;*y;!>!mxHR+CO<+F2&&g=YP0y7%!PZD4-tq9Mv5d_DP1);alz?@n#h+b7yP z7M?-2TRtQU3RP zKPorRnHw@^OVQk{2e}PU##*3u@f|}VN6}Ea9e@1s^+G%SqOIUCfXCV<+l?GYCd>Y) zf#Qdv`vdR)KwaQ#TBUvA3t#Bn<GbD6Bq2Ih2r+6n{bmdWuD7y zv?*Es%U}L-HR^H^pz;EBPC3@Q_HzTWHU+-5ZMLr+L1@v;nKSE=K`wTp^rIjZ)}?in zf^I&}_RGHTo$1uX<3~So6Xw2z{;KT zJnywFzy^+qpPSgMz|+LrBBq1fs`Ij!y{z6MsSh&E{5 zE=XGpL4>DFJp1gkt5)CS&dL{XJDk;b%EJ$Q-~)9f%0$m()j(4wD>N7(V*SAney|dT z`x3&`iVpFI71N@a%#7^1w2T||*CEE*8El{ySk{^k4iscyzhM*O5|F#gxV3u^9Inlm z4#eO3^~1{4(Qy-YTvWFFqMOS2znM@b?LMYl_xpw6yPzD|yaBjKm+}I`@ zmxJv8@M-1o&)>gX{j2%qnqS`*j4dqx<}NEozxIJ;(r#nQx!=B}%shVIa>w-x%T?#k zEu$xlEZ3iZYkA@;4=snyoLcCfktYk#*eEE$KF+h;E?&wJ|w${ukuHS5MC{B2FL#Xq%g zv~c~E=N~S;GOPechB9z?x#iY*W!jX<)vx&@9L9$M`P)`yZI)qczoU;9TPUswKuIq> z_uOmGxr+=yfLAGx#{Eq$;L$WJmiYu?VuHu0)`Rlj{Wa^|{;yXv|JsSb;=zF&* zHWk!_OcSTy|Ni$CXZ0l+gH;6~m;9o=zy0lRS7Fx{_LD+bHKAZZqff~utSsxEwf$(j+@T>A$>*$u7=gceD&$_uxoG`BZ=J%I` z+%~2vNbflv6{;>Fi$8KkK(Ve!{C-esJ_0&^O z?V}@ruZKOfWkK6)BZ|gnKl|C$P{1w&eIrknf)srEdQ3h%+Iv6hHAwb?Dt-~1Vq7fpaEq2 z@66EhGU0SMJZllAqb6cZVOfe`LBLc+xlz2y;T;2 zoFESY`9lhWTYQ7=lb`xzdF^XoTNRGnl*u4;%Z=@9kPhrfOsH0<=V$bY@#P5`(p-`2D$d1E%6O14-Jw|e*JQ$>x^e7z=bmwDnDDFK;a}rc$DVjKaQxInT2HT_ znMNH5Jsve^PeK{3Mu?Blf0fvQTa#<1(Tv}x5H(`_^dyw^6y{#3e`LINU7UM4wq=Qu z#T)8VJy*shCJ%i6KGA-|%beLu%czN?%2j_@Se|;){>47r6>;H5*Mw1J=06`=t^dCE zo-4{BPnceo#n#)4f3c{%{wuMC^S8H`3%)g{JpJSY$|c`lSRVJ>eaez$Ys*jmXI^>J znU5~rkKVnU_KM5PDL`x2v8e;2)gVJBNJQ!6H$=Bd6I-`m z3O;(&#E!8DeHIibgFsr2_kcQ@Q%C$fbL4*?ZDzrlY+1jS1R5 zJSvnv-Zuua-O%}yLV<&qP~u3(gazLi9X!fP<@28Ryef3#MOKNAKI-W5lb`;iTAjPa znDyf?fBDOD+;PX%rwPp?LRftAlV?`JkAVFz|MD-DZxPxpSjqGJ^Utr(SHALu=m<+iMHZ z7iTuV|0}LUK9ofB=C2B+&Wbvb?Zu5&wsql=!s5UKW(573*5lguVRD^HICCg-Bm9K| zDQS@LX!4HtnSa?fYGH&`{8M7f;&Y$-+&XbKkv1no%g{aZD|0tAlC_VCwI`(j9!HrZ zKFh-sPdu?IwkZ98vfzjEvv4JzMZ^ojs)q#;UPoyFZ*~-bH`?m$Z-0BGfBM0q64_9j zz5U=>v*Z3x>ilgwcnudChCe=R=Oc*T7%@`q!!y zT(NRRRRG$N;n)@NEHdI-77?HGoaa=3`6yo}NPOYfJ_fk8`*#{E!fk1gk0W@-#<3r3 zgEmc>6g!T>t<%|PS#CQlPB`I&YK>}<&el@827RJ^?C5#=)1MxONk>IH{j$2*icU8{ zsZKT^bDeR<8MQ5&cxp^$TVxyPH)DYUi-L-5NA@%3^rya*riDghfbxoRkep$x=r_vt zS+i!<{!Cdn>$9cXbg1d6AGs+3-Oz5@h(VS5I-*V4uMY*_>X5Z5sg)nT+PO*ovLHeE zm+fZfhB2VN(xIPmULb`iL#|U#{dkr8Ex1~6M=Q0THbt-KhtL+vLv)J*_J&ByVh1Iz z@s@p)W%tbdJGJXTe$6zt<~yl@D9~HJ9=Tvs^1Rn901Yw|AlhMCZG%Hco5&HWk2>n8 z`c6=`3bg31MfGecT4hLLMV>aarm^9NSUskKEfZ6tyd+$3T%BD2<_7W$NXH*$ip19wOquq81!bgzY3EN8x z+_~t^jVelOI?;;aHs+~&jwyTWKe1f;)7#3VUB{GJmo6z!K5^f2(=~U-xpl+C>aHu4 ze7CiT$?$dM?uB8wwQhZR=Bs9u=?9E2OBSsvS6;B7PNt{q?{L>)W!3Vv<%R!#NICEk zQ_6}ZYs#aJnO2tFy{e2HGa>|<5L*L*T;yTfZjh+@y*_j@<0p+OH(s@<-13)2W#PPK zWzrsF>vmsd7`w~JG9t<&9{js&!HV*?|I%IddyvCnhn3^rbYQvl`X%)i<0GEAciHRU zu#k)!pwIrmwPBSQ=kSdi(ZXGkhlSR0eXNuZb55a^k#JlWH0bjdyc(kIy>Jttp(6!Jb*7;xN0lal<-;HTaOFn?n^D29@|;CypAbq3uB-|1O>L3T&bONF z)9xou(|HxaDat` zz9QrjDlH~j{RWh-&i^5-Ui+78WAd@8#(|gmo9uDOA&1mIxRr~GS%&+|6W+nw6u|E< z_1=-{sSlGT4z*r*CE49r+sOxq+G?eo`L+Kk@B92W%OeijJB}J*kdV}DSZsY9UB3O* z-50PC{xH2O_^u6zWueK#! z1!WV(DV(*#kc>!=kYFa$-WHVG!{b~+>B`r5q{yNKpD|-bmD{AP9>$71#4$Fct>0L$ z*=h?%SjT~_+P+z#L7vUJ!ZmswfX2YfgQK1-dp{Uur<9{?wRiyU$+Tz%yfq%+rZ$o$ zD_}b(q(O&+t{5BI&4K|CPFv{%mYFj{h6dir;N__q4Pk&mKx{SLh#mVE^4oD;0 zv00aNtATpL<$FHc!=(F`dMaWRuNS-;%Sjj4n_zDubmc8+n;3tiqh*8Bu3N!iYHZ>| z(MOgVlVA*~i4+@M>Fqeey7i$1iF4V8#c@W_BmoUf+m6e9 ze<<4O^{rK;O~E~9^DSSxCM@eFm&-4hUw(eptnxR{-!r!J#^Jcv4l9dpTTwp$x=YGS zKXQ1Pw%6G5*GumVAwl;CF&!0FdvRtUA~SB6iWIR;xRRZ!IK1WB#bxQD)l~_1<7G?A z$dlt7jEK5&MN8o}Z`P8k%p<4{r__sdfA@o%LwUHq9Cgx+P#jW%wR(`H&e~PZ`)oM~ zKQa*U+KcWiPkzywAad)=4VNy8_bIi^(xTi{z6sMpu@}*h@L{a{BGJ`z_9`PLFD}DI zttqST2n)#3D@)g;*!nyo%%$(1P}bfxv5eene$*|LhD#=w5#yGWHH#+IM7nkj3%#lw zY?ZCkZ%?s1dG+gt#$ezkygOm*w19~QTp4VvwD%uD4Pd5t#i0*4vBgEl<$$JQyS#EeDtZ(na zSRrO{$jXo6QJGA@@G<2!p-#R>aLlrbOBf^Y;A0ex-YKXEQ1SsL4<;TaW_Tqbj2~V( z)C1dVLifQR?W_+i08;8Du&SILf}=%1Z3f5;CR5r69DMM><;Oq%aTR8LyO@lSuHU6+ zdliMO)oF{JR{Q~>*P^EM?ymsn@6Yw$5&E67dt(4S(&sz*;Luxb-MY2)2#TX0_26pJ zjP|sqtX1?Wqk>L9@5BkF*_LrC-cv0R^n^WD)(wlFWi2o}M_6 zZ7qFsXOObNE)#dD3Mk=~OJAqupm15HD=xpH?7h$4l}Fz2*Bh#_jYS+lmciS|7oPeV zAI!3mHRP9R)ks_Fr(K|Hq}!iYwhN1Xx`x01`@gS>RJ_~~VwB@4M`>FYt1hb02Vhz# z==PvcipZ0CGaWnkCm@>rC+ftf`X2s_1qtw zTR#4uAFsw%-QC@Na0N}Upbf7XW0BF|Fbmm}PCBWUs0trLo%u4ecnEjidFNFkXhnnRvTw`?A|g`En-M45hnYvyoa@BYwyQsZTqhFZAqOi# zibaHM$A&;F7El4vl)aFaG1}K(6RKOU7!vXP>j{(Zz2E)Bt>GGJNS|AuXQmm?W}fvu z{W_%4TLvj+xO~=J`qrmr+Q`4X44Fo6IOS>NoB3tDKIQAlw>@qvg}&v;G&8?cPGsD{ zo=G4O1C}s%%voM`nL4WMdBDVS;kRxr`#xY&D9_fFJLfI0)_;dQc1oFb#lmvYcSA`0 znezc-tM2kOWyMm5rN%bo2z%4zORFOAn%^$2iZ_;izd2`KIq!>qEw&BMc*MjqIjs2( zdCb)E?GId6e)^T`%h%rhm$GtMYwP^{*nUir=p4b@Z(3H*_B;2#XIE=J7mslN)XOg^ zbN|{>h%8$iLgapK&MM_QpZIh6_D4gIiCdNT4y(VrZVw@IB|;kq8Hcs%wLiVPhN}e+ z%fGdYCYP17_bJ22FD}ckJhZHuy?a@H$w6h!ox7IdqZXIdx9u74lghA>OUkNS_APh+ z=;3Act$W0G)cKn3vVIMPV&6WgX>Wlav;|b$=)uA4?@T_wd!LE3@XcQj&h^2s1|HV* zGwq)6iA%lD9{&as{!8~vr_VFO*6*J5vV1j- zhF^wBCRig4@h8hiDKmT4?5gm}iOh@{GpgV*ci!CUj{jJFKjZY%>v=^44!p_&k%cS% zco;#=t-^#iKru-0z@I3U-0VxJBv^oJ|9owXtyWn4k2}G0&aHE*Fiw$V+ldJgp$GG) z43s_rfF(sL0Br>lw+YIkO!Brx0&g?10EA0IFTM;%oona(A$bUIvbZBaFKukAj5Z|P zrPXBinZ-YCZMB)es9jiFkXy2?t-@3OvJPv?AU-g0#)N2b~PY^0I#dh<`eNT&(n)_>uj&x})_J^sx&`7V4y zzPH!kH_(6io^giq%s4gOMtwP&A9FF zwVXY1d;NOS?){cyGkyN~-Sg}X%dhb--95SIGviy-($>pYtgPD^T{gC==dZrUJZEXo zJg7$Q`N{Yei|_*rNO%=mW$t8AgObh`NOLUPKJh3EK_^0 z)~x4!2Zg2d`1OUquJhq@&N-+2@>jpCTaGh* zG7p6$h1&o9-~ZKqS4U}+J=81b{nFcBfWik(YvZ%dJgZvv9;=p zUsK+4KOve|Nbcb2by=p#stMGlu4BVNV}~=X>a*qOc2e$5e9M80pcTS{3-0x z!jFbFkxrScY{*+UNz0d-8otPb1Zj{$|qVBkY7uYsd2 zwC7OcY=>3fA&Ue*5x}A1-RiX~%cn1XcIb2C!inV}G{%{ElyfWYUL8ukHDz*K1hO)= z@Gg(ie$YXaai|>e)$NeY7_TG_Uk+(h+e4$udxu#5*9NS64l1~~7L)qvV*=7=)!i6Q*X zdT?0&#YXps|Di0q6;6^6u{L%E$08?$VbgfkyeH;T^BCnu>SfVXOxL;fA13U?tq}BRHCX zIOhpZCAizVWs8LJ;ROU^ywsV7+q(t)MZf)B`Q+!$EYo*q3E6i+(-z=)x8G5YJ$hz2 z@q`!FHfi!aePOE`Ie@&8_#_}1fO1eYLG^7U_?Q+|B@g=M#ClkY*_Ty}Kz^|Q+d-|^=1u)`0lt;E6`9l|g0 zIBDSzo)*bw-O%C@c7Hh{2`$1q&@}u(95fM+L;G0d;Ui>Gi()LE^!OF!mH7U;Co zVC6}F@}IhD%Ow%_*5CoorduC!f-vTz($oj&qV`22wKe4lMVox_AiM`?!{jC0wG+7` z=eZWE$SEnqDDR5slO-W1;YT_Dl{aMuIe6VUL<%JjD>UIOY}uB{ z8jC_k7-^H4D2OSXovCbVtsN4ZqhqKAY5Zi{&JK&i4}JX8l?OGv>uaETSry}F>f}k~ z{qKHzmBF&`>3G-n($07NPUe%o{?&)%3T2_Ypa?TIX3w4#dXcH+;6o0M-BPVxj68yW%Nm-?bL`%3gcyTIJm1o_SO`;f2o~aIC>~;~z~3`M5R6w?cUbOcHSe8ci8In+ik> zq6z#lw03u45`l!tbCtO3lmru}1mPfjcQ7j8+n`I3UZ$D;n=-&My>0m%ss>n{JJpGM zJ9G-y9wxuV_lF>Mg2DVd#Ywl#iJNJ7BEX=(GFHz4ezF|eCEJD@@GbqO-vCK%QLo;f zi?S>q83Mty*s2(cz~Q62%J8wn%Iz!TJs8IDUE^GfyVsVkiQ~)UhnTpvigEXvDEGKv zoAH1C(&)pHU1dZl5bq54uIZ!8-4X1%<#B`Q__5{i?x|(iZgH4v#JyYC=k|(h zrzmA<_}#rMwhv94SXM;ZOTvFd*XS}l$`*GZl@UE@u3Hh?%67Z6tPP95C_rp$kFCjF ztIE11vGsTH^s;Voe2-jSR$g^*8MSwWTO3CRth99|6o|vag7D5=qPzrVZP1gbG9`pl z2iNr7sAm&jHY(y444h?XPcm`3-5p+U>X>Oy>)!hAum6(wsAGTcgp4Nt(SF)$uRZsw ze_1DO)Lb}9L4`jdt_jlEzelj~o|7P92twQlR4Mpp++6+i-F#2Jnteq$Gl>8MJ%YOO znN$%12=OWC5~Nrg68Hh(j<7&bqU71$KwqK{z0hChMu7gjOq{Z>vdyH2j}pNBCFqN6 zU+?-JPB@@FK^oesDR1x-zCFEkZ;m(N{B6!S+Y)JHeYVvz%d9Q3J+x)>dsE7i>2_+* z^xND#YCi@)^RH7rn^NxkM4bKx)esA>{S&g!^ZVX@ZVBAWI&87DHZ)fzJ?JwP9f|9K zqJ8EztoxcEoH!Xz*_(4J{;AXx&pe7E5WxMMH<_zZ{4_yays*g++v%k6L!pz+bhqXE zCUik9UgGzJQ1V$QY6prx(B8fj7J0^O`g`Kp&H1f(+P~RX!hw`2^vRUqSHd>uzZOp^ z_E>IFhOkO(>IEpE90fvAmE{y)*~k`@LF5JsB#J~wd9mmO!byLt!KQXd6bNp2lC6}r zySv+?%7Q5mR)_e}e%dtKl{>fWV{%ice#k{b;mHl+c;KEioR&Yo`vMp^Ljm>d1pT>p3fsv|e1F;A%`oYVUI;+!lq6UF+mdRYo(3#tA-G=I`#Os z!nTNU#(&C7W7RSU=BNpC%lb(XIueprh7E_-M?713wBm7vZkwaO${^hk=9v1Rz= zFx4Kjw5*;Vt8goZ#~FZePRICAlrD>vFPDIfXeox}*byT0ntw;njdRQ~(2hGBm&)da z&N2)&mBedZv!&W$sCjRxaQ&5AKLB+c=so?KG@!ag^g2eus=~j4cuQ@(2%l+m3ac#A z&GNM8n{k9oekHx;J3m4e0S6G$2=gor2sO&Vy2F+qhp$rxQVJ62S=tlmGrgL?cJ_0R zzPyLS;04yM+0KdIVpVzsC$e9oZ9BDZ=AezmZ}yk)nRdR{epJpz|7RLWV};#RkiPhv zlg6gzy(#gU<;^lzJ`wGc{gGidHvNp3={DoH`{j2t%uwHJ+@5j2Iq3{FzwIX6rlV;` z{H*w2iQ~Or!^Ax$+1x(Ov^F=LO=%kR8z@7L1La7_GUYSf^C=#`jMMziddZ{xJ>#Ui z^yJ@k&-W}>J~OX;a!jSW4AX3D;hXJ{d|BB3+~G^ke>>%u z{pKhON)*=Zw!o(HH{($B;ct|G771BTj~EPq%t(#?PjtmvzW&wM*VDk!9_#?AgxZ);hP1b>+$QrIFvlXIc4sx8RVM zwzj90<;bw@>5zLV^eAuPF^fhE>y&$=M~$w^KbDA&*m+r8utOPWOz_WgDAQJfUexJ% ziAQs%i(8eu!q{an=v21fn*=+coxgNE^RK-e zebR`unG)OHVAa5ZyZmigM?{>{;iffZwCbP@Gk$v+l{5YFy;&A+8v}a7NLaCUczN`` zH-HH`l zg$K>?;=AdVVc-zxgrkGS&+(9H8LPG`P!jpG&B2rKX5|*{0^=5L+ZN(xI*f8{99~Sg z1etF$eQxQO?$u#C{b?VES1T`dj2ScPIF^RAvaf{kCtkCUdX z-I{gHc%J^UPU`4gc(lw`Aj<6I^;t)8^fv{#3wzSCCDS3(M9Q_z(k|CwjZJA zEMd5blVLnT)4dNqRNwp84<&+r!E^8vJjdhHQ$?cX^+=TQ@H#_uT!Vc zo>qp*XES|r7MaO~Z)oE;zVVI9%h4=6YV?@VH8^>MeCBLG@|C$ix{7~oRY3Q*5-Ggb zEC4ka0<#mgObbBls)*Z!&4U<12@3G~2xkJw%bRb4=8CT|7s1-&&Smc1T4R+hE5O)O&`bW@zWGCH;r$2owp<#*f>ZVO&s*38>C8ZJz~cZpjK*R_;d z{Z+2F+PyFRh3xE}xa2Yh2MuF3&eBNyY~pW*ZMsR7dw)3E4BII_w*=>2I3Et~VQw#c zVe5>ve|_7(R^>wzchLrAc33oqH)8k(rO;q`W|^DevJBhHv)L}&OPMye9B|6YyhR+_ zdad+3&yO%qNN4p&ISAk&Am9_|O~#!ENGJl*+8+CFsAcMJxaJr!Id(8LenSbB<1y=Q zyk%Z^2f9yjN}=j}MUdkq)6DSvI=OKNc&2k^tSrkH|Mdi!X8njC=`_cFrt6S!6E$1B zSH{8O6!t(FhEk49r$*X_KX|5#R%XXJ&g2a3N+uvbIDGxM z{cKfYw5Ofvd$vP{g}26YRs2PuPIxSAhL=v3sXfh2nFLCgoZ+Gei_&<$3!vP@nOhQ@ zdCSvTuxJTB@1|3eT+nPc-&xKP!#2nQ+?`G5EG}^^6dL2gf@b|QetZ7uUL))vKUsg( zX})hS)l;Tycm2^UBTFdr9>xvNfBy5U(r@B~iS?#i=l{8|6QJ48_}gcc<;&ud!7;7* zow4n_w@fde+f%)_m$KZ~%8`AU&+Vc7%F<3x`YTt4vn8Jb5S^m5CL2=@X-6eBVymD2>r;8Y%dGiJ;vx8HVqnKyr4HOnPnI){M; zOA2=si4LXZPPmZ{iUuw8^KVySvj!!a4kA(gjBL*`w#Wm60umU3@c05#JQS7jd&jp z*A+@mD!cXT(`7bV;*=*>6*MKwl9a3K{SlZJBE!2 ztCBJzwgs;$V-LF_zQb~39bvX}%S8;cj_}`fVr;xn5VK}=W1f{H{z{g|}8-;Ufi)voqkRaYhl%ES;ON0^f{RxalkzZpozJnm>vj6Q7TM^rICM zOja;Ns$r?2kB;?eYtxcCLUskTVvURhfb`ri>H+@OjnsSLe@m~r+3yhatc3FM81OabGYso*_3;k2} zyzs?k2zM>ItA1ylltcNIRXF8CQ?I=0%5ukoJF3i}ocCwYRx@YLtjbq?2!GwAP6?=; z-BfN&=>wK?WG#RE0NUlqg2ZcS7@Ni%+0W%9#)0wdCR$^KoCa@x|A*hlIm1iKJ~4I= zjtN{7^u4j`aChM5NIV&zgoDN&`iMrrS2$>KOu6t9PyF^yFOg>qqG3RIfTy5sU{ms~5jW~*V=;a3#JA}dV2HMC z>9TU$+S@h>;RdhH{Wk;zBy{A;_W^hJZM)o&#{oDgO~=xvUCl?|8>MdXa*F zC>`~9|5~>Nn-sk1O>e5gpDWy1_!0CHOw^Rmgn~eX@tGVD?g)GE8@%8J zFQ}6`${4E#u1I$_1|iI9fjn7_h{y87b`ydbSP&D0O(DiLa{R1YzoM*JcXtq^ZLZtT zB5c#=ns%Bvd0|*V#+JTNfVM;f3a7YDc zI&l5EWzoiQSnTRh9)*VNBeZ0K%EvDANfioKO|g?|ILA>P@i5fw~z(#)dI#9I)O&YouwS1;#y7sP@&n@y?Z=a}tFl}4kq$*21*3Fd z|GL*#%R-iLIgZ}*AMYtY`}xnRFnaP!PcE-~)hnw-?(@T9?vZhLJ3gu(^_y+U6k4p> z@H7)MiUw}zhey!XBDt%_O7Vfjl>e*P#;D0V;mp%2%*^q)S!*I)hWSJ$>QanR4o zKz4Y`Ti#M{C}ic&y3vB>wrKBW-M8p_e}ig>nN(icqtLUEO1>ip;USc56k#qW&?m+w z{)ZpAVHD^y)@-kO)vM~wq+kB>m+Sk#|NFmJT(FhZScUKY;PpA@oKw>?#y|3rk5oP@ zZ~Xv_duifjj=Nx?sGQ1!54-UZu2H6)c;boW^wUqT}p{DFh7dChAok0x`Y4Xo_prE=T@Hln?=KE}7Qy!KputUfR2+9ag2z|#Mdu+{T^UW{hmGjb1fxs zC+;`Ygzit_XrqSMR{D4Kn$>0eJ`>Bd=j_ zxG`XoYtl*y0LLlcO>E_3OCsDb=`i6ievF4Pu?l5^!aC+T&p9p>hG8)jlaZM*DJ8@k zSCkkj#Iuqx=`i7OrbVvO$|LdB6HOKeo|?p%jImOo9B^hQ8bDZ}%rl`O)T0mo`Jew; zX#+;7j1=VFDF%)8fBeUPtdnQss@M83^4prQemx$uI_eV#`u2>=t`V)(yY`$ZJ=JSR zhQz(>@2qR`;db}*UmgMxYvSz{TJ_p6u6l=JhXM~&3l=QKi3J%ncy?HtQOZB^h)4D= zsKM#ocHOPwIQ+Nph2KyVQ1)58VkKn!QkEMh#*Hy#JQ>gUApU5P$vCv4>>Z!U%UDdN zD3+2R{_JNztBME;C_ELv`Rdoc+M2*GzN?%Sc|SM&q(LFiAHBfySk~M+_tsc=JHO^d z*?@;ygpwYG6q;dN{_{Wob04e!4o$d4opRzqcxIUe5>N48U;&cik^+vB<};uDOy$8A zC&(k{T23<2E?ad7@MH&ligxM84}JJUy<;5DW~D_DWPy(o)C5%={P^{+e|^#BWQDiA z{cTl2sx0IUiY9RO*=JYf1$s?cL7|7&E30yu=v&w$FR*x`1QLfLn5;u7Ll&?YbDxHR z2Gt-H)BhCGluFu*B3N6ZN!pXb)TER$?+tH!L&aZ;Gk)5b0+kX8uRA@Ia29p7c`9a& z0}IK*~^*}hLPrO%TFQYPzvW7?4{lyrDBeyBh3QFwT`>Ba0I=;x8;Rj%8w#NS+BYJnp*C6zT=%`-~INjaws|5aUAzh7HvX% zlY7yHp*TCwzBWm+HF?o zEs#-vvI3<^e|05(AL85Y}Xc!=hwi` zfyDJr@$7WP*(IEoLyZb%B}MkltT|` z3E1r=fFKyQmDDtQ%`g-e1lN;JI;jdh1Z~1WD!>Tagdgq%VNZgP$qbO5Ne@AR5CW-J zuZmk)dnVtu;lBAzZ>|%oTxEhU1QP@ZHd!5>@u;MtFV{Np;dOjKAMIq%1$gK~kQ*#t$Nw$_;R z8;4n*nqd4SK2tiHD4FB{aZG;TC3j^K1~}`5z;7aBY*2Wh3Fri&A1J4^jRVkZlj^V~ ze?sDu{-}|o%AT=EaRK>Np+BM}iyo|ibf?oS)Kj{N*KwjeLn-L)c>kCS9yfEcg{UDsaqPViS zZTwP5;cJv*c-`e!Twc?npiErKGj~xd|W0aY45^cfDv+U@P1#`z3C{N<0daqi&s#?Vg z4}Zxi_&mBv!7fd-k75s?n{LhoNmt-LImY4x(0|IMkEN9h>u4j|w<7@>wfk<2zcWyWtWNLgQvEvf3tloq+fG=v~!z2 z0Ut&ycEYx4f$RTz!{8ZhB#+qUrVj=n$mc*c$}pb!o^gAU={I_Y-|*}==zt#bY0oRu zY({K`X~t;}+YHx?-|0Q$dgi-ut?#}u(jViVIDTwhaU2`B*Yx=dVPwL%v0*aZnOI5# zlV=UV?A59&K^OzGErTV4?M0Mrgf7YktEf47BES)bZwN#s;F|1MWhYb-iU>U>9eH+( zcUuk!nM&rvtr@53o_@`E1HEV5 zW_p=M`t=t-{o9}Yh40Tj^NuH2yKYTA*xGyI)Ijh2K;jSuG7A6}AgoG^DON;#?zLxC z(yLkw$+B5x9poXX7RW8p3}<V2mc-qYJH;;Q%S+*iBg9-n3$O%fjdw%Qo zo~}=)j&*5`2KvGb;&T9W`27%>(z|Y z9<~{-8Nbte#`VniR$d!uOs9CA+*+e|gHNW1R#W1j>3E!Nr6#771s0j`7-8@mwA(m9 z*C~a7F`9Ir(rxaobL*sET#H^TUx5j(NwP5n=W@JyQgpG7!E>eWiC5xBU-;q|Y8>bRAEjKjZ#x2{ zseboI$Ug9ddz8|YfaE>0m9Yi?4|%{LRZ&XWPH87RVU+_)5jeKV;>IY+nf-XV-IFr(L)EtY_*I(pWa@&(%gFU4KSmm=$cAN+tMz`ci z2A?@|X0_BuL&)@Yy;yKic5ST9>#;t&OsZ`HkL@BLpZh!J*kkGro0M5tYZ}Aa>+Elx zU1be@V!R2DE}^f+DT_bj$T*~sOhA{k)s6;Pr^NrE)Gxz&=DT>U?}1au@Ee{3hwslf zvX1=v`evF<*JhYzoc6HIaLxFg-ZQRez6;m0%ZNiQn`=LAan?0Mvp3!CXBm> z{Os25gl4_&EA`K^5AjKaIfA;PK z(AR6a8~>AeKxCA`bgn2RhTx?&-!~y@C@oSkCe2X#O0{pRguf6q|3k!^gd)7Dh-%T$ zQd1BO34%muwUJ2@BuJ`m42NcX(U@6DPl|y& z2w3QwFv2K87-6g=#A`3(9|6?1Ms+3}35x)!Z0XT0p`VZmMwAf-PB0;KGWyvTrvB>S z3>a`Ti%sB@R+~BPCqRlz2y)gUMaQ<7|521Q?bfF#hsvLigKr8`+rOl(|MDDt&Ht}- z{j~jWxwU?6n%2J`Z?0M-ZJS^6NZ7bM65fA~i$BgkWtS(1uJn`OF}TT7oc_B$p&v2S zo$~%ux`PinxSN=msLBUnoKQ{?B9Pk#MW9A2`WS`M3Ixi%JQx;Ybhd2`4O(R@9-3rO zBv4bT@pT4r#sjPL7#_2gR~^Ii8L;&YD<9NR{uCkoA8k^I#7E=%K4#zUp}+gkdbS^$ zwZ;C;N58q!H=_lkKO?rjARh{lA7f=7W?;1@oVqFF>~EY?W-_nt?t14tb`RY9zTMXf zAAHc>_p3bS+;9I!cU@U={KWnCnd%?nZ;~GVupMGQvvQ?kK$K=xKr=MQON%YSdlY}WlJ-k~Lb7e7l{CgRL zj7#W};;v6iZ|p$dwjYYC96SN9S4S&v^jqaos`W$L_KY!jfbEjn>6i)TxHF=H zEu4a>x}ppDz=t}KJ@94qR)^pXA0|V=p|bIL_5a*ypX<*3*147D8pT+oKbpIl_Sw-zHW+@KeIC#(6$T8u=-RDH3oUMVZ}#IYrn zY|2nBp7SrsQSims2Dj*(0oizJ^^oo7Xfb%$+1?*JVpPs3UbAY71ijiPKgIa#?qqZEeq+$={rR_LHlB-aY0~4=X!SMi>8piS&4rpR&p5rx%(gkCSuB z5$cLA@dpNL6CwJF;|T0(@q;51*y>4kA&Zk&zI+ zdFEZ%=sU57pNT*H9F8}aFBBsHoHJxhJx1{yVyI6Vm{COD*zjW5w zQ@p*+MYV4#{b!rP1NL3{$eIpK>7U_S$*WD*zPD|O|4^E?U2U3v+%{hF8~03F&%BE} z`W}~RxsTVJP10dCwb=EGwscLzWZ_G-=-b+ zE^U6|Tzc8%-PgW(URmI^?JDB{JY4guUw8K^yF2f**UU@L`uW3mY(ATmRVcSO+a!Wb zKk|IObt+0qb%)1c$;ooZtW_a{PFufvU}dM52!(yAt9asvk=EPg>KB&6SDiRg*##+ zB+thY5(yA}*XGxT4aFZ9w@uf^Y4d3P+xXtwFoMxwyUR+l(rsrXZS!vf+WcDoyz5gG z(s4AOczJ@e!bGrp>gGA*Kjhb@SrhLmgOYK= zJKxiN=RYs(9`eBZcTfMrCw2el9q;K5c>0rz67%!!ln;HZ`|oRh*&ToMYfAqZoq=SF z7bR$j->iwctxg`=#p%24`%s>N!BE((!SAfEe6@SqJKtBfdzUeY={M$GSc~5?ncVjz+ zDt_bgNjPJfNjOG|IEE7PVR&TXCfu|2Yu{Vm*7~ex*U)Re2ZJKc~Yw?=+ZQS-f;hrsw+c@p}5PsV{7}3x*16u2b z>Lk3)JMoA7gtcY2aoW7&e^Zg^KJX78?mqQ}FL%4_xP9GyFgY~TVzw&V^Zw(4OS(6_ z;>Bfq@#rW5#!?eotzlDSeO13(41cSIl|Pin`NAY=`p=tgy0MJ8^V0|VY1j4l>dJrc z8ug&BC#>tXZAj&(e_T>_j=k}%Ck*PBw6N<-|JiZ-+jp;f)yt}^t?y+8c=AZQiv+NW z?v}7TlcwUact$?!_o>8R$TN8_B+cr?O?l*@zdiA!B0FDDCQ%uerdRgK-+AU2e*XvE z2}l1;cjr6Zu@-5CG@HScUQb*t0G|&GYX;4q)T8m5^K~(4lIddVn6&M4t~$&W-sa_f zuJ~X2@|oRnC%(Vi{SG^=D(99}@{V_V>JuN^9kBmX2X(-d$9T);Lx(Nr8_qOVB+^nm zTL!4{e%w%<_zn4|p5wyC`6u1R_H41)!t|!z%;8YG1OM5=5{K|^)m?=6_)F^@+&%p; ziGFzE^_dN2Jn2#o-!(t%rMxGtXX3{%ar5ojy5t?Y@Erp{(s~ZLwoQzG$xGb4qv7L#z4-SXRHu zu_j@OCpYhLc@GZqo%ln2sGrt%(zWl&V_e@)_*9)I`&|6nyb^~WH&oszWZnEFM=<_T z(9|vPOkG>QynFhExApx4H~xJWzpTQ`cb-W*RDNKYxb1h|Q(oeD`t|7{@ixfkY|M0y z27v`!b6{q?iOdn01+U@+eu1xV?+I(4fiZsGk6-gC{w;oMCe0sl7|$5GyvKP@o#LNo z>LM;bzxX9i!cunPBs_ViyrE}S07{c|L-FF*w%<;ed?!40@SXhHy!(FRVA7@^_nv$i z|B~-e+%`=3`s7xFS)+YS`s%#*-wyT;JAp~UfQ-vdv6aNR$Sl)HqsrQmLuJy}% zn=bL6^K8@QU6^0Lp7Bo^ZT$Ep-#p{rkDKq+eWriO2b@#y^aoEr@!GhF?`g(& zlTD}F%&+f~Pv1Y^aBG%n*$oQ`p@(t(E#Y~BV{oa@fN%Wj%VhXCKltkN%YNSJm;B)l z|4kgv_I;?#g!k)^xNGZKxk6!r(~8ne0lVdo{W_FZ)&9`;U+Qm)D;%K*xb^fsiLLJvr7StojwYPk4QqjGOm1Y(DXmcbl$#pDT}kc=GG}r+x`<%jmx+ z?ovI`Z#(voS5i;%o|)>lJ#Bqk|M|SPZAuyXRX=UwB~BaOh9x|8%6Fde&olmcCa(?l zIn0vg-5j{)j4j3+zu+U81Xi9y@8Y%o@-kl4_>&UvDrp=4l+!-N$Ah`#-M;tps}Y+& zZFrlmeQ)ComCi`Hr!G#mf_Hh0S zV1*%i>V&U<{p)Kw=eQ(|^CXQ%5l1bVO%#IPBOgD!4iS!x>3&ExdvQVewC1fwQo@ zCw}7E8fiNa968|oz~>#IkAAWd+ zIX`XZ2fofC3oL4{Y@@+Sk9!}y&CwP0r&@h@CVi4kGF10NuR9uDtM%ll>hNp?$SAmn?Ze(vVvpl z0>`fM5|bZw%$P?-oL5S)7{~Kk7^RKzlYQRvZ2j8zq4410;)^csUiGS1Rlcb2;*nOQ zpqXqvmzVMh84h26&1+s$w=yQ*_L;bC`QDe^G6dEY1kgI?Oh4xtqE~0CISb60YWSG5 z+R!_BFfyGqEp7MvU^U!K@*nXyagwHbO#W&87W&@iv;4kr2*A^2mtIzHY<724?F`yEdST1dg7Iap8B4^>JpRG2Pfs z?|sk%AJpBxY*S6%!Bfg~MyYpagtu`LzL@&l8q&aB1SdCZy%tg!MEygYR3cvspf?NvW zP+mqR#Q%@~@Q>A)=Rn%T%Pb*ANde*@Gzj+%fRx(IjwKC->G1ph;q%gREs%Z3-}{E@ zLMS&DL+Ty(*sa@rH`mYKrkl9yo$3ugR>n*=f0ZUOC=j{{;m>)_bGm~LI;gwnJ?=Rp z-Z&WX4?GjcvwcrS@ndj$#VcM>y&e2}>PJtV!eQbJ<)MuUPoB%qnGhggeDU-zcKh$Y ze>MI&NS&dMgIgCx7`$BU0&f^2Ma#k3(lYokroZ;JudNrd5URQK%l6&v#h?Dvr)&5K zU-fm$z{Nlh*Xfrn?(&{zoBt@6jpJ|H%bUuRXsCNfe z1{Sv+PE1UQUio5uDSr|tPvz&GGHo(NSsZ@KC0yLY4m-47`oaH|uY6^_Jit2~j%qQA zpLQi}>G4zfh`*HXmU1hZGm(B+2KP^X`m`#H{M(n#Dwl(tTW$m{2dEeMDRm#Jml-$* zv+w`({p&cCIBA>jyyw~aweO1wPa0>d=$CGkbWwqW>IpjSYU{*RCYmBl4wWySUms63 z@~!w!;FssE7!-?Ydf?_6K7z))5B)-aDJ#|zx!SvoiWShd7E#(MK^JmJ9pdPe!Fhha*q0) z%Y`NUtLqJHX>XqEW4kt_It7k-F1GF_3!nGA=hgODY?ARh^~_Tp zy(ipCIejAjiI->V-})VV@WIt~BpiMcmZv-|3Zr{+fs=(Xr=50Mm8V^{#CZEBfAS{< zkCUs$OWop!$oOlNe{ zluiqgtho@vc!8*_6l9TRVMZ*co_cD%y-J?SvjRqE!vKyy{`guB;JYQy&0mDrAa#*V zT_?#xBIwwG=ziLA!wqFC8DU|XzE`QAPRSC^SQJJi5+R+X8%!B;PJaK%-AiBc(t6|C zr#|(m3QxC=y79|w)tle^<|@>)jKBQlFR!b~bh;P4=tWgobz32vSQX}GyeB;23Ej#v z`-{0U^0M5&?sc!LjM41KU%%uf_2%F=zVVIq;L$VBJhOHfOnBK1LqI><`vH4bBcB)q z4YQ9N!2?4geEY!}Jw&q%!Y9WLAUwcROs#x{%|y~N<+zG z>_tEOlpCJS5Mk18OSCFZ-_s|v!l~sGHRFxsPX<0KFRjSr+|0*ih2=l}(?3;y1+I*> z_>uSwxMm9dtjcrao_?htSVaMEZtBG+-Smf#>R(padN)w(J9wruEEy2ZTDk#Ky%>BM zo(P<70ERDp)oq$)^%$nyrl`K~!;onPP2CuQ4X$wQav(PVqp_vLBlfmgrL}9ikALR$ za`^Lh-Ivckr*jd+?YA3UQcwXs=8sjc;AV_C>#VPo+1^Lgm}WPPEiSKOh%??8ugvbj zkr_lYm98qstGy^FN-!;xE5B`mdgidXR*QLhO81OHt zHyCnowv;rwq>WsQg`pYz1N?4xyW7^1(AsQHn!Yn>OXj-Qz3)|j6bbyvY74splwmA- z=R4ooU2x$A-OtN~K1UsORGoDvdl*0PO}Fvtm--Vq!PuhjSxJkZl56luJj%`!{L@Yc zN*71Qw7LV|(^v62b)%T!iD*O}^h><-*4StIxSLIuTqSPLgVMv1HOYziA^yu5OO8JJ z=t^5pd)m|LB<2-YUeUe#UGJ`V#UHJD#;4)mZN6^%g=>=`#!2*GoPukP!G)5Khe{(4 z3k{4_=w^e!XX!t58#m{g#Jd6S3KDu<>&6nUP2w%{w@L!5{Re*o&((3{Eb@Z!n4_2O zSH}L&fBy4zq7QE)lUcMvcY<&H%y>;+BoByVv4)jqjEPyjw2bG4V+Ks|pw<}^+}La! zBKN@sJ;-7RdMld*orN8N{6{V{R-JtE$yLwUY3H4~yWZulmG`hw&}qe?(~57rlea|` zcolsazdGlfbE<5Jm%Zy<@0yacUsCj6vcB<$ZcHDeC;jrvVAVy`*%*yh!IAxjEdku|dTqBNPn$V9qT9*Ir(n;9V}%@dP+64pxW_%N%G7te z+udru_&zwC@uf4W9FCu}R~XB|{4f9VFROkjy*^@*i`&jQlTPICv(Nrox3cKF>ZTt0 z`Sbte`Q1MI?o(ItS@mhWA&+Q>G3%3`{A4wF(zo9q4*zSMK{9DPqmSoIAN8dNa4 ziHV7dAMn9^z~9zU@Il}RS?58tgms+;tQib+1cMjB`^>Y>?6$kzcD2JQ(ZGc<5ULM2 z;DEXkjZ%#c#D^=woih2$^CKVra5WZV8p=l#6ktr3fl$5YQa)B~?Z)kcQ88R#MEVUw z5GKYEl3V&^P_iPIL&LUU5tt2HX66au7*oQfwS_12PDo+E!|37WGoSfP9iSK*85Ip^ z`Zt<@bAzZbj9$Iq)IiAKkr}vJ*n0SpyvMxTNMutd-L;E#Xu zSDzi-ien=`{C06)EN(DxIOQ@^SX;Jx~K{^23do*eoBB5mjRdp*E+Nk znhV|JyC2W@P*@vp+&lbe+pd$hpzp9~Rrj1EA zmfH(IciQK=6)RR${1`us8QMz;J^%dkD-5)qQ4~Kjvj>)N#&`fmaH1UX2r=oGs#g2f zB&;aO>6_|LSjBHC0p8(^Fv(B>*A!b@BdqSVqW(LDKmO>4KddV_8UN4-1EL8X^)XK3 zsf&g6ETCMHAhqA9&hb%gQCj zw7!EU2I)AHh*n3#jq!btGC_qW;XB3`{S42-yNn?Ob^lfkuJms#V&J1N*>0zg z84DQzJ&i|XMSP9|LZMFal?-pv zi2`R*ggkE>-rfa|jJuR9${zm7D2uO|bU_dB1ovcl{1acrFVTi?V-o!VzR5B2U}WBO zlTE9_o$Y+;fQRQ&xAhvYrGKek?PuOA_gfVSWZ@qa!-Kx5e=WN;0|BtdcOp+MB-a)T zcnMm?x8UkYWm1qIo?!yf*y?wGe6Q}tXj^?FUW3jx$> z#I60J^oiNV{x*9$5}DQx7w^Uex(NdkTLf919f6$0m;($gB@8`J;<2GaH|372xLvhG5P^L&lpUe zc4Uo3M#g8fOGbbPGVC*+@r>@JFMVm%cUG)eQFYNX&N!pSq3bZJ(w~g;(#oH_zVBo9 zt?;2&!V~!ctXl)QI?}Vq)y8*y&_ue$5#(t{Fo8dZ7A$BX3m8`zVvjrSxaw!+CIcYj zr8axQGy9Uo7|LvIYwC$k;M-V6pBDdq_q$)MtA!O{raoNTpRw=}ZP%bCoDM!S?sSY* z--hU9^QAVNq+yY34FP&wnl{SMpLLF%=yd2KPE?ovA&!quS>I6=zHtxomLZ=O?)O^6vo z)6oebR>1h?d^0k_Gr`P{Vt@|e8w14z2z!J>tBiCE+u^)324mDL_y)~oHw*!EjG<-w zpw$ghqRj ztQ+z1nofQZ_`{7=A`GO)67FFSeOMhg(6xyS4lcwcq@ZU) z!<9vt|M=wUbHbvr?WaGzs=#NTDg+WR%``J2>YH4@of(@q+kCS+2Ew~B55H7~{>-ST zk1|54)5OF?H9pGk8)ba85{iN4hs6-6znWNsC#y;sA<13o{(WUvi((s z{|d7*+XOOao7m+)xO~Gf0G9e1BSyc-^s6F4I9M37@w#QVW*~r1UHhAB7X{N6OL$Dn z^Wcj-$T)=OnLK2~h<*c?968RaW^&!fKKijr>#YpFW?H#{)80m{?Jb3Z)iN002M$NklqjU1hVhBcBu%*YK4Sg)mw_o}WoWVOg69=y1 z8-r}q7MI*TQE0{DGx9v$%WA*SkUput+ILA=*uk*ZmMLHQ)qw{cSQj(FrO7GAMtPz+ zG{VWV#c3&i73YqJa(-WJ!${8ErZ48Ml14lFZpjURsQ}<0UNd?WO$Y!KgwFVvjzk#? z!gMmuHY%&bAVP<*3Wbs?E+;MPa7kE+f*+#PQ91c2AJA<%p(KfKJ8-r^)`;bgG?+0# z64EJB(#b=;d?Q4ipRmFo(eZ~wZBy0|@KeT`d2v}|0 z?_c`;DsX`XM}cAlc=A)8-2J-jpO4`{9^b#@`&D4J9a|^kmvq1S^{?u74}M?^rX2Wy z9e++|1ZQxxA`N|nu_y~8PTZPc`OgdpU?Pm_*=m3}GCb)!G3+D(IEER*!#4{9{9&PG zOj;hc=U4%?vM}-VG58c0qcv#39YX~ph(SPqWW*)V2TzP7lx~a=voo+#wg~v@c6yo7 zr_e2Be+dkh>IoLwXV9`*3#=%&`l{KVA7A<7+OG^kc#>6!se8lmQYQ_;KN@D~hnA->VlT(43G9(z} z8P+&_2Q1M#2SyZ1aL_JwmY%?dj~-fPcHxx}NH8%@5r)iOn$#d5T2;-kOXy3!HS_WZ zENg!&vWx!9Xl}a*KB#U495~X)7%9;c-VLt$Wt3mavp%o>;h_wp5oS}~2K_8U8{^X> zANr7TJKuHP_b$4md&KWPxckysXBUBLTKLmOI0x78vJJZ3>$viaZrhbDz>nDbx4Z4i zxi~Snr&=!HdHPez*xv9jVQ8B}zZrXcGwiJ_;|$u2yoP42Tt&Z(M);g@!b&jx3?A(u z$fN~%4zFPhGUJX%S$SZ`g0YH>r%#K|0Hu6m9R-ZRzoiSZDC50;eo)z+!1V?6>bd-9 zK@gx^G0ftXWDIyW>FBI8yb8ZGQGs_FtKi6rYB)6^NqM3_z^O6AJ3}C48g1c?-z#(y z`mptv5{cgMWDYIhm78xiJ+>~W5lbFq486=j6puZKWBSwjB{K6K)X;hsTB&nsm$-d9o2%?^f?he`gT6&%N%^ z-EsHby3d~erE=-zW4eF;?tgU`7F{%BO&?D9xQQZ@2YqLIHD04oZF-CfMCBARQN>92`#yC0?!;+nK@(UeQeXG#o z`ryFEm})|%b?TV06s+(gyq6AP1vhy)x?s{>ebv?7ws+dL`jfrs6%2l9Hywq%D;>Nl z+t|#3HU6(G@A`*#PCW7b)JfgE>pxatvi*>;IXI%5GH8-R;7NYmi1&`<|BADc2l>D_ zWA&dgO__etiE6^~NB*aM_O!ZKfb3xmBy(`;6WUU*VTVFSN4q`x;lESp>et=HmtNjI z^uZ4*a_-lr&x0LKJm|a5E&%~ht6LB?g)xH_L@_uJ_BcuwB^ffaWyg|D43k561bj+W zI+OU6%$rIcjD+$;IFQ5{_=Qu}2nBa2E8AGAPcKSfOEBV^No4Ghr`bn>%84hwyLM{f zR=53kA!b|OtSI!%ia2%D&hZG9!pac-P#hnHP;d0lBj0Hau%H3c`zZa?wyPt+BAR_zhGEZ=?LgC1BFTf(>e z81k&HF@yisW8PZJhF`e11r$t`O@PyBfDv%uDIGj6yI}~R`J>9r z$%*eiv98(zN5(cQ8Nj)P9U&yMjdHtvVayDLj6((=N)WtaoMBQJFeQt?ZuOTHMGQDr zve|xW#+`p=h2+c6mP0F#~?bgC|&{OUAf^ilT2dN^Tm{KWs^0gs|#} zvD%hxMg#32s1Q&X+MFq6b)K0@?ZoHMxLJMWNCPhXga_Y4Z4)2QlLsM38irb1gFN+1 zFjby9Q>J6=OW(w!^*Q4jp^HGtU0+~|A8btSh8u6{?t7nmclWyI-MgI%ydM0(y-Oe1 zX2i1^p$aX9Ho<-Qw>TJ}om*~k9@)*s=z4v3edz<&U*G!`zh7T_-70-I^p3ybB_@~{ z_ZWWkJHj#^2v3ahWC?tR!G=KyeZn&$K4ovhW4j%bO zZL=;Go(sVw$zvCQ8V$J1sT3*g*a=GJW<15)=?h@M$=Ce`V5e;U#uqyg$pK&nf1Em#hm9}n91L;B6*9fP zWkL`>*{0~R(!yK%nQzA{$cF(>z1cCel}<$m)5qy7#+KG83vS6d+Ae<+nd)YI3k(9+ zq%B2NSDIHHIro0|*{l2Q-`ca=Wv3lGw7$)@baO_^*{FS#zWuvNA*x##zZ4!IwGrm? zuEG#9*NOr_p@c9Ld8hbMRCEw|K%fB}UhZOP~D{EZ^ebQ;+qYWpA``VG)k|! z=$w>nofvX4Q&wGZDbjv~4N9lHA?KK5-cpv5?pGBlNF-1)aI7rG6AG{yXVzlGW5!Wl zh|H`FqSJl~mvj(~$y?=-RTuMtvrE|r|u_LmsLDv^&chZr&s^H z+x-s3@2a17kKgx^-SeJ(KrKq=Wt3nTLfnKWLKb}JnA(WIF&iuX#Ai&^34;ePCs2zA zZt#aef9!@b{D+O`g)41Ty!9gGUVaxEuD&T4S)RLQatGx30Ti{^w3T%Xe0WA zjxi;4J|Cy=pi^lmGT5Fj7pwX70ob}1+D+U9wo2#A)r*wb~ zVGn+;y85c_9=~;u`mUc)Ucd-!z!FT+x;_bCV3olhobVcb1-wi)fG0kskLYjeXf>Pi zyc0;2gD&veJKgzC-TD7@{!||{alsI!JU@LDzTnaMNN~z9kH6KrU2<_X$Wy2YCh96Z z`q2($>9cWoBKi<+fMjUXf8~o$5*(C+4&|f06GdPGKf;kgS$;!fRA7uwk9)_7-9?xF zpww-v5_hIXgsv|C(UslX-~8G-;iGQpU*LHW-cpREnTSH0=-X0$;|@BN2b#tcl?Oh; z^o#7Nu>#J9=n3w?7EPc7bSED?m><0Bw;4zA zMFvCkB&|C0Q>HrGcH$dfMr%K`nx^1zzWgQlT;HB&edVj&+urrQx&rM_4}MOa@H*@4 zZ+6f5qo;N!zVGk5^Zw)f?hl{%nC>|T>|d+ij(MS<^{q|odwl{oJpDZ+<+%N9q*vq}yi)+8%b)KK^=UadKNmSnO+=V|wRb6j)Xf(tBEcgDHUo0bAvV$bH z2J>7=)jGButoA;_lQ+^K8g|A9wnQKM?+4y=@Jdw3B`D&%tqz3bMn4J5^^#OnX>e}+ zLS)?eB6sV!TdjR^HQvCh82C7j#-3vc(MTGX=+*?L0 zfd|`04vYfmz;)u}^qpt1Y>S5q)tj$a*>J0<@!Nj4w!F(_&Ybn=$jC2rMp9 zvG7TAL=k4;dmW3YSJmfb;+uozJ%eIcBg!`t<)heyEnc8ozrVB%F8HuGy4$)vyZ{T> zU)iIrfVjcWZcCD*5=3KWOvkG4m-v~qy|}j)DR&ud-Y`_ZzVbC&4P_uswrso= z%$zVL%ul9-<+{xHiG4h>Y_su_?VxI^J<$5+BFuk9eZlAYC}gi5K3k9NPRXhN`~GOJ zWB=y6?D7U;b1$HH>~DM&))XP#34<#S{is2Kz3vN%w61|qEegZCbh^Bb((a;i zj*-=)l#NQzMe)|4X7{nrZl4F;CWa)vWStQz$?MC}yHRlkw81a3`T%9Di7_BgTCdl{ z5bu?Gse|i6@sX`K*jb-l@bGTajaRQnbIAbibO;<+?2nwtng4T9K<{~5M|{?#=-0pR zMZR-0X$D)TlNNdDvj z_Q&oZsUL@(G$wxHCYEm9$xJpYCFIH^d?atBv-t*7RnqQIe5D|8bEWfn#rTny0KoOg z@09}GuNTV?a0V|8WqLhT`%#YMz#W%gBFz&nK0m$E;;OdTmIYk5BFS>Bli57mxJ7Qe z=2(n8vDGV#g#;^iX$JafOKP5d+JOvUqzN$I!Erp`qsjLkMq2h9Wjwor}c|3Y|kI z3p`x|>*H}|3Kn)tq-#pe7VeAFS1rT}^UR7M#^H&kOv^xgKD(RiYy}&Ff@{2xW3g^_ zNj1&QDBEXOm)Gk_muo9+7zw3fKbo8K`tu$a;^^xG#SZt_mJFEL<*!`)s^b~IoV@nJ zSdol}gN%J6E+t}VG_vlJW(Deo{kFK(C$(8OBdjf_Z9?YaYBRVR#_-hLn@LehQv0sh zN=GK88Yq37fm3=PSsDXWZ_blfDrLnM{k9qvare~@r$Gd%;W4f;cId-94*rubOGVp* zB{OI&c)aigobB!O=>x)hDesr;CoN5R>{q+EWkp)xaf;{d1#j39DLsc6`}ycjpVEh; zGZQxk`(2HOiakr-3L=C~Vs>l&1(e|3fjbZzNM^%08#&PYsPpV{&Gy-+9to}^`Uvj|*_rUCdBTSa!ma&Q;i*H(& z0V786E~_ZadvyiZCmOVUEpu}iy}8cZfbqq5nYZE8kN(6Lqy2Nwoa(Tg(O(YtT5svNV%SrfY+)$QY7*DR0CuNfFhwx$zS z3%L#OWg5&GoDVvuG}xqe)n%vTJeudBWXbM~9q)5IsHEDs5ncfj-|mY7**{XdYn zZK#gL2bAnfWl>{#yI8jak94kY&mTp!qJ@nEo9}^ed37PL#@_{&9v%GBw9k?ZlNvtY z`AA0@F9PdKL~a?0UCbIs2xax-XhqY!EAR3O9ftQ1rdW-e9Hz7oAA1Kmb(#hWR@4zi zxclkOs*<*k^P(r|^{O}AV*-4hg$R@gbA{%w?ICWiz0OaI2Yj_ln|~R^R;JuA-YH!X zscc}2I$#j+xx|mOmF=TDMBRucx@cSOao)65bf;Ig-srM|IQ!sQsbUP^b7|V(Hm5mz zv(Ho(Apl;XRPe~sK(p&e*i7%b4)!jcF!ahj^0EMc^~pg#H_+hUp7HpeDflxa*a>xg z?Z5JPb%_80K2P;r@iR-%3|b3GEue-bT4k2US1d_i_jQVI-tw9{ka6F5RPBN3?JR`R z>GGSt{rm36(ZLBF;EPmN#S$XGK^ysCUyVL8AlGAAN4_q)Q?XM#G_h8CSF_O(d~g?b zJdf1EukmsslG1r^3KAt@Xh9bPN%8nhkW5IG)QfVrK=+N~>|_3lq0HNj0CKrH$a)Q% zRp_=Tot8CQ(U*{iiiuCMS^_Zg z4HcZ*=KxhrZIq)D5F{Z#JRP(M05QPP$mtRPrMowl5*`s}tHNutcE4@6@m}{+8bB?l z7E;oVpuPlgr@tw32%i%b7;AIl?`{UfsBFudRc7`l&m32C_q!F6$ENe+tP?|7r%~Oj^BNM>=)?|PbiSS{nY8qI`wFHm|`)02wcMZx>7amDs zL#)lFB>PeR$KoECkzK)ih@F}~%=>Gj_Wl)}WQ@FAG+f_XZ~l<$7=U+9qrw?xb(M`E4dSGpZH%`k_t?4ba@L*U(TeArZkn&kF+UUApgJ*j&dL|uq)5t zLRK;H1oQD)HEu$ofxv z6ZU_8t|C;a)qoq$T-J{~wFvOik2vgx*vgWw=2j=hKhH}pU>5oVNUh%PQ9UMi&hm&( z6_Jad12Sfcf}S6e_bm01#tX^;5v{Q5SVeXcq@cpR+e6AgbTD=EgzToRI+j6k1V?{f zx5*%Rm~v!i~gu>?RR^^_f z5KBM3+SQ^*_;TX3T#epAzSm;CBkKBi(3=xjO-^hK4DSK_7lGrHazu#t#Z+ZUWI7OA z?F;3F(C@2=xV{^|g*@~++f7^DZdvWRO3nG!T(B>HVq9|56M7u{1>JQYW&d5D`pd8j zULnbM@HIqv4vtF3N1*g*pe@M22ijrghY=n|K(ST=t@n(xM#T^c0q1TiA{#v?W$eR8 z)zu80rkB5fSeB4KmADz2>F!*8*ww;cD>GfYA9Fd5Vitu)TQtnazV4~nylVs^$wtj< zo3aOA5Q8hs>?C9>xWo9)#NL(-lk`4bJKwo~f;l4PLn;;#^LPS(uNj_N=Vs@*RPTbg zbGoc?&gEm0lKs9*NNvqM4!gFx!^B8lnByw1%Tl@zx{M*!>cVLPzI+Hi(u82oVyv*o z9Ekdzyavh&yFtPwBq>^i5Bu*s7vS;U3x z0^sHl;Nv6Mk~}7eO1H4Kp$;m$#|S100@3+or~N!-j6WAglUIUoF+M zWreBYC$gDlDJFz2;bzcY(SX}NXrygGoH(!pclVJ6-Rr*fdnulCqcG+XX;Go@<+%U@ z0GTqmiiS?FJ5NlFL4%uJ?e&WlRXp#{8^hq9y4OLT*4Gu#lYxYnRz9SI&QdJyNrLt* zzV3o8Z5FlDBeFMLWx|P@A-wh^z}YR?<75aMx(1!^C&qnqr! zEa+E{@Xys(re8(;l1hE_AGG6@W$h|vDRu9W+UwdY*GWk=)o9%6m#l1Q{6pTD{C6^d z7i6&o>J3s@=PQGV%9D=RO^uo~|xtyf3_lA>LyuGyuoYttP28K`>M!du<)SLUA;7sNv5*$9$;K z!gcxi=D(%u){pMo)Wgy9jOD;S6*(x#v_s#rtXKb9DP+Bv4sktHmwgC8;|e{7qX=i8 zNUt`F3A&>K^Fby0p=s9IhX%$X_-mY`=`|Y*Zj4P_Snp*$`s3_RWj@QD??^c z{Ojo)cc&{fw$d_uphl1O7>O%X*KNo}$GuH%b)TnpN$B3h{^CZn{D(!{mffY7Z^S^AP*V(Hy5Th9oYR7A^uD1cu~_O(Oe-p0+*u)FS=(d)j)9yD(h z12mLNgrZn~Q$S>KwM^w0uluIKT-(U+=RI2u>*i?j^tcLl zoG^3%EtLmefK0?Lgx>}Qc$ItShx3(zE3WvRTV^@YrMoMtKe0??EcXPg3d88F)4V+g z(mpE_JJbyH`?HC##p{C{_Tyzd7~Ldi5F4+Bf5X8mI^Iua=k@};MAl;5mdMF?D!Xck zMx@B^BcJ+82cStkhNs2oLbxFzg#nu{kr2n&T%;=0m8yQ`s_51~;bx~^ z*gkn+!lXC6++8#%)2yz?L=zxxId}NI9E~`>SdajM4Yq&LxiI)}GH27e96B5(#~XLv zG`TKy<$+UGTW*!wZ zbzn?w6`}}FD!YdBGdl$=qlb4CjD-ef1CEB8;OsZ$zqeg#PK=VhBYrChjnkJ(c(7)l zidqK0$bWWDnX6R1om(h2>k`Nq_`M8xsU zUw(m&AZ`SDTC+`RjIE2JqgkdBo&ZejKcW_!)`-;Z4cMxh40tN1$~H>>02yzE|CVZ` zQUv{+0z1wZprTQ$EwxCsu>A0k4g7m|T;XI!NJJ%Zach4`ic^cwC zr`1m%r-~7A$#S25j^Zu!4o8D#vyX%6r|QM=f6g0xyitq~?2gi>wCtZVfz;~=iHVEo z9Fw_zf4yJ$-WL#Sk^hz_u0q1{LOx0wFAL;U@f}JqvY_RW0dC(BP+k|-mI;+w6x9Z0 zQB}|~Nu_I`Qf}`BpJm=*!r+^4Ck5;Owut0sHUqA4zkfWpWzRoS=FupPIgC_n{5>4g zMX&A2@v2!DO`36byg0l# zc{_Let?+e}czNuA@CgTmSFU{|fJ3IBMgKj}FH0{TdJg*cOM}gR!y>~C^!Bn#J%^un zSsfjLk$0Pu!|tUYthEcf)XQ~Qy_u7Msy}F#=ttjigfv?mwp}^2I8T`bDCVQkLnO)>PiloswS-{htu4c3)vz?-UwZ^O1_;d&$wNC71IP@Q69iLLEPh}x$ zCYq#MUFO`h3vvN6z4k0t6yIy4*#5Kc3qG5w2&{XGGQ#M-nIg2Jt(YFZZO=Pwb-PWQ zW2j4hK?E%{ed!RBP{R;sC%LmMkL`vhJlWwk!~ra8_xAsz5=7s%G%T%lJeYYkA=<+} zacKYY!+ecC6&;T4Ea&DD<74!xgMKx6YSTzmdhI$E>}S9_12gjCRSn9IS7?%5Pcqm_ z-xdy7rfx=DZzIZAbKJ!w%)+}#EgeYa!9p^$ra=kcM0GPYL!|3BZ}qH}792jK0Knv~ zFI>JPZ{U-vA9K#GGE#+3x*#sJ2LKDmo_Fd&m@N@qKO-O&cc;x7lgbxZ1w=0H$h}M? zPv-cDT<@e;YK3_NYpT&gKRknsbCtGy_!$N+`D^~u<8)?t zPy1$tnJS>-H}eKN6qlO}^>>t?Th}7RY+3z0GHM&nCUh$pm7zg|tTxr_*CT)z)YQSY=j@{?M> zD)#JY-Tm8-Vc{z)N7?5FZdD1}=lFi?Ry5U?Ul$h@6`ca(cP)D1Ha5wk0dX{=#oo|m zYO9~Mg%ut=kkX&8U=9Wd^6gGK`O=y>)bIC+)AiS@aO*4k@KdzWM%*(}mt&qDvc{5j zs(uC?xhkOPhn3XZJci*Osex-`&)wbFwb>=eF9$H)oiZcWh+~Pw)+|{*>N?7P*`sBi zKc6$nb^kOttuu(3s|F{4-ng)NSviMtuAbFZrnjLLY?EF_-oK-$`jUud8I-7{ihN2HZ2EEc^U?;7 zSP94ENc|lug5|!qWc@_pzVF{ZKGt(i()ej_@|;+U@CSwX`+LV{bK44Dq{~0&?=qVG zC7;fL=wx9pqM&R!knNS(9y^_SQ{Cio?T(VNFGj|G9mMkn@7kGnvUOCy^Zq4sp`mr9 zJx%%$6_$LjB;Q%+C*k%p_t5Z1zbuXMwCmeQu}+<}=lrui)}U^JaDjvE9@A?}1Q!7q zGX0+8fpxF-8?n3yw>LzY>r9&79;pH6Kr`revHcRc|wowSu8l9 z2Kx}Hdlek>2I+?+9NB=LZ(Dii;%0O_&la~A4JFzPdX2Yo@K(V3C*&jifScRyb9{uR z5>mIwLn{6$Lp+ZQ;JPx>2XOUQZM!S-i%nvpgBiNoaB+`>%$CgToYb4&wo0cmowHMo z`g06MMaca--q#pheQ#BQyIy9s5b_z?^EpcAyRE7sg9s%Yn_zQ8m?*&A&7~u%fSQi? z$vogmMAd_$MH*8VIw02XKkqO#M0y9ng|2<6O5}><>hey&6J-Nuj`wn*K+V7iXT8oe z3(dWwH^io>wMHf1h@w#aMYf+N6}lg1msip(9voj;-R(oMkzRJX5nLI znSia6Q>2~+u-;&PJ+4{H*Y*RMNa##8(Ekn&*@*GVRXk!_h?3oH>VFE1_<1ypDDdyS z`Ro6i2+xvb;#IjbO-BMXWo+240B|g|q}`)A$#` zp#yh|A=DJVRG}dwp2VKVeltbS{cfW;?8WfyfbVga&4z%|)Ll$ix~e}M%QO$*6|heI!jO{t09T7CA%j14b)uFR^O)3_0B^Bmzvz+K)+ zRRTsI6`#2>i={5TIL&t<+&LK@e9IXLEG^5=4(?S5JG*R%nCf0p%jZQd?CBbbGjats zgTO$CfQcWY*B_Ie+rG3ve~x$?W*1LOL}c_=aJn&XCdv#M>umVpxW8XsJCvW$70i_~pkqC_w1eed`7JZazM%voe_t`ezmeYkLs&c;Q|(-n`+ z)x|@K5=_Sh_CrAjaTl$Hzp)VPvU*6(Qe*jG&-{5__LkEW?Tuhm>Ajrf`rjpe0%T8A zm4HmK;m8nl;Ku&+(<5?^e%ybjsp+X20e6I=y5D zp8Z%)c(uH$eqY~SCoZAQ$b^jexQ*|J3)ZOotZmj?Syfe){G_@c2sxM#cH(cX>-@wY zu`fktq{`q)z8B1jw+j;f z<6qJ0h@5rigI z>exjogbFY|laIJ_0tXTa7IEMuJFDx(KZ?Bs-PR8k;~2AJp4~J~D9r47?f>~LN-em; zAzE5uwe@FVx4uNx6&hToPQLqZ>3PHP5M)UDKDlOJVU}StBtM%2&kA!pR1#XBihq60 zzf|ruyGw^keN9t;%)IJwcroNv61N=nnJZat;N@9Tv0UL|;L8a2SFuf-J~X`!%e~z3 zrE)6%V~-;Lm08<8dv4mc5qm0i+<5u!v}34i!)p-Ttl#m@*=hZ8z@X!%B6y zis--pLV8JPkUs*IGzEi~*jv%Ou#<_;8?{4B1rv0i(#bBimJ{r(cK>dZ_g=JdJqZ#^ zJ*<}bYV`ti+X!lCM4LOnt4tFd)b{eHI~1Ta*IXt-^D^nJvVZ;aza7?VNpashd{y7T z4b>J7Oo8f@>K|9=pVrhT=_}{YdUX^V-d(}#5wPUM`EHAP`A;O~;0hk7vDk#`bC(4a z7800LEnjj{r5n=K5B#cu4ByjSs0H^Y_cQS62m^DZYtFFN^FORzKW2g)6>f7QpIT`? zGZIB{EIZkHxH5MVn*{Spb#C(xynS>~Th>oSje?E_P4QW;U{hj#F@6l$FY9)MPi-(p z5a*mGxum*FjQ6Wuy1>y2@lX4S^Lu}PeK|7V(i#2|H}wOkI~vbh@A-XX)9Lb9pt{sY zZuspJxv5Y0sERypSl%8yMI9V!mYf~DJAUI>D-&_Ag56gnpf8??Gba`%Zf+7Ds<;Zn zzvv{e9DH4bkL0Ff$Itd zzsB%kE8q9L{Ufz*CF!VHNzrxc0<341ToO=CxUU*RbnvmX`rBf^KQNBw8~ ze;H&x9M^8$)5=p5=xL+TGMoBTm^`)Z+ACr!TUiy85PnF~a>9g5U}pab_!}&sHmzG^ zXyz~*_L%)EOjFq%f46wYdq(d7Gx+`*I!6LKkovmoIJow%{DgmG@kgrjTWUjlITMfh>Hiu-W@aM2KVlSk>|Rk_ z&6u4p-$Jp&f;(Ww7UwD`{S(tuI!(5x2@00YP_5YDlwa1vXL$b*l(jwJx7$>SnjLu*QZU@BAFmi0f=2Q_E)?@Ytna}Sc5{zHnVbk)=Ez)&F7$d(eI(P9a_Y4)uf zrg^?`n1><2Ip6waL4gCaZN91TAs-PoQBB>9R1{^Agjj4)aLgZvH<&&zeZdkPcQSB*PXLmNK9>$c3W@b zSAmTXyMf;?gVr4a%plpm@Qejxh(qv zkJ!*Vr-6g5Q@t2-Arz+;#a}uBK)-yB=ArrdMzR+*U^U54+*<_uxZ<^v3p)c_@3ZwF zeyAOgzq6o^@{&@H)il<4-lcipXxZ9XgpS>3-fc?iJ!uk@MuFy0EB}@e`cN`%*^8z& zMkYoFNlC`zR(jBPUkOQb?us<(Z#mj$u`0V%H;L7~X7OhY%!d6Vd#}cvp7f1Z<+EQ0 zYxiOS&7~~!s7}LfG7Uq25CgJm%8UACd(01IjI}lC!}H~xnvwF_Pd^U7tA~C~{u;xJ z^dX}n(}`ohi(@g48F2j_-$v+{LMJHZ9Gq@wvXUq7`u^Q5$-OPIwyAOHysIi~v=+i| zih)D7IqP6~^kkw9kMpG_(wtR_(r@LOUWwCB%S-D+$XC~91|H{$CfTHMz42%1D82l^ zmr7?jiTb35X`WT3QjH1T0+<%we|~I#KWy;cI}c^Gm@9{{Wka;J$j5j8YKh~C1jHWL zH$RtdlWXkGFf&mkR|^93H%e*5;U`(bx3G2ocW{zLgOFpzrinBk-ov((+M z77^|sC|e9t(K0$=6UkvDbaSqC zR@yP4m9>(vNxzlb+W)iZKa@&BtoALKnGWKl7|NT$8^3IG5C)gIZ*3Dgb5HBhD5z3=M|`nU6URm}7hKuu`mC4QG|sc~sQ_tp6mO`E~AA#+FM z{TB90Rjxa7=8)yr3v7#K!w{B+J}Qr<^3w9ZfpCi^;~SXpul3FwLt`t$k*znJPPOj` z(hVstw|Ny8t`-!brKnXp*%@&yU}ZzqX~@3S;?->4$R=m={!OV889On9O#rK~V6D-O z{K4Z_oM&+i&CxHVw4)u<}>g3*%!lc@b(@&5-ap0`$CdG?6a$j#NKVmVT7 zO@HNEISuIky~dHt{H;GJm3p{so^S&>9?gN#q zT}lvQ2dVNEkiHiRJWFE6~*TUuck zu{>p-KVk$Tl|q$-qncbV$3F?aUG27W4^tZX{gjG-q34sds?ytLnZ~Z=CHKAUk^ZNQ zC8UMf!b8Qwl1vKNU>MHz?3ZvrBdU;P<|6fhvmxWjO~cZ+|Dg|6qe{&r@7MZqK*UzM zbSLT+*MAjPbvF=LT{VbCo%WRGxg~T61(xi zaEYoMe^$G%ydUo==k|N-kgsZ3O9;h>#V6iu41W0HeWE`{;k_~IgWXIe_73zLH0&V70@qtyMkj}Hl1 zb(SLYS7l}C~_uMLSlEUrhqtBgON-2SG~ivCYX7*h!Fq1!R3KWN=E6fW^BqV2cU z)#98(_mCna=6$v!mS%6~+rDj-ok{LvewW<_yy%(}!sY%CwPprFUSIcR(MLWDvuOO; z9^qM|@!5{OT%AA0A8qxaDDXGbW1L)J{%Y-au2;|1&8=uRpjdW#r7nEvdzrYcnBUG! zLZDKMgbONSGXG>7LEp{>QwD4j=gBADz1^Otv7)m749z-ry1qdcMvMM5yXxcYu8i^l zQaW@?VX>!Q@Ak8_G=P;Va|o=}>7<2`1TKJSZB`GOWUibPXzah$`qHoGSei8uSjn%|mKep_O&+a}3>xW2}WX!w}@fPgt+cc{GA)`eq4yOP&%cxp^Yxa9!%>>~TkWek_HeB1f|4$*Km_iUT z7dn5?+Fsu3_%Zj4&L0$uLr&!83==IWD;{C!sRp7XvxO zV!XskMm@}_o81DeDZE{oFZ%@Sw3dt8Ff5SocEw9f<`!kyf)d(_>T#$ucBoU(GX}q+JMpeV}reFt?3wzuttG4#72Z+IJerw};&E z(Fo>R2hh0iGt0-cz0j}zH?h~|tKi0bPc861H=tZdi20jB?Te6wjqxZJ^ZVn|wDK-X z)>Bp+Htg&SlAt{S>8pdTZN=^yyUCOnO|NJ~)Z?vGDeL^E5-96;MHx8*dfOL_2cCXl z;K{0ae`o|`kq&r$HIcH_7zP`UXcIw$m{!h~B9lO~>(wz0IE?H_)wO6dO-jUY97Gu-%9LQiplw`o2#ER@S8c8U}yjY9nkMIkhAZfS)uTI{ywkDd9CArE2eKe zz8Ii6)F5IwudBNvR*|Rw!LfH~!eNu#08ak*(a!AI_RLL={K<;4y+G&{Qu~b@%G+0x zE?)&0Am3N^0eEa@2j`|Owe+-nD6{l&0Ot0>QqcfJ*S_7cxiO3(fJB97X78+jOo)A$ zEn3!2t4p+#a8vdrn^t){ zZ?T-`E-ztuf$o!(=6pURY^bTh2r~MPx``1^7-BH(v0$DRbVc+0@aZiq^s(8L1>x~J zi#ceyxJ3ebk<&7F8Gbg9HKb#bso;x6vzX6C5SlGI%Th$Zb)?a@BkE5S+{PE%ta}wT zW|o^34U%yntIt*%^!z=u%w&F;sLzsg;1z0}tOA|OEvqje!+E%udeg~rdT@6-?}0K4 z5qaQH`l~GOy7F!f+6ly^Kw#7zJ15GPrO+}B1;J-4Gsr}Gr9rN7y3N3x@ zIA3Ian3krdW;Y$(3ZX(EBFvWz`X!&;lTOmeVfJIh{37GtokMnpNpy z2klvX1LAKXPIh0tl1E0%g|>>=`y;7CEQi1AM}W?U6{@dt0_OWwe{DPOYO{XX z?jsdC)Zx53!1>p^F;qkd|G0fH4WH0?g90&8h^FO!BL8y18QJqmDrROrk>lm`VZwmh z0&9!m=9WMXwL_X(<;E@n3%@oBhZl)c+Fmavhy6!(4?aM=q&Z+!M$D<`o=GSB(M1b1$mn|%`<97jRGK==S(

      o7g{kIS@V!;iS+ z^qSar`V`k|H&JI9O6Sq_r&0gk1u%j4#r)fzi3c)(!(drsOPUYJc*Fr`{1Ha*@e>pP z*FJWKhBbpm+mr(}?!N*L8D_G}BA8022;mNy{K&)S0%n@!(n;t~sx~Cn z&}cmeCmW{?9al`Fo%BQKkvrYn8@TDAhY)YOca}KWEdK10Sq{a<6e)D@5#fXT zgi}vN;>4Fe2pG5uS0;QO8ScaL=+3&zqwHGB{fj3px!NtSoBNt-?S@l~w?u$hFPNsM9e9sYtq2^yvl+B55D1QbO#qf zPJ3Q)ZgiZcr)D6t1+N?aiSrJw&8OBvu~Iq3#f9kbd-cxQAYSB+DjhTH9j>RIZjs~o}&{7!Sf;1ZM{b#a-q~eS&rjGaz zs}5_jR#Q7OeidvJBO)aA&?D@$x08o!hSxa5F#FU{+NZ{F-Q3=SI^QSWi&#mcmDGe= z>a+Ww6Na3Fuuru$niH{7DK;5)9@I>PF;hnDNF|D^*QQnOj?#}OmokBPniet}V?Tz) zip#^~1=+>xxH;3IejB+oI*n#x)gi2`^Sg8-E*W&^t|1G3iNf-L5#J23gjj{?$*jI! z4bzH28i)QC&nu96Gm;2KOfgCZ=LjaWndS5i5zE&aR&sw>Ba*#2+DW(DdJrz`3BdQz z8+MO^6qiOu^SMQbo4lfy*l~<0W~&{Wx7z?gdWMhTynM~S)MQle)h>}qdQ}SEZf&_c zQ%rwk_giD?Fz%D zoL6M;pakC=Y3pvV7j69$Pz~!EsdkDTwHL9zx~s)%vhaNCE#!Db*ZSIZ8>pyC%(xRD zu*S_qM?xORU{%?4C)@l#9UgVgO^D2|N`+I6N@bL5rylm0_jvQ))8n@dB6kyj#3xk- zxAB7xnvwRiW9phz+~d{PSrVOjsG+viuhsIKx4+Noh4zxg23pI6b!{?IbTN^7kWY|K z6s|l2J7Kev}2m9_8PkhJ7UA!gAeJRx zUlu32ryX3}EulBkse}O+vgq=_SFlM%*6mm@gWaGzVU!_}DW&5*Jq~uMAyfWWgyZNK zX{4xqh_9shP{W(@HlGt(^88gd7mvaI&XmPZMcYTYA$vnqoX}fqb2CEmgkeE@ee^_p zL;*hk4e9|O(3aI+B$1mZs3tQd&^hWPKU7N$!$pe{&{ruF2OMy?v*Q|-*s@myAzY!S zxAI?;p1|t1_;Q>c997=z6?rqe9PZHcR9si8I~*()wVU-p9ZQpO5K0_pu3rAe3RhfB zWh8T%F4~LRtR`_hcpET6Ro%;+WMccyVdJ(hy5f0~;YWwmZ_ZDM&blWMCIj!^AdO># zu_8Gun-0l(eNxdbNnh$qA9yZFLuLu{1F@=LhdDb1h_C|KFatjj>UI?M4HFtA7FW-& zwxosBR|}kH>H55`3$u+@8)8z!st%(9J z^W<<-0a1hfkm&u*o6AW6yIlKLLOkTd3G+W@%!0}16uiwB@nc4xcl#ajYAQ#^9(+n8 zI)574q|Z-&44w0H%yhW$RZLfCP2dNLZ-&5G8uJp0ZWm~kO;l}3^vxO|VAV7WT>gVs z3j3#TgZqS$cfXw+(P)k$bGtbI=g*fbv76xl0~%pn20&L>PFBfU6O``vaQL#|$~t+< z?J_**69l;0LPFT3_1;YVWe2oB|w>#zJ zCET~Vk~l`7F7f+cQ2%(fZ<=$p1AFh~`~r@TF^?HxKO>5vv?D;57b{aBleznd)8_ru zmhQtv&eS5`b+1868EI)7 z!&0j;d)>lNH>MpHfaP^{s*g|WKz7N?9+5Ua2d@lqNg;kRnusSMQXl%GfBd$U{%($W zJ^=0IihP&g=-ereyYLmgUuJut;(kQ|h>)0GV=thw8WBMzf+p-<6`fT?hhi3Qn{@?8P z?ziNV_di?=mi*q#9WPfsE>IX4*jeI@SQiBU5|OmYvl8V=BYjMh_BE|x`_FvnNg3bztOtX~ zu?Ge3D8lOxjSc~ybzjZ?a%*e8vDVxCBiFc=zLsNtsb=+JbE9rj*mqKt=dM5HZKlm~ z@&QOJKFpV=wJA?6kbj-xj5D}X))=LSR=q;Q(eEIAFIJcI>#U@4^Sf^WzGHx!u{V{? zz9j56Tehl`Ce@e)9v&yfBb#nQX3N*swIOQFF&vWSFqJ}IRY=R$fBnxKHJSk%8jzim z+v@K<+-iJ9RI~#AvzpwGeu{CC4v~hhS}bF+Hkat@IJj|ocNmRAkWYW)VEZWN-+$6I z(-T&!9X;nd#pX5O?{Obb|9Yh=>qvT|(B;mB&qPX3Ou{?tQx?h%A7RUZ*KRy7*?ZtkNoIWK5p+3e!F=hgx z<9Hp^n}yAmPtiR|-952l>#epZl2tfP`d^w%dcM|L`NfV`u1in0cj;zdJ@Rv; z+*-TcU`q?uCQ)=N%4&6LV-P~8DhxXx*zWqSu$2AHiL^kSSBzCEkx-MRV6hGz2^e~X z`77+Gb*%TZ5O6Z-)pLV1e12I4h*OBb*@deIcMnO%@+5ZL6wGKZi!c&9JuflfTr4bCaWTKR=VOjbx|!6_cNiEyx~WWtdSQ1>WxTrEJ+;(ab7MUd zTeS>op27-HEeAvb1*$D&kv$<`NONF%<*kA-p@oKiO}P3~rcN39L(U6ptj?vu89!&n zTi%W}A4KbU`Pj7bg}`!=kbzeYQnBJdf8T4}W6Qj?T?O`YH-nwKi+BNR+Ou=~q*Y~C z4ZJZgh%n0K6+T?`GmJT#JZjpmC`nZHB*(|Og%aMYD6Uy)KIUXtGQHC-rS5b5p+UA% zlT)FUD zNuWw&mYa9=d)hea0ojMn;oD!iS0j5$jjs@s%%Gs$R;hI=rP|bS&GXdMQJq}lkpia(B@{ug&+|H^Y}T?@Rwqj(biIUlSlO;O$j9rcnsv zMM?qPC@600ZT=4cwLnV0S6*mWhJ9jUq6(Lo1_6!%#0sTsb<**rQ7=|_v&kHxlf_;c1SBh77%jwe zzK3PaA)uOI1OKBFV21F)7z%D?Z5YzL$CyeG2Xia12z8VoaTrsdzW>uJ<0P=c8~Dh} zwnfCuU(p-A!W!2yW_v&HgAN;Db zl>lb+DGKtVI4Hx}k(fTAnuFW**-<2JECS}%Wp?6MMWOYa!2x=e2XA;{JV&p4>~Y7c zd@`n5MUhnx@MBd9gZ3NW^u}szl9d6D0g2%i-1HI59z*q{{7{s$dckTIbYL~5J`J{U z<6uijMH>b|{gVNZf?{yg=MB2bVicng5~3J+&DwE{&FW3rWAwuptcH+|aS?A=-yFRB zKlbhfOtY%G7yf~6=23zOI8`|zDucsKVnk^W9AY$1HySlpKH+&(5@W8C#26KVBJpB~ zCRpHTt*N`ZtGa7-zje;p zXOC;Iz1G@mue}fY)-Sv-d7;LmR^M2_&}KBw>jVDr91}8t?=hNFFc>@aB`{_I4-m?R zElT=bJ|>gsN58-kXeXgHVB(LyGAVUs;MMn^_{1lxp#u+u+Z>Z%LaE;@h?t<7=mLDx z_=A7-)mC&vaawF((hJ}EWf_(h2GA(FrZDfn|9&%8ULTL*MQ!55!B?K}Kb}zK4rLcj z8#fF@WQbK}e36lc?qDohKqKFbM=}k#A0HpDSG>-c*!Pk9RzsAsET%BnSkNRx$+$r3 zGOF%*pZK|s3eWq6x%$w?K;gc-cuWBkikV=GvRE5Py(BirX0_?SElyTM=f}gfq1V; zBU)pOcCbE=YLiA~lZSqIKX}Yz_N(=j1}+$xE%qExWc(uhPVen(Pjoq_<{TcO@J}{2)i{<`kv9)gZ zcq9*II1S&NOODc*E0P=R1iYWkT^Rwh0E72g^wIY`(a9Ok66RLsIt+Z~B^GbYQON~) zt}2V=oFL3?$pLB1U3iew8O(L)`*^ZBjPk|Df9KntxwL&$+|taVs}H=(?k@99FbcPH zXS&XO<-w>rEQe3U02x5fwMclt0sBvVIpj%ya1xpg41Aeq6LUSsQAraf_nfKVw%fYOEO#yH4W#i(Q}qXA|hx?1H8fnzA@ zg;AUA-dSe9{3GT#np!ahE{p08>R_Nwg#)ogIH0xDXu)p zFlY=I4KV^TAeywSX-!2t<3z zAxwd`32V!(FBZukbcWYuTbYT!F<`qi#Q|@FTlWkIaIvNsAEeW!ctIM2+8W*!T*HGt z1-F)QYjP`&--?1i0Dnn`fJ|t^*St6OY{$ntfjW9`vS~667ri@!xF zlh6YC%fxSELu=-P&v>lcUEyL(9FDqVOsU4D)ZSRo&nxd>9Sbm4RO1lgBEf zwaMk2@TV?#IZ8~Vc*&>biA z-SuCi%{ND9pWR)?NO!R6N@o;GrfV$A-aLN4H-rTwRM#jK5KD@*EpwuDyIs~sNZ6S=u3;aj+;u|X07KI znwhQf4{kR27T~Hll!7>E>UYIAQC}TLnin!t0vS=VuaCjjx5Z!X?E!CsXJIdTKWp$Y0&$b`# zy*#BDBY^r_5s0!>1DE)p;P5XC&MB2qvbELrzDz#2D#O36PP~0qmDLV$ZQVKk_~YyO ziB{+V1CC#SVrtTYS;lB1e|-@Hh`79$^cn9bt1ZqvQ?58@h2qR}$^_mjK5r#7!_$wa zkv_8pcug^$#AA%&uN}^d<4Iuh#ho84R%WYSw-#D_MtsNNvKzi_av@ z*kL&5<-s71_c8EUNYUSD#Y7RFJmZtRlS~@r6=Pi6CwCVGmM4jcCq7J3dDgE#t9ppM zvV5fJ$g-Ut-!-Y_J;->j3`Zp}#K+)DdD1TY{L|-sy4KmY$80Y~6Zqv~1O34O0AI_n zv@n3)^F@-^$QOVX(<&kGRsPIHIZW|?j$pFK^ zVmw*2G(N>a_Y6UJ7K2{49rHF|Y|IBocxmBhV2kokJf7X=!#y7mMq$#8ReO9D#xM` zBQT&B@gn6FPNtKaVP|!`EzMl`g3`z3uip%GkcE zZb6-zcA&32|Fnf)l<^Ig`=iCmy4@Qe)V5K>VkV6a|K(8NYHsMrD{{u-9$8M_&<*fj za~-w_;q(A}9RN)F=yFgPjS6i8cEA%}5kd~Cda41_U=+pa-wa%$4e<3{<)vK5tg zp^56Vf8*ITy?ikOTagV==k^%5@_6)P23tmXEWNFqLpZr&FVRwhMxjWbQ26x8ZpDj; zaV&u8=^NgV@WvQGF%@oN15f(EnF;#SBxY=EtR}AtOd;R^oQr2-0$L_Vfu+0xS1TeW z1@O*0je){XnO4{-(^j{Y$+Oc$3Z3w#LL*UJO`dGmX5?iwW>nFqXp5l{1PAqDk^O-^ zc#2YC|9|Wiql6qhT~N-YFu~C_W6E}IvufILFUG^2ev7<*8@#43FY71O_LGD;MN!DaZ@K8Ke5bLO_hW48x4I z_^3%FFHvE}AESD_15Ld3LzExojE|4k39@_bSZuHu>$KQ#v>59%r+#Z>UfULiCW{ka z|Jv883(WD`&ZzKWm8*90W|RlC-d$q7R{1HK6dgATra_6N`IR+R;q%Znk4JjO2_oq!hx zA7nFmsO(n8)`HjTpHUKM`a;5ke5?!qS8odp# z#1S6vr|Yk~zUnRd39qHYxVMcL{{#%bN0xK+f;ZRHjc10fw|VDmVY(=QcX}ja;$t53 z=&CpASMTvzI)`nu(NoD)yqi8r?g6rmQIc}6k4y};5y*!gqa0UwP%ko1{uV*;dbDOj zO1A5N^|57btjI*i*q{TzAZalWEdfSlZ8rfnd9~O_SAe6`Pds&`M==C~;HEyTWdgLSbtvauF;hz@b%xTCki$feAREh_umf-pDt|J zyS5*Oz3-Pf>KUJ4ER@F{d)%)~j6P6}V~j|BXv=Bu#p^%!)6Vz#6Q4Y<`@p#$?e^Yd z_qzQ+Iez%3EeTg#{k`rrN4=~&{Hcf3B6!t#H_QVsbr@CGVd2BVlFzVf8-LXOuyp+} zyuxIZp@UJLp_MmcCev;FQMAyO-^QQseez?>e$VM=c2`|TKL_mnA@|0P`@Wz;w&9`HWliJSK`$x-oY8U73b z^_FMy9TH_ZXaWN*&r5&Igq&99jY=~roUXz+?krmdl)yb@QKoLwn+O<{elmVTM+tM4 z4(NLxe`u2-pQoWkIR+VLCi{@n1!aL}yzoSeDrh-$!>GonXt9LxrX7nl^Y!p2?Zd0z zzxwR%iFcgl%x?jH8g0lpZmED)Gz4TIzj6a5jAchZfz zAC~8^u<7v9=DjXu_47$RMupF&tWjx)h0iuD^=iv!2)8K9%b$_FrE&S9xfo*G^rP-u z{a^YPmU&%^jkUCWchTwp_ME@#KJ}UMQMKK6t;Zy_F}K-ztL~dutm#gC(=pwF2Mo?Z zwJ694VPP(K4jn86p5>jfv=I5X?OhD_t^Vgc`4;fI>GZ$J{-A64*XS8-J_~iPpTJBy z%0iXDzVZz{uPHL_&rd$BE}#v|TmS4v42wAOn&p&&LZ5fG{Qp9quvh-Po2DL z?}x?h$LYuKKaa{|UBXiaedxVsuI|3^?JLSQ_3dlh+kBmSdF9pDcBh?meD}Zy+`qo! zXv1b;;Zi=yD_4^Ho?;6?-y537+q!Qm_vTylyt&wRMzx*u7MqV9m>b*!a9E{Ac?=n> zhzGN>4K0M!hPMnYgEj=2vZU{ac^4)qzr;y-{rKLuWl5j%+;0k?&DzxV$EbE|Z~M-3 z#a%J}$-{m6%exkay%)C)&vTnjd4cqgc*66X_X$g$-Y0$P-%1NZoBRF z;&HW2>61IEVP^XkgR^Bvl~r-W+%REr2=2rW&T5>3hd{!Er@U{U6Suu4T^rWk2S@Um zDQ=r?`F?&F2yMc3`YwHd4q7la9N>-q!6aWT=L<@U_mojKh5nO1Vzs*}78wJ)5m!ZY0qjm=OuED*eZ5x6gVbk3! zD7Z`BZT<;Uj(fk9nMx*p-g$1z6|b#Z;t6*jNWO`idME!HK7k{2llSsSo=My0nfGm2 z>XJ!V5r5?0Lh8~FZ{y7OUfyu) z|Kb3qKCe3?6fB`!jLn;k{qVaGx@gSJEc0l)ad*X;<2qy0#zpO4#ysabaMCp8=TW z^NQiE7QsPr-L`mc>~^2s>J|pu6-+KOfZ|=)A3XBQV96i~LAHZ8<$5PvT-zyFznzaF z-=s^P$v0`GX`%nzzFUg-@S;ETg{>r3Z1eFG?^=8YH@Q|fo6=};ge7i!pLcCodmntZ z@!&Cexwlo+RzpfD1=YLsU7NlimUr@SK8~{-v;9|Gpe}8Fg!StpY-2#J+XVd$>N%*z zbV5#Fnm96|^}TL`5A91E#m~Lm+jq+Bhsi^nHm@31ykUa>7N3K94{%&Fn*HRX_IcPt%6W`8b$65%n!SqW?KRhaf7-0oReMd~ zjW4TcX`6(>g|LLDUy^a3UWK>uYaf*KR_F3AVZ-_*W#*c4hvC`^RO^L3UEJiS4s9RR zN-e~nLZa%!1MuMw9q+z#<$rY#DIT&8>HqOh23w^^70WZ-3LD<1PZ(6dUFDpgpI-OV zI(~S(7*G16zAFY7TMGREd1CvvGaNy1Qy-c?R!?o?vn5mBJ79UB{~Ta7&V zYOw917Dw!apg$=a?KxYB@sCHKFx!jJ;&gep)Mt*D(!5`Nq%ivZT=~@4a1XoxVB!diMKwk=+&85 z_$@t-XDbNL3|~y0!Xw)_^}gpxH7s55G%9cTED4xS*&ERSo+CVN=^A)PwlOC9boinx zpuK*aHZ9zei#(2P6E{zbe$u9urr(!E@(m2L$#5c0^SH^}!Xa=3fc|i8`y=ngY3bE- zK%C%E*sy*{K8c%nuKL4~6v}pnY5FPUkR6OBJsSnf{m|x~&C-}L=M|z1P zNSxOmJ5IlCX|p_X-{PnZZ|}uz!PQUXepG)6L8=~qHgyxQVmvCpNIG4q?w#j^l<7u-9g#*ILc57!L zP#SFa^Pz&483uo0fE77C3ToZK%RX^eJPpC}RyS&eUZ^NVk zCQsVnT%T*dcWs?4IpYlDZ~J~qn@YMi@7&i6H{c)T5>|e9l|#%Ko4B?MAF#N4S4KOu z%^4KDwwz6sb0yk#;ePj5i7V|o zdRw=7w{dE_8^N0V+Bh5Q-q){gFUsxSdzSM*f8!b5X=kkN4mU?9Tazk59I} zt)KP)9}u$D%_N2bXv>>3-+uU`AJ+3=ozLQot{jF>Uinh>JKpi<<)aISl|!6QEzKo1#P=bH;5k>cPwvUznWXU7$D#gq9vTB+6w{<{<0q_b&+`4;F#wNqfhl;OThh4{ z(~Xah*Yn*Nj1PM9LEWBv?O7*p=*C3D*?G3n=FB{XL13Ial4aGZRrMLo%(aa*;cWiQ z5qJG87pz|Wf|j4>i~)T!h1Q!KYQL=m?c=e|>PEX3LKs7w?Z~*EGQ$`1oZ=Jixp2=K zoH)byqw_kQCrJ*r@g&T1&1A9vnFGGH3-A*5kv#a#eCmjDUb6GZqU#2q!G(#tIT`-Z zj}sInu4i(Qo`!DiocZSi9z5{PYotls;5GS#ZwXIWKW@@2)~osgb8B-< zJjF-Ooc-;CQ$Ao8N3LPCmUhcyF8AWL@%!mLV=etSHGKKc6bx)M4?tfq^CdkKFJD13 za1fO3Ee_+Pzut8~_S$o=N^ArbZy}y33|722oJ%6DJa}3#eDEBz z_n)$1klX((Zx(ASSQHZJgl*11S+X+A7=-ct@f-fQetgAOWUU;*sVfUV9O^GWxW_E5 zFq*K4_6*PB<;)mmIDbnX`b=8)n6UWzQ=duqvtnG?VaFZn>LMeaEm*uofw+_p zUJvmSRSrgEa-w9qi3;Va#a{yuu>}sXvVm zhp)fyeP`53B?ATl#*0KhGIr$fa4S8=3w*<+dta&5PXwTFM)lxLT4RfGNto3k`1QdH z=_w*PtESJehY5|ebFo~v-FlmDt3u=OwN0V7$u^A8KD>w1&wloz?(DPA?q2z-R}Q{F zUieu0Mc<)oyo({8A&P?HKzV6-uo@@$VzwfRZ#B~xLaz>?_aT>0e)5y`3^BN*)SwCP zjbG!=v;L8nvK$Dn|E=6jwxvO~uwmg%l#O~zCxO3hi;UQE%N12tY*o%l$~fuIp%QK! zz!%L?XvSO-F?eh zuXy)aXPs4fr3otDO0O|SczQ>#nOeK0{{)A?!Yda>RNM8C#nfQ-*`UKE1#F3Xc`jd_>oDNQhQit&7 znrIXG6TJg%(zBeOjK6bc$eFEh17GBNmH%bu!A?8wRCNUUp1#x{bZU^k(=YTDY4sHy zgI-}=0CO$x(fd;meQF(d!r`CpA)S7uV=OrcV&_uvi8T0+g|shx;S1e<`|nrhs&IPz z@yFN230aa;aFjVFJi!T_`BtXKw9^Al}l;I#07UbR^`-h#%p5f0!G&b$*xT(k_|aDyM<3+UKA-4}nrTi_l( z>Dcn4v+DyijqeyM@R&$J+G~ozVxNlON;{X z*^53~zC?I=oox6TB1U@1A&1lf$++Ru>Auu!vJCeIs{yGGeErbZ6+eCcr>jyza5-4r z;5PB*s{R*$@fX# M}fNN_T6=yT_giNjdoBQ_39S3h16&w2K9xusKs09G4fI2Gv!TK73aV5 zft7&)X~1OfoeJX(z$pWu6)l2}0T5I4MJfuLG5CsCyrLR4Fk?mx@l7;&44QoU>MH}E z@kjB{M+{NI-ul+JcDw)5?p2wg#8DW}KmYuSQ+T$GT%W)_eEPw;wm9EUAKGG+@t=Ax zr7Kr{ed_m%@|$$YoJKLxc8UaL9G-dfP?D{dp?^XW-{Q4kJ1FqwZMgc#M?O+l*YGw5 zLklSS`E{>*UFC-iSnzIq0mdl`zX<@oXnO+VpvjhZJ|mm_)RIM!XlE`g;c2N5{tLLW9cWn+n)8TXVou1 zd*_V9ETXMTTQ*4A!lsP%jG2u4>B@#%IHb>uPsUitqLZ2b#1VrY!tgFk<-XDZQUAW1?=Moep9?aLh5sR2lW2_q?YY8yl-~i)=KfbH=m2 z^!0UhB6~R>a0a2HO!AlM8n=YrMZ)M0U+mT&^ee|V(3$BD=-C&%PdMR(+6U%8?&*bS zmY%^dPDf|NHfG=u>3o0{Vb2d^51fAI;PK&21RM864qS-xzDg39nl^zuhP+%A)C# zf*`h3y53HVkJ*e3{OjO@5ANRo{`Ysk@$BE|_TFpndb|`v6Zs0h`qi&?M--3QLk~H$ zJHO12@EZN6Z`cmJTU~Z^plM@~l zQ%^g!d*v%%S<75%f6y8F0?~`yz72?U3b&ZZmRmN zIX!-lZ?PGOt3T}2^Z_=8#e<)6aChNF7uGO~o!;T)WQB2o=Scs#&wZ}!XnbeUr4L(b zXx$+7-DnB{YnayXpUY;s2~1&S1mZ zo4m6!h`BNXS=pi#GXP@17%o9%f`vFuqHRkg7&kQmG#hF%83I-!z+HFWRVN@OAq+r_ ze^ylC7{1Q^$hno#iHji`v<9PzEyI!i&_9eCjDZYC@Q(SdDh4;ohm{h{QJeq;0|Q4J z3~wgGj31N*UZd^_IIi1_TbS-;mt9r`TNQMx&#H_S4Jp?OB|&S&lalES!9DJ`M@_?U zsBPLv$c9#wV=}J3T=xA4Np(V_fzVo>BY1KZ-@SO!iM+53>>@pNHb^zm5Sq!lZ8tB8by37?H!`i->!-8*hq%`Ag6gI2Ba6xcp3ynC8 zqJ$oSNst-?41Mk?8k9B)2xSA_DH(*Gv7k?l5e6iRI6(^zNI|ktQ)?04vZZ98-S?mz{?DNM_;c1We{WN*EzOHD0`@*O2ih;p>b~&q;34(OX zurx7H`@YC}Fdteo1{saW9z2b1KriGC@`_jdKhUnpm zv#-w11k%v$jW=VDPHs*`A7D756Ph16%0(C%W_;4)7>gL3#F39V6#ZO&WG0=N0goX{ zKMH4*gciE=cw!+7Es&e;82}fWcg=*eg?xY8?YC8WOBsxG z=$`(-SOVY-ZsFbdf-8&0@cgZBeXGu8%#-PC=Brt__smG*h@_QUt*mdI{D<2t78U7fb$CeZ~pnsOHZemRQQT6R`B$T2|7osmEMEoAy?j*=Adx)`G5a> z_q^vnuZ{->s?0|jq|F`S-MP$c2XIK&Ha6(#`iCvSxa73tO1BRUi$mYzDQ_OeSjC8C z%rUULH{WD?kiO4PJ-3j26NYyQ>xbw4LSOB$K}+a}C!e__{grW3ADDBXYc>J)7xOow9EBvrPQVcU;FnA18mKz&QTsls+hO}1s_UqCCcfZ+0}rTM zRZY4Op@D!P5P@`@B9 z0s0Wf7Ty26{68zx@IHBo!~0PAKwk3K*JuK`*ES4>OMDKX#)P$18bX<102D{%wLrk6 zE^W9l^yj_yhUo~S9C{AZccE(`srSJux$`Yphr4HI&5Kx*iFz&R*rnYT0 zUI`%ZdG|5GG1>tN9Zv|}nHdM6FSs&x;1@29KZ+pW+01~==w~8h^-KCc{G>^dEW` z_p4v~YWJD{?=zJT60$(vgmB747a2D-!czUCOR5LpU~)R>pXnQeM^G3T+$;!DM$j=F z!%GV--Rc)|hSH;tc}-X>AVV1G((lF@ekQ)F{x!}hmJGIj;#*+R&-mze+izD_KuyTh zPh2ai6h@vJjKRw=dkjS8p?kc@Pye+2Is4o;@0h{c?PW51#~pVT**bgUiL@3ljDuxZ zni#+nEtY`!jvumyj=?ZtGRy$P``SIPGBVKuu0=wg@Fvyt2I2UviM5HK<6-bka`C`2 z7XbJ+Z$A*8OTMB#lgX>sTwNF6&>@&_8*1VW^{1#yyX?GEcgw9lM73o(dSt6AM@sFd zt%3H_1=2=38u>w{kahH5_{(-i{81VZFG>Am!74go3PcCuMn=MKj>fQ1Y0+PQ0ft9A zfz*Q+6+iksIGk@YxBhRFxBLe9YCT;Zd`m%X1KXjC_D!p_mH}Mzx>O*;Gi9Skq z&0>MwQCJiGIP>%1V!X^d*ah$bi#*za&eh){1aD*QHkUW&q*ucio!R_}XCS&~YXIok zoE<0+E;vWPkvv>CcYP!JZ$;9?pV@0|ZL0NnkJxoi3y3ITK6oIGUkpPCoYj|Wzkz4v z$|M*8>2!j}MEinb{Y7xjCbM;pA&^&?a0Dk$>4Ea(pTX4DXH&dyjeiCmz?d*XtFi_Z zd{}w1A_BLV8|8s949*Q)VZk9>6Y#+O?RVTh*>7QPwwk6Nt(r*BkV{$9?*yN|OCF&E zS8>%9b0rX;bkLKkF-ktX)wo<^6eh`5e62V#uIN*YK86p^m;@u$S;bqBfs8p(eV39}itC=mpA6p6Z8D_}~ z%u1|&g?ow|JP~A8$<-wuNpMTyw$f#M=`X7_6c6~r+$kOmQEz{-yOhC-qqg8jXv+Oeo-igKaLL=umK(UVtpMGjdws%CYt=Ra z%Sxkupdb@^JP3_5JdKwhIwN59FYnfiF1)DnH>>LC96a|opIf(vIO7kXLH{y#g`orV zfPR-UY*D0IU2(1bQ?}Za{;9lUSfeK9PAwm^`iPc|Z{dC|gpLzNVSm$`-&A=4o@n(m zd{7*C<#l4!U0-H3pJA85QNNqu@&u)*n-uvViSZ^4uUlcfoEZbr3?ra-pkKclxcui{ z7-(f)=FAJthwoL1O(b9~-X;dnCep6uX3P!)wg1+viL{f-%7=&+lE(T@&_A3FZR zgp!`0qZpz$;=j?)qI2TA_%%I@tmN571_00GCY^=;^4P~cwtLm9UsWgLV`F1A&Z7QP z2X(~_7!wY%FaKvkj-o`Lz0g{X%gG|K5 z1NxTH1JF (tX#+3CA2$iLMg^s7DrWErmzK*!HFSzHDvF+7#~L z%bbLMpg$NlY^!Gc1{T|miJi+Cmc{~H(ycRp@(f1|Qszx|aG>iu%OZ?^qq_zF$_PG% zSDmkvZycFFIqpc`$e*)7zi*cWz6%ek?Jo0+Cp>ol?)lGoW_4|O(F>l_J^Uf#^`mf= zR}E9& ziS+^8;ziyYE3W#5Zl3_$=}#&? zr1JqlV4j4}n}<5SK>uYfwV`mb7|WTW|4vkJV4~iLwKaLxVJ$FR7@WYsVyqJ{)?Qcp z_9+MqEe09_!7!cwfp`pJ6K#ZnD7pC~8ex8j4pA@+0fP$B^ao*mxtaXYcIOaK2;d5C z7-@LMn5;TO49=~@VrX2W8P5!Spq~uh+)E=*Vcr2@xyL9l1S>8W+wc9}?^T9C=>rrG zZtOr``JoHx0FN2<<*mc0<(xouSyfhNxD^w$6iI1ZF?qCwHq^_#Eg^&`uSANG6*LSL zEdcQ_x6q@yWBQo0)g0}ou*%bx2MmY8i7^upm^T4U*kVWwZ&qK0VSvfE7PcP#gz+;v zQYy0YqJE6K7%yWvoQ;=NnBZD}ip#LTXvm|2CekSm%worCtzq5#xP|? z+4-FWpp|`nrk#{{xCF*8=B>Y1mn|Sx?iT_VwXlWwQ-qqfIFIokKlX|4`WtVm{N#ok zZmjJXv~#KehC6MfEI5C~7y{hlZBxRh7+rbO+5&^NgjvBo_Sj>qK@hE4;6Sfv7v7w) ziKd+Ug7={uj z6#4K>iWu)$knsq&`ofsAgoubTk|)}iZ-Il3TS z2|u;iNG{Un=`Q4;EnoQJyH0sml~*z7wQ~V-%+I2w^mwcZJy}b(0^WiqlFA@UZU4>j zBxK@Z2U?TywqnJ~ZqGgLTX#Y2R^-Wjci(Mr?(j4Xh~9DBamQ6$G7$LDALwihg62!M z1k>XH{h1C&{=u8wALaxWm2H`9f$X7Agoo1Y;;{tJwrC$wws7S4S1GF_;(XH+;#N+2&DCeB!Sb!}(3MPmBTi?Nq#U@gj~F z=AHVbox6&sY&u=W4P8F>-Z4ztwS{+aY+)QTcSA4qP5mxD2NND{FMiRBt3wQ08XFs{ zbAz=qdISR2Q?R!A0sVmHv?2Bs^cp%8j^5PWj~*-xh^LL_;v6K)9t25p%!*C32QM`NZ!35T20*=ra1hTbrcu|9`o(w&hQHWEy zei&N-5g-@@f}mW1G$AC`fL)$SYg#m9uZh=x$;?R zp#D6#7~F#2nc85&OUW`QTN)rF;507e$wyqj4DPo7+I!`P8RV)T)p5%eTNdNVmi3H5 zSLKMKE(DZkzh7Y9TMn3|yycm=Eq$OVj3hLqj3}1sop1sdC_{dsrL4rn9X@5{eXVn; z4^Tcqz+;E8k7186M$;zj43a#u82*0kNxxPP)n!nyRg==m1C^44_LL*PKBVuiyz;8< z#J~KjZo6&o{k31Xy#4k&%Ga>(+x^*}{!z`M?SJ>;WbC*q&sCZ5qkR#8!K=Q7AMeuF z@RE9}o3@GL2ZX_G#+>)^jZhFr+3ANoOCwIkpYWvspZMf?-3QM7Xt(zsyLUH~FI3xh zfKG2KXNv8%>n`0DSAVa2%~3Dw4u9$)wK?zse`pl{(PlXF6Yi|dj03!@#fkTDhepwj z{)0CPL6j7Q7(dEUM(`8!x}=n(mYn-`qXyp%1C3GEUHM z#@ObFzop)0{f~d*WwQme((3=_^h26s*{J`#&NB&Ot&!762 z?!gbde_2F+K=f167{eesm9~Z5eb;@gm3CzHIMnUCXvXTVxkAwEEwjrGHw$@21oLv{9Rb zr?x-zkzHyW1?=8n)K35D7kEuN_$9|Y)78>1@M z@Ufa1{9D|rWAyFxpZDUoanonmQPYzEq*9U#2JecC5Xe#%joHaz$cp8Ld09nv43L)Ul_ zx+NQeFLlU!<%>_&wDVNqOBL9uI2O#swlk`&a7PB>FB|P6AgP=V4q*sG02x4@TcYwD z(D4Q%BJ4v1O~N%40vS3H1dDq1i)TQK+m@TOo6{BU;nlS@<|Yg-+5wfpr~g3u(tX>H zEncVGH-cV2_xr7#bf*k?w|PisB?Y9O-nYh)`m+3Ky`5URB0vLaQ=VN@UYL@r)ir?0 zBrlBVj$)L{c{RSM#gJ-6n|Bu2d8eJb>u(r*(GiXo3R34b|I}01FoExVZ~+f(UrQ7G z_HnBn6vaT4_B^|`{g>yI)y7+D_dD%4P`=cA>z%fmvHF?x!dd#iRe1YjK!$MFhNI)q zvTeL2r%Ho;UMT;zpNI8JzrtvsP1AqB6rL?GI4j9G-EjwpG!JN3-A9c$?QX|M+F9wg zr$e=43yw1`ECNhIDKq_>F!UapujwZGuI*cKQ;&8`r3@3;810kq@^$@VAmeKN=R9+c z%J#ocKQpIXgfT`9xJ6ji>8fP>f%VxZ8Pn61yQtr-W8b!X6fRo67Cx!{-i0T6ZgmO$ z(Z1Vuo3b!jejxZ2C%jZxtJfq>O|aPi6ntw-`Co4QcQc^NQGyMw{Q9^K9gmVHZC|wd zMju7;Y4dLTB5_-Nf=q7XwD+~HT~F91lTGBB{%Gf&a3Y++hliP+Rx$o1ewsgtuhQ+I z>AZ7o`(o6+JOk}GOW2aS8UlejE(QU1=Y+=dx_@o)Fc?=8X&e0D5Ab-O36DT|glDvL zoxEF|55sNV_s31b`fB4(Aq4Gl< z+(3QU0O7>bYi+E-T^R9f!~5~p*K-EYY}>fL%9T&bto<<1GA6@PPWmWu6TY#p>!Uui z$pdq7HUoymCE1n+F5C_#<^ByAn5~j<&vpi7yn=4NW#GxRv2ZopiR~~v3=8YGBec;E z-&CLRj6fZ?g(fx#&=U&F983acE^+hf7hWL)MJm^dteMd?uNdvPm>gdNadxl#+J2aA z-^rvc<6fCA2h1A-qwqSHzL|I7BNEoK8~SN!W<-)rHn{TC(z;Rov_2X>n=(@V`s|D3 zxjx#k)bj`~hT%8w=Gw+#>H1;)=ed@#q2u3E^bI%~{OBGNjA9_}W>uYGZI)l(I5(@z zW*I5{+D_zWnRHP{V|dxZp~Iyc;E%V|Tp>8IE!)vn46g8%@S*uN@*(d>&0oC_{u6go zylSJL&VY--{pgm?1}DSD%CNA}rOfXQn+1aw_4K>*yf!P6lGfECDpgU{KYcs~KmG89sLqBcVz!#$2rI4qU1uoYBbH3t=E9*x#98&5~ zU9=5s1x9n?+5*hg+BqsQKrci;CQsWvoge0m8z1p-uAg%(OfExbu8H5$SFL>c<6Xkr zc)54YkFc^bg*Keu;OszP{PgpXCSk70uO`?;|7a&*ICfqsw|-|lPdDf`=9- zEuO>y6@O)`Og~=IyVf|ROxqpMqkf@Wo_p@OHIFvmHr=rBnqc|QtS~T>;b?Q`owGvX z28?7ogb%bt?q@9U+{VMg%jp9d8>*M_m9V5s)$@!mI>$$Tpv@<7k|tMM?u=VN?>O$b z7f-nRPT7b0>^SiDvrt}F2V^U zU9Q5_D~hJ))*Y4dM=4Kun@(8TM9H^j-~N4|UW|bV(m}d03?{v6Ano(ah=f@?;PN+r z^EYdhHci@_wDY+Z6Ty6vZPsbhUt?oq-9G#5Q$756_8oD=%e$kFI;tBVAFm$-asC4E zfejy@@l~(qJm)!+ZrxV;K=P{(%^&?6SXs6+t|)Zk9J49EiLg<5IFl32*_KF{5D=kh zY0#`|%5tBdvb_&Y_Tz>AT=Qcj_wfS2)7Dq!0A)4#w&@bq=3NtPqJP38D7?Ip^+)ZO z`wc!wquIevi<1^l;>^@9l%Mnop6A09lx^VSA`W{7ZN4ejby#>!u!;Ox=6ah*N6w=e zt<1}KBxjxF>X-<`l;$t`7H2A7L-kGuC{d8j`d5dS87Q+yDVV{=SJP zO(tXHzYoO#Mkikj&z3xO2()$R=hfCB@i)qK#DI%F=FoCq(e_a+{7^gTgD0JIQoU!q zuy6)O;V$hOhL1K3?t&**vI)>dBfEk(3uwNW?sySf^jED~RX>g-zK@AH>o@t0qKmey z#BmM$&dYwMo}=fvU(dv8)43N9?h-%omfBUH(rs;fgj*kivtS8w9&XyJPtx9mxdQK^ z*Z8P~-4#CPrI(>@1({V@69Wj?B)?~N&EW@npT zTW0cT%S>HseHOu=$dX6x^N8*Nd+*ildA~i1A@C6ecLUwJP}P)LhToYZ`d}OVkHOCu zN-cV{02jeQi$~)kFbp?7Mu=|#@7r-Bj1egd9lXbUd`|wL&94UZ!V)j<7R|NLy>@Q9 z&DPyj|Fx#Oe^>b5CH!Sq$X&Wo{4>ZCnn;X@wskZRCHBS#!@ zL_HhQe9qi19}yJSaa878!p%#~FNH7km{A6};f5QktYpk))4@-CSctttds^BG&ii5g z=injfbM41dz7KISIs&+&&jnh(BCMZJ%1Qi9`8sSItencG7QXoq4iJyeYX8=Yeyg6@ z!Mg3MI+tB`SyhV8I_s<|Fsw`w>=#~mVf|7SFS`)DPB$PZ>KLl6n6Wvyr0W!I8^~G5qkdTfdES_O(V|hBr3p6~>*TBY-q`p-D2YGv$->^a#9{K13g2e4_7&>!5gF@nl@2i#WG8 zvZH3Y82-$lU~0$z`d=@f@^w-8rvo|TNZTT3?V_Lu@}Q?HW}*}P(T{jBSya|X;c5CO z9+fYB=}W8362@Zz{>eQ&67E{iKYr?{ZyBt7ft!ru$;3m0XTM23W8%wS{_^_eM*V`0 z@K3xM|7P6Me-3C@H(zrX&)3%9^rkme{Xu>3U5nv#QoLF^v>|`LCqD6s6)(ypn~y9X z49J$jmhReiEZF@FeLJk&;218*AZ_5Wq7Ufrz<7ZR6UbKozr2i{>kEF23FCFt&IJneP}2zFv?1-uAY)RpWv2K*wWD zpp)S%(w=k9IdvgXUObZIg+4h(z%MUaeJDP|g`F-80dR_cnXkwf&A;ni@2VcO%D@-t zs`|yeO1&5nEUYUNaKJEbj6dyJOyDCRcbEGA;um)hJc_5XkjbiMY@$(%u=oo2=tnlzxMl8CgBrko6c_6 z3C}+=jKO`))obcKeVzU&u7wzV$Vh8049Gg^Eg-A^q8b~ee(JN$Hd}Z9@wLmki@xw5 z-F958`cI41gp0q&995{t2z%bJ_-sqX1fo-9g;+2V=T46-xL*L+VDB8JEYE zoeE(81NQHZe8rKKp2$CQ%Qb7()NRYgwmFJ<3BH2Pe)}cA-F@;CpR9V3HsCL0t1mO- zRb=e*pa1+y$8;xrgI-1UX+K>F?;)3s5wcmhF{2zj3je_G$$gGy@TpFCit!K})&^{% ze}?J58|@pg(#`=<%yrkwsm`V57fBn~$fvSh} zj2w&>h)x-puGMM+lR~au>Y0In0aNY>Lsn@_mJmdgJCy@H5j9UKgh~LIlv7eE91KSW z3T4g&z$e5hITRU;_tHx*?HDx)OU4%NN4@{RwzdcElYd>v2et92;8$~2u8_7brKAM8diF^o8=`pVe z(wZ*#Y0CHh7lodle#k)+6Cf|wg28-Od5^A!fr%+Y8|El46B0@V2K(OA-&>V7N*Bh8 zmMMmq^Pm3dpBCl#aaEys^rIhLx73V}Kct2mAHJrInHn1mO$_B2D?>IV!Lya!XFl_p zbsSPycylNp9ovRX!M74jF~Qu8XWQ>vCOqmsZEfEtti8_kzKy#f@9`r%0B+Ha2@Jy@ zZ(q1SqO9~$yi6W>aGE^om*a|X9UB{~6CHRIhoT5~_@FCZ1t`)yE94EZpA=H6^I)e-$Nw zcST(tYsO!#fyfzl?Y);%GODo$VTqqO$#Wvgl>CIX?{hyakK~s$?X&y9ba}LGXzM>J zZ9jg$UTr$}ZT$AREh~8>EcF#X_leWyk^96eSG+Wn9>Md0yUWCl?tmvTs+0Zn0kV}I zA%F7Rc(uCz!WX=-jwR!moL0cAuD7lOZbR8ZTc&MN4ig=Whg5`Y`qG!aSn&I(IvHTpGbz9mvp^IhE4_=p_m!`Fr7r9qbIdUn&+?%3J4S{q zqAT)lp`Tf3GNFYdi^1^3dyf&qL}Yw?ydK3s|LX%|5<`_fWsty!>2=y?tEmOC*SzL6 z-3y8geQm+L^6^_`natzgZ++`qtG*_0Wq4Mmw1D9lKh`#MzzD7GMUtR0Nj^j$_I@(T|1m#5W^HNByll`iC;eKQfc?n1`)CaL~R!Gsevc^r8MqJz;W`Oq*-?I`v8! zN9y!|J@=@3AA`p(Iuk#Xf5aY|_ z8s3b(XFl^8wLeaH`w2B3UWsqvlkhGN##UqH-S2*P_x88Hz4iq|g|Ye4GSB*a;eF;W z#?jLbe_CyeF>aD>LN1M?YB)jI%1Rfq5K7lX`{qODO$_nIpL`bstfiB}XJ^T4&Fjz^ zTyS`KQfbrm*WXb25`BwzB(F_|6-HCKIenRP3!bQddMSAR~3H+k;3!}jGPi#wG0)!lWRFwF9rZ2{dd2$2g_Uuj<&O7hE)8g(zt zM7eH<#uuLSqv9rQ-uKE^S9msdThPZ0WBob^2jWWyCl%Uyv~4Rd?2A@}fOdJh^u^*yI{kA2)@tNip4MD%UU({tE5 z%t!EWJOv%n%jjC3IZ!ZIo4-1W179H@@CI~kj*6$V2hrQmE?$(yL9&G{$3hW3fGnr) ztyj979SS#ktd$wa8>%KD8s$=Aa$Xqbgg|t#RU%3`#z!#6BaV=;DjzQuos1#c;)an@ z*eG{ETm}XP2#k_}>*F8$cs*}~f#1Wbr2Ym`n5lagVTOWi12PdeyHb%oM<#ASs_ znac8>0Wd%?@hD_f#-x>FplYL4N{q+kpMWzV*s=^*3Z;9D*9tOFUrPM8MM^N&_u## zd#(LiCI=L4lU2eY6AUYQ7%jR(OC~WCWX}|GXOy5}^hgnu{s~WbeDzvEkDh@^ihL;y zCT=Fk?$MG}eO{}^6hk|Z7v}E$vBw@;$FllSUO;$Ji^KN5Mw<8&0XHm7n^&7=G2Ckp z+-SFZLXyxl0m6q|uPKWZCU)>=fM!l~OWj$k&#Du06JNRre$Nxfq99M4 z@$vDhKhTMcL;UswWwQ3^PoG!$wtVR#==Zg+eQm9aNjU?QZBQ?G;R~wbtK5a7@wFq$ zSpWIWw-kM1o9>PnL1#D=U%l`-JPHpYTX>bjoBk!A#Nnw#pE5BpVWFontd5P1RlG`r z7h3$_?MK%F@NR+&=kE0>4|htxcrn<1>by@)oivrS%2#%Hmb#%8UL}lE-YNHw%4D7V zGx1O#daLqJKKbNIBjg)H2YyVq(*rjw_S1zem|Lhv@935s<0-3+t^N=9CXe)BU;#`zV}j1lP{fmu zk;phTF0&O(8so&olTnFIE*=~j_a>JNi|EIM5wvnk|F_RILirQA$aAiv!t;LK*Mjdm z%WeUnKD701vIV$?4*!$7qmehh@r{+gy!H=XTj>=)V$|WJfDY+`G4#+EOrk9ydjG0d zzN+djcop0VH{W5TVgSIe;Lu{obBn?08%5WH>nlrqb2Jlf-hul(a-XXAFdV8A;~^s! z+GdEPW13f)>oJ<+4GdWHBjb260o)FtTqp1EUBkpe8~7Y!hxsnr`|yW8++FkCYwCQJ zp%dNnbVkSUju*fST%cRDk4KP8@PQxV|MWDxo_D!%0qB=_lq>wxCB*~udq!_%hCk8E zU;p~o*SzsEjw<@YeB7M352MCLXs#dM^Lia0L2Sua+spq7JToU$&_Te&U-g0u^ZvDc zHzmrVc}V^G_?iy4)4dzjFnGJW=nMUFM#b-klY?jwxCd|y80wBI&I@!EJR0p;hYN`^go`XvtvocgTT zaz!Dkl7A`3Kv6G0R%nbCq)o2MU|gZdUvkMMmEgF!^R~(0K)j44tBZBqDm1~Ca+QJ5 z#buqxsIXfbyh&3V}7sg%KR7S9-8KhW^^x zqkoJN-LznQF&Kf{ZoO^Nz)UeimsaI5Qi_2IlDL>^n4|Dor;^^50SXCVAP;?qHjRbQ zwKyiY;`sTB6_9rn63;1zLL!_JN+Cj{8E@)Dq0efhbiskT$=@oqNm|0iSqz|lCa*Ez zwRN&$32wP%aQLr246m?yPv8+`_(KcuP2matgJ+Xf_zwgKS#vAd@7?|ZvkmH*KaQJx2mZy4AK=n)dS@^~RbqgJCtU4^0yKWdTp0d4j zrko=4+IYqT1KX;iWHPW*4)GZ}gRy}|cx2&oJcn$-HQvx~^bvKytBh9$dxjZ&&Db!m z@IheAWIR~hlaFVUEaOc+lvO-7@uag79-b{<`4~(1pT$c02(J<{oRP?v>D4cjz&0=W zt#>Fg$k(==!}QCKKd}4irI&RN-+Ql8&#k&||7SUrp2!*j+RU4X*H-}V#-r5RRUi3j zFa3u;XmU(<0^V6zGQr>l1|N|X-e-)%iGC{C79-x)lQ`AS+ibJ;P<3g5{)1}(-xriE zt0v3zvdBbrO5ezzQ3H+8?@TPnFA$!sz4~35_@%n1e-cMobUgJ`UvWT;&J2ywLxtzP z`=tVOZt}yzzn{J{Zg`9^dcdLfw)(&R2=HPuE*b4(EQY^~DPuaIU-TCsPshf_s)rSw z0-hP~dBWSdz}WP^|KNYu`Gok=GVC)x1N|3#tAEBh9R;oGZ+e@$x|crvTQk_ef0P{> zRPWs5RoagZ@h4Yp1EFX5)Fy4vAJPDMlJP(s?|^i8k3~v`DTY7>ZlG-M#dj|cW7O4i z^u#;vxV`c%Vakp^;+nBoGh76JXyIEGx>`|;u?s+m>lo~5^%lK*`A^ID90(2kR*N=>hfIfy!fw=Guf_L=>$;VZ{=yPLC zUhd7C`yg+0@16crC;TcjZ%m;R^->@5$UEWE2;b14eDogKxS`8mjOE>S+pTr{J638w zfTvh|F|R>S#yR7*#Q?NQo`KuT*e0_xwxbv66MWYd2si%&!pu3)D<0L-X^l|+RDLy) zc9O2km}ECee6)#wC>!4cXqGcZ#y}0+g#QfHf5Y@QRJ+s3%C+SNgQL_D7z}chYO6gM z9zkMdlrZSvlSBG5b}8!B=ywvihI)m?RWiXEKnY7v$dT7ty%HFFu6mIjgM6i6f|wCI(jp9Fx;`R zvF_8wP;UEx@nE8fp;8LONB@l6lmOtpv1DwZS%w~4*a!yOwkY=AOV88LdvM3?cT@wo zdv(?x<6gZnd>+8k*)~V{0pBkQ1kYI$MH68=>U49#*U;5lpJAt|^|CSaG^jrGR{Y-%7`XD`;H0d!e$bX&|CMRgz z7GYzN;)-vfe{^g-F+u@+**0DL(ZnL#g(<(pF+GP2XBf!%GCmoI7!bzC$LpA<1XF&E zTSf^y4oxaEV+C)eXV7hocYM@}IX)pTh6=_fJcQ9wx?%0^<6-{KG!Dm6+*OPoJ9UR1 zd{DQ0;YW`@aKB;&h|jK!FHCMLS#0r}#|Xux(MaTpSLCFw(bCyvEr zv;Y{FEcD`g46=AML(rcc|7VpSG9WT;;gcp!Ci}d3w2vp2ZGXzMaK|%E95euwh0f@* zyxVwaGm4I0rm`i}RfZIomZd1_pfX*}xTR(;4OV?JOWV*En@X zc;xYIn{SM)@P-#!FhOIEec(-KJdgw4Ta=KeK9mpn0hGyuD#jIKj_ydGH}=HGTaJG9 z(N+E#E8#D6>GVZ#uU=@#I5pPjgYp2{M$+9cqsFdqmDeP%3Snm;U@B49~k?gFZvMA z<4+Y@GIzvN@3`}hPB@Q0aV^B*=j6SGPsT?wS)O!+`|Ng~8sGfzqh;=^9z160SK&$8 zj9-N(&eYze{(e{=uP6-YIL0oWFf77s8%_CTpqdVJ4rFIlhg+!CT!MjNfB?5*gc0gQ zKg2_!&1BY!g7g?7rb!9J{Hzu-q^Soc=u8#vo&doS?#fU{ikiAm7AVrr0to|_W=%0D zVywUNtG`kip>*=6SeQ^_hT>zy>JH$}fKYe!O?{*l&b@u#NA6oa3n&c~MB9+F1%!*W zL8N{8qO8>v-Zltd+m!2>LZkh$WT)RSUBWr|O?a)~h(87$1vV>#(k%ZrJ`QvjS|+q- z(~sh(|D~Z|Q!tFT7=N8{7qsh*%VQX z+qe|QfKDm(Glq>daBCU&+N*qdQFybmG+P|jjAr=rohz>FzINH=-A=`z59cjt+jV8q z`74jxzkBFI#_KBv1Lfmk-s3mwCtQ8CUE7RnxUkT`kbq~{Zsy}E+Qj&0BEw^dF#_*# zJ_bIK6;*hn%;`t?HOZv#;T!m%$*(>jw7>h^YifSS9{ZNkhxe_tFjgjC`cr+;2|fe& zfa0!RekQ6`uPNpFLB5Qa%KJ$%O5o-0wGm%qs33s1+;WTZ{KML2d9IIskq10}>Ef?+ z*WdWFQePgca$gI0@J&TYf7a6uo#c=BFgo{69?QR_g#*279L-1Ok^hl-^dEf1_~3~| zF5`=2u8$?*lXwz(A)E0oywun*c7gPs@jrQk(6;o(LdKq}cVlI&ndrLL4nOzg_rV9R zss;-BhWbgbPTLlv(EZEerSfbai-E`_nj&0{7lroa)z+attmi-Ks;!rN?b7b*Ym4r( z`!98mJK!vepEe*%4ANS ze&IdZIactbZ?xA01J9*r;ZtcN{zo5UG{Ey2G3ZU(ZMSWe5BMhDt1tAQIC!P8PmYm! z@=!Jq9{mw6)ki$MP@KrDgPwd))d|s(`Y;rlh~s-E9l{Pg;J_-!@j(kO+4@K)HG$TC zyq?@`|BNNLqURXr`rLc~ZJ`@|<=k9j zm@cCXi)6+YIVV4~hlbE_cKBGd7Y9w@3+lzdC>|M|aXni+C7!x6OkaB0H@hp!M?ZGh ze%n(1RKd2g(8!OkyP-SmDZf?>{sXT({1Bb`X#+ln#{33jV!QedKH-b5fX0kPVe~0_ zm4y)am(PYzE)qnf{vqKg~7|lqIrGuo$nO=@0*u*yX?3_chTp*++F+qvY`EwpLU=9!o}V8 z<@kf^iVo7(|KJ8KxYC2h#>Xmc;&0l59?|`pq6eaVIE{Q^Ol3%8=!s_-N8W6$P} z@I|iZyRp(Qa4Ro;5C8CpHqkuVmbZH72lsfNKG$#h+_=#v=)pZXCtu|R_l{-2hZ%c} zBis4^u`GZ{rwx~0`i(*t52>`B#MM(*4UUvB7LDETEqQFNKlsvia`58v)#U&F$#q4?@X?g1JZ8m;EvsJrtfw8) z?NWFnXmw{aacJ@4Hm>bv#2Xl>(FEFhafi{+j@?=Pu^|1 zgtciBwmzwUa5bi)@XV$?ZU4^{zmMO3{9*5hg-Q2|dkXK^;@-St7~QsE{rvLG zqmRO8qPDttyAdV?j+IQ4DyudW4>W5v2;XwnAR~}fOI!8C_s&Eh`S#m5-{((!^1SW? z=YF)?dyn1g*4s9pt&6gJ#ns>IUUSsTy2GD(NPR^BsUyKQ6UZQQnx zYLSIld}2B8+8h#-aJp= zbNZRxRo7hGZNJ?%_ns&fCH8wi_)+&)?|fU~j|2H*vTf35LL;9R=F3my<2S5r^_|t$ zVg#LU{%sxC<-XtEPn%|wcPsPK?)hFbHj=*faZ`_B_35Wc+L^9x zx?yb{7B*9!^L?MP=yZSmfe&^UeeplKNAL6S?iIiD;_h!g^pWmKzw(4?%sJx&AL_3C z;g7p_z5Pwy!^&h3SPWpSp~we98=hy2v(zDZ^snuEp3KG_Xv6zyW_sWDL7R3|o^uUv z^UQtnfHypsf!bMZ8xzzC|I85}v#Cp~|EEp;bi=~iu-xY=y?YS48P-Q_{2FN8F8^;PO{chTwp_ME@#KJ}S@ zuU|Ly;kOpHDHHZ@Ua_V-@lD4RL-T(16_0$AyDV@FGAw^5=C-5iGfIzZ%S*k4wfFT@ znu+|Ugtv+3dEe&O-p@0;bxzjme{lJW3Hq~zk}fe@{jbIMuyzd#8&&za#BKAKYr4eu z(UMPnYOveH?jnX4#yxr;Lq2aTb5TZc#&e!rj4l?ry|akVFgagHJ=PQ>(Vw4uS~XG* z%gfO?yY0G5cfzrMQgt$m5F8S+kkC&P9?}o@tjv^K?#gglD^G^$d&BaWE(|Rxf4VwM zmwvAA(iZyAd(T|medF6#)DNksM+;kRwX(bN>TA2xPCC9A*6v?lSq#DF7>AQjo5ua9 z@HSpQPX9S^_1mgq^yZr03Y&)asZf?xxV^MVF zon_LzF#y6Nh!A|9Ga2(7Ft|dLv$=26nHCve{tG;lO}^PX+5VN7yzS32J5gk zh@18xROboSc9#1v59PM`Dq9@k?S0B^!%}vQxSswbPj$$BuA_=jH*x&hde4+@RDQzy zY5UL04DP1OXLEfAKf`D|{R*GyH#kaMbd65)zQrGWi#Hi}f<_XaKFNFG!dhs~)k^gBH(XzhdxQ`0&KLtG7@-qsjoY?Pc~>KEq(ABt{GN}TudXd&s_xZ(+~8Az`glnOdqgwV?jNOB+7ZebQ)OKhOGZ#agAY|9+;tXY+nG^&VEY#MBU=F`^2ecGSCY2V`~bpDJ@aWYmCul8||mZZa@*G2Pd}~v!|3q4C@*G?QSHjStaAU;$B=}Hu>4KX!ZH-^v>4WxO8toTW^Pa$K za4oFOGvUerDMP%(6`uF*7X#$nW_7u{v^BIis&3k;ZQ{Xq`wZ`eEGI!*gHt#FX@5(X zEsolI@mu`Yye9fKI8DEKm-q?m_fPT`@2G+g|VIF?QjQn^n+Om1+ zH!kh=yx-txike_u|1|iTYgXDb7iimWd<2qDaG2-3pY95G$v1tAH?{dsmwqw4Q-AFM z+JH7)g|{^4ecIZ#TlkbTrTx)=q)!@K$>Thh_J;p1`j%5+>X|$XrXh%@J0z z1a2(A7y>#V&*|{Ib4`cM_P$N)K6$$zmcQ_}49|f!?Wj27_S=wjHGGRfTig5O?>Z`9 z@uz!VU#`bLtjt#DQy-Ic-Zeb344fAFbwf)SKUZEWkQuzvDxTr8{EpISfw5e z4J_BvbAydHl`;t#ahG8&2H-ZhTN^r{(LA^BhxJAKK54`o7FSqH?}+k9{S5NUYW_W5nNur4Gp3D{)!lo@Vb=w$M?HyK^7N?n*s9zhN z`i@FJQ{49busqr@anqj}v#z$I99q2nj6eNin~zmp6QYbs@r+f9ATXY-7|K)F`1tr_ z-f7c@x{ea_=m^hIckPI)y=V1y4YYXdhvQSWJD}aXOMJZ5_A@J(;iqlh?Y**+F8TD! zZ^IKeedyh={1UE?c(nLhp zJQQq6gahqYS2Qc!DygG4yl3c+qALz>R&>($CJ>H>@E=}Vwo&zQD!tz@p!~;M&HIc) z_vzpMz2}VzrR%k({~Oe4EnW2MXuSBr#ZEi#RJ?Zw2Xt$*v$8B4;1`)NNFN-8wuDLF zhI{s2m}~IAqUd3{mkx;Q2fPa;zxG|yCamon>5?XSxQeUXKJ?@E^O7#*DA%?rzfA?& z_P1?s+nu(yaYu!RsV?V2ZA&2+I+-=2fM-OZlEnAc?xgy z6z)exIQC?GY<#k;q)*z^K^_TnzZ5`ygFE$|a$gLBm4P-55x*T9c{MC-N?xUJ`%v?0 z_)zi??$<)U+%|9V(2)gq^Fv!G9S=jt1HyRO>HqBbIJD@Dbo0IT+^g;gX^rVM(R}|* zt@e~$rg>H48P5!slk`*)?7GXYQ?~8r9emJf>APcNV^wDoMwc&D^qRB^6Sw~? zJZa#=_F0~kc+If5ZCLVjT?~+Rs7vU|eWjy@=7fPZzUL`v${=XfOTc(t*M6xP<9E_0)Pk7-O#wn*|al=@Y&wT(yZe47@t0%(gflEtOvS zv)a;Nv)Y$$KArVI&Ei z&$W#ye~Pv-q0bYbIo(*iot$-?GN)Bg$oR;4;T^yi?7Ez*NZ3L z&u{*D73Sg^1XgyeR#^GK;H}v40HP>i`o1b^t9#~g7g$F0@*A>(ef0_yUF_Oll=&-{M ztCKlKJd-9~9E?Edicx}Ms~z~3x=U-3f&$0mD=W9!9zI9DdPnKy8Q~m6tIQN)JkU?x z__eq^5h;Pf<)d8;c6g?8Oe&2DAWVFGRvCD=1Jr#az~RQ~NXeC6oOm_j&DyxfefOva zIbRH<#9K^p5IIGbm!dkU3x2P^wH+uk^(P0^QC#_|qjsb$ZG%V8Ie1$h!Wq}#HtiI? zkf6Up%PEJRe{byF$6*^+X^Tk*bW|M@Z)34}&XAs$z1yteMBi!nAR;YtB_~D6T z3`BOO4omwwn9Ocf`tiEbzSG`!R`;`;Z|Oev$@44D>W2%4jLVEW^y!dqlPDj3pi7`P z+bB&Y!y|4gG;~AB9}S^Jpzkta;%$<+*Ij>IciXLl1GCXRTGdyfNpz|Y(5m$M77gmN zcrM?5$L)0+lKwNcM z?rh<$R&G_p@#I5`hf@HZ;lm&_nRj!&O20+#3L9Foo{Xtk>?-h z8Sj9!^bF$(ox>A329#y)P0w0a{M8KS`6oKg#;n6UtG?ut1=s6R@nQP!26g{KD40E= zgb^$g&boBx)U|J_)f8V6bx16s9s!BD zDOWkXEif-B( zx{k3b?~}*6T;;WLrEP-KXdOceP`8_Jxw-a-ep$-EdoK!m+M#_E7>1re@a~-zS7&c$SLs>f4*1c;2jhzUqno~qw?#on}%-i7s{7sUq*D;ut^aGjiUA2FZu26KD*wh z`*1nq>5E_bQuXv$y?S-^p0gNX%ab(t5d$0^N+CqAr=Na$^?bBV#-fTZzglGB-RkRj zyqn3xBg@yD@l6w>kA3W8^-K1?D(YM*6C>W16iJ?h_^$ZgfAg0p)_(v1KmbWZK~!7c z?B0Lo`|F~KcH`5&o)#}Q%DAnA|37QMj|ACyrK>$2ndMm;2^iY z_4co)`tWv7PfxGV&rHAPoI16gr=Gp))FH1ui{PKv=^2)EhBSdJtFEnfvnr7MC7+Ky z_SkCJ!;O_4@XYyTDEkP2I<5Bf0T_M!?efJp9|qv~F>=kWpZBfvy4`7a5lG-*856v~(S$o+-bI(j#tJL;gs-%cJ;w0p zqmQmZc3&a%u_!i)pyJ0r{_#4F>M&t>;)y5LHyutdUvE9T@TkD7uLk?duazCjq6KXW zhHH;rH7Ou4sqMu-Zj%nn)Nb~L=~_ym^TlTW>$6}*bQ}FmFGx=sTJQ&?``Cf&1dP{$ zmI-gGW5c4`ZY{y=ul)D-y2mVgaCdu=*DY*Wf(!rhx$ks;{;D zR{*b(y(aGI3;aY*N%KJmwmjWMhTD>b{G%IVyVDo)Snb#V7_wrdY`@bDFKy@%E#P3+FfwL1>N%H%WHqWS^R{re&wrGm->*KkF9vKz~n!< zOYf{)xw8Af2R=}J0Sf?}^F`na?iV8H*FDAlYw^owLhG%K?tX$;q5trPdvL*qKuCqHA8 z5}c=J*n6J&@sE3a)gAN%d+-Zi_(FZ&Bab|?d-k)Q-L1ZJb=5y67Q{m6DfR-JNidR4 zhSnYNBm0njgdZ$^G1;y!0*G{G>p%B#Fq_wS9u2hPJDcs@TkFO%XkmR}n0%bm03asA z_@diOFtZq7ehduno4YT3@ylffqA+GL$XhUzXl8Gu%uxK+lb_Vys^GMrnh0;~pPOt_~E=h+c(Gzs1%7+?U7IM-%m7dwO=`p+>@`gHU4 z%T0Do(QdKD=7Y_f3%yPi(EKm1|3!DxjW;cNWjPW4Cra<*XsY@81{*Nr)x#_8;{&#trHpZV-(x{EHns2aAM zOE{lvz|(@XRem!a}e~~DpBJga48@}zcGM~o7J6Glc6K&>h;G-kY6Af z-Z{y}OK{d|%VD67Kxib_?)f8A7913E-ehAz&9b-7=*Mo>)vF9>EH90{Y`p6PJD_#Q=ORM*APXt;=|$>HCy_GXdJ& zZ{MetzvV-#bN?@oUtLynuXz)q&FH>B0s6-`r=EIhmECCC)(7O46^sH5zGN)uEr>yP z33#*P{oyY`Ica1U``l5`+&vQ^cnZ(r6*AT9pMrx{`0@)(7U3c3hpsrZ>Lz;0Ytv+| zmAzm1{1>V&q(e<)nIIx_^#M=QrF7*9C!A3E62F4}__Q)K_uFyQ&y>lrRx}Gg_ayso zCeYK4!}`<*ufFmtNIso9*&71N7Luq-AX$)&zHp?oA5*p)V)MC=_D$N3jEvNPH+seA zY}nXtE=5)Vv9e`ciyZ_l+k%;@$;Yme6DmKvPwTbdCrB4q7#+QxGo}Ou#Q;VC>CA_UXaJ~dH zivdFF>)-fh_t*dMq3)48?^J}*;7grpW#f&@#@au=vODaB`wtBO$|rzCsd9kKU~p88 z8K8(corDgji1Uaj2?2kZN#PuEPzk+N<<&PrP#F#uA;+PXm$OW$3FJk9TlvEHASlg< z5UiY5*Je^28IcSZGn*XD1So4K@5MiOisNqu#S(wb4j~j-+>`EKz)dsK%O8>1svr2-K2FPG_TH!>VD$4*RD+LLyx-$c>e{qEHzjklD z;l^qt+H=ufbiPu_(E|cmBgKdXf+y*RYctYbr%X`hyt3Mn(B_hwG2Wmxg@Z;Gzu2#JW z+?j9^*tA-VVGif|1i$)h1z!v?4gy?rQayWKP307Oer4cSfQhlJJO>tSz;g@QP)2>B zk@kM%hW@5cp`l^<+p=?cULIqep`|~z1Asf}g3(qDnPhzPoByKHFh>kdy`{jp0(cH@ z;>*7)tCoN*3hWU9F0xW3*%6W;8V!jkuRr($!5TML*Fu_N^Bfr~C1m_V9;4 zi*?wC_(AaSz&|{&_Q~X{Ks_C$U!ixrgm=MYeOgzXtV@1<(I>pM1ha<$s|-H_~7!&%-MA%3S+_;`eQ&4Y6O^TGk_bwUH-o_J2t`i-s+&XRyoG`An|d&&EqhNqk1~MIC0IBZ$av(q zaC&yn=t-sfDcB)*%QBjvJUM3dhLuDnA~-)Be?c}*h*zNmsu*wNkymBqF}Y#Iv=4|# z_gd6T4|!>~=M(p=4vf_m;~X*&cHD1v;PD*?jC zJ^pcZcG@ea0*oeQ7?Z$?J@S{~$!T+68=N?=Z!wq!6P=UA`XxW7P2kI`kJ^sIX{Dfm zr+}jXrP=5I_`-kGfFD^c$fsXkdzQz!*RnWlBgH_37b`%>`j33%Bi%8_9#ailxpvr2&I1pA;dIeT}Ce73% zI4khTsZTw%(M9%y?>NcE0lmEP6|b!00Uzj8Ivmsef_Z|qf~jm(lH&yt zcN3-+Jrn*c+5Z!wX2KifGuaGUy6hL2NN&P8*+w2&afF`HI@!#57YwB1zI)+!yNB=k z@M`CybE~+?B$Hm~pDrQ4t&E~e1kU*vq(}e<&zCaL@TmW_xcbZV z2OoTJwPoIP!kg+_KkoY*2c`L>;V1M7&~f;d{xW&wwO!i@Sl#MATA**xC40aGD>}7j z=ILjg-tGQ>cCU6H9%O4ObH^_Syn<%uo0hb%PyUu*b}@iX*B6G_zjGP@tPe2CK$vEU zaMpK7*OU)F9q;(%>N+dZ4*){Fdy^Rwx8HXAm|%H)QJlUCO!=F^I_8bX)cvQ-{F#~a z^)t>5C()ix9Aw6J1R`g~7kiIC?)chKv+-VSI4qnLK?VCCF~~SW zW`w;G%D{7O#e`s)y;{7Y!5QH|Sh2)#JL@B7btnDJV9z{TCy-rLiI3V!UbnKZ5o3^n z#}Q+El9z&P0&8TY0Ekzi^g(cgvn0?V_-6&66=i}SzD^0qWWf>gS+G#OD~h9~olkx0 z)AiNd1eN4BvBQBQ$F;-I)L)wle*}Y!zd)@?roH#xyIu=g0=h=v z%~;S^UPTk=1jg0#a(;jB_kOnq=AMTePCqxa}KGy4L3 zR@K0fG3ShHhZCV*v?E>Mm18e$F#?`I=Xfidp`Tb@p9gRYKO7^0PHzTy6$%dF-)r`V z9e!B1!}dFjtuXc46h8UV7r)ef>eHVZ+jd0x@Ba69yOZ91Qmq@E3LxS`Hj5ytKzVEc z$Ury0mzt^k2zm=V;BWW`ixtcnXI7GOj3Du zUI0$8oz5c9tmLCl@Z+j7A#>cZ$913n*H4dq;rKbveNOkH17B4261`y3X{#dN)ni2- z|G*^3PCGrg2JE#*CJGQ*MU{QU1t3lS=#$rm@qE>bI$Hq0o8TbR@Tf^5!4AHJ6yQ2yv}R9Q@M1MPUl~8zLdzl-``6|TArpnCm;I%W z_~Row`(m<{)Is-caGx~`JM>`*?j0CFqq70`DSP+aWtJ2%5x&y_ontJwj>WKg2xLOq zE5Kt6JS^i<+O#q7&2!J|-u>P)x*fOQ?rtjpDcY;AxvqQmzEABAIe4%_!Ag{@Qa}UF z&4xrN6MFuV|h4El)Z7~0vcibvEz zR!L*rP8X&l^IDw;|N5wZpAs1W%}vLRQ*|Ea;wXPn|$iK z;TJd5`r%S}IM=2iXg1py2(%i~D?WmKR+tKoS#={2dr5IrFDNTptX$)?T8SeFJJ*oD z!`*48pV^)JoeR5d?z>f?=kZR7vHsov7$#yF9FRlcR+%;7xh>js4m3oqOJda2a2FU) zKWnCY@eiDlpINy(6;v3{CHsFWm|9~K(`#rBzl7%|sv-CB2|hyW}dc`E%~C)ko@yj&P0-^%dw# zc%F{XKeDvtZ#;>|wTDmh+~5B8x9h%u`hI!|pqO|fJM9H3SZETAZ7i4%A7qF93rzwD z1Zu~kgw$6%G~{Q={u_dnIZnzLty*==qqbKF*a(z<|`c(&d)>iDg*nsN#+}AgCdo6jhO{eeo28ZfB^?j#z7hQZweLK)|w6Jk`EAR)G zUf!MjjyHD?`L)3$7@lXh#U^a?FP+ak1|kb*!nY?o(Jz^5!;z{E(g`KXxDNyw0TxJoZJ=11b^*Z{=%?w& zFlfsRyMJ#^gWDE@(>84?=j|9xCI3WuW~!cv>R&ABbzG4A=C2MP zt0Nib6~RF6B}gY-8W|a*C{B%ZvM|@FBZghBr#kJld6Sma4=L}cd@GCF{xS3f zlpeL)qiPX!*UJ0UllomVeEkI`>toxNd;m`S{Y)KwU6MBD^2nHPalmi~Wv$IvdUTk6 z8`}hn($9&~-QRelHG#esm%)!boC9Mn5NwR}3CQD`!|Qcm{n)YSUrq^7pZ+q~(bs~6 zi5PCQvy<^%i+AT)ffw9)=9bo_qiHzFI0h&3w&N@>Jon4v^8m-ridcb!y`H>RO<0?SA;Fuu0MFgRT+_Yw=eo`IdFSdpbURUd=%cSEC4obSRtsN*md{oO7-tcdx0nX5dHU=~@o>qsoCoh;ynyPJ- z&XHk#NMEPhkCgA%dvCZNe6nqxp0p*HoX_=Oq`kBc70#1BPpFx8vukJ9saHLQlTvBU z;ibYTGq&kDZ(C^bSnrqOc}>;zurh7=rSs`wU?%Z8Q+3T$J=4R;!YDNk2Y1(H>(t3{ zb*)p$@tJ3;p7FIV{;S|6M^6-ambA!2hDn>|x|MUourXG)$U!i!{E)QdNxoWW$WQv{ zR?Zz6kX|pD2=upoj<$UNyuD6;#-68#3we{LJs-@D=;5_xKdoe)78t+v{-2KS^}^+ImG=RNPKGSyZKz$DBD8_xbDO25zP`&=FuLLX-A zdDn>db*^$4eXAt&RrvrdgQlH6{`&mXzu&)3yV7$$Xk_r4{OQNo^$`24EjJVAzbgEF z+wJA8y|U`h>PhyXAmwC`{!Nx=eeX@yM(*V}45yQ|pK_Dsxu@RSAoM*S4`>;p&%fK- zg|G$&gD?*96XeeQIrrzjBS>05{p_>Pt{b__lO?{%pSm40_+GKGxwKbtuDIfgnrb^fqh-P=5W>3S5;cnqCBC^@R9VErc)0(R@X2(9#)S!QcvnoH?Tpo zW$+;P9FyNMkh)V}?j^nLPwGfLt`{1l|6ZH=*vJ04jtkireCTicY{@S@&(%IN$KQ;# zv_1^WFD>cX369K!+ege1Bzr6Z@oEBKYhwbpM2rmt3vi?u|J#r zNXc}sS9%S}2IyY7B)dFM{yc^>MqqGI>+H!nX}KT#C@Veq$+h}?xmTZn`zfz%t-qw7 zbIw=let+~;^2r;JH*HFD?v<0YmwTz7Oz)>Dhc>)6pkMZbJ>i5C>MJNME|hZ(es$NH zcJ(#s^=9)UeWH6!wi!D$Mr(ti{pqQy+V7tJQ*YASI{N4Bb^2n(0b2;Y*}smAAh+#% zMLuw1v-+T2A!@~opzg3bQ}^s2*N)S*^&$Q5+Z1g%d6I8!>FTNZdt)@!@~NK#C;%(? z7oN+#rDMUsdJH{!_u8fXPknvctD2D^a7`vfPQkS__gncS-7E9-sMqCeZ9q!?0|WSc*tBzRnc!qt z{$Xi~`?!^f6ktD3bYZ_$lV1EXd;Z~NuL_f!_Er7FCq7Z_TXeJYLwBxaXX7Wd!j|~V zXFgMDjjdrH#`uh(E3bAYzhlzTEpTjUIrKbsZ&d%b`BGo(M%VdE{mGMhT;E!@!SGSA z;I+*o-@L;lEI7%naozT@m=oV}Vt3kUr&XE=eZfn$845iImkPGHca5KN-?0VzPLe4; z7)DlIfBnxZU)j6aUYgqSdS}L>EgxJv>dUW2x7Tp)m3I9Gi8UzOFC%Z_A8cA5@tg>J zGhmzhZrvTQ|1--9$4$GZJn8Y>UVA>ayS=Q0*UvtrEh}q%1PIiAmVUJDitX3~*^2tM zkMDZdyX&6Rbb)}pz!K-8XsC@ie zV*t{An4I<<+!kqha z?$3S4-0!D*0z}D)0_{>Y zFf_|_wdr2_EGau1$N3t^*?5+vI@ccqKP?-^9(U}qRk?5!cYNTE-G7ZL4742DM8_b! zlyrFjgTW@weZG;uUk{-uUwFfP`2qs{f+#?G>PUXa+)Lf5&oTMiJ|->s=8E5HN7vy; zKfz@`zN~y$;RO{(HmtV%|MDv?ulMrIo}tBs^Y)o#wm+mVVoC?8-+4d3dlTV@VfWj= z{o7*(p7LOAeMx=tW!%$8_mY;rILh0Q!=Rx#{_V@j;LVrEeej6fW(+V^$aEk3;1Jn3 zoX!GyPRGGB4S1n_*7iBIA>a7>cTZC{yaAh|+usdnr!A{4M$yqnzrKDY@j(yTaV%fk zr<6&WYqPnjuYX@9{WNU}jMCG?Ig7MRDM*72RkZj3bzhj7Eb zSiXFDwK>q*ieeYN^rbKD_S$Q&%9l33M~m`W!D7>Xz;RR#%pZ>X996q>kNJUDf1&q# z%!AF-gM?1m*7j->^d`%!e6>d#fa|r%759OUSC}ZVMS>3&#nx}j*No+-l}Xz0_fP-y z;VNt8u`jAWkn)a^Ve+RA>8|rUwa`7_C-lCU9>q8SuS}XuK@Vi+iXul3D_;?o?km4} z1=A#pk23gRgI9nB7U+CsKbV>DM@(++JpCLQeo$IxNUlfPb<4@D$B`SMIYqT-`1$=}wWw6x)R(-H{!*0;V@ zec{^pJ?O{tz3+YRtGaf#N9|VaJ0JQ&DziUOtAk$L`(MWeb2`f7BzoM?PYg`r**=)I2DjXFPl5*>&Pvsy6k*G41j( zOrYb<^ikfYKJ_W}!)k18vS0r6+kGo~?Z4|NQ0{{*?zh1`K}{bQr9Vtg+bShn0mvI% zXcwe!xn|S*2oQY)(te(!E#H>SdD^Ij7x>RG`*-fY0z8T&v)YKlj0oi|VE4lx{-CaE zG0?v9WZ*H7W!ex;cp;LDFTS{by~@{~2q(@kB4bSKyYIgBOMM2;9z(0j7p*wjHqcgw z`h2ZNz!6{yM5bgE`|i8fCGrUNi(mX=H9k1-m{A#mTpQ<}dv2Xc z&>wpY_-dnkA*R~M0{YQskmCaC+P%9g!=&yMF+xcC!qkdl1OcnX{NCqC(kRmi7JU+eT$PBTFGmk~$! zGwf#jYi{)+rtx!E`8dU&{n?+@)xwGku&z9NWmQ7HOb6G}p7_Kk)<0u$(M1>46=`q= zKa||*r=MQs(i5KWgt|vn%e&-{nQw-LukOKx8Amg5#@yHSj1@?^95Yr76e~wLXJlo@ zMLkw>8W;PW_!_4%NFUYdH6jx#WV1lDF`@jQ^{i)&8R7CR1juvii_O3}kpZ|u>-sK8 zlP|ELHHL>(S;4OlJp9|g|62{pShB0)kt$Z53-5bXebAuVIB4nbZr0bi+yGvo`W=)|)z zqUb7Lpp_=z6z9lF1^qMT#@lo0pGmTOZ4o_bLqF7kw|!lgT<|r>&{gf=0{F?e=Qv+o zO8fA~DFkqv{kM#fKajl6;ZuMxdk(et+@Ebodjr#9%_PrM+fDhY=AW;8i>04)jURZK z4sKEg{gRzzE;-89@O9V7LyG~}+2jX(CD7-OTxsop@{*nd>~FG+jJ3Luougi|nCv4T zO+fMs_J8jFb>i);vp(F7jEq!YgUpNkWmB*}etE|)yFDJeN7ZRox$sleuPya1D~kpe znrwrM;5kQWQ-O8OKb1P?G7pK(}UbM$&SmXZe6=YbxMFN7r0`L-}CB=Ede5 zd_W@QHrZt3?&|A)QRr=adhQDl@>>rpfyoxW{^ci@$eqm1Fd~@gZZ>&F)0EVinn!lD$a2=o1>? z!?B@v+ikbH8Zgg+9@t#^xqSKZD$k578&#j!i)c*X~Ht) zhDl{Sq%D00a7(VDJME&cGtWG;;)hHZY*)AbxKD0d!KYm8XE;>O{Aoj0=xo-#!j1XYlWf}$Ki(`UI|1H!D=PTZ5agy1yL%8uq`Q77Y8;FqZ=~^e4<-< zMDw+;eXTMlhY11cAHle?1U@i2qQ-cLnvxOK7r=bm+ul}JG+Olp4m#+dSv3^Mw89VL zV1trC)OmLJ>)oz-F&{+|#WSvgrHgsPfH5;R(>2HlR*t;jwcrCqColvoA7>mt6S|O0#GM%?S!}@QkTfZ79rRjyYyt$D|*sKpz0F z!JR%bv;@51lv64w4mK{vJz0r9Jr8G6Anw>>j_uy@&UaJ;!8Q<#3j8GS3K;LUl0c`N z#%Dk4*_G!QA@GYgy|RQhvx(>ZfBW03p+V2!vrJYQ|2Vo{qwpLIDEJo~Tv2o^ zUbK1pXFl`UVvHVG4IYM*;QJfj_{PeE`pTK`I-X!4qg0+h{^LKc#+u+DBbm;%f&jk@ zWHYiDWKVnA)2i_*pYnK={(keD-`suR10Se5a=v*n?UOwVN$2U8K1COYCeeX3Kz4>V zYeLcH8*Q{<0KUHClkmmvXacDYsgSKg$+aI(J`(4&u$=Z*!W~%UW;S@)2ZIbArr}RuX1yg z`2x0hV4Kjjd=7flpRaDyW#k-(oSfeE;k#Dbog$f|DX*fMEN5S_3DM&|gs2+GyW6h&{kBxg+4jc4pJ5quS{u&cMHCqn&WV2{rg904PTAj(5DH z2Its5#AwjJ05{-Iv9bQ* zFaDzH9lUhtp@&vHq7D4OS2KQiM?jLViB{k{xJ|!mr3>uG*!TOl(b@@OcAkO)M%bJ~ z0u8a)n*ouF8mFV2Bm`usCSmpRm%pNR$oub%NcS)zVdq&0L&PH@%|WB!5rO;|&`b|w zAjohOsQP$u{YN{ZadF2*6{LYSI?5*W0q>FA@6u5_(UvmgQ@F~kK2@P#@FJ9}*Y z)>D3~&c4W>nJk72eiR4+eR_8d&=~=ILQ$#|q(0&k#>cW{%c|fdT(#*L@W1?KdyYKv z$XbUWhgDA7-+%iWlwzDyf>zryWZD_vT3`YF++LoC9AW^N?0{3VRum-#mYFC93Hig| z00JA`3M*-VZLgb9o> z>d1b7X6?}{oH4FF54!YB_6TH{8;8IA%fGCFY(YAdh?Y>yx%>22TJd;R>mHy1~J8#r3UZdhY^thH(7*c~eOLa}FpQ zh<(9sAO}q%3INc>WV2Pyw9ac{ADA0;_9GUKYA&VJyAST^}a9*XBjDR>$rBn~(0E_S;WsZw)r#@C)U^PkHlA5ZZ*IAcT9zmaTly7~hs(%Qh6~$=eD7DRk^kJMB~_Xz5@Rcx(j= zPk>2FJfTi|A8Nxy9=iwKE6dJg%b<03s7ZPG*(bqKt!yFvj1DI}S&a#wo0r#?Z!SKA zVC^uyWWo#>%XV8AX|cD+0r)c}aLxxIC-^pG1~8G%Hh$t0o>*-jfgpH=tBn19x4v)v zlDvSIvVw#rZOI?OEw7)FPiVn}DtRS9WxVmQfG&HQkEYzqU-9xfUM4KqfBYqZ%8YXs z4G6-Cf1oqA+^S-OPEFqy+zilD4x=aaY1jTk2J;iiMYs{v=Y8wEDmT%b zSIp5qK!3_@zQyKskrulZKK+r|?(ywnS1Uv2YlFSZH{?&5lwp5b)n|OYcF!NOSOma@ zc#}n6@MC-hShFC7eePNKK*mDbVo3A{-#~kKkAFpPz4A|9S$)u2`2zkKCW|&2mN*yB zfKVZj)9#OhAj)p`PPzdAf_%=~L6;sz4e?0BbP2M#pFEVcs6B>x$xB`$>llM#4#Kk) z1O{DQ@(YqAcqi|sn{HB>_n?Ch>OOMTM~dKlPk63v9r#`sM=C3ghfI z$~*k}e)&(Y>h>r~>*DWUGTM(dN)Z0^k#n~M3kw5`*(j2A?b+(`3WC)_W-)+3o?y7w zXapw$=u{i%AT;Y_3%N zDj!*;oJp2Vid+jA5BHM?p4IEv2BkS(>2KSYjEj2ALIVBRX4{1)V`3nZlMED!K7jw= zTOQBkdEm}7q4DkRzg-P!r(t|y%rfT605E3b?cLSbYt==tN;47VOfEeXUX_W zr%wWOXhGkC0{B|ec{4L4zx?GLgRcdaAo;q0fJ|s+UCJ%xT{svZAEyiC1iPG5EWlu8 zI9(_J2*^1OpNR&}u3%v+<02c$)X-66k@7j`M3ZCx@gM(L795;hS8I@ge2mDp}(W@po1QYd>O^R-epK;IF z*NXc;h2G?gJl$}E4ZB}W;WM%FM@D)}CN`%u?dhlIhYR(S>yeuo3&A+|0NOL2%Be$M zI2zV>fl=cqP%S8DJOot*ye$U#>k=I0+wc$7FPH859YZX5cLSw2C1SUn}vfgs{qK*|KHz@iO4@`_P9#i734&%kpo{Vfa}WIXD?OykEmdL`CA5LV%sB{JjW zl|B3==;WRm6sw3VaW;cxm6+w^D_5?pe8k|un`XMuNrW&XM*Uu8@aG&qqka4_3>YZt zrNq2ei8m-Yklp~YD)6R3>d}b3s+>G?FOuE&) zG}9kv_=Bf~1av?A0nfMeH$5D{A9))i-u2yJ0v|aJz!L7Khx_@)8~)LUb%m5so-Ewq z0Xx){O%HwO&UGsS_CI~Ye&BiKGf0Ne^d`k6l*y9yr( zPFRV=zGq8S z&34XL&Z%}2e+l6Ek&%&ZMcGCrZ`$xtOiBooWI!45ahzKbAerL35Vdsb86M6Uob#)i1BN zYJ*QlRLh^3h&KDMLBXTCZ@BS>I;nTl%{SFRa`4s9pKEfFU5ZA|`SLkq_OpJVE%a=a zYCzxMO5X%e)o<0QiD&T_wy|dy+u`4+7mW*m;uH2Zd;s{cTHI^l42$e%!-9wt1OPnD z+6H>EXQQOsng3yV4LSnDFq~4aA8{rqXbz(wgqaA=3uj873`hbC21~S;b0TPffeBHD zfXFvNDpGH0skQ_={E5s9Vju{NoIzE;!BvmG6UG>XK!6j1R$tr~5JVt?5RZJsBkMWh z+^q;5#HtURWUD?r1Hpl4wP7}np`k6XK6oC6*EWq)_RVkqceiO_9>G7G(f;@+KkfF| z{WrSreD|X6s-IokJ!;ow-R?yg0ndm*1z3T;E&a_u4vYn!LQ7Mn7j(^;R|YVK8M=ff z<&T%pxgZ9C&6p6FuZM5neWc77C-@r;<9|G-Z)5~T z%IE=YA8NvS{(S$EA9VlyKi})N-g1D8wmNd+y7EDYCqDK!yImf(tlol8eISR(1G7$) zrg8E7l#%D9%qb;Kh9H}z^TvyU^UNk6-uAY?s*=eNDC058#-gV3v!#reKEL?i0ADo&knYh3k78T5%p$W+fjW|Nw>E`Ztp0Q8a3SrBd?wQfE zd;ZWZdIA+Uzq+eVGNC{DJUd)I^I6ZV2Agp*ekP*el>x#KVR&<51Lzq|a#lHw@M)}# ziLpcDbW8A(qk8F((6jM0D=QuUp>g`gxfO_lZJr5V&^K`2j=8b6`qwkuRqi>bx8&0f zKBwR|ej_K)0$s+gH=)NV=VXy*WQ=^y=^ZjJ_CMLD zKJtmp?~g1cv)HuskvEH$mp})3NM0*T=5hkbd$Ke^y^&%+L_V@Z*d%nK75n-}&ZsB* zg_CKnXUopO7oHEU;0UZuzPYcTbdJ9z-kLeyf`2qjf3OF@RK}yV|L7~albysK@P~fc z>JNFyL#vFG2aTb76N&;RY<0dZ+SNYVWsm5OaVAsw(d3OnY&KRmGV>1@$??eH{y;QspJ7kurT=NFu;?jF6{BMKh3 z@6J8{g6^qL-n0ARs>`|`UG|giep_!<1B3G8CAf-T#rJ_jzQ2zb3if;Ej4Qj`mSk`x zjg6$dH$B)$()rG8B6dz6N9;P|K+cd!>PSD>jK)x($gRWm@QZk2!fVscsg;worP-?XVO0ewMF=l|CQRZrhuLT!_<$;h^+6im zLEq##nlu*ZnhnZt5zr)`@d0}DobvMlJ%c)dzAFb8;y?n5CW-J3Fg_-z-}SC{)i&9P zWIg*<{T5hABkSoKevAbuaOuxAeZ%fe3`d_lr)LD(_guya=+kU~cKLtnV&_iOkJ!J) z;XZ$N$|-jpS@xIGfWes#AYcLnp-%<`A;%XHDl-gO6QzsBil%3uqqJjHpust;`KnU; zEEK5dxcvq#oke8r{fXM^r}wYZ{$$6toyqde&kV=>ITW zP1I)kIhA(nvy{G1M%%;Mo=V-bod-{G)~AYd3WgA5OiTn5;ci&^ur#HiuEw?`BpZV=^E9V6KAld=`U-@Wt1!XJYm zsK6E7;a(v1<+^_yc7Iq}TW;9>$k#Ss&WGi9Z(Y*cyv{*rW5Thixu*ZqZ!_(wvAs9_ z7VciMm3dQbqp$PS+V(ZAOtn7w<@JZpBO}$>rl;O}!ZEmE)17wunccbHxv<;jzGYMV zvLdjBP0A}l-}}L3-AQjfuB>o=SiQyRwW5pBtRB$fKXum|bMP~)55tZ_`Lo@#$v`@b#I%A+>DJ+~*Zphau{52KS|X>C32`9yh#^{36-p11YQ z_owdw0~u8p)kTlLR$y}`@6*2`BC{18OTGf#xO z+@Fg5mpa&0tv!FMXHG6DIv zcb`)H+}pZ8c;2(S-5&Yy?xa)yv3vciUe^8R*N5%H+bss+~OGa z-epDMe1U*D9uTm#uq4mg@6SZ({d{Y?o~e2!YDdscAfIo)zHO0TZ^%!^)p`YPr22Mf#4q)yDqo{p1s9IO`L(Bc1%*;MD0wJ zo^tI`-nHdV+YyXy`Nevkal#V;&j}Y9Q|ZnF=+_D(P-*!-13pO}WrM4+GEI5+lDD5v zey=lnWi0oi*dhngXNHT{BnAD=;`=gjW?WK#+E-WjG3W9)U)#8+j`ca-Q3P|^y1mSr zO{5UpHuN{op^y1Xzvay{x!0!Wyi`&048|_y`)vfDsiU9IHGu!r>$)A6`(K20X?906+jqL_t)ywLjcTUCGx^OS!by=38jzq3!f5c*rv(y*;*gZ_|gJ zt4|wgC)dOBPB$%ePq%!(+-&r*-^N7O+D30^GSB52NNZ`;7|HK1(9&kcP{8+u6HXWl z{>kf2nbhm3t>o{IZ?2Ua)@ITj7aXiXO|NSM8>yE#?y|*yAMeRnaZ}o00|H|qEoB{Z z?tXCWTzYWZPtUj}Jv1RW<5k{Wc6nHBOTSWwI)O6sJGO1qo8_^kw`H^?4YcPqq4xuw z@_-!c#UwxS1qaTx-S*o(>FI;}Nptkq_E%H#DwA@xUh$RUlgb~c=}mjCwQaG2m7G>@ z2Hf)plCN#M1}w|%O(dI1g?1=DGM3!61i!)8-0Q};#EK3efE1>eY9a zy*9V*eo^o@41x=*ASk>3?7aJ)&DXlGyt2^i&JQhL?;g;-XM%S#b?7*Cwa;uUt*Al6 zUKueif|2t2lQ;R>^3LHaICJeaRkM3pbs;GbW9gP#Zk@ELwy()p`@G>mkhb^R^Kp3#jwga)&o3=_@0V-aX!A@Z zJ$1EtrM1^>f7do?#Yx&4nd9uYuo5y*^Gj->F(sRw`@ajB!haJ=AZ}TR- zO-mh%{YVcQ=YY}Jq|kwJ@7rVU_3eK+$=IZhmVZM#_bEIbXz}P=;KW2x->;BAG?uc% z(uU<}^Dl&R@{JwM9>imL^|8fWOJ~mWT*;IBo~OlO?vs<~naxJ#C4U_wg&JOS36jTo z%{L^Ed-{!5$j-KH_fp4H(vw#?`N?G9ZM3-r{a}}&JG#Mh(G`I0ZMC4+B7wa1*-C$d zL+S1KxVAk@AkP`Q+;!}S+*7B&KK<9WN=3P!Iv4bDjakxkQ{q6rH;H#UMO*Yw>(hF6 ztF8D>1KnTb$9)DivN0_=bl%0{Q=jh zE5~|c^e1iC%R)N+JgL`x=PmBz&yH5L=ngPCFP(;Tuk>;zpIP>sLikpc^am@*&w%GT z$8_E`sObWTqr{bR?LChB*md*#DU-VTd2AwSv-LpoyG}bvQ*F|ce=d$0O>K*4Z%~3R zb!AsErt2$llXSwEtSbASSWdqGbN8 zwcjSWf#56k+Kko*i3B0+2ZyIX@&$kLCoT8!fN{yS55`>ly^F`L+x%&--Yh?+@Pw-(g zd>?iSkXyDHU>kyQcpsHr_O~JzTO7h`uG@2?lRDJb;y?MxJNgnN&3Wn}AK4=I(6yJA z&GI?$fwq2Wxz15q+I23VVV_Vs6eORce94=1d6MRQ!N7PGw@%$+*V$X_HLrP1wKxCh z&_lZuPdu>(B@Q{{kQ!`NAsm#4AFDe!fsdR!20u0bXzqHyocHr4k3O)GK+@{PJ>Vz! z5Zv~0x5E!VyyDtcDrA%A4G&g4jpER`{TA6C$&>qzskgpVl7M?TO`b1gp>$~{Lwj=lf=@2}^nvtBI5pHUehIO9W? z2?|a2C~Re4*rog7BtDN1OZadK@Rm)Bw*fBK$R2roSb`p70|>^px}lHPwk~CJ?L2vN zl(vu|@`FF<&7hZ+t>k>X(Uxn1f*{Z52=Z)6uZfeSr<{B_S4YY__OFvqncQ=}1b4^4 zMuTCw`;FO7!6X6=HbX!E+vnH7gNQAmls%@RP`r9(P;b4h%or9yrfgP*nSDz1-C#4W z2w4il?5cbSH4d?|HivYSN3`0kE{Kv*M^*%wl~IqCHTt?w`Ls4rC+C2mu~H^PCrv*@ z!m|P=_iDje{$VQl+r0Gm6aV_z`Z}`B?@#-{Ka~wrZy4)S+YS8%p8rq(^iQj?VDn60 z4|?)%J-Pe&bw97K|H%h$aJlt;2P-3#^KLqvn=x@Tvzxqd2gmT@9=s-ku042^-x#MK zIr{K{z=q9GjTsQA@=7SD4Hzrs)!EMEq;5z1d>I3I9np*D0NPSEV|3f?w{^Fc)k5ed zvyK!4I`ACYSPbB~8G508&*}Mn5`Bx!x2PM=ezJUN8~A$O%CZTrj}3U$RveU zjSoB-L%1@-$SHDeYzch#eFlEhO$Mtr(aFuFA6t}}F}SpX0&m+u*XG=WKa_TAdIeo=9o9aIGsZS|5dt$8v4$z~r+D6Zgx7>P5orSkyFnr@ndEkyLip+#( zv>=Z^1}Wu@4$O$#+fO>k?4CBq3eE@8eV89PQ!xdo)a7U`8I&FPtzRP+PuydBvZ-tX}%k zmsYgEQ`K9Ar^)}-<)dcya<TJJaxHQoRyag}P*a+@RkM4wDX`7WjV6Dt(=^=Uy zJt&V49YOA?bA9E>LK&X$7uqL>>@9}IKm6ej*N?uPfByM(wKDpJYxL>)!KXj{=}Pa} z++H4Z3(t5Es2~2=4#tnXv|)d2Hb?vhpXgYAW#K=0jGb#^p`ZE}`#SaCTIw;e@`g9O zp|F{^F4wbhnel#hXYtGl3l=(4P< zEBoDlxcIv_7C*T7|AqEi$XLL!K;QDBci7o*0Y~LNQj~s$y^sgOsDBtb3-9Fd~sf@F_jF-CFu@24Fh8Drks-g?MLFWS{*?D;s`LmvIaJ(YY~5J&ORP zbJoSOZ~fc}!S<;{%gw;O-~}(J0?Ai!%sLTp7y=Ut5+Ei9HDWmH!)JASJa&(|vFXcS z{_^@^05e;d2N7aat6$8(`A&FF0JYAKb9^;TU6K$l&rvKm1X}4dyiy_o`RFss`gO`TiyK`OM%N3tx;B ztOKWJ3J=aTK{E`~5Bd8f5UPE9Ma&mkP z%#5)Wpy(anz34?RsvB>k_W=wPnN@@E0^e|A6@~h?-fHVwC*0vdt7yD}kKcoPO4ka` zGtWG8Y;4hy@$w3Zz%ww`zAP#z&FM;cbh=O=!6kiKy}Iz%cw6Ic-4r0)p?rh_e=%yw z3L7=&tGoE`z3+W*_sws9v(l(ww-qmDhshUUH7>bnHH!Oyk`vf9V{R6XaYB9>BO9mZ zOUh=xy`u1jH@=}e{`lkTii?#c_=_IoXP_DvjxM>Wk7VGsbB#SONS&7g{ZCb&Mc~YhP##k64v%l_6M2@~n1f4u9xzUw0=1 z=_1Cxy_(q|CNSXE*DsBc)#=~=|Gr=KJR5^tG*Jn^fPS-YEU=Qsed8!l$Mz851?pil zvH=D4=t*No=CKp$HjuGGXY!B{f{yvn7FkU<30C@oqX|oLhQ51ld4qy%rbA;husfeq zzLtK?&#tKf6BB1_6=lhCZ$Xg5WI6j+JpyIyngt1cVY&{T(+njac(22ubU!cDu<1ERgP+|KnUApa1ga?vKck z(-FB5rrY!8{as4cYQZKqgnoW_o?+MAlR0~NQj-b%kf{-J$OoY&PJ|sI&tc6*@f?=-M5-Xp?qdJJw&q3es7^HkR)*NEpo@#!p>w zqkfVLmH@e#2{y@ma;bclPM`*`BH!rVdKv_cR)%E9Zf}~N?`-L0|C{(jJ5=tH_vSD) z!(Z-mKR*oqFF(<0ZXnWRyvWW7q@e2OQT60<4cX1eX1wX*+gKfm)Aam+<}K!E*_rQ7 z%Je<)s;)Sl-^yo^U?$w&)}!=odN}VV;DcZC6?97nwAaJYf1FdB)sV?_bzt3R`PbS1 z(g-_i-~Q;if;ofxxjd?Joi`URc%SC0?RTChVW^wKZX!i#qQ?=^=or!Fb)n|lTSYp96>(pkE?73`ycIZzG3@O1$e7N&WB<}(yb2% zA2q`t1Z(yenFbxd$SftTy$yRX41_b1tq5{|@-8$Tu7YIheNzu))-rl%NA3dcCrYuR zjq{I}OWzJf`k~HzPmMe0zoX)Sv(92!m(NT`WzFrExu9Kvw%xJ!c4q&^B80_itc{xF z{gq(;&`el9$-$FV=3X@IdGR6V+ezO<&hs7yBL)Joq zk4?-FRvmV`2G^=o+&JH1Qj6C6&rCEfPiq1S@}{*ZtQTio*$h;iW6y9Y6X#d%s~FX} zqlxf07YpI;ijZpRy{~>-fzIqB{zhV5+8FCq(KzmFcDRQ$Is@rvn?qsE_*<3jJN~Q9 zxU{WzvQ|Iex+J2DounxjvbN$WPWrjctP8W=JkRQb5ztE3I0`3eS4s8t^vdnK>P?Y8 zsydLoISp5PWM!cgwom`J@>%Cy4C1X&{J0X=n6h)={CsIQJDd7ae&kch#WhjYSkr$_ z>`All*NOrv_>y?Cy^^}HciSR5ua<4n%%+&HjyZO$Yl4n&d!W@HqxK6>SDe&Hba!rF>dQFtp3rOV-NCK)!a{q_ZW8u+0i4!t04Lr{L4W@vTa+u zbp9_&!lIvv?C^TG2^{s&PB&MNPkD=f$m1RsqDTV*CQHrqdgJzx-%WVV z-|lVt+%33Xo1eY#D_{;FlW{=KUzABQF);jb_8(byQ8YU$zcjIb6x$yPn)#dUfF^DL zcG-Kd8yhPS1pNC@Pwba_x}UU7Ko-zlbEtj?Kaz)@$1lpa9!iW2c3 zY$>Z>z?)9n2Qzk|H*Q4u)xU3->}MbN zfN16M4%Eya@Aw0x%q5{rtI<0%D25xA z`hUx-E&Q;!bEtzmUwQ8Sk_pZd7k-~!>&vIgb|*%g|J4qp<#lLweH%Db{A<2Fy%@dE zg+2qhWaq})9km$}X|-1Pa()W!10Erx!W2}0?XsK`F&^H0%_wNzf3yOC^B3XT{k(lr zcf-Uqh-}pU0K|b&5DaP@S-C6ypyg!a%=sx2pv4RSLws;*-p4R4f#x663L^QE?!j&d zyqHB!9$7l3gM+;Ay5%AW2-WgRj1@kP2<7DljgSEZqY`jNRZEFZY5MFm%0DT`#}xMv zAlgd>pR+!` zZtq9ayW>u*#D6va=3BlXj`Q$Od~!6h7wDv*>ivn)UI}D8SCKL_PR;V$9}Ze?eFL2$ zgEEw(IdOF^%|})_PlFNjgKYBxu!n%KHlhV!f_3PBKj%r)|t1qpVAKwNL@k-%R=SQA;0psXy38~NJ2)$CQ z+WXC54%;Z=fK)oU)vM6?jq|ZByxyQA<>;8bExb%IxT{izy=7%4jztU^);hcq^@CKt z_1iw-^UY^Iu}c;XOztC!lfOo|zfS5bu7FyfCn(3`#_>YQksliFPe4ws!)DWW35?ce z`sk`Zeb2lth(D>ZUG_30d!t8I|I zSoH@xKZJk9MyxHPbn)g~^SdQkLjoO{&(}&;{fsHY&j|!JIXy{QzH1c1I^(G4sw-Eumq=)ZumI%#bX|mJZt&P!~ zt;B*AM=zNQ@V(LaD5KVgGLo4!?W+N&3(Ta|Ugyi}k;aVLG}fU%11LXdH#gBP=q766;|GPO6=jds>>E(P*{AckOCyca1QO>q}7;7Ajr z5C_r2FGk({>}*1MnTiPKUSk-@n`@7~X^MNWTIWXcU&h}^FKxuzP0E>W zH95ZY(3Gl9*;I%oMVWNWYHmKd>v8Dgtf$Fc^ylT%B)Yx9=1%`3lU3;L$^}p@RYo!0 z5e{s*CrBh8wzrP9z$eQ%Y!Y8r;^JjeD_o|AeSC#;#>At~TOl4Y*vH3`!o!n^3hVE?zDLV!=U z8-yJI6P-hB&;!sC@Yq(HV4g`X_wE@vr1PDQc16v9SUnq}=&?w~0ncC#iV{ zhCHtwHQ=%Nl%E!5`)$Qgx;wNIL5zq2eoR%KK2G;puq$-PDkuc|5$&7Ep;SG5;=;qc zZWsMdhRB>97r=(LtP;Ha_7uoU1V1^YWc)d{{CmO1D7@ozw8T_&!F|dy>s=(5>qMTEg&*H|HNI;ZgJ*^ zqW&9o(fltz-pmd4s6>^mZn^=>%xptPR`6`Ol4CHWoRtH@7V7DLqnR00b#k3}d^u_w z#QDB*utFSqhx*@K)b%{I(EY^z_UZm{rRnzj?M*dBA|&nA?+!HsoR+&TOSmrdC>EF^C`n0m9LxvAx673K zCLb#{Zz{x)$Bt_Wm#Zhs0T^@Df4jjZwim{peimkxE5(HAB9UhFLSj{Ste{II77?xB zgZJq8NEs)5{iNicsdZOL~&HM&3 z^KbI(?qGU7cr(^)tUR?@H}+{vg!Sp9xe3ZHs-A~l(1!fobY2t0o|fGZ1f8Sw%@6c?s9)=FG&a1=cOVZ6ddqRz@K2|n zMjGuvg3aGb?3zAi30yex(4krAl7iT9uIRwzN`7_w^ZKHaK;JQG{Kon=Dqxo_J0_wH zFd^G&Wm+TybxrA$aNOD$)=+bm8d>0tMR+;`MF=qDn~Sn{=T0|if{x=k3Ldm{`!uHe zMaXxZk3T1Vj>dQelZSC{eoJJ?>ijrX+cRPic`hUdxA^X%Pvk?Vs4!ltlpd7Wn=lX% zynUjPOpE{H@e~(cQ6GUC2`=x*X`)a#JuW}*#v@r3VTXt-JMxDo`QuBtiR}^tPRyJ` zMVl=JE0i#)AGuk-9UV-8(g<83?+iC^n^1Md$0Z$p#7RJ(oGTrA@PJ3uR>&5LAh!8{ zQ$VBmC?w%grA4Cw18Gd_FXi++`q!M!`ad44AYwYJMEc8u#9zv?jo6%L{17EFqer=u z5C9tpOe+NX)APn7!>OR;<#@fQr@4>H4s(RjVKX(y;ey^4ly~{cH{Z3&QhQ_+n7uo5 zj}Z)pnz)f>Iib#or^FP_a89T`HD{lWXk5i;v+L{72)mb{_rs5!LqIs$1(a)GNF&$q zwARt?QGSPD;MvY%ih-%=+Qi;szgzn!m)Fwd23Q#ig4Zt{I=w?wgFq-eAzR8c7s7YurU`taJ17s)R{H+of>k zY^;CcNAyH>5qqb~YIKYeaCoo>O$O*UnL#Fz&G)j`19Z8|k{36}?3vY(1`y7*h%6$| zW5?@fIU~RLa|Hb;CQzTYHn4HI$7^gEn<>69!%^~G;&amWlT12)B>}Rvk+)pZRKQJC zCjGJyVyj?Pb&{0Augc;ongh2$M$Wrp-ymuxrh_?5r$am8jUBpLhEi@`UVv4xvFRds;yPCL) zB#&}6eG^}3c(38RD=U(vVar{~+qcR1;3|>sIZf{rfXs{)cpN zNdBuVD61FA=SyebRIDkCSi(hx% zb!Pby)XQgXcvaob@S@_rJ_#bW&reAkn^>oO?Ah*WCqtTUv>ALc^Lp*ISrs=M2)~1| zSA)e{Ao^YHKdsJj1n@l7)0VN8wC|~SR*JQCszKU68erV%OvLd|Rc~6!mFQ6!$1lKd z81+YQ7rBO3`c=75G$h+c<$W2gk7ML7i%wIdS2-pcUPJ-77*h=BuScwjvolYhpIp{C z%BxBb1~}}#ZO^l_xK6_KV=^40yl2eblil7!1%Y`((1TMN~4ebg== z$hh=RLH4cfw(kvR(wn2Ye+^}xn#NX?LtUip{b9J!FxA&ddkmZAw?)&tR{uH*P8|RA z(9^sQ8))c2@113sbZ4ju)v6O2?Wua=R1rwe&a3&|@ol`vc?MlcSQxD*q%|M5udc6` z4A|Ed*KLos2ye9fR_-v(o{C-u9ZkWA^UVcBb8+!lUDeSGwnX28Y+r1Rhk8DE?MD%z zu%;#?o07}E4w*28Q~TCNb5omv7>Te(5Cf_76`|O1Oodec*x(a&dUK(jpOhFg%2~(p zp;w|`#@&2~l#K34?AJ+@l-|e)KQH{l?OpW3;Aw%)TcalBclMDw|Ad~{cMU#ZCrWft zf0sN7C<%EQmAqk;?T~%QV#~6xN(1_QevQ69=s+x2on zW&RoMa(-M!wE`>Z6XZ&kzIhA^BSH&d7#9%;Su$1%TtR*X`soR<7w_xJEl!m*;p!$_>Jmi zb?^`c(a4ug@!HDzOyitlS)gKvebz7=Ev_65ixqXFsz7u6My+bRwLZ47I5-{qzmL`5Sn=7rzi|k8`v1^mU za%geM>BbwoKV|?gY<0G1MlS%0B!R~`k;h$*(hbUcYC4cM8iU4nyk!HrI2$H}`xe12_g-arsnkw2lK&REE3S+%TQ~56IHq_50RTlBIy%rv+ z$hs%FN$W=vltB^-QUs9Ox2EzR96xqR<4RDc#?qFt=Mp3ne&;v*d}Z8LgA3m)sg^#2 z-7P0YVy%@byq;heoU*PxoFU_k+W>DBEWz;TucJ5gv^hJzYoaEMUU^LILQXD}pt}+I zR+Lc{julPDDsWD58Edh+8F0ZobA_Px?{h9I`yxL3!i5CG6%`Xa=@Alw2eVgJFmhC6 zEq_dBLa!k{T136+^qhq1Xz~9>eK%Ltx2Ka+94yd}eXrm}>x^Uv-fkBOAV$8v!(B%f zWFe^kP421zYVL$c>xgyj?Y+c;i&cIPaokZwz{upPfZxoisdRgs=`SZM61%G2PfP#Y zNaOBCEdnR}Zyi7|t7P|edPbCumBz2~12+KeX>=+EOlZ#XJfx8M(S=Z|o(Jw{b|DN+ z%&;(<0)g#IA&D-6eXA1vKkp2H9xp)Z=28YgC4C@RZM-8fkw%Sf?1O%mT5?1NZb;8* zo?dNw$l(=480T#tDLI8TmkFb=N&)H%Va;jMoyyC)q1wjcZd9%AA;1Z>Bm7-!qwR3Oyi_rb! zRMF&89&@1oLY>OD>!3Uv9HN-$ul9@E;ZFho1s@tBIJTrjYOnJ&-tLJ=S)UVk$;8a2?mzEN25;$i%I5K{OT}!=yQ;NG z{ql<|kNH7#-@RRi{%GHk;&yDuw17N$2O=?N5*L73$#3Fb2v*nZ9#zM71{wvM27Fun zD*Z%uK#~X2t=^O-%#`LVCm1ow5B^ynu?|8CXc+nl%x6~8*7)HsCwO(9AUeGkf1!&~ zb4656y;wip#ZrhvZ4tBF`cof>{`gkQCM{-lxbiaTLfuU6eH|wcyc{b}XK!PIUsrP- zbJ^65t}@3J49xg|A<`u&UTfUM(zs+EzXJB^u)=#qtok7YgQ@ENvTo)-&kL^9Su(1gmk2gt%RZ7DCF3*&T52*;-T} z3>(kT#=M);0$(gIwAH6njd>318pK62TwFf?%7;X!+dVEjnkJ634U!*;+*CQPNr~pa zw^zR2^Zpy4lY7ko!tCxob-}yai+4S)6;a5P#`+b=felR;lpLqU!2-i)H05WX4Sc-W zZ|%3LQV5%tSLGnakZp!}S^oBir1B*9U5&y^mNl;kfsqh4>U+J6J{egXz1DwxxMa1R zX*s&-Z#p!-mU>oAGScRB>+A#Nvx>PsvM~PXjajZ4DEjfDr>G@J2h{*bONrw+g{M2zKh%*+~N=o7#cw+44FWb}@g6U0W{$gF9+ur=DBFv;L0J+P zMeBE&t=o)RqGr7qjUM1uLothx4i>e))&b7tLQ0)@)$NhjKR7wnTuBV*1^94-s(s8~ zjR4(Z&cqs-CK6;l{${$mHTdsmUknUP_am#Y?@fp2Z<>lVvi6^?wb$c;KMlJHUj2Xq zn{$01-gX7P8uH9i{yew1jmoL8uJLGa>;`|YEm_s=uA%e%yg4Jj-sK6pvDmM_-e&Hk zZqfNfp!VeOV+RQG3&nO3S@dwIIU?Kd=JMKucax@ItoNMdZ6Ks-uYku}4(`A?#$>lT z+q@#mvFSqgr24jcKmNs2nTw5W$@XtiHs7J&Es>!V%s&rPZp0D{1CM8Tyf0zBh zLn0X+f=ft8tgW4KR0_&DkvH{PcH5uf@GreyX!9DX`%0H9`1_0(K3618mpSZd&Fyz{9lldmyT}&V?;*c!4Df@RUPE+&5br{00CsDVjrYK( zcR>1Q>^<@+?o7mX$@x48JBlcZZ|YAvU1)K77$s`g4r>pSC`;rNBD zbCiMA>e&7+IY^DmoHNLDqergdhva&;`gWe*$#zpt+Jwc2In$Z7f2~1aRAy=Q?e#>O z_jK5~naRD>m3Yz4+jTKAzv))*^&Y22b4Mycuecw+GUyDBEz~?PdLX;*sDJivBFJZ> zdlqCyr}pUJMn|R@?7MxuJ1J%-NxJ%Y&S$*1HWyR7^@@M%56ARcjoNytH~5{YnSoZj z+F9(exSy4Yi80Wl9$c~G>mnv$=YLgJ(r2$Ff2@8DNxi@_62T^~N7CIKCvl<2je=q^ zD2Kt2vmA5QMs60TywC7Y2ab%gN&pEhf4~>r+?(2148~!14D0btS9SZSwNN{vw8Hp7 zj(X9kdSD9Tz@p_}VNT=@?-o6J9?g7HwaQvqL4{Hd%XYQ=tSyeOAgwzf90q4!$J8LG zjr3McZ#yIC(@$y_LVd?f2#>&~t8&rKfm_JJ#zIV{-=3SVynvi*g+v36!Gp zDLdUxch~Tepw`-P*w5|USTvqes$VQer2lkb$_P>ZiZqG!sS6L2+~-+Eg2yDct>BxPR?2SEBrhMiTc06X z<|N{$Oe;<6gJR904^fG@pQ~+7;A+I7^eI`T0slYs{=e6}w{tVFU@cVQ-8ouLE6QQ~ zNACnD(ABMO^w&I3>v2EaXl3acTcEV`U{mUvh-b)zgEGx-IIG!l_h%M}*jMKJf0E-G z*V)&nb-Bf{xxCK(&2at4*Mqyj&~EX-?iHBJWTF% z;ImHd`P{6<`=5K}WHlMyy_84v*`(lMwsQg^o1_mj;o-jG>o{X`daj41vi&u8uupX* z;>8tn0pm+N6>F8&wSR^80}@L0B`$Jp`Tm*ABb6&O17Ed9AVrTKn9H7BVm9+f|30BH zzl-^eOLIBy!vrWc+6}}#w0OriT;=_si48*%JI`ebWQ9!nR$^A+nBHF*bJhx}p7KH@$J`M~tz!wje6Eb0A5L%Y!ldMHLB zqzPxdQ`9ZhPKfv#xWE8dKK&&z`E_i(qQ-=Y2#V5URH_$KeCNAO>z7EgNBVvI*Lf)Z zmM%5}gL=~uxWcflaZh^HYFqYJO-shZ(WVCc(SMs}tm5XMj6lU+{Ph`wh&U_WRTA;7 z+ASdTTvY#7*q{Qtk5QHy=B49Ndg2H-`Bz-#5I+9MVC;iTz(t5#BU222XUl^$wV)o| zRNn1|P4V8llw#xorT*RVA5;fSQ@b*#%ShC9KEKm8X>;oEhsf=+Q~Q`h!rglJ+b`}y z_v80{55C|eFHyq-UA(-d2**^H{N8o*e%P{-83vlH)67*hYWad&eF$Lh${!@2OId=D z!X~a-*ZuJiV`(t;$WG@0Kbe|-MggELD&-vvOp3~Z5Z{ls(nFJ)T%YDp241bPuD?X? z`PtruIRBA9>*M8drX(qEI07;S3zDzyz-rrG5=7_|AE2ob8y;p^CWr%WfG=vIYpE?) zlL`U3pa|rcp`6C?C@FzwtjJqT`03gR^~BiGz0=raDwUIS9& z4JB))N*CS9z9xwEd*T1R?!+^Nt8mRGv%h-%dfQ=slj#hVnin|e3&yJmu3b`PZ9 z#ZzAHrFemz-*KBy(=i1@e+|a8g4=ag#3T@T6fk)^F_H5ta|E22b%FUKFzT7sVCySh zSixB9+jpLA^QH&-v30Au2Ic;7p3|r1cU}y}ZS`k@7B}D>@NH8Xu%NAep5&-&0@xHMyLek=PJE{`>Hf(Z(*BHP>Ub>cm&xYIG9GNAfb<#BRfoHc7UL ztLR=<00{ZY%n|x)W_LQHdgrpe;cD*sqc0Y7m9in zDiTcPR^>gy@q{W&wP z572)x`}lAb-wRaym~Wq|y$%&B%t_+xQb7hqk()oUeC>O1JUNhk1Xth9bbxIIoR8;D zUR7D-u`KaZQFDE}+Ae}ce{YE1EcF|(kS0(9p|Yr7_pPw4D?|O?oqfp9?(gMMmE4ee z!&a{x7YFdjaa(h+*@(mN9XvHN-Hfh8%qKnXY2*eCzklAC&RbUPgL%OzI6m6$^0=9d<*>3^DuMc2F!2Eo%h$Q1Gx?Kf?!!TM zrv#}Ur2phnYnI^UGc%-lOhXn(vYhe;$LSAfQT)YW3XqDAWZ%Y=!*}7YXssD3%1ylm ztCDd#ei!)=TrcVC6!Z?^{tqzksks-XPaaKK9NSrnGNTc5@nVy;O&y8A2Uxf++`}tPfPj75p_0? zK^0u1@j+v8(IPJl(>0ycW1vOGhBe>f#_*{_`R*GYEIdI+a-MAt4OUm%Hp3n7B^vlN z{O7^WMu4+UQ^VGqxgiFsI?zkhTpZ^SgDx~l@b>e->B*EG;oy291b`@ZGzQI;=usTO zZ)=5udNaAiL$0*$H-zuVGFH+Vjzn%~Xo;Z~IA0^01Nxd0BRh5vo$m3^VM-NETnen7 zGZvFP7NcB2xqipn+h>23zhBT=j8+I+J?@ng()( z&?S@Z!2I_dO1a0k?me)5k|Vv-LKT0Dk#J05!_jSHA-KfArNBIdgW6n)&L;Kod#MXf zF{Q}|RQH$<(dPdEz$pNkOL=~k416ldJhJ6h1R(h#7JT9E`~a*iRVo#TlC_B(+Xdi) zXni+Csmow9!W8!1H!ANOFhARfm$T5VuM2f`c&ttnriB)1s{!7JD*cqttk}GFtyt%o z11?u4Tb|y)XNJolqVdUyv8p*N$jfY+%(@|=mPvhMgMv8mQ6}uq zvX3T1{M|&(#{E?gU9%3Jk(iIk24>7!eyg;lk1C*(>mK6$Wx|ccBqsy`!){Pr3Bn2G zrYQr^PrE|LqYy>XHit+&?+G1My;hsuNVg}SRYYNh-EaG)4){Uk(^@KU{B!v{-;0)I zQ%V!;;J0ob|NluZq=J54O%wy`>hUYg2XVqK%A!Yloxwr)_}tw;T=!cJ3LJ7r`pF+? zZ(j_RwPZbyq%fB{$)m#g*-Bx#A^(WwPvKNt|)M-4YBqiY^r<<%i>YllLxTry8cNJf9GCziJd<5_dpAYFe{o z%iXA^n?KN_>Ov$$0QuaC2vBz>_DH6 zaF&b>7|se4v(_;~j*D*%tU3JVKSfEb`d(7Yju-3o{I=oOi=&~TUOQX+Mgm@iaKnI2 z?M{REU#$K{_i0|--1<(P5wsqDLJL1-l-lf@869>oyUpBZ=58+tusF>Nr7Cf=pj7vi zLjFG%fcJ4yt_gav{ZJ&bc|EFel;u&lFQFAul?gQf^)0 z4+Y;iU?obFY0=yC@*K&>-LHtINzu7FP8xsBT^#08ZJzN(+RQc9YcR^c+OfSurzPRC zP`6h&4lew+?*Jj~)^^|pgLO8nc0yRuU6OY#W*vBC_}?BH(*vr~yHpbRfa#UbNj%EO zStjhr(BiGYVs-_!{*zM^H~Clx2NP4UiLosJv^z@Z9Hnk|6**%P{>KC(T7yDCfSCp#MR+tBh{BsuJAfQHXt=>FqnxHF~;o|#r&fSTlsm4-$ z`^3uJ)I6-1pBDtZzS{8FZ{WXgZ2tc~z#qpB>Y^B_rki8lX8P6}y_CEmT}D(_oejnT zBePuPyH`5JGq_5Kmv$mU(){Gz5`UO|^y{~Y7PueEUv)jOo*a!k-n}*Fl01pa`@Ivo zs1U-|6XP1Hw5}|(a7(%?YsiC47EoF1hPoLp@=rzbDQzW5qBncF+n5U)|ME8cA@1dz16y5kQ9~8l(KvEJ8#bIk7B=&j zaVtSO`sNF0%`W3GcKlnRR*_0?y7{=WD~u61@M7G~&3HOq3DlqN1{QtM9Jp4%GAoCv#QbNo7qiOQ-S`%6%NN2y5tJ|A z*mKyGg=~b(ktFX-x9xkR+`$AHN#zBg*0PFmQXA-?rRr`h7SDICf8Q?QR?`#zF$SXd?6@6f1*E z2Q2UiY(MOT#fTQbXS31y;*^koBKF-nDrSs{vV(v{$hOf5z-px|R^2Tk4nVj<>MSl9 z`jnx2{eq&SPjK^}w1e3{@yp!$kw%Crh~io>uxDV0K4erRAg;GdhOwC98#Uxmxg;N| znjNre#b`wWL&MKf8(NF{gT=plTcU9hgikM7J~bo#55_g=put)RZx3JYu=?PUSHcHg z1@g8cMKg|PBV}8zw;`Z%(86ohhuf#pI)t&g7j*Oh24&=E-Iy=#$!m2*pCw{!CynRg z-gtf6%tc%y!5Iq;HYo#cW4$H?(c6NuLCX6MfdiaJb@o`1vd9?wnEpwT)!sUp_yCGh zlW{wnu-XjFc5gr|bD$ISr$U-KMC%CWz02E**!9hZ^v@eRv(O z_s(?XuK;%OW}G zYHnXZW-)&o2dr~>STGPUwf8Wp^FVrU-_fZ)x8h_q*^Z>U{pN8+;p*(MW9;G8c*{Ix zBbo(XBuT_$Z)BBN@kga6?L~+9&i^Ffi;N}5ll3g2$9RX{xhQ6Tn6NaIOP1R+dZ``Up@b$M|U`0@Z;!l=}*6a)cJp9Rx|!J~c*Ty}DV zS_n(NyX3MKdEceh<=+3wIXgWCJCBoQRr>`kv3`Bh;TGUkEVKN__W_UmG29j!#45e6 zyvTB~XfV4;vi*JX>yAo1lzubzC$g9ksF+QQ zdtNeJ0-VWNZ$CzQex-hTY(4B|D&qKsd?4@>NzhBI>W-k#XmrV7kXK$u=c36W!P|$H z)=K1N0=t3G!3K?HSLmRGbQrO?_#rE!6NRxiGd|$1TSn7(rPu|dKTox(Y3vP9RdApGx%Shr^(#Z)ldAs=sWz;BYtt#FYxfDvZyK2o@?i`?a4){o)Zk}_!UDpeo=z9g#Cq=SRCr7CTvA} zZm)Bmkn1(=C4lIE)(w5Z=X*0??g`o{-FV*k81IiWu^7|8fRsEwYCy{!fd>@F%-8z$ zNJXAt*4H5FF0T#=$(HB@O?KgS-&=Uwwh3f1Gk7g#HNWR1oc%2e5niweUTQK;fBE#e ztZ3d$hMhV4!%oA}5l0p8F*;YO{Zut=$_G!q<>ZM=1P}%l`EN5`s#sfxipN@(awwWL zo*VkGIuDB}1v=sd`mBj;%NvSDNC_gnAwt^8Jel%syTu+JcmHG-#n9CeRvwA#8Obe>*O(hg4b${+|w`3n1zpSSUcP;{dN=3iHULL-zk*pU-6RXP--33J-6%_wT z;Z?m1>VV55W|yBlJKGgg*<%O|$m%|P=S{i4-Fsr$2%jE|Z|XWoM&Bm8_Lh$L2@Cmn zB?+?->DgWtiXrfEjAq=-Itop%xUPbM zB8MNh%kv*RgHB$X?2-ETDfNy4$3)?FF+wgRg6qQ3^%LZ|tz%Jlqr3;=t=Uy5^4xnR zF@bGfvkLypu1+3njWY|5t0bW5aku)b_zg|RJrU0c8Qk~{i+{%R2wJm<<@wjrn?}SQ z&a(TlDXFqD1^+dleK(09&Qx=cUS2VhNS@{o2cQfQk+^}y^l+N$!AyP8% z)a9PUwcy*BCCvZ^-36uQ(&MoT*_m*n>JM{X(|>P})CBos;z zJ>=T&r12YE-_zP#&xU=LqsqvsCta0S#T1W6M#Rw1g2C~}QL!hT-a>MJcLnl@g)u~QEeTlrkL4LXMVtKw$*r>}D8(NhB4_`?hrK7go47up?bK#YB z&Uav0BK@%O?ISr9L0!K|rYZawr5Tg9A4_Y(FaN^$XYbX10>O$Ragys8l-Ik`CS?^CVgtihMAju@fD~ZL14qwHK zGiU$e`Fa!@3A@z0NLK~6dJ8YrPyP1yE{TtMx%sFpW|_DBg4d0vwfciSKL0aV9odHr z*4JbK2t2cmZYFPNW@gD*Xq_i2(s!?)d-0jo(kSC6Mb=|`d}frt`5qZ}*cHlpsFC4D z*!j?@9WEPE)8yhz#q=Hbz>(=E9c)Ve+%MdG4-6@TOu9e0L0ATNW*}Di~&TMX)Xxg?uqjC|D0O#5kw#-Q)@o( z%Ecy42Zj_wA$Q4MM&7E;?F~OGqj#(0So8@;qP8AzXlea5v7{XmDj?6d{|5p={k|jW z#K->PFaDyg`RG7f452@{>?ifB_27a(fhky9&*ZaNYa`0qh9^lwJL=R2YaD$L{N3kc z5_9!`zPPlZ@)@VK6#Rs_#v>iRT3g^!%7|b7Ee!@>`Rm{Oy2x|e%{dPh@Z}Huw*G`~ zZO(H5CdLn+&pzk8?x#P$yzq^3JX?WL8@AkXiz-(?Zl6bVw;A%gR(9T;VYoiVUM8u# zMVXKv{P2?Q%jbM;sCQ1EBmCv6;*7KV@9);#=MQ(UbEt3Qg89bB@UUByb1Z&G5GP2h zWHAB4*p0Oi%oZ?0f|UiOk7Ow~snbbcn^%2UpY5&9zK^TRq}t7-aLjjXn4w*B3v^p1 z^RuzQXKnUpZPqnz9+n!HdARVx?{{x_>q*_V+YAH;^(M`|GXU@648Y+T81tF`w!Av} zp`Xqh!p=ECJ)xf`@$EHvDD{j=jDr97|9-qE*gMo6f8J&kE4a$=M*-l8Ls%!I^S~m& zI%kKsP#-_rw$}Ik>Hq!l?&N>_ShsUIi{bi0b8T<{>jf8I(!Jo&XLXPI^GDPqN(0_H z*9J*jPyfE<&*qsj!duEUAu!MLxNGWR)Zl&N6>%N_lwL~iJKph*Y7mL18KK_mK$JB6 z{V)IWFRL+_SCQ8@3HTc_WXu$@6aVRb-S>ZRX?cz7mSsJgzCh~dB|pBbJL!afEI2nf z3y}ijwJ!?Iq>%dC^l@=XpDitU`q%lE$=oSFSDCre`+XSqtPWweHDIajEVcZ6cwT>O z?V6V~ur*HonN1Fw)Zcb)Qs?@*PU_RR_;GRR=WJ=olWX#l>E6HklRf5TD5vuogah!}mhV{lyByX)0L(7?>1ExW?=&!su1T4E*UJBGt``1n{J8rz@1*;-T$@My zO~pvP#Vr=6=d|^%>-+TEx(2V&OX4QAopj!bl)D)8lfR`8eAC8&4-xsmm`#^9J!Mj7 zo)>a$%eMCmsbgcyOIKq2u!%6&n3CSgf8zRK()!xZoAqf@{(imVo>S*sbrj#G!WaiN zw0Se8adoeYxVhS6sJ_!qcbZj3Y5Qg4!6qa_e_+w3w_|PN-OE3zKeLtV*E8vPQr(mC zFEu{xk%#`z`&M_~_|65zm^#y`!G`*U7hl@F>-b~3yOj+E!KO5wj9jfAp@l)}t_kbm z&$vGHn@t|^ZD0HOW_wN@lgiJP-miNh`9D`Y(NBEeDdh~n+gCZOt!u@KEz22zKd)y1 zKK&{CjpgOZkALA~c-R){KoZy26#&Qm7TdmYSilw%CQaf(>ey8CRt7(&^I!;;nVW^e zbTRWVrW>QE)YtY$+)_g7T53H@>BBdfIu-T*{MsV-HNlWq#Xq z`L!qTvS1_;+B~VlwY^WCT3}elZarm>@h|l%!yv{pg}0D4yrRaaB=1GV6N>@RZnj6*IK(bkjvY18w#^wgDla&7BQobstJ*OXt|*OoV? zZfy!+oAHL8`s0;%+<4_{=SF=gn`;~AUQnO(+~+xcO4(fH%YCln`joVBux;=3#WR z@CGx!_BvZF@}ZG7f9{n7CmRe434Pcur0m9$H!x`NLfmYj!fLqw&X#XJX%%0GbTwQ4 z^wYJ4`)pV&-~@SpJyS@sY87X zL2xEsR7qP%eaY*UGcMrjT1q{sZ(Ux^l0I&`?Kbsmz`wfks_yo;+p)N@UtP~x>bKp_ zYvxj(_8vU@G}fleAFn8$c?oTvejTYVSA7=LHz(`(9J3HBiE&+)MMCyWet{0|Il*?QEsZH;+KC zMP|-IcjD{X)X-h>s5A5D-Z3f4S&w+F=L1M>9{IK?udyYxbtTRMyj*c*o0zO4|;lPk`EezZ8s#xYA<85zO)Ar`W74y_)j=3Mqnuv? zKL{*7Y#?r-^|u(~t8>AX{un0pXG6ss=hbE5eej-t-2KJl_pQR*)AxT;w{q9J6$9Y( zFF)#IYvp&J@r|xEM+=QLBkPx~^_6)@+2r)x&zn3o1+fhSW0D0tMm=A7gkuiaCro(F z3NyCw!MO`BxUinR<4mk`&iP7xEtP;&7u+GMs_hTkX#1hbLC?zHVIN2RYV!BXq_1s! z?$g$wzT{l^HT_Uh-TBwnG-|V?)_m!+u?)wP`1GsK)KhQrr`=pr9=sV=z4GRa9_N-3 zw(w+gWljh;@<}`I-1F+yyePvkEKmB8`fK~c{-!P0gqnXe`ZahWeWBw|oulhKma^$B zj!I60uh>yvnz1Bz#xQ!8yW|tr_xRJ#X?+>?Cw-~?YWr8x$Az}8+}E)V%cjgmHU3`T z(#N^3nJ+xZ$5(hBdmY}#Ch}2$Q62NZt5M!^le)#twoV1cZP}aM{diOx4KuI;r@&)$ z4bGNpi*xlpX+2z4w*FJbzvRnxm_F)2@20I=QvZ1rSL#Wa*3Piae!HW*>DQQks7DxG z(`RLdOU!3395p6_&$v2n1%Xp|Q-ZoZ?4$<}v@HGQGTQ9nVkLn!uv5g<4HT_5(wPt1f8@4~X4q|1U5#&$Ey>j_UOFhXq-)r#O8!!Lx z5C2ft8s{=Qf7W`_hO}W_a!#dlYUyH(9L_>zfM`SV&l)#e!@l*+Z`BW8$=fgI8ICv_ z#c@2&f_BdDr#|(mTJ?n&Uf3Of{PFcZ^f#%VnrVrD7}lH#>y<^Jm32pbUo&M3ZjHQq zboqGNbD#U%?s?C9UY!eP{tD_JwK1&OM)=g!RGqI6fB3`oEaMBxIqENY$xABSE-D_i z^qCem!=hs^-oWwUImRglGqQI+GS?R9_oGeQkoUo99~knnv={>E=RWr4BV0n;fA`=6 zPV|TtR{eaF#@6Ob9%o4BJnY1|CND=5N8OR}*qa<-1h2H8JZ-s2_h|9uFMoNRuQpHW z`2Wg>G4nCD#O0d&p0$gf|K@N0raSqACnss_wPYWL(M=+jd|lu+!jjt?Re-rTq}s$e zgTkVZ5E!9C5WGV9V>y#%ja7f( z`l%eFg58xM@u*{);Y|>f@ztw-4jXs)wlB6i{1|frb4cqdzqv3!U}-Mufs!TNtApn9 zLm&E3%`3lpmCeqE{GQcehe;mwn8(a@h{VSy7>!)by~E@gCVad=h{3q-7?_6{yuRY_)jO0!)VC@hg}CD#ZeRLe zjAA9;xZ03KQh#g6W%!)*woLBZwA_#CNv3k`$JM-PM~{a0ihz?>sx0P$4}ACugrP^4 zw9Fk`^Gmq;>T9ae$uk^DXxmReM`>w1eMrC7=J>a`MLn0%fw^0h`>uhZHcl&->3$V4!uNdV+HR{RDJ@cRF-k zXzQ!b8Vu~mrT507Ou}f~!wOP&uA_WS9Z9R#Ohht{xi(#^sgveq)R(5MRF^hK&&`-? zxu%gBdB@Z@t)BAGZ+o^nlDA*SXby&bNge(CDd*azHx^GuLfAe(sz%n^s<_Cma&$eF4@h;fUKh1?L6%wUKo} zT;!F=8R^5gyyEm%eHo{;#l(cud}t4yfgBsGwn3@^3TZI^gZ?En!b;&>2t44TW9k2>qvicO__fFlyhy< za-VX^muK^r`=l-83g0P>bbvz+Ib=ke?>gySmEN2+i$<(B@>*A|Q;`eN40=QJjQGyN z_3?@X>C(s+OX+9o+tjXo`U(s(uNhC`J-2DOZ_~$>8I{{i@IP=3EEalYyklHr{J`(8 zzv24sHaia9aQSWdpx%ltS5#bAFC7N%`?-hv&s&!@BtaZ~f3-#knH* zu^kEel>Rvj|AZ4x7|lu68ROE=jI|alf7GjfL0%#K`u4ZKU5%tCope%-Z}ZlO;h$mg z@-$?!ZQ>H|S7>xYgq&aHHNdH+5j73}|u>JM6ITh$D`uU(7q^ zm}4s8u`-L350fIe+szm6;{})&#nu<_t|=4nx zURk{Qp74Yx)UWSxef?-L3>K`eUqw9e#1kul_<#T}JzsdlD8cyP@+DJ*e%x`#RYEXN z`|rPhJ$J+$+kwGMF#-87+4sHgebd}$v-@MQ)HX$pzz1(vuU_4qa>^-nQ8d5$sx4m$ zT(xRd{kebho8MgX!;6=`^rf{euTa7Z)_h;)G~QPf`Msg=dk&LoC}(clNusJA@J7iJm8RvD0tDq3hr15Md+V{YTz z3u)iHp+gKd`CRb;@ff4$HceSxX0FQBF%0`&^BGLjr(x3Q(yyxmYL@(?g8iG}_`zMU zK=}B|sbBnh_o(}osKx8MF=G7YryWbmjk~sENIkA= zWBlp>dvnmAmwVjf9s{^vTh0Y6!*2Vb@8(5ZJ1@zT{-wWdytswTL&~}efm@9q&cAyL z?+rzeW{e#)P_xhL58-WAL25YvEv}_sZ3AtbdqIEO_!=o`o_LtDZGGyf@x$@gI>-EJ z%T~B8pxtTJZKUJZ#|Vbj4Pn-KEa`zs%{=_04zdQE_xcD~gYny1#oK}R0~x{Yu}v)> zG=lfm8*2kOgIr?$;O)#)gO{xJk3cW4IA7RS7Y}wyoUd{Ez>;-Py%a;T&{0PnRr$oY zzPA0|)bG(9erO#FUH8Wn7`O__SK~Kx{I3R@S@=i`yR}XK=EA&XUOX=}C{HeU=eyon z>B~_cWV?Sa9u#DAG|fxIJ-S94WPTp$Xox2ij~VjnvBw@;Jpjp$Z+g?4>bZ?4zVpOx zmz{U1Ul2ySRjDg@6dYP;e>bK4#+bEvL|->E{=dHQpZsU70N14ib&#Lhjc$gm!~fy% zst?g^UiGS1)jagE8p?c{Q}jm9I{fg%tM`y~gtrkn?(Oe*d&hegPd(_MgQ~v9z(v1d ztBq=tZvD@U>?;IGxWI<^6bgp-1UH*!P;(yrvr4t$TEI8~M)f_8P1{ z(ZR{P);9(l9))}D^{}E-9Z`)g>Zd!MQQqw0aqkTihBV{S&hGc#y*u`pV{4!2Is!e8 zZpn~ChaA1W9{Hr^TG$_R!SLq8gE7je!G{O+pNBGia^=dwm#~e?$4>Pf-?84C4{`$! zGY&Jny6~zymk;JWx9}Z$qx#4PybQCMP7md*bn(R(R~S6?sZXur!|(Kq96&a(8UOBg zzq`VS9KmR0uHXhkvi_rSWj0g*JG%4>Uhw?#vB*!>@$YfpJ?dQQld<6KUyCBCSK>Jqk=MNSc;=aBRvPqyN=97mqaid8x53-|lGiv&8G{cb%FCXB z76f!6pjYkE$IT&cb@ZYCkA3W8t33g2f{A(G5Mf0+yS^Kz2t#Cq=9j>ekB1OufY`Z5 z1Ek+M=bTfsG4!2!+Ns?azwpJ%TzK;F2*Xg66A0)4z2}~Lb_f6U!L=-AVwVuJ!RQdw z8{hcGntyZt6CALkVL_psJm^mz)IGltG;csg0tm}9f}nPISyaH<0)i+hO^m4&sRQ;u zpw5{E;k@(CtBVdrh`=vy-+lM3%u6}tk1j6Q-~H})yAOWwgY}t`gu$mz7^Z~_qdoG- zBfEVby-)YBvY04?0eJNTj#yMJG#3>&Y=q4isZH$>5D}rVVdxBg4|?!}>Q_)PZt?0< z*KUPLV9p2@b5$2XlhMykk=+A^%j{&NpYXH24?ZO>&+;Yo(-J@ST9``m53Vz%e+OJ+ zR$x#v<3NL|WQ_or=4TckpQp{Ad$qRZ6Q6bltq$@G)6)0;`1341_oL$dxU|`}m(00J zo79gsK6Ry>YrkxhKmEhA?)Cfk>^}Y8;|Avnr7y#Jwx}rp;PG``nh1nCF^t_$T$X{Yo9VrmSv&v4JOl$wRoVbJ6A>RxiIGeO%d5 zJu;>Ipoo}h?Tnt2t`8|w6MN5XKI!FIUkN}2EHru3O&Lfkn0{?jje!BjB0YjZ+y12c zVcVmcQ)!z&c`~MCZu5$3({rCZZ5_E!nfBRz!fbW4{d3+E_LKS`CLobvYhR8ec7q~=C{wU^27+ihV{aa>x!_v(;e^7-Fx?Y4GJ}X z;Q%3zOh7R7HiC7EB0}INoO!kIv!5MoL=rqHJP&>7L#uqk(8myHC*LL(fl_@ZpL}vP z01{paq~s8SFacLy>y0((V;}oiT|)_=)+M+sgwE2{N{@M%BfVd?DYjAE>L0-uU##N_ zegqfhJO3%yj%v0##^KUzW&8R2{Yu%yxA~>z*)^ffD=z(Q?~_Md>d1Zawa@MoQs1~b z#?_T_uKlw8{KGoUA3P;5E;f+GpZ@fxS6PsO0gX|3DO6}k8|aT*PdW4|pjW)m8k+NJ zBx4{$in&Zps_a&RMI zwmhkGTwZZ)dhS!7^ga%zOwwH2Fk2nt>YA-=lRrF_-fEp#N`U8#4CEEY6NU;p21f`V zS+nNQXJWK2OmZY|eY$*+oUY`p8cqm|5R4-axc>vXga7K_`X-#U=JG2p?@s;bsa1EQ zXEEH-b?7vl7#Jh0Q#QJ+bBOOpEwq+?-VyWypXGdUQX0iBXgdfv)%B7r(f|h;4yB2tHmR#aqA= z%;?MvulSF-VXNTT$IgI9=`(oHk!?tjBcAw#C)TrO)vs;(r7_X1$s=AfHfO7fGYj1o ze`6T4`N6hfPVqxB&V~$}bjUQ05@HyG+vIWlhsUJ3HkQwS{`2+iK==sX!QCt7WN>m4 zxr#0hFOUez(Ryuz@eJGnpea46fSN z)<^&CqunPy`H5N|djYRJhDAnaZ>zE=sGlK_$D_VkXV4McdBWqLP>;1@i^?ndk=e*~ z@ackL+xk_ZImS}+37^1-OgLKzOB*oD*>WyCZG(9LrmGOXC1g7WCJ#Xfn4olkihHh! zd-~I!UIl8q2Z+){vI0Xq#u}Dd#7CI8{q1f)dbgfc_pW!nYj>BO?@}j)5WXA+5P+}@ zZV2;|OE2l(^5(Zx=FCEmC|SPkHeu#qh*@G<7$wGp(chwY;biVGFLhzE3{!SS7|WYt^cBpx{zyY8Ec$j49{#Y07iH|Tb!SPw|N5{0s)S8QG?x}K2YBm) zpT&hopM}gTCm65=(5tj?=2_2rR$U|+IV~=jltl|8QI}UsFmsFG(ZyIviGy>Dl!89? zak$0jnyLBIrs)&rF`u9v`Gvukrdla!P=j>%k1^d??l94t>Xqbz8-D~a- zlQ2f{N`pt}X8Rq=hfT_B+sk3?LBL#WQPzgv6h6by1KzWRHWe-6NrVjbEQd`C0;X)m ziY>b@p82Kj=`VS0_uxO+wVsRGj$-SrR&-yvpu8n;=+nj;0F#%%XI&s<@^F9?)(>j} zy8qFSeq04x_~OT_+&aVqo^WsdBADaB|MD-VR31#xu_jp;357fXC^7^{>nYiW?BXn9 z8Pj@CzQU4V{rui181;T4(4Y))Vq2+;^o5qmyZ&JaWpgro_2{ zL5Ym%=p}uF_t%u;b8Kc=SLF3}l)xCVy1Y51J$kaXmCZU~jC8ap51zB0FnU1~w7Wy;CJSkH3~4D<`# z(=+LB98DM=)8F)S8jR-oaKnu^RAUT1Hn7$fBaS$ZNMJ;#G9L6KO#l~gX21@O$)_Fx ztQZ81UoegMn>^;oxH-XqzdF@tp1{Q0jGSGhlPjL~)TdQgST7lO#d#}%Az7evZ^!^g zjh9`30}sO)MXQdQ%|e-1GYX!$Os4CjAitB zG8mgfjKpw^ZHFQ9=%S|!%8u})Jm((G3251UUB?Ot8PkK$=E0jF))^a3>;!BRw=1?J zbgM39jZ53-ef7L*Pw`&D8uEH@g+*N*|=v_I|gx zBgrRJ zllQB_J7g!UVb(12tn?TtLKiS{bK#&{436Ssu`mao1&kx%#&VA!g!IqCf>7-cTYM;L zc8u+OU;^e6o(zcdc6Ce`P67hvQg5uhECh_iGyH)A>cEgKJ{Z?lTWwtz8GW}Ay4-KO&0u$>+|F44z}37AUW%Jk<8u6BA%H&xzgxknU!OTI|7(ED_>A*iy2bJ7 ze)Y@GJqR!a{jPfdjax3)WG*B#ErdR&MJ_*VQV_uJ_Sy5^-A=bJ=l2vjp$#hvufNR> z+to8v+xXn0Q-ZeFeevY1JNUcvUaUQWbEQAz zi@s4<2$AkT@PQ9hqlUB3zEO7ht&!F=WyvZR74L0pWcop2Q&v8PM(Yp{gssaOh56g8 zvVK@wtvS;0DDe@FYp2%PpFTy+uOaK*<|=#54?-J%F0`}QKu$qNHdZP1-XcLSaNVXc z*^J!JLxk*y&d6TU#G_A&F!_m$`n%uVR5zt5TVy`?kDk32yg3H+h2JcPwF?1oU8(_) zp^FniH6WGlF@Ern;;g{)?VtbopKBT#@k3|k($yw110CLOJ@~V7WD$LX(~LEMY)aq3 zTN&zjlF7^C8qLt1|MqYHwi>={Skb8&W5}|?%A%v}RP++YCFSYSUVXGSO-)VJKFB9t z-<0LGWj*BKCeE7aYSWwJ2mMUn#R*%Lv$F+j865~5w9iOs!_BMzoI~VibVKv>Dh?>V z8DPD`1Ef_C(puZX|Bx58kAJkhOkdav^qCPzLZE)nrW#jQ*|LtG9x4iW&b-XR^Z7lSyAJMtJ za?UW9H!OMD86P7xLmOD&@o*$%; z!A|8NhP&@}_l_~r;p_`Y^k53**AD{^LLXqvo^l+7%-NV`^ZVx>|e`w{5}e^S^gNg`0y(zxd^|x*z@I zvhJ2!+ihrbTMq{j(I_%L72?2l}S)eNIi*PzAg;{foBEv9m>@z{SXg5{^G2RhF{p79JB40F~|ao3b{HShC>_o>HM z>|6v|uX7P})yIpyDmA4&PWr|XSM#zF_l=rRRwXLP}b1`Gv7|LYK%k;H&W+QNn9JkO~Garm0 z@RZ(*mkV?wIuYK@_{ZTuemV^U2fdcgt1Kr2uc-1Iw;u5%@(~eh5PjHlf>&xeNnBJm zmFOMvGrllV(edbVhmtuYLV%b-mID`ifw^L|b$= z1}jG<(Y5J%);&6s*E16sRm9QzuKd;DE5_PGr`p!{1B>_8k;Qn)FyqWW`lL3jZ}dNK z!WWz^xHe=qYbLrN>fhE0`;mH~JoILbJ07JG1bMoJ(|96c8 zYdT|ePJK5oIr^E90b3WkZm;a*H!y}G&7*9EdRo-K8f}z;jE`TGP z*%$&jC5BJDF%+%0CjJU@pAH&a^5T?R|(S42qPWYi1#Br z`Q8QJs~@Mq`|0O`_8D{Gv$er8DM82QNJJKtwjK_rVa`f=ENJ}`s=Q*^Pq0?f}qWlxy1PO7v3=( zA{=;Vk!l0tMkokuW!a%hx^^)YeM3+dN^Qdt?F0sJLL177gEzr3efdc-rfs*~tt<1v z5a1~ofDNXuZ~CPiyo0~Sn;?xM$7qO2YoBmxM*?ku8LvmX+3GYu1X_!Wwzy5(u}Db2 zFTC*k-5cI|QvIszugh3}Ta?^8-1auzWk0{XyZw$kRByn$>~zQOwXb?bExMTbPn*lv z`9T1!z`NkmIHsDKGLL8h{)MN_RwiYauk(XIU`z-(@t@w;eg6lS7JA`DzQ*{fCUkwt zk1y*^I^iD+{oS!vZmqE{tPNpue!X4JwJspw72vnO`-9z`cjBo%-O$Ga@Fzd}Mfdo9 zR&~#M##3wa?V3lBwm#s=*16ylUK;r#JN)R_IW_WG%d9t97vPc&OJ3sw9%0Rbch)R< zZ3J0YDMAEY>k58ieULwEP5MAkr36wQC|9dit*WvNp_ede(@Gzmo1~BG;T=y&;JIKu zC4lSWVr9EJm@$9SN9))7SD(^->D;e(I~GsN8+%6_@LWIt`#X)N7atN6J%YJ&D{|wH&_? z2rO3qgV*!|YXF^xUe)qs`iAv|JR;teZekui!vp%2xi!z~P+#;A&uB$CYYzF;I;9Re z3tF(|ga)m5Hlu#_)1TEca773X(W5w1sAsC^fpj(NCfY)qg0)FJU5g&3k9RDxmE)Df z>nplN$NC{39nP9-EczlI%?kSe%PW3a^?7Z`i!Xo`nwKs_k97Z&%YM?`X{S3?zTtVU zpiXV-m-g`**HS_G>gx@ow!kiP5Is;|$nao=cNr(XLqF9=x~`+Mz+YMO3C`v(@&LFf zAN`a4122;go#R#7R%h%U#;Z>AC|z0b&~Njz*pRt4zW?*S)!jF~b3wP=t!Ew^u+>&8 zx(hG9w0qa_$8>kQ>)byygDZvZpEc%eA_UK{WWyo^Vmz*HKzC8*oHn}7MyPV5!($gd6kWw%fl8ZeL6 z4s(fyrOT_Ikq6C(cynV;$d1Yhficz?|geY>YWWxrWvKClKqxU)e$08PG$ z@C%>-BLPql9M7#b$ct%&aYz#f=q=#yzH%UNCS837y%3^Nuh5^MN%1xFCi=&GAUFz( zUmNVy__eQ8U~GsbAuz!V{RH*3^Ot#&<~~H|9`TL~2#YsoLfWyQv~^2QyYiSb*D$8U z1;>oH#Tn)0LGb-?87qbq1uuEEfw6?CsWaoitO&XogdO}dPrroV?6`FSPsj5U z6i74pv&8Uj6|5WBc63D0_wPW*K6D?>yv(j?gID3 zwa@FizvKEauFZbF{`0sp%W>l&Kwi4bod+_a9Fg1Hw=xzP$}fRIiwxD$QPR+eIYA@5 z1gC{)QPUzfgNHJ1FiTh$bOq*q>RuQ1r|+BcHE@BW?Rt|jG33RVmpI0a1V#oSw9(Rw zczRTHDbIpA>FYPv8$W5=+;W>4ZKj{4RV9I(^aBRMBPnA?s)Q(WZ-|XSJ|k z7-@|*j3wyf^}=LGrbynYGdT6jj6O#0foTCTS!j!`zygA0@DPP#8e3z1{phiB_|A2-D* z+u}@Q8)@ylc!sZ$Yt)^%;D+bG%KbQ)j)RxH`r%4vkKV2g@xe{$t=t#;L0=wJF1S$f zvH&yn_w88fymg@^zqvw0s9fbQ-K%xivK|&0w$Q;15wzPXeCY?k_$9c9SP7m3)HZL* zCvQJb(o-ha)I08)wo+H}Oo~tXrh3gd1Djlphl?&RH%utwPkOG(w{<9&v|QWtN%zXN zA!T#zx085faxah2Z$n)2z`xw*+U9TL+H&HBw1GhdmtE~7*j4eWG6SGdG%k^c4K_6zLTzzYQ6RKT~-arsAH*h656r9>X z-I=r5^s}FFQhYz3XL*x9W3PBTgvGcr>nkpOYp?68?G_g6tIg$h1`vRMlW1>{HpmAr zk~i1ja-Lm{T;z|J#~IuAKIqVx8##1F3(AC%Pil|4goN0;Wq9bH6>rt%L+0ru1$Au zPWo}RC$kAlvv+lqP7RLcn!yB~d0y-_FkfE7<_E#xW@~y3_Gv+x3W(SA zXIwk_D1-;-U*OvIwH=H6d2a9JZ^NYWZP_+Yd*9ZR{OvVuwPljNrccx7JMpB0#H20K@rgOsQ3AsUVbvKo-pA&aC}dIyuYURm zvE(`Pi)Yq!@enLXCXairm-0IQ#w(WU3ZPRa^(*6-_zY7$;{4=wV5hIxx>tYVdBZvP zO?>LeHFa%@SL5mbjDz9NZU~r37slmlZR2LUmzI#Sxy}~f&m(U?u6@pZu5JD{ zt{?9?!HxqLU#`yH@Aq0XW9jbq+I@sCb`y94!X-F%>ZzwzcX7&`cGgxfKLU4YXN{au z4wKE9BWXkX70-v~VvTUVJclmC2@c8~-Iu!E%abxmlXnzXUIR-%#3f#y%{^qU&pr3t ziX&e011s?@tTGRHN}sO;p00wt{e1mAeYhuGxfyd+@E~<7$B3=J;nB(OSv+1Yw0%gP z^i4WLxHC}1;m=-aFm7jU_^K)chmf-Rko%gj4*&4B@|wQ&h>_mc>;m`nA^q`uV}Vi9 z)2+bNm!8`)ZMr(U?)n(WsizWg7B!SkB+ zF$rz_xVY5c=9?`pb=dU|&E*UA&Y*q3{U1<`fII=MJ?L|FImhXvWleET?bOs%H455Q z-&jL%n6c8UF@Xmei~MHXK;P1Xu_zb%$$jdov{gO^A-EUsmpYO!aW#L*=hzOf`{+YU zceSGOM?8ZonUBmWhzmb+Zw}h}@c?ycLy+da#x;Fx^VE!+(I0S27p6N7oDZ$F zc%J$bH_B7iH}^O95ZJfl6xaTwwa+OtE^boZetdmq&Kb^q>Jr}%Ny}Awd*6RfTK}4Q zXNw<~r;TgdN3dQN{5cT?f*iF0*^BHhrv zHNr=|Z032U4}SAo-yE$~>PVYjGv(2*jntib(^(*VMwIz+d>5N12v;Kl>+jnv4cg7<ks`U!VmG~W3xJ6Gk$8BRiASRa=7he5+x zPz-=R*1~<>;qk%<_qQ0}c<5lu@*H{+XU?6IIl3=&=3btZajl_{+9+(>c_qyHK|#U4pZUyZ)`PA0eBho{IL>P^ zKK|kG>xY*ws`?;;v7p%p{mFxBRl%dRImYx6X0HkJ$4fj)AX|A|(-}Pi<;d6dYz_!5 zJ?Ou&FoH7DyGIwU;dwq9mwWMksl$Eh5Er^)00ghJmwfUH&cfPz@4f5#?kk1+?YCd` z@MrMw6C#ACemo#;jN(dPYh3B0P-%MDkF-@2Hj_Wby!;yvgQcQC=*!t`Pb&xLI~(+q zpZH|`=m29!;NIe(HsQYYkMTiTXeqdyekm_qa3-k_LFARt=t=7GQ#R#OU)$~|&rtqM z8#kvbcqIh(%h&O^KVP_1c&-6!z&r0N9K`#55XBnngB$pKHl*Mz+=R2P!S@z-)0ns# zUvOB+e81*3uNi#|h5T!+Q@>yX>3#2g->B};i8O}#kA3W8gF1(6g!pw8jL(~8w<~s& zReSwu*;w4Z+w=Z=boVPpz-z9(eymw3V|3QB57Thcq7zuZoevq9Wn7+xz^c8r<8thY zHyfl2DeqYw+I3BQ;@UcHj`u-zGR|eiS>p1`uPAcJ)!mQFHw<`cdUbocJT^BJHrN?} zh{_kfD8hEJc}~6l^{=m%ctYT3Kl|BgF(>#sBZq+HClJW|APU8i^5k4KUL`(MM zc7Yh`;$=gSwm|v%3}MeMGi99e>a3orsi~@v+2Qq?jXIn=$H-?_0CFQrXYTNZ^Nu@% zj>9m$@~Itl=`Ul@h6;tHF1TrM5^^0^!E9;c@^5Z&@XoG{(4IHo+=!eVK`;`wT(M=v zS&R(+MsVuGcrYyspHFSrZSqB`qmMq?W5r_&j<09Kak!5TEPiN#BBS5F-XtDQGwxUz zopI=1TyUI+lpPwhsZPvUJ?Iki_R6^W&>jylb!aPwj@qfs=nsA;fYA$I_`<5-I>W-( zroh}m|IQ{Qu=9k27hdZlxZ^GNyyrcukZoRlJ&}UU*estpBCx9)kM!kF1}sKkxF?Ur zG7C05vuN8ifs^KncP{}2@3T3>_>gm!QqGr5_t|Hk+J=5mhV@~{KB|X-zT13JC*BEP z^u@g6mGMf#ht=_sk9?%|6R!C3nlm(VcA9d|Xh9!Y^p}b*~N3%(i$|8H}f9Sgk-)(#$$gg$E(`eW=P9R16`{7YR&dxmB(#O!{`sH(d3U?p56X_SWF6N37t7x*w+E| zwR-;znM(K=Ug!(3XanuwmFNzCaZetz*2p(iWI6ZbG<1uvm~*lleu9qBDLC1Lz=yLo zGb~!u+Ow!mIN^luWiNYKHNN8GlsYmYxfSolkM#?^;^`l+uKG{Y;$O!s?C*0gZc=$5juicpi&&Bdh>i}aF-5&22e2LtKG#(Ep z(TFtypU3mbrsO~}ob^Te@5=i3m9Lyr4TZe=&_Zk#Jon`leC$ymW5ap0V>1bEoKZH{ z)o*3&XIQgj;52P;>u9Pt=mZNIp{3%{U~pm#Lw zi^t&NtxEE?@}8}u_>3{1{gtz;V+`9%~g4-7Sk=ar}wz?(T5A9lI?HEJ~IIg@Hw4K}FV1W|Mux^#daW z1c)GL5jpnQW9wuRjC>ZIqG{3zX_QlnC}VHc)KC!;$rCtQ@)8gtp@*j@uKKr@PR!jYdKJ=mL!R1rtm;oa6HP@-KaH-cToCLxT zto}fK#S`LU0+dHa6<>3uuo2ET1VUEAUBDC}AdCmx5u|xpOc*hZQaDCPeQDztT5rnc zy3q3SFQx2!+pF_jtnVwf9DJ#%Ef>WiuRF?%x1waQ#sC@8T3m5Y$YLOA4L5DQbKNV4 z@iL@SL@Zj2Hv-(ZkXhsy957oRNsLImpm;7GT?9s+gLcIZJM6H^uq|Nfl#ZSlvKa7v z)}Am(S^fLJ|NHKgQ%fG5B4AdI>7}0*@%-_%3{a3%4jcQUn-A z@VC9~ZB>z{6xbEStG(h27vKivT>t~G{W5$Jt|;TqH1ldayknqz-t(SU@h|;Y8`l}! zZ5V+L8R+~N_IM*wlHU8?_g3YH;cxFp?A=}Zqf2Yt`QJIeyqZcE~!n+UAzsHrsAfjDQS)`Z6G_t+rax z?YRAR6L~+G2_M4yCZqy!7#~>$O(};?dAlo1R{OiZ z`@8C8{ha3(@9N{;R23112DJC9) z)1M*loNt$m3!fy{1h%u44Nc`bTi!`&ODQ|4&T;W=JMM+0&_DQq7rC5Kd$A$B0iB^$ zMmTHqMHgRGH}Bw{^Qav|!N_NwmQQ{(OPoOhS z9r9S`=}2A?bkxSdML$#TM?d<}IzAf~WQG^K-~}Tu=C#3>7YnzwSq@yR?c|Du=vcw2 zTo==)rIcMrdu==Jg{9!X@~Jadacw{&i{Y2b31nHgN*}_LtT_yVhaP%pwKFhalS9eE z`2Rr%9aKHm@qac2@+ll9pR0r6@A=Pv{~JwxR0JVFOl`h-e`0U##|+XFTH> zmBu}P{QrHt>L1oen-20H@ya8rylf7@C5|ZIjBk;ZIgWuFn1d^R!j^;2WL?P|r;q(H zC*OSI`}sD^^I(F|!;U*_SE&px+~Ib&EjTxnx)wNxD<%PGT@O&ZXZ+6@-78-4iYlnG zoD;q%M#mj@Tz#LMQjDOy+GYW<$gsvAU5pcicZ`+b@>)h$qRS(6bh?-o1BlrKBL`UZj3JGJXn6?`!b0Rl2UGG=8;lqhh7nwrGO$gw zZ1`*zG{X?bxR$S3d3KOL!<`*8=SUJfc%xWU%@YIRaYdfsC>oR>^#^{n@H+To>}M1srhe%s zyk%JMy0%RniqZuaUQmTZ@HEz`sj2RlzxrieBPjd?H^PoFUsTREL;GNmzME&THcx~Y z1_=gR>kOJX>&s`=-DgS=`2FQy9#p+S!2rDyig;$i3v`%z*8w;-%_<8It%p_@IwBkV z_UdcOSJuXRlfbF9vF5da>aR0-&b7@u-+MSTZk`zi#QPaX8}J6ax|S+RpG z--hf{_j^)z@IePw55U@HFJl39^?L6`*GFp;#lhOc0LbX)svfUE+32NUS(7M9j0Ah_ zwO6GX^z@`BJ*j#!^D4OSeeYXgp$-Q8ZMWIB%50Pq{0p4UDs+lRQsAsh=$^cWwiw@S z0Heirt+L5Mxv-gxA3S>BM|ZC}@>SjS*Ii%vGhR!6A-1&6lXaq!xt;|hHW#+ctAX7bwL?#`Ib_)t!J+Lemi;2b*}Q`(o;6qexAk9N9y8*8ksowhR@^U)(>(k z;}V(8)n+zcPhKUf+6;o@3}AS>4Jw{}nPYXLA9O`-X1mA+Kc^3GXz_Bhv5#KRp!LNo z`069~*&HK>TINqxgfhnB3+4!K}USr$^Tj z-{#v`VBPOW`=$jLtXQ#SKg+zHH`pt{fK1>b2zhM`LRfGZ*ASqIHW~GN!1B5aV+120 z<&5w~U?k+mO_ZQ)K@!vrIiqYMV8NBZsT_ifLF9h-`{ODcGE&H6L1K)=03fdZ2o^Yk z-1XNFj5^`~|G|YQr3n}ZVRb`=Ft_=(um8rJG0wN#a=vvBf#3f2>VjXz(_yRW9v<^) z8IJG!n0>2ZT7Kse68v~qV6O03@Y*MVOh_DNNXcT*VEm(aIV*z@__U`zz0kzA)mzND zX%;{NUKCQ^T>nDD*g>n2J&7&o2lMN-tb(>`Z-e6Ag z8cNoxvdNLS2=I&&)+Tx4eQRSPuO#xGh-`-E>936kuTbNccpmzrj8H=G+ZX`F>vQF! zMFCN#cJQ&M9PpHS)@P1Mz%S8%Q9Y{MNQT7Y(Y$ulgO3Q}thIQK`tWmar3l*GWI`C* zJUh%g)VOU1Er9#UzJLY*T8tVQru;JwfD zhT#L=W{po>=rQY;cF^U{#aJOQiZg&DSkKfgM9z^vuiNWmWYCnkIb87uI8QEE4r>gEqG&trz)F6coI5bgoc;Wd9ZTo;dzFCTMHPt@NMU~TT2+Z;d!4nw1K7= z%sDmjBqzt&K*#erERjL1Ip{*2Hvg?n;<8Du9!4?!T&JOsJjet-9mBd;j@f>G3bs@s(gk-X-} z&xRVf(PQuo$9C+p^DecE>2K^jEzL=@663M1lOKnDT`*X7^F0Rz(q&lVfZBX8F4eEU1qgBFA3$wWxQKqH9p z0;}FlWk(qOS)3Rj&>qhOMkfr~t4(NY+wz(hj|oC4_inFrpiw(Ju3p0;++F#rD=UMw zIHaw`j^*Z5juOhN*lVtoQT&TH7$wo71;&DWgbK>2oi2;NIkih>p|$D2t5Y4qt+%^% z{g8zn_*F$wW}H%vQBj@vnDT;+4#J3j@I28M3p8be;L#7tol(5w@LPD{wLH6V+ZIDG zMOV-#ug>wdcI7pL*Xl2$p;wpTA7NM^xT)8(aU?MMF~Y%Jg3#Iy1JQ40t#H&P6CBoO z>xJOe1mosKM2I7Bc-5KkU{~_TKl*Vs$nlQ!N})A_K?3a%90@R=D!ad47v%k8eKFT) z@Z9sxt!$0L0^+uyoNy7k5)rQ*}Lr8-jH(XUf!wz^?*w2+Q2h_X@9r+YDy-khAg3 z2_rh*h37DOGZdm7Jk6#FT8c58;=~)tT7`D-K(u3RBb)IWAlJ#GZikSV)n1U#fH_>AFwL0++R~{XdLu(<=V7$e8897p)$+zmpL(~yNzw(<* zn8ZwH89>J8y8N3R2Ed3?{GqE-EU!1S z(44}x+fo!8?8qP z+A!zVD$W#WfNmv_^Ef8Iero~w+ghNUH$B)c$b;+(oH5pA(1#mua*prdEMLwi zqcM%)^6YLeJwSQuE}i1*MdoK9mB!9O zSABkQ5aT%rzBb$GOFWL*cg&4>@y5`KtyZY2;)5%rp!JrX0glR&#f{NilhLK=yL9>n z*wcZHLB5PneH${YkqE|2!V){S<>Md!xT7N!8T4WU#*YwY3nrE@R4v1WShl|9))hGr zp)*-d`}fnjeIB(>Jy(g+$nCZoBmVRu-7kLri>h>4h`6phcv6V#EbBXk%cMqeRwp7R z{HY7!<&byzxsDPjEo_jK!O-rp^IW*Xv(Q_dj0>}X5RikA$@r%oiW}vYqRu-<{aks$ zaw+hf4UUu2FdY2?UtvD&V_=9pyMO8T@^vtO8v+iQJB;dcXP#9*`CTWp`J-RxY5QXM zdBnpWT2nIrj1%Y#V?6)6=hs75rSZ14=)h@A)Go@(l`E?P!l8 zhAK=~-Hh!N9$sJ;MaCNS@&?45F=nq?5$Gs#cFNSL-4!*hC*fVL1TemjEvebZtbWeJlD8{2v~TyGYJ`{^GclhW((5cyc%WmM;e^}%%?w7g+d-kHi+dLFC(cN4TWW=kB z@?@>CW-o^U1TMMc((X%N`D#57`A`4k0rf)^JpcB*-yYq$U;AeFlb;qI^!vMYd)(&_ zYk}o8Z|Q3rK%zSeJo=%qB(B~}_@fL#8!yD;tQqKxa^o2-F|t#Z+%uH_$A5gRcwT(J zZZd=p@R{w(+NT^o;~K*}8nFpWo}*Op=wQ^hiG|**YxoZSBIpATL_Fx)>#pstE}r-3 zIqQ|R(ksU3*rtiI%)E+aZL`+mXK)HlqhYj(=Xn)*)x%fSHt|m|QkQ_ApmVQ=k)8E@ zA#z)-WCQ>CP2s1;Ki@!Ju@<)Dgb&NVnJ@rTaIvnzLp(om^=85!W#|CbB|rDp7x>Qr z_}i<0+r9m5Z?7Ijce~r~bw4U=K3pZ2(1FkdgM|FTs$xhdL%>z*8N4NL28S4z044?Lf4gK8)Z2RFY`QamZPJZ&=nO{7!%GTs%HUzRY++`zZ z_2{f0bT9Xg4?`o?0k#PGlzyn+I^bvX>HlZ%P5>+`%DdrTaFE3%3NCDUoskHVs8N*Q zmN+7DLxmW@NYD_)C2ACxAc_i6ki`WB1zA+0#;Ca9`h6xQ8a1!t28vPRIuMAWs9$7P zk*|K${qLzh+}nNc?e3ZG;nqywb55PAr>dTM>e*^J;NTvK9R?TD zD2MF&@>ehD{p=V2TaUH)^7&scc)hCFj^FQn>pS1;-Mq-v5McM0y_e3*o5RJ*-Q7OGq|S%2;h+YCjZ%&>Z4!DcQ?Yfq|dVo$(;NizCuF_NQ;u#iX4& z>r)}l*pqJc6oyG_*bS*8%_@5s*rV2K5KQ!opZcg1=On>BpIizoM*S(L zoz?rn#h3QBDXUb)PrWO(D{a47Q7|s~(Ph0;Uvo_1k5k*6IWjp+DKSeCQnxPbLGj&m zp4;}1lCK}EO*QWGUpTM#hBMyYyLE90{mqjP?p;xo$IpN9tG$CC|JdGHZ~v#>h2Q*6 zZ~uMw=^gwR2UHYvWuC|lDTn&?!?1ljOu9n(mFCkXdD6!2ebV%+(_C?>2g8T*&X7sm zpnQ4Hq0QkCV@CS6UW4){-MDpLXnwpuj+nNNX;&LJ=zcCftlx@RJSgk3iq~fR6OSG? zwEBPgyPLOP-zIIpcisH`p8Mq&H!i$>Wwdeq%4^>bbD#Q=Yh-}&lDI+n^PWSSaTjMq zzw}AleK#n+O*be_8$XE7XQx@;2eaavaUh=JvQ(p@Ew^psp!>zp|1@UlS~RHUgX1fX zJFiC>8_7RPo=$NiKayx@g5SZU(6D8jgy5u>r|o+Vr#Q4ynf86+=DT)r(SD8|&N32Y3wKd7jXF&ER za4dNqwl9*ey{1lWT=#xZn&`?Lx+XgubKv8NR{qQ5`wteuc4e(oK>I|H+L zTSL@&kC6yG)>gaZ0}kFNZB4L&f2#67M48${K!@&o5iIXq!iRC`Fp^)7!EMxLkB zi4$u2Qo^A2gCVqd@!Y}=E|RuwfAS@byf@`As4vS zoKMledufIASvUP+Jg2@XYcXJs3qu|JWn6_u)iLi}gPX)l-@fmrY3tJuX6QWcqz5DL z+xwJ_chyiX-U}6%^=@f?z#k<{*Km|9v(uLHmfJY5I99LbZ+4{zKcyc>#p7Uz8}?1; z+yoX~%X5M@X+{-m*$*lZf++otVT#!8E8Six9ThYvKb{~U^*6(yn97HEsx z_CCC)&C|XIBM0fHPg=P3{j{KMeGZ=6Jb@W}Cw;C-o4jrOsP}=jBCa<^?aC^FqMP;vmy@N8%K1(^jVu{q4!qQknOj;)%>es z7h2XZ`L!SZf*-i|*YcV!o%ZX8HceY@i^Faj@5obp2fl?ijr;Z)?$XcdZ3W~YzS!1b zocq+v>dIlm0!Y3VK@Tw@*$=dO7Tjf1xoPgM+&sooH+2!6l^eT|A3A6H)$bQdl+T0J@2T8xNu4zy3*4Ded zPyL38Yt!Vu)wPv5D4<2FJkg_%fLYxq&OKQ8iQTHU3j6Sw<3ji(5^NV` zu`)$>-3*)0g~)E=$#Z`Ugn9OVyZmEQe*)2AneCzc&h^T9i%BTn}6&=mqfGGTQq=We!S%t}$cFdj(sSEO|}a2IU)6&c=!_1GIO|wb%9by7xVM z`#6kK3=e`v3fHRcaZ0ZAiOpvwGFBuc~LM`MRlP(9UuZ2t4Wh!4pS=CDV%) zEWLIHosjx07VMP@CwMT%91Q==zjEXIbqHY@#SmVOZwqB zFovmTo5q&8SG?jCb=(F<-|I9PI2hTANavV1s9I>@_04+|jnuOYD~g^!&s#b=pwHDda;Dl)(gNKz`&SAE}SVW;Yna^u4N{O3QverN}8q$dbIzTvD{p^K9m+2^NC*Ui@_`AAW7@sE)JO%m5Loeq7DkYIcIA!6LPGk|8MXP?RNlE}Y|!bPv6}u#K6GSDmoIqYrOsRx$j(C!Iiya; zcusovsR?$pN#L+9hd9XDU<<4h|bp9;SK@AIGke3dEg`_+%Llq~G`PM*0! z%9SSho#T1<;fK$R>u!E|d>Fu&QR$98yoCs?l@c${N zoKmv{_MrR=jSqY)j(pewju#Trp7~&O({-Q81!LotuY6@ai<+Hat7L4lx!@;_v)Je< zLKpsA`8W1E`~rW_c65h7uoK0P+K!|@^UO1A{|>}OANjwr@i1=r?N|aM{C8Y<3(c4E zok_@%i-$Ou(b(gpcK#@RhkhvV59oIjpgxvqOgg{bhcAWnX?@s;KkMt!)nXT3sm<2| zUpTN~Ak27k%OKlSLI`hTwGt*GAGSC4X@0G;b6_ZO&i7Rt3!YkBNw1G*(w66Uy!{>ZuxRg;)lDy6X!A_Pl(sgrk%`+B zuE7Ci*a7nTr=oc=oT#1reGx;4)<0R)#xle~%d+}`K? za=doiFl-&+4=q|DyYr4a6v2M;-u8FAL+^Im-F9Y6@E};eI_ALgJ^yIWYJh-amXL!; zebRqz{?xPOaZ!q-hwnBorNm5Q+Yjx1-~=v39IdDW1xE00Qyn8MZb!YxqP8mi{mD;# zruW&;f3bJjPcQF%@WUVP{ql+{%lVH}v-xS*83%j5f*G0G_7jJLFV7%{B(fb>Vt4do8VDeW`R?5@g)N)NF(FsVk-TqaXWdeQhF! zLhPeGw!ScOO!7IPoBYj(Fj_io;kxhFo^F~^p92%Ft@zPCAIL%PK1v`w^{G$o9dN(_ z^!dUecO&|5+NR*F5y~}Uq5fbmd z?fW*qy-!_|7Jp9Nz}Ofeb>Yx3+0L1sIAhKiF@@-7EnU+ceN{WFndD1edD?r=Lh`rm z&OLmjJZa&sg<(}ZquZHWzToXEtZ#kGTdSPozznX#-vT%BV78%+&%Hd#q$8y4jUh+% z2YOa^LU5O7*VM6l?^&B>aL}w=@=j=BC*5y;Jyl+wr&3ORe2o*{>TAwP6QKFvg*0tF zk|%NW89~386k91FIvUzC*~>9>#u;Z;{@`PXLg-~s--NEDg^$qY6QA_NI>FY$2)@J> z@~ffEKNYj`ezUu5xzs$gZKW|ig8lED!hQGMw|?9uJ80xSb zv-*SbiEr~J-(2ZOc^BBjWvxvwxfqbaI zY`qyHij_g*&`hgZUiPw=)fq;HhEH}=9G>%>=hS7;zKUn1pMW?i`;~?xjv4P`Y-iWzw6hkuoTKB%&TB3FG3sLI_S&YcH6DC zBk$zlcrxqZ>s4^Be?DElsL09dz|?0x>zTc;eEBQ&Yrq88;~w|t#X0!Yn&$oQe}A1l zaY!n>W1ye<)TgRZ%2E8d$33nZZ2$D`f9gH#;ScNG{cd-!GpvNFEg;I{@Up7I7nyvp zMm_Zx{QDA<*=g`Oh|!ojNVBN~t1T(IjtwvtetP*&d)HobZEZW_$8vOviGDiiq?78` z$sAgXCOsQl40z7n)vKqzwnxDi@7dU)P@`!};H6^#$9pQg*vMUt+3{_@^xtaPwwDtR!I0FH$L|Am%qI7Tuywj(H~kuYsS9`0(4}R z2-*>hZSv07WliE(0f zU0Y=&-j2p7&15dwL3TRd7+$>drA{jqLyL2ubm&(M&+tP$Q9FF?oP5If%+`Cx`{*53 zdcE#-uj{Q@v!?g{54^v3#_4BN8SQKJ`|Y=1bu@5n!Wr3ZoEb-q0=$pDB97A+j_4ft z1DyMMI-KZN@X^5*g^pf&tXp@%NW zDLMeTg?G|1y!R17dV(?J%d~Vq{ff@fXF?`T^rhV&oG<8t9%UOC#|K%<2&6BfeRP3V zlyTVe4(r|KcWzVpF*%?tx~y`IF@_@EAT3&=KhkYYDsVO~hk)n!x}_D(aLE{^7r?LJ z>!+`N^{Xp=)3NCv_zT_Hc!wwH@e6W|lgLN9yvKhY{)mTHoti9kw8aT0oKQbl0!LPb zkxy^}|MR{e!>&*R(;97FiwrV7r*$$Rd%Wy zIf#CaKmPdIFUs-$UGI8V-TtQy_^>o&uKL^di(X>v*9vTaA9bSxqY-?D4B&XctI&_D zMG_|eI3>^>nl?uC0U2@cJ?`CmFFc-i38m`ePoprK8X+dlIojJdvovmKlpx? z87H1_VsE#*?lz+{q_>bQ#tu3d)$y|1evQfD>nwKeNf)Fb*J;;SLk^m zew4Pn#kf~TbVzP}^89c0_S*GMz3U2Jr~&FX>-DxQ{czrYtt-2orktC@mg|!(!=_zu zI>bV$B7`Sl@iBl<+Or47DZ#mM?VxDyG5@t?fDoXRG(wD#LxHDU6aEx4gAb$pw}1P$ zYP6&t1{I?Q1LR<%L=kG7Pz+v*9K(tcg+~77nSawe=e_4t;lk)rO0R32`fsQL4E8o$JVWvgzH`Ia+j)L61I#0!jfZ!;()0;6jZ$^Px4|K zZD{e*bx_Uqu7xqueQ9&bnYzwBZnr2a1u143A3Rbt2rtS6 zBap(YfA)LK{+0RYe}aqC&zG+$ER-374h`r#${c5jzM@1ZlTk~sQZP9$2wKWEWgbjM z=|21HQ*nOb*Dvhd`gd+!6+rX?@6$YPBy=s;#2f~M44gAW_b&H$FDrH^B9t`~Bp8A`PkKHys+#4$lpVZd|3GLUVx61P&7j`{kv zsv;RHWr)-uEq~u^s}G;tiD5&_(hyTj3-75!-;c1 zKjCAXdHR%bVvKOcQ1%!}l;!i!KfgMC@F_H|Yz8j}BI61_lm-vd21cndqwnxuN+l;C zrJy~_X{McJY$r_di#$zTjs1S{vs10CCvCb_`4X^ck>3{Q@3yxs&Oh3bw$9O%E6XZD zJc|>FL4#N7M}eHdBRPl2J$&;qk9kZr(yXc@Z>`EhFN{|F%?d$$lHp4hiNi1PL5?kx zSjIRb)cED(V#wl`A9()3+yaFAeGqhtX8@Z`GW1B2{ z*0Y{f>wNwN=U2xjW7CQU>Cg|ENg*c3-}k=v)wWrEhko%A1`v6O=P(9MCM-71=(Bd) zCj%7jI26|Xa9wYQ9e1dG15cba@T_mp{^S1qadnaqFXb?WTTTE5F@ufcm9x`W;y9uDGzC#f)6_@GX2d z4j|)3UmbGDAyprtPjXt(9ndtIMVrPEUi;kVKDX+3l_s zN4});{M~llt>$a%va#;rnSA0v$3MsryoSu-RKrh<4Ni=wJ?&||``r6JwLP47^GToK9UOhej(GiL%+j^#j_RU(_{PIHy^K{lIeBR! zncO35O-z7Gr!jsxQaFR%?{Tj^dZ(XpdYzEbZ)kumKVZ!i3-n43M*RyudeWC0 zGGIMbrjNmc(snke73Rh>*-l4;e~v*kgjVQX2bVrt`{1<|KWrU;cnkT#NsCr(`zKfR zseUug@EhZW&5I7n9DOLSMJ&b@8y1{?L7yk2&Uv2eUD7P|6%UBx*Q&~@Yn4Ll3d>S; zbym-|?lb*1MCFoqs;%gGDpSys=Psz3x+uS)%c**()B4rr$vcy$M5J8r(gUsjsQhl( zv+~PT(=1;5(bOG^{QHOFUtIN)DV(JCQ@Cd9@36!6HL}I|`cyZ*b299WW0xofv6u;( zgrumsT71W^&xtw9M6;V)1Y2!N}KV}emcXkcU%DMpZB)d0s4hPt-Qh{zv7@1D|u z=`vafq-;y&n7|k*aTw}{i}UK@i!QE$P&v|3-U&A|Ps$)X1qwzE*5CYQo7Z~-hJi)E zyHetnN#IdrC?Oa>V+w<208lb0mf|TGtzl9Nn*M1SL>r&`ad4l!1FxlTB4nq&P(Am! zwbf92DHECP)vw|#c{iiS5EZOMgCmBo6&MUw%7{PsyWndVRHpdWx4xy$S}{J&%2M|9 z31<_BUuKuJpQE3EU`SD@{SmHUDu=TX-WhFRpe@ei6HYv#_5+8CKAaEN1M#)YUPMsB zCnJ>t$Juj_VyrSaIg2QI3|mU?6P?oKX&`+E) z91L4+xm8V$CU?2>F7@L&R{l}=7_b!K@C(MHZJ6T4;dc~iiu##nomt_4iN=iqtBO?~CVECpsgaA^(5}+`q~I3Om_im4wL@4tUOCP6~Pq=btgfAY*WnQ}`-b$N(VA zz{G>W$f_s(D?g{AJ|>$O+R`(2?{>F8s9VKvw)y%=r^ggpVVE&$jb&#-GQiLeI^rZW z-Z{y@%tRnwaqC;%x;hyd`3#yEy?8WwMtiS)?Q5z`W#}>R)CcWbIS3Zsg!aP6x_Dg3 zb3d5kw%%szic|Pytece5M!e00)ln}$YG#6wJYv8y+N{{+^dMv4JPuj7b5Bl1_HmfP z|LWDNtC4IRaCUkY@JmJ-=hM@l@$}l?^~L087C#vk9pOK&>3?IwJ;#I9o}pp-i$4a= z@uhF*67)SzdwiQL^T!bpKIUp{n%Jc$()s8u@~kONW`P3>A4XSb09@}m`K_>37jWo^ zXvWweaQg=hWuokKP&L?B>g5H zeqD`K4z2(C_J7qeXA%rw(^tkI*@w5{o%)TF<{j^RN3{n`PzcK8jMY!{D66eZh`Pu7 zvf^G@XoJI3e{YmfWEK94m$NrGvDcMJA$X-vr%iY~y&t|fWKEO{@Pl5_p|+t{ePhDP z#QNSvAAdx_Ke@wRLgV@h9Sa#J?Kl)Ca3;bH`6O5{z;4sehrj6Xs+ZDD^*Nq;i*0T( zW1G|r8{ns)Zz{~(Bx1CyogV1SWEh-t=%Wq1hZ7dff4|Vr|6KY%^`4!=;VqDf`HHMK zvY5^XFX)q<DznHLhEEozt#BCZ|!qUya9fU$>^Vo zOC3T-p1bX+?@FI>7PiRa{eJ)eKmbWZK~(K&tDE@bZQ)7ReeUM1&y9K9)??1R)AXNq z3@R)2npJMo2W=VMwDsKx?NLrE_p=qYgERfkWf`=fZXb?t}BC8rGK@_*t2O(pS zX6PvoZLm7Q>>~q}2+>eZ`jy})GjsUxM5GQ|+10C9Q|*4~XW zI8(MfaFF`BsvCYaNd8e82!FV41N=}HC~6dGUmv%bM^IM>V$a{w}s zj1Oa2z;A4)!A~g3_!5J{Dhj+MIF?q~`U;;gCcuazQ9n&N^2;`?fBu)=X>UHQcXrtZ zY`oyB`pKXAfouGOO@X&kjWK6jQp_`c^s)SSvwp|p(1CQ|pfxC~S>3>v2K?Yd z{cjSX5QTAQ%ovko-}9dL{5lzNt6Sfy$^lL%a`E9sPM|9^09OgS?z&s=;3xiN?|Fwk zuWk=N;zdXFR&BAW@;XMrx*}r)2B`qw28mX(ozSL>;Mtv(U;X&k1-c16bSfVnIDq=cKzyUe^zSv76uG@n4Ja{jh>>&RM#N z{t_x5Ec{m3W}2??H}Nk$^t4}AT3KEAJI58r2`7dLOS@grSLMZ} zPffNl-Z@>+7&wA7`dk3tihA_K!Ig1roX~$WKGznVXgLJvQi4uA}9?aQA4(nrmEvTz}RyUiZHerl5QVw~W04|=*c}wnrq3(De`HH8p zHKf~+0sT~YT}TV>X4nhr;qNZH-lc90<|KkQV*uZGj}Fy8fz3rWp+k6~r*KNa13mHU zg(uqjjBlY+aVB>-q12-d$`0S73*e{h9sS7W;y^}6?gciUG2%TvW<%p~rtV|#Ah;Ab zzUe>41^TtRk`Bm;tZ%IJHy+4e}``0TIPh~56J1ugOq zde~_FzQ}D^?%?pg%cuP?c)(o!J4&By@UH-?_~dVCaWE<|hnNTn#w-KVEVz{>mO@*` zFK|v+0mz7C_;Th@%*{$MfUTkj<@8U)swHEViDm)T8q76^Py)9fs#<@LY0zRtF&o7IV! zIz@ysqYWHiRyYu%0;Pe|N{I4D>A>v8Gu9|m+QAtpP+~Z_l(()JADJnIFAD8AfvnoH z^ve&+YRLaAUn=@dX~)+u{LkJ`etLOvY|OoY7w+JL0b{kEKC%6Iby0?`aDqRI>zX^S zsfHIkGoYlkP8Bz4Osf5rFVNP+=4;ceywgofu;y6{eEebg&GWz^3NI8Vt^c4q?w8oWjP1!L{uPd_||>zyH{PU&iLm{Jm-Dq)CnIBCPpu(6}rJo@#NKo z|1xr8{K36#MdTV|&6Y$mL*EGGto}rsc(j$D>ScA#e-^oty5pk^2;*CN0quY#_-e7f zPCysZUVZgdl@`Q%CI^+t&^GC(EOFJ?n|6c*#zL=T3weLW8K?K2{FEp6{^Id}QDqh* z7QNCL=oH4Fm05Tj{4jRNeOrS$Zfwak7RWkAG1+e1kz-)tt=<{e0!M}S3~cQ*?$AGc zMV?D%wP)lXULb7B(@eqmFormr(AtNJV;TM6y#hTiju&)- zN7yn?C;jSIzFM7r#ESQWiDNP?c?zmUgqjvBf^)}8q!cBn5 zPuCEn^(Szyaj4;IfIHgQ-&ZGs~0$;%o;X8&ZK1r4--^7-2Nk1|XVK+qJ z;BE9plh=419;ZLaF`?z-WUV7==-|#+#lOJ=TN~)OY#T5)L_ntk-Pth<=$C8`@1{$m z!#l6JbEQLlU^}!r3)0i$-~vChn$lKmx(a&@FNYhBI=YB{(@s2;T#CHG2m1v$%-G@_ z<*1_1~9U@t}7j67ce4}uqyXlPFx$zM)CD}~vg z9Hz$3A;tOqtD;Mi4V>J9{zSKU58V)530W9|MolEp?b*`k@fM{o*_z}xx;9~GTo?zT z4--?yrf0N^$FZUCNr8Uv+;BSuzW@F2)inBD-$^TMDEX9esjjKN)qAs^r|G^{to+n> zb?skGndo{IBg|Z<^9EiU-NU)Dv$9I zmV_>+BskhAV6ub+hR*2cSftQk#B0k;5MjbdawzhaH{Y_(WLnvU*~?2%Q&zy7FTe}D zegFGE=pA>`sl^c8s;u<7s&`FMq;9wEZF)cc>Cbz&E9YC;=D5QhZr}U+mmXe0>I-;O z7yYWe5zKH1Cs!3XoJ*89#w=VgYzT39;)uPb^xt<2eh54UEgTU_wiVy;4tFedxw3az z8Snap0tFww2zA%p?>e*n0zD}M9@T?0PhY_;8sNMt_{DAjP=n)!D4s|X8h1FTp1H^1Lx@1_%a5J zm-IV$lz4d8cZ??Z*2id1Ul>Pb?>2=H9HXIAPCKjj!~edtIsq@c{1?6LZ@+Et7yo-j zq4BaB>o&jByXev%_fCE7F@=Vw#xx$4ElzL&|D0&>4c8p4@NMkiFUAO7Wy}~$`jW#9 z@6bQqQ3kH~LxvYfS$Blytbm3@B;D5 z!AtNKd9)pk;2G{2t!N#s2%!`8l16(IR}=L4$$Mi7FT~%CL44mk;|L8JlY;h$Gj8CN zk?Wmtss75wNAXs1bO~b>p1?Fl)g27|Y5c;2F(c?xX$8&@V@=(J^qqU>VR2HL^h|$< zzbOa(mDMT3;sFmtUvL{*XyrdRKV0|2-lb(_i?ODU^`G&m&phMv-jT!jW5%QLXRJnU zrcUbUo%F^7chv75Y zhIbiD+7FN5%SV>sE8s;RhjZgkIr`jq1m8HMFOoySr#hKPF%}(Za_3#{T=5E*;K051 zz`63((S*9X;|*|4M^z7XkXF#gXaw%mOFDD_CZ4xLnZ((A^UW&!;I3wz<7c7zpZ?Si z_`A5&?T&>;@J{VVzj%<9V`xV_r|8RG{<7YE_quO&aLNY<_#7QjU(@Z#1NcJA@PKyV z8!q5M9Qg$A(j}zb>h!Bp{_jpta=_2GOP||zs7!bk&;)q;9(?_aPb(+7OkgkNl?w+o zqdVg;v^`&$@J7DLBgAf``)QAre$G#iE~rn?z5Y-ZdWY}ejcy;A46k^V6_GpbxKpKj zGz|v&gCFG^e{cq;8B>8rhcg+iZ|QFIGP?rUWzw@jANA-*Rfi;5M$a>8;<$`+KX`6+ zuFr>qyib|>`psvZ-TTJ3zt_9vEw-urCTU!^*rIHMzUb24n_m5jLLXDMit&s`;(e2_ z^cX-x?1P2Kl++S!<6~soW@V=B28O~y6dQzOa7-M4LGjAD8vKaCU=Bm*)?U2OWwL|P zck?gS^Putu#gAKV3oqk>&@=01#eo%W7@#ein6!Zee`eWiO%klWp-h@_#q7=ISan00 znlGgMH~_ca%C;_Ef9Ek?UmYCR7p0IxaL4V71MtZ84nT?oCNW<~8Pc`){qh9|!=!Ct zwfO?KeLv{FU)scN?CZD+AmxBk*0#BA3&p{V^xEP~ru0cC%s1u+!E0e}%J*r19DqN# zxHy-K!yLYUU6eHrAWk`WyyQne>AmSS{T+aT)5X=G_-?xH^RW4bO$UCzwBiKq!(*%v zWN5k#LWvcLVp-ta?&bziwHB+CTq-|fdaqWG#oaE`Iu}Z;;1kM9S=?N#CSd64y zX7Q$R9e`-CbpWIeuHE)_>m|*waigT|!lZQD@xX~-<>p-cTRAtS09Tv_aSRO8_O1g^ zo{SBB?mo|f*XJmB z?6%DIzJ=G`chh(d?d08{^m)HjSJb>v2jC#w^lMX_Ht%yy8{6kLeZTjKb4@o;hmZ9`!6%Nsa-%PZ`kVXq7@+O*QA?3Cx(eH)*A-MGZ3TvrS@ z=@>3%aRjR(7}5-Fs~QB3KaAPRT7gm}q^V3+PMqFSH3#%5o3H@k)8-f?Jy%fLQe}DJ-I_W~cB3t|= zpSTvswNH$U!q?pk-p|~Z*-4ZW_%*>M_Jc1NBZ5`LLS`ywW52$tKkxyk{#v>Xp7Jg^ zoB>#hnHd-2M4g3K(|`E(6_AipQ5e#qfYP8aT0uctLCTR|q#2CPjTA&WMvjt_?rxBV z(K&h`&FI0XXa0WAbDlq7=X}o2XS?6;>$~JfJ5x5+L=rwz~xZEUlQ4RH?Jv6BUa8laW!{ZyvX&$iRyOr7qy^TM zpJJaNofl|~?(zntPZ(%v_&5lk@*U2794_AD8ZK%73>g_(l6D&>A$dtybY^I1lFLl# zV>19=dEShBz6M3{Ib4rrU&SRg`Be*+@ER5sRTj@VkT}zVif0+Nd9zyzEi?Z#HKeDvIn_j9j7e=GKMc=s&z0nEfF(~2Y|wDSl*Y3m9GI;8YIZbz?x=!ht1yQSxcAMK~&+@0(MUV z1JcD;hB{-8cayy!@us?w3!~O_;zC(ApgSh2vuMOSItmqwnjcsa`{K9Mc5V4(U%n+@ zp{kBPrU0#^HmnDU>l z9I(>AEzw=o(8)zFI<#V1pk4A=eX~05>*9$o3sGM9FtlX34kJwhD*-?4CKZc+z#OyD zRadj_vQq8B^dpuy?+9&weXwUhC*N9u5~^N`7c+S|XLz@CExn$2^1+_JjYKe@()BaM z72^5j=1Y*$Hxrzq_swrHoY?g*d-h9xn)IesqMpQz=xlqdXI70`_T%me7F#st>jo^T z(+qpotHD`q?;k)rDzeOLvyOW#)Si<@JW6+~JXl+I z{(YEZ6qxO@^qpPJ5}o&-9pf~=DhLKrGahtfN?2P_DP#Ci93{=_1I}8XdAPhFv9U+i zUf&Q@5^!5J?6k>nzl*!GKG^mV)GkKd`-r$i=qtjV7S|P`p0rQX-EMjm;q`q;i5KnK z>)Z}rXvFSSt}Sf*sXkn|JgcY8_sP|{t;L)KgC}r({nj8%>q!p(DUuK5T|6SkZX|VE z*bHT^P_O1pl^8NS7=5%c`*g!H-{^M2F=1ID^&Ti=wEC!+w3bQAB#2Kr@C>)3-~~qD z>x11Rz3Z{kW}ILUQe|>Io_JQLm*6Hw6rd5X0~H2 z;o3RTXm$CQ-#I@g@UEMs*+Q&n$Q!QpGVSsjb%uNwK&l$$9@9 z5_Sapu=4BkcJ7{nYTakuQryDkWWO~gys$M}(6XH+ZNgXx%^$**s8d$3V-rWy4rseeDS6ysu z%@3?!>(vL6E{+sXD+7l^HK%5?wDnRfKPJKT&?O{Gs55L+S_-q|F|cixJ8CnoUx_1KE86j@0o%|89$h&_UnjF^WkR` zx$2ke=NU2JzM6s*6<4CkP@}8WucdrL$PZq;Qn~6eMtb$wl9U?g22^!;w81d&N7{-W zq96i$@NfXgvo#=XzSfyUYu(20wb(q;&pzD$DbjAXyY6u4ZlVK8JX)iQ1z~qhSjbR{ z_&^RN9x7P>a1%N;L6-4QpiIxLN!G4oR{(9mT>}1*yhXXP(G{24m zz%L-|J74ARXhPWLf89kg=+|gB^Fg&%`^vnM`Wg%emb~ZfW3&U?!x?E}r`^Jc;trG; z7&&+JU0wJT(WjlPK>_A>%Vj5tfM;9w48~0AGY&rPK~Q!^o6<&fY`pb;z13z;Vwj@$ zx^s~Jn`?A=4imOvy7?88!g&}f7mnbUg=zx$ZKhP1KC1T_?|$aEcfG^T%1eFU=a;0s zgMJ?{u>w@jk=wz;EC!xXYfaXm;uPZFOgt86QC(Ktw3&F&h&m`*XZ+%_lV34NFl@)Zr;<}eZW zY)GqKIez_MUr$l)COT>JF$M9P*)1Lm3vs6#LE|mwlw_W7?qd%PZ*kMpCDql=cwBK2 z%SENopf$Xgyw0CcO)kv&G*w&2`<#^(N`!>A5k?eAR}`8(lJE5GBD^U=%AwUg`ZWu( z{7Mw^vRH7x1Dq809$2;Ix|!eC(&wsPn|+9#VyoJNgO77(C~{nlXd> zPPL1cJmNX}?9)Dt?qhV12!}i14>?{veIhQQyF5Gw5u+$ByqmA0+vRT$?&WOMULSVA>snfO!vA{{(yF0L|{9>mzz*T ztu6ac6vdof6BfWpLZv{JD{Om*CKeJj>(YvIakzs-l9!w#T;eMRALj?3ToYfFt*ehM z00kC$yZyre~;9w|`JOi#Kd1 z-}${Wk-pU(Q0W(COP3=qUVmJ$)8?ll7_I&}pIcRjchqX4L^ibtPolsMWBB-Ukxc8srM9i@jVC@HGUQa;;|( zU5tQmc5zLyRRe^C-IG95PLEz5;>^hdf}4}SqOJ8u&k8xIfXlw(?LS+>v?4n2bajvP z)h6+qbM(&L^KUPDm;xTzH~!tWd1at??cK{3Ji%Lx_^I6}Ske1&z4>aLzf>MD;~yf_ zWSr^POaL;M>3#|e?hzJJm1n^gpbKI@vLq8_vnT#I$*~U-VjAo5QIoz{^GtgKU8A&j zm+NX&d|!9e?uX|VnsoJrg)c}!)RvZkBb)?z!R2?bkRb_4{gROgI7en-{j_qJoPtPV&J8+q0xpDeK+Z5+PMt z7Vm?0c(>}*GP|@k-6b)9Pl^~#@vq9ZpsetsT?0laZa5dbTB$uIxP_ffp;f&}^71l^5iSLq5=W&hqoY5lW z^HO4()$cC+&L|zxU88aK52b~Bm~cXZ@;@HawliA6Q_LAFp_jevkwx5;;ciVQcx1Vc z!L?me$^!{JZj*Z$4~xyA*qOe^Z}yUAW`LHEIJRAjzQ3Y){phzYB(SfV?a<`ag4@hr zk@eE0OA#=ZS=e*j#z^Z|r#t(eq`Jc`ZLZfK_fIh0;+lsEz}M*hq%6ffCE&aE2ZAU$ zND+4sWzPFDsX!C&kAlYD>jV871l@G{WK2KPli1}&gO{J^7>-JuPG}Yi%#{Mq+eA@5 zyX8G!Owa@4M4ZXjW=U+9GdaJf`P~99yo&!+ydva@t%~-@s;cW){?z&+(m($?SCP6pr z1JIK)YVT!2mwPPrf2}MXmWqGlw^^n$3%tT9zz%)6Uo6<5s1&I>d~>tQMPVEM*eAI$q!h& z9UzxsatqEN#iOmcrN=A%Dm%b)*nK;GeNYl9)4#U+Hh8XJP|_ zoL`s-!ei;(AGKg+?}O0Gha`+MUdx2cx_ev^)w}+qRJh<{Tro1hp6d9G&D0mzS;l{E z^a*PZ=(|Q?Q+gI!Gt0@04q?d9ff@@cX)487?M7#f+ z)cEk^DpiD$nI80aYA8MKa4UomA}H8IU_!4?JoubPog!>Zl!##?P8h&pVkPiaH>up< z1tbG&WP*jnr_Fk+do_&) z3&dvCtij7B!%{`Hn5?s6tHFI5X%Z&qPft3Y=w7g~ay=r_jT<91vLb!XT~xy-tLwek z7ogT7NUC|(T~{D8pU1?IMHMSV7j#z%k!1gK#hdMZlw=%_Pi&b0#f&RqdKS^OuTl6j zl)RseVxx(`h(V5!NN8()QO4skof<1FlkQU<$)KHik$f)!9l76n*S9O!5fme@_>h87SqIJhqd^t-k zoAl{dYn+9Z6Ze^^INM!om*S-Zr%%kFf*15;gq!@YfA~nBw^OIh{<8c~a6IvE9UoiL zwA!DHtSgfX%=%jPOUr2CzZB4fmJ*VqHo3R|8CuB`ACj*stkKn~oOg94}3x^W0tQ@@?;Fq z0eQGG3ZDic0Wc^?EA@*NDMd!@h<-EwRp|{4#;Bg-+k69u^mKNT{=cV<-+|Om$Y(;Z%xFS$jz3OOyj}?_v zB=2U&suh5CO7OnW&&$_OZZ=u`i(R$HAygw0tL_zJ>zQ4o=I%Y4i;oX!5zeIs*O`~F z84F~<@>gbVUAfqrXLHgY)z>V`?rA_&lYw$7v=SSGO1hql{{kUQG+W9vh?}B*&v`Vn zj*hU|lSw?@Yv?Dnsq@Ek?GkQg5>pY@J-2Ylv=Huw*yW`A)rO%B4komB62r=c;DjUE zda+^%hx5Qm-*e(%#)faL5S&;9>B29oDjV)1@4Qscub2@z>SA)HqPI1a(|VpY<>)u= zGR%CCv{~)2eN`e*&futOeBx`N=(Qrf3%ka>T{0tbv9QiSqidW_*9z+p|h==g%QwBtaq+wL4e0(gD)8KrjuMU1>Jjr)VR(jixqj?5<^ z=~vV0+C6Lkseej%8T{4!va-N97n(M&E+Ej}Ce-;>r+r(xc5+X&7lno_%z6Hb{ln;B;)~N70=;|2=087o|1dVr zKkkvaIczu@$sE^yC6qn*$sWJcq~)8-QU^3iohX2`2 zL!+$4kzg88+b3rO4n0gdOe*E-nU;&?W)}U(^iNbCPoxWrqZK%sd!^LgL4eu`;OUqjOC5~xZ!iP)=hG;?Q#Nj}g>#_y$c;bwYdw2|r{ zEsL=t=8WHtj0JRr{=cmM_Rk6-8wAE{AL#w!%L-iXFGBr)w9l;PfJX3aGMm|X42!{( z#Oa%!xI>4_uYpOT8)`0xK&1=t+(b^e4QA(3uxG`)4CVN@!H5Uw1RreyZ66UIHq}rq zcp-_=iAR%DrOlYX^y?nw%M`Di1Xm)-xi5;|3f6FSg`|`&YI6$fH{yG+TXG`OOBb`^ zm%dL+4>$1dyfSB;%A&1^9=GW+!?Qo}_IE8y0|$i+cS1vi$m?&ig*HA_js;z)3l7BB3Q2Xh+ zG!#{zMluSKX}bA~lf`^c-wC3<;W}u5#P1wO4qT+Qw9IW+I8DN(2gN$ACRfc%BnJ)` z{+o~za16YkhIjp#6?jL|afdT}VK5O=;7x;fcD0+vRN2{k8QebIbg>auY<-MIRY(jp zqGh=={db3s1qg0vh;y8yvR|rvxpWcX79Xjr4ueT%;X(>ATWFmGo*dZ%{| zAldzkbV>{)Bjy0iycT%duG+>G_==Hyyw7Qozh|e+-&<@7nkc>%@a{Uw9r#fk**YI! zgc*R3zuKZ1&e+clcjC4(AX|uID~-Yud5%q-uYMHX>7MP;>-KfJi3E4on63|0gi*>` z*9V_wnI77Rv+PY_$I($5!a5@);N%PA;d=v(Cm7ikB5hDD%uKy9E%V7SOn_E`54hQ( z3R;#=&bGlcdi?b?q+sNK;(f%nr`4@7?NZ_zcBytfu7K{aJRS-rG^+;MU_iinOvivQ zus)$Co&A-7_8%9&!Pn?e9=6yyX_uw`m+o?n3$NQ_&zGm56yw>$Pml{6V$*AsO{(k3 zHLj&rMspZ3EB{c*TC3)rGp$ASl1@|BIYdOdEpXx`zW2;9Uu5#Q*YXU z)0*oJ4-UEWT6$dkHvm7heyv|J(g(>8R)0gK+B^Q&CVc^0`EH_hoxP97OCemYag6LG zyOqtFb5mV>OKb}_Nem|jwecs1Q6kOzeSgxnM*{AJ>UPX|HcdLN)++Qoe~)!w4y%3a zc+y3GGS%F|*iPyu7_&n-Sg74+Lc`0@y!WU(;e>LA|(3MRH|2)d@R(_H$IK7(FjEUbd zz}b{IFL*mip*;d1Q9>hL+BDf$?*!V}?eTdiJ%g3m?2xO2y#>d3mw>ri-9yN$Dj?Nv z(=p<*0QEZH$ne%A@gEM*NVczRBY{m$WJ~R>G#Ohi*IjR1%C2yie~5a@CL(n zr!t}YZZfuvl0ylupOXKO-10JF0^d1=U^64Ui?USHv0!~KnSHN~dua~c^jh{*;gr8V ztn9sDd9F}f`9S$YkLvnm<(xht=<$6s|UHx?dyLG#yUMG2RGZizfklr04%zpaXFL-lahSG$_2s|gD0>Pc9vo_ zK`W?bk1HE?p@B#~9CIKXEGuEJSeKbeI80~Y{CRg8vPA9 z>f^-XD@dp(FO#aq1>SS;VM{hA6dpA--qcP{3*M%$D|^UpPYiA7^;S#s9B}SAxWf7I z%Gd;k<@S)pLYubsb(Z(m0hjy7*6ddco}udcCE&Rxd})WF&ep8cHr%cM0e0&snq6TX zh#}eIH298M)|cL(6Z6r6*!l}=j7EDdRU?MJPXjM|=}S9Q7$hKVv<)t$(E}@a11dd5 znmE|tF0_(YV-nYq_I@!?P(X^qz5}4ktZEbpYjg9~Up+1Lfl6`XQ=`|mla0@GI^5Xl zpkc#3EP)5MSj7Y{op)FEd0+qXwzJooVEkW|_jpG?P$u1nc%K@~$Yhews=8vFm9Dah#3kSq&G2`dV>x7}}l z%T1An4@I5<+{~W<9gF50PGVk?s3-dEAh6#9{z^T54lQ}7d^z8oAm99GxINknQ&F%L z9qIY)+PWBsadMI2_R-u(wj{h!2|*u{t2A~8mz|592A6H5d1+fv2gf?`^T=VJ@KUkL z7geUrL0T^tO4Hce+f7}JTfSDap%N>Co}4V)47jiSSOz%kvst9L4!7A^e!lE-Tl!4e zdIT>W^v>ZI9sqw02FP5kP?uKLO7H*oW|7q$vd#FwPxh^%i+kA}*X5d1ON>p&QD;3j zkZ#-l_Drl)Q|H^A|C+&$0BfZU3Q9g+zr}|NSL3)kYS~_~9 zeMA<7dHNYP=e>uQw;k+iB5FP0E`|60`uNP}rQxk>_aX z9EN>qnE-bieH1&&dPw|dJngIsx4zp%ZHq2jOepjgJ{$+a4ULFu4(na_zK-sUt94qU z9WmRC^uc-z<2B(9W8Drc(g;VCc$L6B|7#-trE8>{SETnE`%Z#V``R7vRho3&ovr#D z`qM`MO=;QZ&-t)vnivs2@FULW=~W#4C*c`Qb_Xu9C%67|O&KsLm!af0lVUvo^Kv5k z2(O~pdfpAt?|R!ttg!bd!VUsh^oP}?vb_@(6Rps%5z8DdyHm~PU#Vma%*EfQ&WTV) zUvZ>lcWFjg$U$5*25zs-pe$+N`4uY(k}_?ah4YQ zW3b^yRFj&BU0UTB#`Xz~XF`;3QHhsYnIh~lQd@Ce1|B`(Vrc{7={bdv%H%;hbKXV^ z*819lUC`2%_JaR5JBK+6DRX;ufBa{Wf$MAzEc%Ss-b49&roNGI=$*w+y3A9f6UFKj zgM%EdOZ>qWsO2*}n&+nxRBp4al<*l4phmrxMl}n=5N6U1yDWxqDrs69TuxhZ0-h#71@_*ddl zfS#=TWMm;!P{@C)SDz2X^_{QP9ZxEw2dq1e?v~B@)VTi(NV%YD54j@wl^J^crHKa; zMytl@*d`|xOx5sJINPLateJnlUK25MhKo4f^c5P8{SM`KatwUB)Dk71`CY+CSNOA^ zTVLoB1j+Qzc2Owx7_!;cVp&nB(c=5!llhUGntv95V=6rUi(0yI4M(?4_|#ba@`1AP z-jHApHo0fda|H>4acW+&ItO&jT^HS>gYAP4fAD3a0UFfnj)Q*S3S!vG#kkoiJxL5d z#6K0DwS=3h-R_|Q{yjubpnVCcepflR-=mul?~KJcRp}XEOK)+daPyS|&2-$CocbaA z8V^h$joNSL@2~^?plDc?r|NAK`%y+?*L~Fdf7{Crg-@Y-)GdcJpqv95A#@5ptINc# z0N0{Uh+`+4AXEMI1U&CjYv4tVizS(S;?hl@{0_BAXNY$IM75jRLxrJ0Tpy=d;t7P9 zNfMPdu(jW2Up5{bA?Lnp%7QvJQ}y}hSiMqZh{ZjGouZG;6`vG028?IoA+aE@{O2U@kQNSi@-!-CI~fAJGMMV;SyN-4#w%@Rgw@g7E= z9vu+PZ<+w5>HQerHXd)LLTU*s899vX1Qzq-oK zxyS^`NI97Nih#;)yf}urUJMt&?oz>2<(Kzd>!W5*0FGykOSg8I; zv8{`LTDfBwl|l`^gDA2jwvz+isu_X2cppu;_B)a=&AY#^d4uV!Nw0xI>|H#=t#)dx zX+LZFtnRl#N1*sKN$(@z*V0z_k zmYtHMu>rS7%U|h(ME%aX_+jM=q+k2YK&)tO@gNm#pRTQT%fos{?gYRFzt6=$VdZfB zy_RJKpkNTGGIuKA2I0*35JB~?-RR9c;NoTtEm_8U6!qT>guqeKF+xD3n84(BK3!&B z+A@x($wHn+fyh)pB|(@aVEkWnwP8}=y3!>7zw=W|)E!y8;yn zT58`Ra+`Gdf%{l&+7~81#Dnb)D|>xNBBcA@SS;%2v>@WVa7y>m#rzSXo%9n{YTeX~ z5TkmIr$}UkX}qrPoB8`-4I+Ud-#A@#-cB*s-n$pM3{iRxk$3cjykhpbI)tZNGFZr1 zJk6P2yKBLc7r*gOps9{zzCG{3;_;jn6Sp1Y{6$S9RO)zm&^FJTyLYHaejM6`mXsnt zBMw)}BpMuDVx`sBd}|q&2oa7_oTmmb<*kxjJA= zEL!2|WDpAhro~a}Z2L!~;~N{bnpOr{TQ4!wXM%PkNmbkBHAT<<=!~)jGt6}jiy?ta zRnewAE@fIz7Xv!KCJFjfeLu#nhVqwOzg5d1k5F@$-@#XXIpFb2_6UnA zG4sLRtkT<)OrNhPi$`x+9Ofj1+H~bpv^h)He5sS38=wD5b?Dhw>Tdt-5?twD)WML$>Dw>zG1K1qNbhs@=8da8Cudd z2W1~0)~ZJzY|!tv)BhPj!(15$Nb@gFKV))lm@%0I6rR&HQqj26P^bu$^#aP8Lsxh| zk%COx-KDVs8&i|ih`WqTVUqH6?H1Z$`qz7&VR*OXAz@Wf5S&n1mO<_e=j;U zvs7Q{t;Yvn%$3@n3`HO8$kGLD1M0TN`DfG|ZZDTw#l4D%D#X>7n=a>lyh~m|r9JHkGQC}tzXc0 zg%c!WE$B!9!Gw%0YrP3yHkw?|1BT~yOr4)*2wFBd&O-nW2tec5p9{;JL|0(Y+mwn9 z$~53bd&aWHpOrvUvQl4}e$im|4Ti3nc*|1~hT#=&y-#m-UwqnLQC-?G;;!YoI!7Fx z&@k$T=S$t*U~UbWY!K4!jOz$l`&HStTduBa0+LNUEt-;VkJ0lNXM9CWf@2RX}+e!Lk`lv{Dxs?!tffPj{W%_ zrIz$JZ|T*Ck-t%Xr+3l4z_s@uFx}tDetWA9e+C#`Z0i(gP7+Pct)730fHUn!0#|=D z%ze3(z1*J+xe^pPmGBOnqIW_3*hCN}WIZlfHev#vhl`nQ@^haPRZIzc_(rJsl4*~0 zmfsl1`GZ}m(f4|z&7Keoj^BlU@iAS}Ws#?ncU=>|vx^ud?~~wMW;2QaN#kfl_*r%@ z@Rf?CZoBlDtp%HeRL^Pn;aCvpG3=-Xi*8V=;+$&8beX#j#_nBYBe>~;Uy|D&v3)S0V&f>VpJ{F;{h_}?Np=Vqbs6SNA zvJh{gxpu7TtNZ;HJ5}w^C}Ooa(7pULDkqN|qts+`on9x$X%C0fZ_2OD>z{5;yLC>9 zc{nkN7^T>;d4PcEMSPZFt;-Fjb$(O&ld=W>`~Hs*(UxLt?C%#I?8oJWFsD%I{yzJ% zy?_u&Ox%UvYEOOIGiw6BYtqGP5=9oak3Umwr)6$Z@4Cq7>x8p(Q?6JPCc6h!8FSOi zg+uTs1(6x%4XKp`T(y6v#4ypbJl_+1i=X$y#OaCSI>2q9a85koXDNCY##ge&Q^98E za&HSNTNQPmQhcgls*_~lRk?(kzY=^?Dr0uQAgp~;-OjVSF4Nrf^bj%89Z_z=eVyi0 zWubL$yZ0Wo37{0liK!DQWj&a~8XCL|NC9hWyTuv5p(Tl;w^VzE^g^=+1&KI#3#8dM z?type(3`^DSAJ4&V7ZLyN8O5F$hl;U^Aid^HJrs@ZEKL_`4#6+GVdDZxmosJvA0_r zxi6nT0Nx2#SA*W?Ti0R&;KAtW*5@SjvZ_L&^%A4!1vcCS!UXW&A$#1}FhwE1OW#H^S514+w)6+$}7O-_HW9u&R8L_8Q}Z&7~~Am|dD==s zU%cxZGM)Z&o_+(LHBmbgraF6PMmst54U;o zVkLoQ;{=>0&d*%7V720e%=Cw;#UX{a^R@wB)=K=2gM@k?+*lj?p3=w@h_#f=ymMz+px~$LeIfqIcm>nF zSAznBI4!oUoL>kb*V2W_?;SA}^^QEPe+b)j8&Kl_6G__scvj2feQTk-a)-Es31jH4Zu6~q7F8Me ziD+OuyK7Wy2c6d|u}(+@-Dbu`$cLD9*Dq&{HGOuFj85y7hI6 zQ0sKS06WfYG2Oc+R5HpHBA=VYt=s15Gpob zeO*PFNRW>J?!N4b`y=v6U-)krOHdg2JEP5c09>UTB=cR(a2-`(MLhRY<|6g81^zYQ z1hI=H+Xj~tgm-o+NduRkSH`G~Gvq)QX?rLfPmV0>GN^|HQX%B}e#??0>=5=G)skL4n-v{XbwUKI^HzU0sL34zZD;{FN-1;H`DZ0mcyn?afJLUL>mvx5AIngHjbA5 z6M?>u1?dO(I>xH{pN&Mc;+yD8!a|Iedhh;7HEshv?l11LmB*TQ6CKUt)DXit{%03kfz(XS88&O&^t4sKCPD`#4CRn}=# z?_pnu?Akl@EK;>x9*a+2F5TV~n2wUe-?>%1O1}vZ0Y2-aFTCY5bo*>zr8do~x%*MT z!@6Rm*>Uqx(jNqaGJDHj7CWW?9g?}4C}{wZ*P~Wu!f3)B)9$97@!Ax4DZ%1_=sM4{ z_cQ7jEV*1nZDef%$^Yws0RhHg0>3N7{r%p36kG+e0>)>>yP_()es%^34n$SQ85sI# z=OtbX<Tzc` zo{r=FGUiD1b-m}n^b>bLc@Ud*Xv2zBn&=nfnTHbxK%-fYVMsUVC1VKc)9J#*0GTxX zL>|Ib8$&{8^i^BMR&QE6X$5Icd>L&%y##& zbzV7w-I65a>*1P#G)zN|?=#dn~bVX?*XCO4-`8`jhixdifb2h z*P6|keBxw~cU)q+wHOr|JQLyCZV`+p_LB6Xi%uMl1dcWLWV+#k;4nwe&pNlo} zsRsf3!Ne2lpfHOAAbXgXq}+1dw5!hHO&E>00#loc2ctxP00=#+t6_f%Pm3Lr%KK5V zj0EmHE(tpb0&M^mVFX?s*`Yp$VRfB&2`CwP=iegBve>S=EU=vYCJnyBsCxR2 zeLELTd>D5ujkU$V#A^XKhy-1 z=Hrh2YJhGBwr}7Wr2!R zy(N+lti>gugqRmuhwiwiFc#=N>K;trHypJ`s7&lQ!NmiK;IMBxqqDt|6}~*rTH(s+ z>BV8KcxTz#;f9Ni zLQPRbwOC@1zxGbE;xJq{quUZrl%RZX>fi@Ubt!x-*+UNEBi!}QB&1KIB2II4miwX zLDakV{#X|Mcr?=M&*VD}q->&H3Y~mV7O<4#+p2r2PXP?gyv43qx~I%QM_@5?6fd-(A$CV+!Iu3gR5_%KY?qAK?k8aRi_+%(2tG|p zC)@Ghtr{!Bp8FJPFtaOHT%q&h7=gL@+QF$XP>s8b$*Wo|%WSv~qKfQ#wZS9SHNSMH zT*6SXy>vcQN_c5c{W`8CvA&yT^h;~8CQb7@dpVK?5gykU@>{JVE|3j9sp3H)5O;>2 z!&ueHLeAxgGlU6eXOdUE8e@pqSnh%z{WVyP;Xfs2w|c}G-YPjww9dJ{4qbHu4?LdE z-60`oD2RyGASt`dQPjW06WM34SLcpm?OJS@@Rp?vSTo|XP3`&!;oQGPm*9SJ)H0RN z)zw!R7P#XBa!3CaEd>23{$aCYVV<5P#{EQt--A#F5(jVisXTj7%JRs3HP6H5$OWBa zk9JHK8e{QmjIyEQf5~q47YfR=OP0(tJgOtf8lsjT>qX;R13-q0A=Fp%18C@xpu724 zobY|{koAh+%K;T&|rWSosd| z*~sf7rSx-=y`N1+kw2pgS<*&^09RG+RILe9&2Beymu+P8y=ju_%^N)F238o*Y?Sv{ zp>nHGQwpWdV29kdF|H_C<$OHX-(n%Li<;7v7N3y$Px@`XX19Er!S_GIBo>;UOQrTY z_t;W2=@s{ebW=8BLUmo+VYv31!t$GJ>>JN0;2eoat*!g*CDZPgE%0Nn7A zr|I`Yq+q~QC2x6gXv2B{^<4J;0(Ny}MuZyWfK9s@2{5k$BcaJ8YUJGRN3c)cN3P>F zTd}R-PD|3t;~k{)`Wv3p)U@lRsbu>Jx#0}X=|?DR2*c^uuk)gzHCyB$&!U=v8d|g5 zNd15S5x&!Hy1X)&b9&t}=gD)a7F&szBpEWOSlgtN1n;qzbVjuXecG(+d3<9YCD2cE z9M4NsIStbStN4dY!1~Lz7&_0T4w6EUJQmve8qADc$r+=HZB-p#9N>3eQSU+qNpY(> z5O7o-%v~nKl9?ActE{Gq^u~{CZ98$+k@_D{e{I?2F0CrzT$|%l&!?3-?>RzH_%!;A zmlgl*?D}MR8vFgCG$39>p5(=}bnpVG`}asH8G1sH?n)n_C}%%-3x)S|;M%}(@3i0n zHB&(nocc+$x}HF4P{E=*OQHvy{|J$(Kzdd5NdTc#rV_6sogxF6pz#t2P7i~0{(r{(5c4%6{w)jVdE!?AjWopinp zM%2T1v{hRH3|5U0LVn2RXFBga|3yBx#hj81thCELnj#ovu5L}SC9eEY={3%EGIyj5 zK0_ZXt}aj(2WXoIPI>`CRE|tv^!Pm71An%&PBeKO>D~($_eNlVSRJj;v zI5?llSF_siwvgFBvcGB9jDP3CoigVW3lr>oWs)rRwUy>}nur#<%(u@eqvxW<&Ebyg z;p2PH1!6567s>!1jWi7DKO&FHaj(#Ms654`GgJnU*Xo$lfPpjI{jQ49FD(+}1FE+U z-Bpp_pBuS{2r`fuFZzw+N3}VM_(J5{#}uc9D6`VIie--LTEWW#mKN())o5_*^l`V~ zPblNoTC94Bd>TdAw^%KziRs0fq3d%q2)q6M7DrF>cAaPU8Xi2qu9bS?*~M-2*@cFR z20aj*8k5JHXT&H2o_62PRlfGN9omMlRFP5V!*#>bA099Ss7x-O+p4m zEEX>;Uibo_3na?|b~NO2>(B`CHyHr}|}h)-Qw?L$Kyf9Ck@ z$(AB#>K7Lt7LX7zurJ5nOrEz9h`&gq_^-!qZg&^R=SwFOWo{bh;IhwNkPYWP4}7XZ z(y8`XBl{y;eu&_Qumia_UD==41gPF*53#-|{ft|G-RpzEQ9iN~P@<9x@=rs z952}TV6kHVhoJvrz^~|E&?+$~R-|;9cYX`$&Th>Cl$Pp4UMP}y(^zY3Al=NLXSa6?jEwB_Y;6LU0<;6?%%UGp_ zRJe!xKcHDkQms(rj={ML6GLIC&q>cS#g?6Qtl5P+fP}`NKc8q9&p5#oKquFp_|00x z(fs^ftDzAbG_!Xlf+y8%Ys(1d^VA zD21!-|F{StH}=z{RtpYIqNSXid4caw3QJL^5O)vHip;Lddf#1mGyF9!by5<(QR8nH zD#G&}NFMGCM=>6hd$!dX6W2WpC`VOo_U;bo9pZ{(ZxsT*mip+~dG#Suq8i6IqTx+5 zlfM7C1^p1ig=!d2;u}w5yak|0V&VD(C({~}4CLm<;9Smw*lGd%xvqYx1@1m}Xy^FjK_ zbi&}9L2UmpBSEDXJk*uqK99w-IruJ>UnA234zJRBeD7nuMmi4yyo^bw!KuZgl2&@O z5G%Zjm-nff0}I==iFSn_e{eG|PdA;_21&nV!l|48KpSAg_+xKR-nW8!_2%B;s6lLXy&Ynl8q6iMMrZN3LPa{b-YuqGBN@>cs{(N_HVzo zad-M~t=u-X1bS`cIejONrgn}q-AtAMFvndl6c^mtI_+Sw4R_`W**6Ox72+D$iOY;* zeY*M-B=#&4wl4I-h`})^{uck|7bxjf0T|nFo%k4wG5%pSfzk0i437Zj!31{W=Pm=Y z9GkdzobJj4F*hTeyu@uGX&qMdkNVz zD-w$EuTiy<7;7+3aV)B5rhu7~;>~G~bnr!XDNyj0hkSpz`R+gCmxrxhtGit#eybg) ze^BDFC;UR(TgaX8-|<7Krd)eSmVoj7PEhU;;AHrDTnAf@cj-mf@nXoG z+W7Ol6UF7y!_6j+?mAq%xgrD71L2}B1Lfey-PLJ2rM=`Jcz`Yww<-sr1SDiW$f<%2 zuZzW5CtK^`E_i1?Ri45;hLCOL;lr=PSv2l5_oJLe>{7%M`Nf6wNiMKV`k@92F?Tqj zV~_Nr3!jL2!IoO-h-}6zQm_48*#9BB@yBhv(keI)8)eZKWtG3_VJov1Y&#n*Xj9KR z=x8JMI-r++dBPZi|G@>|A^ng`^Ahk~7}?KP35rzUMi0a3Y-f@`o7EKhX-`b_2jMS! zZC}4+RQ1e#@cZb>?LQHVmtl(V|iU4~h{sjU*%x z(ryLQk2dfuPem*ayim~(2715AbseU6@aMvH!yVx$-3KX$YFb&HdFk_SIr``4ukyen z@pn~+WCGpsbSW#h_t`kJKfO_O0bZ_#Iv5#}0-PtJ*9(_Z98LIxp6b#|{?23F+X3CL zEZ*(%kaSRhfwd>imldBCw>lfKUY9M=x_irQT-S?RB>^8AK5peb?>J&qBDA=;zj1V~ z{&TtPu#sY_8vlEZL`AU0Un1<^yT{Wnude;V9e7T(5IZm9@EE14{sP7zsMH_WQ8s1) z$SBIN?TX$}Z580BxWOd{)(pe`wO5wF0hnZoT8)I{`>Ra}T2_&t#;J8r;?&Yq!y*DJ zm`UqRFMkMckOTn6Fx_wC|A=}fHega+7_tK}v<(T~7s1(Sk>@lrXu+|+4f7^T@-)Wp zdsEz&&gUvEl7~uB>Uo$Yk52l-A6DXF(z0MIm=z}WPT@ZPez%kPW|iRJ#pH(^O!6%z ztNvelp}b&%ru*Ct&bQ1jc|7HRv%!3<`gVvy&|+a31l9RSalgB8E6nHn z0yk*K%W`d~*+JKtyC-&*9?!jgtX&7OfHUHk?h9hg+*iU&VSU`4&ia>3+3 z(cbhVZUXRRu-w;RSM;cWQ-7<_^@vYhWFjO*+`Ez+a{l4*ntuch_BhDQsG!Y`%@J!C z;K^y(y@~m1ILV9>Se#DhqYmDc*dtad1lbb%{c=c@4ez)abq@G(!rSpP&-CS%pmmhW zyjaO^s&2h^&b{Q8=gGM@MZ?puzwilJlB{!c_M2b%JgRyxePp0xZzS$EyYf3Olame{ zo&60N(X2iQ#IkMz`>Qz!gwlR$DzI6R{4Imzhrv1px0mL%q7EgH}+U|v~JxsWExB0n~uW(&|%kR9x z)cC+&(EDG=xVN%3^T}^la~aNGv|MVBXS{WS{AlGG!h=^{^3wS~_&L8Tht$zQxvWy` zlxw>uen!1n%Qa6;N@i7JB(+}*wdr-syZ&QPNfNbhKv4C}{s}J3q=&>Ej{RZg$$VIZ z@ZAFfyG^~T>hg#xl^GzWI_SAzmF_g&e)0W3F&XVu+NYHUbiYWOkJcJQ2Zu9H=-&P- znnFwjCxyS6CBC<&h$dNY2>NlO>E%(3)oc9H5Lm2$@Xe9_gTk`(d#mmEM)o1bCRIN5 zOhUtUCQta?5bCe}ECu-PCNR*1(+?Bjb5c{MoIt%x48Am_4_w8)*KN0=B5*|3x=EZ1 z{YT$3To~l}fs#ewTqUNWkA#?u(umP)9<5UMSpz!dkk77zFxgp<7f@DPnmJ2G<*A>QN)6oa%Y9T_w=FFpPSSxvZ3 zBXIXYN~`{a;fOoU-o@k!;p17q@ zrrLnpA5zAs?#BY>p}*bxy$PP)0IdD+#Ip#_#l^`IDbu*nIx%b1)SWe74MMm zdIvBhY?Moyrc)OrMi>&ttoU(U&9;{`jM*j$Xj-@2v!9$g7W{YlZR@vyOo(pVxx&cn zx<~u;*cM!jQi!*sv4iXz|2xtQm?#LGe*LE>^Jo^0hQj1ElHmB0G`Smd#E=3RPV9L|cTOF#sRgT*RR zLvZOr6(~iBvSpWl#&&V=E>Q$j!6H(u6^H{#7-0Xgv9UF5!*m`Ab~DJ*f9~QGKyed( zde%i52`C1952Bhl9q;_Qo)nLe3=&T!dXsaqehix)=OV(0dOY{D6_R*1fo~f#tS)(| zH{B!GA}om8&rMW3BvsrW_S}$N_|t3@&y^x0X%sA(Ziz@NNDnNu~YIN z?ZL_l*e%KkDJ*#C9xeKsFI&q0mdqtBh!plNy#-LHwFU+2dDm}+(-{9|^!-ySYP2w+ zA<^X<17UU+CrUU0AXA6lGJ|RTye$F0xd~B0!T{V*UyhfeW*ng6&zG)~U(aJ?ulOJI zlD@`GcAE9h0=ZSsgPP9o4^a76PJa2Zm&Bdwar$DhWjw$~rR><)tA-qvS>` z_%>(~W|iTv=ZIkM)i2OQTueg8z_eipM~o$3W+ks-Y8{T@bsazhSNDY6gwqg1D#OzP z=>2Ogi|sflD5$MhIwG|Z1KoZDu@-F8&- z$V(6$q_`K+qveUSa98YSyqZA3z#DPqr^{g?e<^Oa?5~Tik(^7UqsZbusY7|)W(CeD zf^0ne`XUuLDz21rAPh1iFXkAryem&&9p;)kmInm%{;Jkh>=JQ*Ld>#_vmO5r?3y!@ zR7;J8BwLE+4{4etnkgiRQ4h^S@>@Lj!S-{)o+D$EL1Xvh#XdfBb(CL;dCJf^Ji@$0 zw6wRs&Aj<^f#GIb0s*qUj?sP%@Ei4j&)*I2jr%Ds$S~mV_tGJMIE`F7$oNO-0JO|1 zOJqps61YN}QuUJ6aNnd{wfmlFqGLdN!U(MzH+YXsDP>cq!K#scMTlkJt zwPgLx;g9iMT76nG(y<`c7znvMBu61;yXV?85v+})id@f;x6co*?Koi z=`x8uzVxt>ZM;Iz^U+vr6P7$`AU%wt>XxJi+v-Does)HgptT;A*zaZk(>5>8n+?L* z#5Gm zdnV{Vb&|V5r5+uZmzz>v$4u=bg{`0!sPP+v3KW#4xAWS=bE^N-cMG0}Zs#|cP)AX$Hp>+MMi!?4Jq z2)zW!w7Pomg#NXlkqFKSruL<(x}D9k=OPg}QJ(}4nqkBLTH!U7>B?*b(BcgDMy+;W zK8vzf$U+b|h{~!i$z|=|^_~C7MT>0EgSj^-5IVxeQ%D#N$sO*(ot^XD(z0e^r?eWU zrWz!#GyXG3;xBT}oPr*HY&d&W4U?$a^ZsQmTrWGxiVPa66M~`Q(H-HG!bwc|_X}^V zRqMiO?vHNfB_YdV+#^sXlPQ{WQR3Ga;%aheaUo5VBF8i_)<#r7f3s`{eOsOFY zB{y~UvOmh2x87>hQgh|eiEs&avQ|H%f0D`DQelN+xabt{elXS~-)}xe{{2aB~ud6~C-o#R`CTN12H{_jYMeq&YB@tvsZZC$%%c#qP zz6fgKY5#UCh}7MdL3IO zNQnc=CnPjDtU&X6!@=?UEkJ2C|Fl~L{Q)ZE`6`ku;bgA<)sO|n_--ln&fej$8&Z}4 zl4Ambp$uD7$!>|3NQj;+a@di)%N-)epDBz7mXGBjg)nP~!AHQ@+%v`hwqD<4*JX^@ z=6a_!FDfJ6(p2qCP)W-`PFd<~J#gG{&z`m>w|b%2WIu|!GJy5cqNI!%Nb6Ti! z#0r6q3Rt7LFj2l#2+C*X*Ur_^G8qa=GsIBf_l+ zF#p(q2Za9$F&l<5EBr~1RE0Xy2x2{%OQFJLl6yx2f_do5S1LTaAu-pDYkV0>bkkT0 zc#E~MEg4Jvs!*qKyLmj{a!SQpCyjt={@PN5TU0c}fgmVSBD-U2 z=eqkA`@8(E9h>H(Gl!_0IjjV)T&1r6CQyd133;rFA?7d6mtom!p()<2kne%lhk<)X8kCWv4+uA>Q27H0SZ1raa>o3LrHsv|M$zQwy-!N> z^4l(416UWM%UF`Anko`89@dlkvlk7 z%jldepV80K^`JrdXtj42$C1fv=iAP13$p`s~$fG`zz+c$j29zhZAoF?oR}k zcudcS%WdA}Nym1obqv}1giDj`3IiS0&Uk^7;zdH+!rv!^U`>s_`g+qg>68Low@2#o z*0`=AWJT535>K8a*tAIxVLfqXNe;+;0rs1ss8|Ej4&vo%TXugp!#~q?qAfh8QwsoFj@{Wn`S2Z(FtiNs#R!7#~=IVOsZl>)1jcr>2n%C<@ui!)FLQ$W5dqEW5d$WOBOm|ku#-MlNH8N30+n_0|hl`o>cvd~%k9t$~iYAj4bS2aAd#9U>OHqD5 z0H4+$@KEE5ehO)?P806liX~HB0$ZanU)%9ALUTPdwxo!0Fz+rY+iwWd38XTOMyW3j znVbD*C)czBZu=zNczvE2kBOQ3NBcdCyeSQ&#XS@E5GpM~Cnq4J%@7iv6BTfX_1>cE zh_gqCtYe$H%kdqttW3?XdeThY&Jl+M1hT~9TB})_ONVJ{G1ZZMPY5;yG zP8#jpD=CTJu)z1bWtzwhE$`rsp&=^^&>W(~{3k)AvRk{S@<5Lmo?2B?qf9awr zuIJmyzf2D2?hGD$YbI>uoj`5LBQFbRz7^ZP;j85M|;gRBJd9r&YJ@>a)Bzc@AT`Za6E-_W=Mo1njL7#+1bb0_q zM~F(+#py-9w9*(C*ivnnwY_GQTDnZ&MS!p4$mB(8*v?BeLz=Av0k>GMM)c6UveZ?D zDd$JvAMbJ8t}wfo!T~^|UZjo+wxd#jHLJ_ZVj(f1n1M?+(p)QskvB@Q1myH1H+Yz9 zJ?KjaYV{E&>(j)rg}HmW>gqX;OP?)^xs#EQN0yy$q7;=zL&k8WdPcJm~1737RObS@H@*j+sS^a zsvAq%FJ}iD%V2_4NZy36gdL5+pO%UHlAZ@G!D#=+P@_LbVNxxA2X8KC!0Za~%7(u` zg>#tAxuc{MzuwXS{!2Cs)rI=L3|cw-oW$Y(vCe(n4t*yrY$9=M z+@|)QK<54>$b`x5X)Y#9P^ zdoVQsnEQ~CbIfW&>fZH+qNnGx`=Y8}!Jv_16?A8&v7Lv10!pmjsGOIRNr}h{tBMzO zCE^h0;pnE;mD6Freuq8OMuOv=TNd#&WBpO7qwFJBSRfzMo5sk_pRs72ECL|k^2L%X zTE05(qfA;;a4BPv*4Wmk%1r_*J?EUErnU&rf`#`nncadep={&H#+7iC;5wE0R(dVC z4HZ(e|8eVA8gGTeJ~jx?^<{rVK%b00hePksFyg*L9Ua53hge7*3E~@PRM=lcB)SR|)A5xfB8z%@i-J_h~kTI-3oLnwdL-d@Zl@8U0{&If-xWEoScWgz= z`WN)&`EI>yMH=Py*^PYT_f7|f+IX~-+*GJ|YpZYJJNj-e(fQ_l(PPxRogg0H=Iy+T z+Ot@T2F&{Se}D0~-7TEWf6<@*i1x9FdI`xMq|mwaf~V3?tAEu)lnJBKLcuw%J!0QED1l{GP+P?7*p1^RE+i}j9&<+E#C9(@J|7FAHMM39#hNM7B|VrkLo$j4dt|h zZn`eouFOV?B5f|IRz+(xBX#Js@~I*UA_U)zy#(O(nC625?%meaJmWM4dfb7)XmQ#O zmld%2Dzm_`iwl1Z4R@f3r&?QBH*0|>K_jjS&O za0JA5_BE9s@ffC@eBll0qy&$2rZ{#7TX_*?-g#)`T=!z~uH7>K`Ul>uo!)4$xY{@V zhS-i{pV)=J(*9KsGQM|<$a7bVFWGZ=e(Iab zEHNzZ17`R|^!4e-Jj69>LX~|CY8Q?!Rpev}-~H1;FW~q5&vG%NTMlo)buL8hENidc zKh~lZePVY7Aid%4?EIEeSd4go%KVnu{~dJXl$#hg`o{tk>$7j=QyY#ea6`6sT;wqU zNv*b;^f~m$pe0L=b+Ge(xJio;!JJ!s?8M4)@>V8Vsv{3)DVf8jX558}`bDc1br7CD z+`J%y^5H-zLCJ!|@>+YS4oaPCd^An>5EN~)A?oMfg1trnWmB;BKF`fk&rJY&QhSGhg)(tM|uTOLwp%qx<$@kVn=WlfFIw|^@?vtrQhw` z#Y@BNpwsKIhoy(lu@pnMHtq;`*bXn_!>+zzjPuk>;5c!0oLbcIKJ>LG3&Ilz z0vmHR;~RftObk6GrT(%mE&EDWwVkKcHF$NErMV(-c7PyL-ixQt2fTkDWu6peN9RfK zdohZ{mqabcrSn76RZQ1Q<33i(ao!TV_>JQ+ zIxgqMMh{J2B@ScDO3bZWvzUYeHT}t^@ zd`#pru->rN&Han{Q$GhS{=_5jwz2ItP_@5v6T&7Clou}D!H4y%Qd2&|&i4Q^jb~^5 z*{Su4H|+ADq);HNhh#+X-$&d{4%-I$U?4dhEjT7K^(Yf$i?2>O*~LMU9i~ZlS_R@=YbmJ& zuIP>tpU7gx2qSB;m`kyidlBpEdY{-$sy^*h$8Frc!LmB_7&0}!J~+C+o`Q^o-IN?1 ztibE9$Gob!obDR^QVBnp%F=w0!omPwZzL80z=^q!Ya@}IMA2VN#@n#cxo^ykA+DOP?5h)Si0{M z)_{k637w)p*HHHwS)>;hFo-R%+gv57x_@!_Cp7g?D|$X{)PHxQ!@r95J2nVL8r1zO zlEd%uqcX345c*rES4Yhuu2qj8;6;DT#48lRg7hlF|C^^GK6M^JO!FATz@rtw#7!;z+iz%z2U$$svt-GTy#P>wvG-*PBbp>=PupS ztTeSb!s2hmx>l|7&s<)b@R5xVRKvjeX%;ZZQt44cwuK+$SS1r7fi5MkivCm-2VnNs zlrlsvezF-WR+9t0!u>XVJiOjWP9$iJf2M~2^WP#>lxxor=_U*IZqW z==*!33{|N+R6@14L|fd+Up6uhW3pqw!bv6!OB|nYdbjOCpg*qp_(2J-4Ki5MU?z zNUJ7i>$wzgaZ0(~O~6lRCjQz;SlXU2(QR-ff7&a>xQJt4o#6H z=021%pfiO|)$M`8z%t3fneLI_kVoFd*CNi9Y_0_wTDq`@n!hpmt<0B6ZU4Cq?KeHTFv9q*E1qjyotA$ zoS-8z&|jp_5!JXf!H&orEpx9(sup{t>%#(R`Ft{C-{`$7V&2i;n8MV@nWVpBjP3(g z^VyWjK~dfSOUrE`^KIF%k14bN zntwk@)iO0XYgo>5ZfTL+I1_mZ2HZnE)`AZL1N~=}U~&Cm2|@wERw5?9HDXf@=!aO0 z)j8C_-VpBLaur1NWh6lyUfqUU-}K7*?UKVK!UUMXs zDL~o+?sx3FVt8eWKyl3UcVLEOuA;$yU$-rcRy^j7+lU3=HP?CfS9vj^On8w3+Uo7b zBNq#GjdyJ`;s z)m2|p@e-OZ(RAi) z%cGwYUl2MJEV<-zHuy9*6Z7&|KEh*b+}oqPPXiAi{7)OYe%R@fN(;Qoy*n$N_v-Nc zo*)7*Y!``}RP~++x;vlFyQyzXKe6+*I%{|+(p<*VdyPwOdZ#kaxB(Y*MY4LpmXQ|& z$NSqK+yCuybgG8(V5|dY-mMZXXU(q5!iVN2^IQaw zeuzvMUkYl%uU}V$2)w_o@KbJ|(FY~r3pfmXJKdsuENH6vFgDg7gnTYNl`nKb+M6CS zFEem1Hg_wfA2dIW6tI>L-fj8uMp%7aej|)LH1glzAzFeJ9wRIhU8pLEWsRuDzKevI z=tDGCE-sop{*}>m1_80EX&r!5mY;WW53N#kBbqnjC98aB1pgeh z?Bwc1w}0b0QW-Z`yv>8$=N+*zU%hKO?zo)&@@h^{#aHBl$|1pnW}u|0{}z1lvL8suVhY?QO#y4Sl}&%XswaxI z9h3-vM;Kxbfy1&w@y~$Mz{ovaKD@zJdgs;_%ASw;qT+GO+Gmayi#JDEvmyJT91`(L zfS$ixGSoK(fbF?&$tM$_A9b3iKP%-U9BZ$Z(j^tkM`y)={Zjo@$;K2G6h^|6>-eFg z4}@0TfkFy(V1fF3wFk54-@1|3KyE|&alX3!|FK%ykiC!?R*UoxKo)VeFWx;O44Lnf zOZ#P*^UPkf-kgk7+^}8q`X!BSGHo!+b+6nmt?1xd8d{%QYiOyPdZnWW2jAtuvfQsj zSlGrXa*<(2!@_gc^o#;|UJux+S^BJk&)wmFY@lX0BKn-@)PqRSjrlps`WzbeVVaJd zcqR2-=U3cCRc(iutf63;kl>m&lPgJu?XU%z^E5Y-1^1bhjMPNTWc1|j?QvjW0vSm( z$qMi{FLgz!^awOOeKISTmArm7J=b^8t!*BT5k1eb>DO#~`cGhRlwlG7ZEf*_KWn)- zEjEe9Ng>e6JglfNabxkOKg;Pmb7|RaHN&?a7Khl|wMgb=L)fdU&18qXrm`oYwI_m) z0vm#E0+Icy_ce^ z5123$k#kgQ&|6IjE_srmSY?LQzjQOjZn`?juc%q zM}_V@w+B#BHAGeKJ2WdJ#^xX+x(Yk}nL|h>)h)YK$Uez)N43}ZaEaW(!vALhJOS8M z&N(nU=6-Vd9+dZBUhw$b_gG0Eeup`5cn!GqyG_RtAg2iPT&1n{pY3ZyEzje?ZdKXU z=>uEQVhktoSorESwoBb|jCA2nqU%VThJ365+=J@Qvg_^QbdT}CE&A3-=N}%gch0Ea zl+pPsu2ioW2h5JQrZf4-puGZp%km|>*Vk%?a>T#g2(8@ci5T|=yu3X}Pmvw#W4e$2 z5`$La{+u2aucY3I&50GW4u`ph9%aW09CV<+6)$;`|MtXtndrt*2af@e0T@(0)vVQ2 z!$lr{sYwc_7Eqm|)fp^1kKtUfwn`fD99!~4G^l?X5;jrKq6{5)8tD5rHOms<%t>Ln zk=6I~-~FVn_rcviTs1za@Z9qZJb{SEh8Kgs(!hfxCksCf769dg&I(U1X(O;KD65$~ zSYlVr{t6OWg=wiru;ahD`i!t_cNKoG_m_3N*tl@>{ay!*(ftX&SU*v$ZokmsF#{xs zsb5h+BceR1k8PHPjh~HYNuGX{ej}}MKyoqcsbX73(aD(QBeBWZDiW^C$VdRw41X@| zi_};zTDG`ax3aIQIGwjpWGk!Hv9XE_cV;&^_SfGhu>7%+o3SO( zF*id2VhRkfdG~AV{(5k$@E-$9jh%|B)^eYCd*TQe_(v4P_>3xdWD({RI(DgHXmHj; zj7$`;Rq>)EZ>MeBJBO#G+EwlUQ4G<+l&M3rfePY|HH|n10PU*IHH>oX-V`<|YU0Uu z9uB6Vvn4`aqWj7Jj{c)xv5Hf_D#>C|nhviBR9(sI6p1|1stFG6vW$FgE1&dLg?60w zwG}@kwTQ0eMo>>5uOtQWhG_6Jmx!p@F$)0L~1EYYaE}2czd3*59l;UlgiU-G;{x69Q93BlUWmIRbHgi3jnaH z`K$)x@)OlVfv#LBmr>?V!QB-k+>wG6e=jF*ha)_5i+)wQxLKuJWvu+sz!ErW?G^JF z5qJJUO-;qrw$bm!)t@hU9&#>==vT!=2uc$D(ZXCXiZ7QT?5?l9vi|JFpZCh~DcHCk z-R~lFGq~PX*%C8N!d^&6S$2o~H7_!s5DLib(heA6T$bzS%H<`oe27crtR>ba%JyG? z`w9A`*MOZ+k<*v!Tb6Kg~XlLuva~{r==Y ze)qw6n!*O7!4(1E1M-o7|7C_)-49uMtX7h7c6YHc!3R9B$Q|;;l0@}7nvLI2d(VC{JEzo|3ed~Hv7J%$!>>`Fb`3Mfn9Z<=w zf0aL&Ju6h`3bA64#9v&UMtAJAr$SH_m<>q&IMkY?=ve z77WcRf+$J~AXEBC)~E%LJU(Gys{&P$L?HHTTvEcMu+O1DN< zv8f@+S)Oxz@qd}9qMo{(bd4p7V z)SC}mVxiJ_qiK%Qy?oEfAg~i6I(0X$Av2sal z=PgVDxv%Z{TQja1Yf2~6?}Zshts_-S3pRPiQY0S_wv}YAwq1HCaMbbjhnf3wpC26r zatKfYm8%`?fKOG^yxRpyv=h}LEW+NaCx>w1FQyTMIX0y)$*; z>Tre*rpBvZ2!;pQF~e25{o|IcxhZ`Adi2c>y|YO{Ug^p}v-Q{EiR6nH7Ff=&@ZanN zB(cJ`0j9h%lg5rq^~N;Px%`{CN@AJA(|s=%9u2(6f{Aq7q?nogbJJ8PCgKV7iy0nb zwd{R2GTebGBFf)6h1>iL&SRaVbuwJG7_nz~>cqn+K%eYsR6}7N2hN$8p2mTdiihhm@XJvB5DEiFz0@$jeIyV-Z8uX zdp*k+x(%7sH}Ww%gQq#25lB7-^gHowJ;}Q>BNmWjSVS^dm{|tlVTf@l9`J9i6b`-x zA`;Px2`(MXQi`vf^=?DZMd3Tlrnei53H8Q2KPKZf(|^f8tR@mROZ@?WhOEkwMP2;{ za{Zw3U0x_3vz#XQzjubKv?n-VZkoY1%)`5NW*Q;AL%$f_n=xQWo^Y@OWs9)TPh?ws zp&+qk{=ToxHcJu)ts5ozLHQNY+C&4fJHe zjx`hJ44!#fwbN-;4%f^fd*W;3+)qF8J`2EgkR;t{yR&6@y&1r7p0nc9qR&c+vmYWj z6ta`*e3VfotD1?cG~%laG896FAZs>Ih_grYU8bUpP`q$!k}m~mwzo4C1n6iM`;?7Y zKh}Ev6>nC043&E>sqUJZGIuzKa*8OE+p>c|OaUK|qo+|+bGUDBjY_V*qgk z%i%HLnKwQ2=<8h|bxK%o0`r7M+ag|f4JUc5Ii}r@>8>UcveDqTszL4-tjHU%P7aN0 zJ7dPA)bd+tDHt}zwVjOUnnP343&QV;;~GTeYHc=3QIOZPwJFXMm!TbtH;uw3ftT5* ztzhGut)n9^zTE51jw-0gN-b=oiE3klZ|mb|n+N1(JfZd9j&{Z_#Vge?uUn<_ZnV0M z+3%iUR)&Mwy%3a7)&59o^6eFhqws~nnm#_O3sTVd>Fv3|?RcYUYnazA79bg5O}nwl z$7DhS1}WIIaxcj<(FX1%QfKgSh~(}^Vsd?Ky>5a2Bx)1cei|kU(5qd^szr@vSDr%8 zP&UQ+3A^3bi!8tb0nVI&ifRMid~{h}Ymt<7`F#>SN}@OGGWJG>0w}1pxd4u>J^Av+ z0s~mRf;GZ|puBY&{`CUAFP9(fs!A6`o~$?h>zaA>c~zIWY!VVIM^LDtfeku2}tnUF$6{$fYeZ~}NwF5VvnK)nh!EZh*n2IpbgChm+DOo6nAgxi$)Z8K67QP@RvMZ#~sSOp> zkxrFR9ml;Dze^XJA)!jU;6DF?mQw6#l`IM&7~{gxirma>!s<(UW~Cww#-XrzDEz~% zvblfa?pQEi>*ZW#$e`Z;hZ5RDnfRFIZ>LHazH2G9$MS;+VL1ssOz~ih!Y8el4ok7< zr{IU}sm^~kTGa*-TJdQY$QN+XeHeNmPieWr?Mp89r`Qizyc8SMAF*>|um$V?mb%0` zl%t{6{75c}PdUVX+I;u#*NatQ5;pv|tM#Noo54!{`NjI5c9z_$9WjGdtF|lb-{VAf z{nypDB)I%z1BDrOy>CzhkU~PR3x28WE6!e#mE%-9G5oF+=kj{m1pMS;=jjIYQ0Kh_ z*BI2BB!+k;A1U@r@3X+d#ZKPN&tqDwPUM!;>8RgCIaEmZs^>S{NrFeHtEK) z6&`;#^X5~d`Junz_(g}>{6jzay7xK{(fp&u8P$m98}3vhxCi?hOOibNP| zy|9IU!*WaCaCtoZ;diko4U#)`EE9&4ao6B$2IX@k;y(RV)wC2~s3X&djn9t0`_r_? zl}%Rdw9?yMV^Pt+Xn8}-XX7T1Q1+7O=eqJe1Jhfvq=Mrl)7B&o;_33!9P&=896P_1 zur!L6kw&(4&`+@MY!q;8Qp|aJe6&}5uudwhQKj`XS)hz-&#MpJl z<#GXz?JvLT+-M)@-VQ0WL$w&{u?j+6Bh#WqXy#WL!zA6o(xO$={EiY_0qbh#bOBk! zM%trptbN*nhuN4?J|o$lQiE-zDpFO{I1s*><#2y3y7&4&6~oQ)cuO^SQ8{bJUa2jc zQ4y%-rsG#-tc_Ll_Cmh zzM}-r=^P@KH{6}xgr)@$hH|X)hn`~he{nOTzFNBN#Vq28|P$I zVFUT;NEDRCLs{aX&qc7l1~h=XHd;@Pa^QHsVBWINbIUs$7B-=!XyWtD;%}Bi096Q# z!mk{zYrML-4_PprIn8{_MWMcMU%MbQ%XtO)7J>8=hR|hB^|)6Apc5h~BiX>KaBh_o zb@*r3*TzMa5Zetpzm3V6>zRi3^y;&r`O}aHt0mvXzQ5HL-_Gk@RMS`vv*9N|{Z{y~ zGqGcu7&!ax;QjhpY38UKRAlRm(%sbAyoZ<-T}cid9(A}-DYZYq;eX>a4Uy&4jOp_E z9OLcf8wA>Ljb3)S#9^h^0r4{9C}?ioi2iue1&E1YI=pU-!*2)cA*2c24#~+o#1eiw z_ok_ci_tu@Mns7`YPm-|`^X~%mPUAm;bm7?Xf(NQ9k@2KoB~iN3Pkh=8KZ@pA0G|U zKgXMRKXI)k7#(Yv)3QKm&Zh5Lgf3OZ*4ALyFlh!4j|!Gds7-XOm`7ebX05 z-8HS<6^NnS7TRamvtAW!6|(g zJtmR~Yf3jMa?(A(CT{^6lZ>y9hR3>8tLF6(YlM^|Hs1aLfC%W!Q!4f(lC`7K&2T`B zAs$%$srtf7i2XleG8DyJ31RMo-UEcfu=-6$G@%ga!}iO|?P%Y)fM%X8d(?Ms^dd!| zWC$x_aALi`uJ{JCV!DFZFY4HRVnCT}>ev<*$+VmGig4sdWz*$w;~Y{GQ-5b=SXMbm zUHuuqgL?7efZWtMhwA*>oo8wZDLuJqtS|r3^{L%Mgke+Egci|!=s(p$CZXz56ld$COsBV8BTAma@5 z_g?})K6h*9shkrLysM%r90dgWi4H2nF6|Di^_6S>7C__QNd!oV(6qk=xb+sFVg;I4 z#l`5@!Y8Fp@%A>CN+>u?7F}Ds{4sB)#`{FKJc@!*UzTw{2QK@19`BnP-Z%bge`SF} zoOL6J4|=slnC?_Fabl<5X{!stUi~j{l!oIN=ybf(+Vu$?_Nm2`o&|SWb$_u@-WNn+ zRPi$I#|Kx9+q>&y({VvplV8Tip7ZwbVekKTH=j5q>l1bVlUCXr)!wELl$|<1gBWi| zFohGO=lxKNRvkj5ZEG(>m2Xe-Pm9Qa$gU&(aUb2K?J=x1!NX88iL#gGn!2B{8QME! zSh>%gN2WT!bn{`Hd=|@7#VQA~=*)Zxuf5e!vZEunmFxFg32%;Lzmb$v$`J%3(nbX- zfuGvY0$aP|D%oA$J2~@*wF6A&u!2p)>9ofb#aX+?p9Ic$Bwo9n9y$m5=I}0j+5f1r z^X_#~&eMzm``xKI&U2c%spWYaS{Lq~DZ3vgee% z|GFh~6kH`b-ll)IOqS*9nw%G_aes&N3s8!0EXv%uX%v_5Cg3@A{&o{EDKUnrQ`^y{ zaL|#-2jg!oeSl@p2znaTwadWC7&fje-4>h#DYdqOI7N1ej7^UdYFlqk-esV9cZbK< z7ZoMC8!A5#3A?|c+v+=+r)Ps9WxUM{twH2hnCYiq{k>~{aJ2t}mOzAH$Uw$#*juwi%kO;EllCEw|W^@eTZ_{nP0111Y~6ko^?>IlI&_E=hV2bGou+g>n8IbVZ>n?0>n?&h{{A!v+cd3N zY9&c)x%aazUrIT>Ym*UZH_w4Hej@sz;Id;nPHR<*Q*I|ckJiB4TRzb*D2(qa*`E?hvi6)!a z*`2_GxT(Accn+ja>iJLKtRb=T4;{JZUlW=EHDmf%76k-@SPUt+Nst|)<_4Wi*=-*` z<7P&AzqcYA(!bnJnK!eDk{$%^ylzRpNFV169V4WtgP0CV2v!b@)XGyBgp-Q4zU7y` zx$mCI8Tf48(}$T)al0$Ge5pKmNXi|g_53ANC%7^03W38aUEGLy*Y=Gm_fwt&pTLI) zNempilZ6w+<#mN?-zR`z`Lbp(o>1xY1c>w7yC}>-m--vh4jGToOIy!q0mP$1)e%|~ zMx~SnI*qftsFAQ(u(m^c z&lT)ERk`iG|G6gDnWlWsole5k+~peI8DIz#s(bgV9xqh+y3nm5oEr0`Sl@J&=%s`r zXiej9bBWdVjEi9a*4R%{o&VI@*Xz40Xe&!-6`?w&g&FLppJErx3^4P9Rp!qdt~*+J zGam}Um@rh3PN#|a!m88ZT(V!zMjmUmWY~XGhy86>dhSTyZm6}0EM%KlzvqgEEaeBJ zWZ`o!KZxJ|{348SX_wV-!zp5|cnLA6Cyd&SHND4l*1tvTnLqv823Dp%-boNSTaaau zRA{(6IV@62#*%oAkQ8<3xQ!#y7@`Epxns96fMc+v`G8F&5B)@r6xjlJ;_zWe#H0i zQF_Tfv~ajyO|of0*uXfaD$~+9L0d{sD16-{A06ij9^=-Y=e0@|d*bVJR#i66H3KX7 z8_CjI?1}fF%@k{1JALPbh#h`sy+&kK+Af3LFRKshO-6o$C%w)ZG_J*m@M%jQZk*ri zEI-UeldeU%0|E!=3Aw#&l?Gg)Bh#BL-fzSbegi4Pt%@yvB5UaQY8Pbt8NpaR?V$pon z&8e91s>Nule$Y0Z59Ti9UU&;!qedx=wP%%72 z=3{omrNL*Ywr4PWSO4utZJL;aKJBNB!Uy#{oq;A#wIse#w)CfjMt##%p&jRx1MEK^ z_-KD|>}ez(;YQZl@2P3HrRe!evXfcY2L?_^?A|VIOrJe0#U8qXFN}zJ1(e^B1s9?+ zJc^feIeri0S5P^gM*%Cx^?W(Qmp)#I%^T3Th^jbLP=DDJybK9*VO0->N=H@`X#jaw ztpD?|xkQi~8Kps)|qRe5HefjK}v^R;qQUTi& zgM7nejxHDHsyu`57|Q^(MC>b7z?jX3TI({-kVw+RD?Ei>>Z{Zt=g0FlJGEu{=uOV7 zXL;d1DUX62thS=;90PC;!$bSJ<^Eo?y>eTuY9JIuY$1h?Q8=e0+A$lNsGo6jXt&;HW(rM1$o02-iHX5!xbg01g-uj}Oo;HA1 z)Ij4U3eu zz^G@F&a)+^BlWG_YBqZ#r^1!(ewO$8^*UzPJ!1MOEwUZIfEB4oO9VIq2hgDyv)OUz z=RPoCz2vW2?YX>#S7eFMp3}~mkAE$CiI*`M`KREsOw{=XaDAQzCvzOsaGbJF|M_mo zc-F7{3qon!-5g^!%q`UOOR;dr;TCXCdmPnjmf;|E3k?%(S9~6+6jSaa7t3RUJF@ub z>D6X)VJ(&SVURkY*N>XNUjA>T{j)^uCND|BIbrlmxM-5qp>EX&pJ1QExC87s^dU5r z!Y5h5s)+}KSY@0XxZH}B4n|?x=#Qg-*jZ>IP8FHKFj1uPAgyN%`}1+GQpfXkRn^Wb z;omIX!w2TbtxJRmj!CIRoN5@guREpH$Xib$ioqB&k*l<|e~w$z)B#xC)bm%p@?5(a z2H^cSJX0s?`&=d%(jX^J8wsljBCe>hHoN`45BT>kLZdzR_>~agDCkkhH0wN6bX6JG z(z!dT26`)z?)K95d@#L+!nZak&PJIc_S;vy^HKT3-HqwSIjC`Cu5?mnP$xJ~Fn)`K z>j*q(AtlmU?>SRpaOcK)YMmoREf9SHZ#IrSX>1-MaoI{jPP9Fd2qNK`iJ+kBjUXbM zZ5Pgg8{1pS;+g8%;=jMGEWl&%iZ+OtHYn`J?bJ?IG5K$)7EQV%hPZN~Ng*A&sQ@R$ zjFIc|@wk1C)tk3*+o)(wj~LQ8X6zCqLf!hf0XK5%idW(FJp!zPgWtRcUqctfV??em znXpu+5<3PpL#{PqJ|9odzQXl{>7|{C4$?%e6M;&|I1{@xvT7_<4Bh?Ge*HP+9A{fD zgfkF>XJm`K<+VGExnN?*NObt0A!KCq9J6Wuo+(cFO|1v&*Nk8x0E2|Ocz_HOB-!`Z ztwAq?-)PwLg?@Y(?DKuVNHsJ;QJ~~g6{&%@1NWwfbPI~#!&R1L2mS2q$cEU0zu5n< zglgyXO^HgMw|pMvvh;~L8LNd#x*eS>-d{b|MbQjhYP~nSd}?_7x7PgiH)hn(L@w78 zdGMpnDApGTk=s=#E8zvi?<~T*ZMLGQL;^FNSRQ@+ro$n?A;bpW!e94lfDrkNI+3^FMPf_5L^5edrv(6{ zXl5B5=nduY9~K&N<<~w5gM4NW#?(*)0qIFR#49 z7O>ua?{0*$&IH(}{RQYS(K3nh{WADlCu)_pO9=a#**IW?E{K|~Wy$ukZd2U%YM*_k z>awFm8Y)*5JKxE^DJ%k06#k?%Tm<_F=h?C!XW-gP#j4`iT$*RCEzloA`#yM1q6EV? zYN>)TOwD45*KHCky-@kW^FF6T%!d!jW^OV!p`9saErg)PufTk{=DU$9>M*xa8s92i zV`E=tE1!mPk-Zx6%iFj|{q;N*OOOOy$vC!A(tIJWEb}n2<{U0vk zzOXviHx~&r-H@Rs8etKtzB^kOeEUaM#}WWR{3A~=#3`O@zeMArbwFpP0~)L`dsj7t zjQM`kH+xOl(`MB?u3zz4SpAhLG1w6#wyJW^H8O!LSo7&?otG9C?#89Ltep-CSrIw=HLIhM=o^sOH1zO5WK`(dL^QuOXpi7vz8Cy@v5HVKg3C1GeaKKMU!yh@>wBT-(*?fp6Kyg;Q$07S z&xA0a>DnmZWfQ-ko4!W0}^yCu^&Z4G&jyCJdtQ0q-QL zDwasG==i$}Sm+4hVnWbB&Hz&Y!__O}gr1Ab&vf1uB2g!R>MHj=#!pHmb5f>`h8zRU z7PE#w-s81GJ)4iEHPnLeAqr|@(_yo* ziD`82V|)K4Gllc`W8>eCN1+^%nuK(kU0U|aPO?>Nf0&apA*cFj-jtaRNKzLd{0W-) z2Wg?q6dfZslVNvGSToUBDYET6+7}q%;@|V=m7vwSEUvz1$xC#RDhNuKb)-9zq^?iq#hI+{c~r2VX-2{BJ3RoqQr~#9bZ5yF zI<}~>gYj2Nip(lkbe8(?rx4~**aB)x)K!#Q(|T(=6@iB|mFyI1rhI*|P%Sl z7Re+~k-0r5OZ0laX*yCrTAid6$a=(QPSpBR!nC_b#oWv2q}A1cyo9JSfTu_M1S+|S zhF_Us#5NReGuGvr#&s0{s+*Gf?sW#l5Lt-Po{6T_)21*t4dWJkwp(u+=ex>k035%VQ|Dq9U#gE;LV_UQB31lDW1!q;Q>DjwGIM|r9 zMi9*btR5`0|5nA1F9&%$Yd-l*{$am2`Smmt>-(Kp$>H4lK=3*$Og+JdR86X^Oz45$ z6cBc4jK+1}7~%;3QC#@t+b0hI*wJ#B>gJb?YIy8#3>i_U1<9nccpSf9kxV0tYfniB-C!ol$x)^zRqrVMKQm=TLpUv zsxW>ChardB5z4m@q#mA%CYU(Jk593`+P2amRFEcLo}6Nw>8Pu)rcPGZVre_AJvQ~) z!>=lrlGJ$^!J#VLy5rlealy4Il+M{#GT49l;uu46SDRdOh~a;t-3ZQ{<&(%8fLc z6Z6P<(C>00Fg%2T%7uhzgeOvugg--4p67QKXr%dc^Q*9#mx9NLh-uD}W=0Kty9U2F z<}x0jKirzzSEo2HsB`ld>3oQc8C_`#x*P{-bQI18{Cv+;=Njl@^fhw}>UL18oap7^ zDjIyGYM9yk+0V#=o8ZT38j@5&>fcMQ;Quiy5chp)te9*T#jAmPi?B$M`=fLC0cgXf zLGnIOgB`8Wu=k;l`la0KVnd|JtCy;6NdrT&cHz@jwVt-+#Ip#Di-B{-iq3b(Na-yV zW#en*X&5EJz*L8OZwR}+MPF2W;|FDwy|m^dyIIW%n4h#1eGx&WYs>dq0a70}u5Q~FSdUfZvVN-X+6QkqEB$qnxy=XyX+@d@PRU8P zphh)ZjLNqa6GGnAFC;g-2L!LK}zgE=~x4BEW(y+{m@nS5m=*eI-rVi_Y+0NONU`4 zY>L0?ah|ku)u!`rVL|!W7%z2G>voui8y&TmJmNffrd;>mP@>s9qxrsRs!YpLD3=7> zZma&1yQ{shZHVMH)lrm&eAt=FqC;f=scR)Ah4d`dTIfAzEt&k!FZ$sJAo)?viL1%G zw`=V#6gsuOKP03{^r&MGH#bV&*p< zhpRU!A%D0gg$hLr#(SAReKLsIQ??z-W5c`5EpkGs|4rvvxY|47Idy1Wu8bM!G>YSA zzAM6!?k#Dsms(PubSsYOl5aLSu)6*qF?=cTXd2Z%r|GHMTjJGt917aUUxu)ZM__Jw zVDkXKst{qp*gYfRfL7+lf-A!niq6}I6?4-?E0#MW(_}Z1tBC&+gv8V7UEmM~+JOG+ zQ~lMO4trT`e{sT(@~Po}M5jZ&77ZSgI`w_`^hT4)xID6CDyxr=G~E?_wEHxCG<>yD zBlr?g33PkuZAYEdE`;h!PnlZPY@W(OG6s~6rGeK=fvr+v#8a5Q;wk-vMOh%Y4ZZDU z_?rxvP20!uhAipe5uC3HLO~jj&6q^?qjxz2sBvz{_yhDY(3`8D3S0)F3Cp6e$VNMQ zsbeCrI|*IAlJJZ%KNWSE#8_8Ja&ynp{!CUUGfqKzSP1?uQ~)&y+}KI>EFXyimJmeO zZl&{XzgfUIDs%7IU8KgULaVY`IXAI*P~85|g&?w7oF_3}l2)<3<1oC!a^@43Xsm?- zXsNF|u9vb7Y_1vZKDFjXHy(veGeHI;m$E8fTBwy?9v9#qBG)U)t~+a0=dkp#%e;8R zzR^2N+ha@kemW+t_f1hDguHJsft8`Dp8YrWoIxO~0~q@3b}3JNLfw^5L%jlhzO45c zAMhEKSVG#(=HL_W`LD*N69x+QT3Qq}{e@TR$Cmvwe&I1$>YS#o!wMoiMKX^WJXklt ztMV{yo6C1~Z|j^j>b=j_FZ^!{Sr&`}M=5{tpbdEybN~Iv53+rD>(m%g<^7@Yvd6_$^c7osyz_9m!D7G zzTKe+?(6T>0s(|n!$q-%*sOgSrZ-sNQ=B7uel>a6*3CVk3wg=Bv7Dbg3hylWP~R!F z-FT}@xq*mzH`-6-d(w7AZT|qBOIos}{X8(XDCRf%$%)out6uo;%ziggFL{e@Xb+Mb zRhpiV|Ky`Gcd#Kb~8D|{O_VlH$~f9D7(NMdMZ={0((y*5c-W?6;^i~>;yS*pXnOTCzmcC0#uljTQvPF= z*!`5+azFS&caNi=^WVi`%tR3)%K#3duh8u?l>0;fgFUrC{1n9qhq#ZL-#fjJiL>45 zp2H8a$A6U&<9N2|Y9>JtW#9I#-Npz9FiNOsyVXqs@-~%Sqin_Zwpq~7pDAEw^geTn z7E%($5KBNaAmMD87irurF_TM4EUB=HNOS`^ZDgstzq{4Y_b?SE?3YH)XfW!X&8o7A zK^7teA22aD+p>lx?K0YWWjUe^iFXyQQSMF_??pELPe)4U3a`heR2`CyWM3cgG2a>` z+k3SR4NW*1;$Ec_f&{nRl2W;b0@u;u_qea*gvs`U$_5NxPt4%Qk`ey!$ejuF{{}F# z6FFyZb7>QCEIMaNUu_ZGEKy=HBeng0Sd*(On`Xm#KW-+X+LTp1_OCA>>?BW(Zc#?% zBbQkgU(;UalI}(c$?CV+xo!$_qYdv}TRNz5wOc90brU5ReDCF+eDK>wF$&0h9?<*~ z_zRs(2jV;w-G&Of+1(~~Ij~KUKAS&#=4~S~{)O6VmevFKJ%w)28{nIB1c<2lNe2w$ z)>x7aGn3av>;~>D+s?F`$mZm3m=3g$uG%%+=LHxShNLs>8W0nH&%wn74FkOuEGw$D}?felnwKko|hR*j1cB8(Tj8g60{45A_Bms5|&JYB_aNNH&?xvL0j0vvL z*qkVK$*nUWEN{*}wOn^eHtX5Y=d+I+MW+qYx7nDsD{HswdrW`nAX=kBh#QmRuWv-k zVJq^G1>YQTzGBNO^6v&)K}Z_{ z^B05&;eRUP>-HFkQ9;U)^hw=PQi8#33uC|jg*t+ByPksBWD#)k`z)7$2?`n<^u~UH zm#Ni2xTO#njjlBWFDHkQq9^TErY^3^Ih(iRNMT_GpV{9d^-8D5@tRpc`IzL-j@(Kb zya6&j!@17RipFfyfrAHmfUMl+IQ91PcKt(9TWU?5#MNzX=q`<0ZR3%2G)!Q8^BB^E+*{rK%id>vGlXnMW=>cLMqjZ&*v=G{BQ0Bmn zmFn>s5?rJ6GHJn7_X)`xZaUT0(i+NgTnxZFclpd>D!vBrX0G^F*jULRx89TX_*~zM zIP>cqItAsjmPrH-bkC(N}2n?1Pf*=QSZHr$p7MthgJAYq_p2d!Q-3Ea-naw$+s)LnppM!)wzY z@3#yxgU#$4?oP(|AL9K+*`(8^m-rz813$-f8HSPE#p_O-ly= z<32c#H{kCCy4UMXkmf|Ev|ISt2Q&E&OHh5IvlhWZovrc~8kUZSzCz8ZL+-IYUX~N2 zrOPlqHby^5a_E4ohF(X4<~9a;n+Dk)q!6RDXN-^n#Y@B=b&J`T+FyUd*(eos?>lxV zA;lQ~8GLRimg&0tx33S(kX!o}qs#os%d8fXG0^A@Es}4!nT?()_ECg0{%(0@@TL}i z6vJPwY`ayzJw0#P6K)N&?$W#Vt@KFYXo$OHiDfce0W{@pzIqs#yuSxO$uV2l1r#zcff3r8@>BXk|zNVK7p-R>1aXI2;Jp(!o<|(8r zfomq_hQgmU_p!=QO?>y;jX3Nc&!n%Jabf{hQIjz;NQXI{v*kKbyXP~kLNqZR)I-18 zB~tR8_K&GwVA3^hrH$I0$ znaYD~ydgt4LvDk~iPG&!xP*_4Rj0FnD@0%NYrtO>L-|lXzbypdq3VE*%~BZ)&`ZQ< zp!~rcm`7jL89LNAcD!{SyV9}ZGjhHFm0*9p@mH>s&2(?-6TZ=SsyX?12&w+Ep5w?z z7s=I}zx-CRAF+7KKBx;}H+_^#{w^{5kCuLpx$z=4L=*j^!~J4gKa)}yf@q!ZJ8L#8 zEp3Do)vV|HK6UnlZYc@x^xQ<-dFO#n_84_L zp)&4Qcb5&U&Joq;#O5)!9GZW=lbMrISu?NvBVBJZJq6&ec2a!u)#v`a+8{3kQZ~=Y zq`x>Wu52t|V9g7;3L|?nqwA&XeKF852_8y$?PF1fezwIJ+6xDE16qkZ%M8Iwf8Td@ z7fb;206(J=fZh#hK~oAy&--@Ig}w?`2)2OvKoJ0pKD8NgpKGd9bmPm@SLB&n6|g}q zneu)*We$q>=g;)rtCfiYYCX-USz3O8q~LkI@olD^U(wt6^2047=k7M}2&r@h{UvR0 zWTGFOa6@(0WBy{8sPTS{7XorSys~^5ldZP5nIt=rK%-5!=hU{ujEG>fsg$=*a~Hnr z!LJ-NJ>yHUc^y(v055G`S|9t~GV^Bn_g?H$7Cx-FNpt5Sv^6e__I$F;Xhjy_L4N8wPO1V~l5;>*|(Eh|Bv$B`%8*R!J&*K?r_e6XLhGo=eB;2ErG2VJk|I5Vfk*rPfRi49w zK1%xKdEL))C>8kKh4~dj@=ehkPLU{kx05c0n|}t{tbUL-RxXg6<=kXXe)hH=!qkiN zHF`gpdXr1qfpuJ3boZtVn^W(1#s}%>5pz^({MMJdRX^wSb_O7qckyuDY>N|Duwwz5Q%So}S|*=4Pr!J;0_kG1q{q&RRN@W%O* zF}CkA#NyHAma@gJLLKVCRtc5gj+Qj|;>C5VrsfGU6X2u?t6|uQVaLckbQm?_?MLLu zmj%q|t@WL!W0z`YH4fi7QwhB9zBVmezn;kL32Vd$v!dAX~TZ>e%gQ+qb!Th5$$6a4}m==rd;_6!c7>igvd0hg}1 zxr}%3N0j_#ec)Z4`VONyorjzp9N!*E{>%|xt71H>p_^!rsS+kh=ysowRzP3BqZtwR z4kW$6_DRyWF@i@LJpIVjIh+H4N*)C_?kE4?O+ZE7&ZOn{tVAx7b8F0G9es8F_|WVT z^(;2T(Us@L5b64!dYJWMNAGLO*b@PZnN|XGhUDSNGYruY3_JK=BVJD^YU(1?*JNFe z^t;BEj$Mb#LfbWs>3?$k9-G+kX>V;0XmsNcjkCLy=`|a51|FQTrs#qb>lSf{eTzmR zMfuGzNA;cfeOKqR!L=$hQ55CXGD-DGWt)0ls#2xS-cO-7wzJ1|C#)jJ18QV%`?2h# z;;nVE`3Pzgby4PJ^N6LS0KME1`C>Egesp{H;OHx3qFG?O7>Ra145=-@IZa=)fgu8l zMH#dMQ7mY*2t4UL= zXJKldr$nR@MENngn)j>nA9wR_XjL6I8Vh974$BQ>xaGy<*@^If!O5vi z5VB&X|Cuo0OCo;|*2nLZz-wQqXr2ytFX1-lFAmq@rpD?(i_eAmo4Cy}g6GY$f~ZTa zdsFY+?%kxCipdVA)mHxE{iwb!lJ`eht}I^cPJ+$Z0shD~s<`UT5I|aUu~F+~2qfdh z{)ii*Y>!2$2Q+-#nT+=9tnp0YfT{po!4^fO8DFQ0(GWiGsfFh+*i93fUE;j;551(F z%1u92b8TC$lffAO3N;T4GVS)}_o=AQ{a16`Z$b@}`qGjY8zsnIi4d7RGnKH_HZhTyek-GmaPAhkh{`oiVyV2yd$lx$(8=%MA zs)Ui_df5%q?L5B_Q{FLR83WG7WfGnz9bpT@?NHVtR77MC?n#S^oGI?7`O9xq`h|V4 zRbw#m@3O_JVzb+EZ{1k4(d$hOQ;J)ml~y3NZS&THZ9bV7=&9MUz9-N1^!evO*C#*0 zXgFN$b}1Ht_*|a5JwEp?62!ND#i8JrM>_p6${>xIkLv$f0D_QqCpUzVX9=BU%lUmP zlJJf{DqeA|EZ^Fwn&6z|Az%=WPV)DF99+3f(l9G z$ppysMD))`Gzi_cOlllY8&7Oq0@B3TTHjI5rJ9}QNoYOQV}+9fX>JicFabr-RlJjB z+L11UK_!FEi%a|MP6(Y3ER1723Qxd;eUg|Nh|Z+06D1iI9g!1U8PXXh0-5%7?vtQ; zinG04bAwc}=!^oDPW9PIw#HNyg$sU!$vxho0yLd@G03R(2`V$A6r2qnc;SB(C#qe# zIq`}IG3$#AhEb`>+z#_EJGZ;4if^6YdQTemKzlbwchW_QS?n!!q)Z=jcnSo4b~9qX zgYM_)MAaVUnGY$ROnw0yP!#cvfH{^Z#!S9ElXGiiKgcYihG3dL`REur#-e(ZXNV8d z7xu$d?FZp*d}k3U9q0Pg7$v`#whh)Wh!4ceAc+Q`;B4nJ+rFoo_59tAPBr~@wAEm6 zD&ZitdEbm=d?F7Kw`5g=r$pU3%|rr09xCZ`neN-+#0;6VZNtMO2nDHx3)QGh2$kH6 z(dLlOVPNuI8Zw?QhEOY89|z^D4fgG{D|YJ>0~7RiSP5fQd#S)5Ht=X{JSl>wk@;K> z(c+@()4S;T=ithG%y91wUmz$JWkx_q3qJt{UZW zq)OX|_de6aac&PRSPCb76fb~YVMH9!_&@v^T!v}_dV9op^H$x=#XE@jBPw*^MDQ8R}Yn!u|h z`RbkNFO|?Z4RsAu#CA!w>_^KCCC{<`OY72tdjs1QjBv}U`iC>Bxz#mTb^#Fx*T595 z-@d@2Z>(Z8&9hgoC0nhJ6zI<$_7Pqot^jj9AqUMKh~D0x|5Jh$p{Xt-a3M=eH??4l zCgjCU8SMOB6{4h`FGaS}%rJv!N&1D>+=q2!`ijdXq=k5X+Ng=!XEdxL?%KWxRgObqOzq; z&MYtJV%*I6wqwf2N;TL(J;gQ6g1%V7iucLDP$ngu1|b_ci|~NW&%LlleI8c_C4z+7@V~AUz6KrW67GY= z{lL$6@I3?_vFV~?tj;Psnvuz)@iv@>iO(_1{jBcsGZeR%9ZO>t5sW{J6%8e%PCsSS zm&bIshl0p@Vf58Q=dou`3K%;hzk*Nf0AB`4R{|*$-uMJu#IT4>YJKsXbOPy_DqZe= zRItl!V?r?1j*-{Vd9}V`M#Y4SI%b6M95k3&bF1^;1RKRsef8r^{v7}lPVl|F4OkJa zj&XyAW3F;eHjgg-mx0|Nxz2=DM#C=~7S2L%1FK5Z(Dcf>?bRVrj7l0aJRE6$Q{pDd zXDJSh1O%_ZqNOUb0jsOmF2?T|T~gCzKYwlhoaMQ4W|+kHm5h`d;f zBO3zwpwV%xws7~ARM&HHR-3LpuM!7&b}@sDX>cYDO4M1iJmD@gBqe(G#S9h9(Dnn0 z_e+0IixLPTb0cemvU>wo4zbNX3o>F-8P?BA-HG~qxFEUYb{TR*95x_=Cq8RSoevF` z#XB|QGr=GnGPM~D;iG z9zRMD{ZKUper%f(=<&ZXPMycw8WU(~I$@Tf_s_$R-xw4A?fn;de8|AB9gJ--T(ne{0xGef9}%-3j5rul8r{YhSv@>{ zN}@Yqs@q`+W4uP?E=ZDTbtLfgfB5L_q8Z|c)$d;|cleP&^)10~dSum`#FZwFAz|ll zt`WtX-Tpu}0*ro|)PQ>IW|6}dOqVII^Q%_UPH0F2b2j=*J{@R*&Gzshjac<)M2Bn- z%LkhUO#+1~XXs1rM3b-ljA+S9wCT!!trU0ls3%BD(~J7^DVv3U)w``)ExO|H85uZo zyA<|VY#eSqT`w+$m4>}MlF_wH4)Yql{x$C_1Dim}cLi;C==a3+=r%%UdZ5PF!&Cnf zU73k>U-O4^4JlgSUo*cGaMX+LrT(=y&KX&)RWpIL1I>)18{xIx)rk>0f5VixYTN^D z{gEv8k}m~UO2HzYWeRp`k0sUSIh0ZRe;0Uyc;A>@e2*C9spLC+)k{7w)P!9@6ivI6 zn6RDWG+P;8I7^+d`wiq_m12zgYHE7@VDXtD0?4+v*6N4TrnKZcwm#&=d z>q^zR_R1Rp7xJdTg#I_ZOMpO!=f}6*VI|$h}g?tRKf7Vp<{5 z$?;RgK0|9)sg|)NsYNX-fw}|olXb%GJ--FaQU~kM8tiAPyTaR;!wiu0A5UHfB$Cm!1Ieb3)_w-aV zo+i{n<4{5buk*L!Y#0tCU_384woNERj$CHBO~U*a6o*H%>(EMDBG3Z`(Cr z*XtNSo~^xc4D$0$Q<On=4e0u#DT-k+I%*F*ZC0*g*;Z*aTfj}WUxN5!nANW-n{ zI~kq^=hV|z%n)sc?J|u@NWCdp;og&S^B!oI(sp$=f7uQjT+(y1iDtF&*?l07DA#{h z^PB{pkv`ChUL;bp^rt}n*G^kL%y=s zk;dI8D@eizysGQ%4j_IlixU;$KfpzW>h`nuV&KD{ZEVhl+DPnBk2i|tyA)0^c9(_F z>Cf!pz;E<;f$pOL0fe^Y!Eb(G*&Jl}DB}7q`L$W;HT=vyi<0P#Rx=7rT(Ax#I$=!a zO+C3673o@(^s!bQ@bA%!_?V8of`p>+&iC5*_p|2NdnRQb6_g%c#+pZBCwo4ZWOU_5 zueC@0h1{>1<+U}(xnGq@bsXtEv78Pi?G5!tWaDQ2Ya>3dqXfA2;qsJoeHo&^C~wv2 zXn2?s|15+`Yowzy!=fn)RL0(cJ{Qb&eP>3)njDoK`BH*)JBo5!MlLlFzcn zy(eBvD#$FmrN)U3kcNB8t9M|3(taz@B)cL4J;Ge%nYg?m?P|`xX@q zIWycKNzi#(E9#<=B4D7^D5R%97!n?=14qlxf=#LTvg<+pix^HWd%v6+X$oMUq`7S! zKOPD>Xx1MmLp@yOutgojIdoUugeDeSaCdx8A8CzN>}{UjL&8r+{tP-T$My;vVJ7ql z(yuew*W_Ze_6!Y+ATNI6Kkl83QW*V@>hHvV<>-J#jyuYXcL@;e z7Y+K~&(F7h^Vsz~5`%_X6)y=PP???5F|z)TCu#OOY30Gg6q9;=G$XR{GECoh;{A#7 zA{mX#>k4dy^{nJ4ckF~3uK)67TQ{Ci8tg6(YnvEderVb2{Za50`7=n3*8;IiMBizE z8@S$QwRVww#E={`P0`bzLM`V59+Dq1-nG?$o3krfj#16U7T=NAZH75h8b5;T}*zX zhZR&N{5EqG;RA0^%6)GCHf?V_(bwmp)sBrUx}F75nDs0K^8U$VEXa}cz5bZh7vQi; zF@T4!ZtObj-YN->d3(j`6MM=svD@^-t$j~6mf+UQ@ia|B4`aC({_8b_7G)E&Hw)*48y*3GjkVYZW zU!^tL^{!j8L-y(iHba6wLj@N0G3yjIHlw&;WJcd!qu=Y;&hq8hWJIL$CD=b{X!1xT zgSmrJ*|s&0KBn#op$1VFP!3QR=rKLczeP=^%E9n^pRdKQ$`iye`0JqFJ1qN$zq0<( zS`&R?um=BEbjxw`{vK%%;7?>_5eGptD!1N~ZBuViFzc9Ql0f>9 zMAB88ur{@~ufd?_sG=n`=fJF<;5bPnb&b)cE}}ntN@LyPVn(JUHYoN?l|8dl!ASOQ zR6tz=&0vF9+Oo8J-+Agks|E@Ugd$gb602;k-B*x70jvj;iMRI<)H_$;CBURb>|clM z*P77aA!};QNRiKiW<~Sg10vDyIF$PW8c|}=L~Z!X0>H$&;hf*ViPX?9Nam z2n{`Cdk})YCZb+-<-PZmJ_>D1`dFpDiC@6Ko`Zj`Shp!KcZL71{e&41wLNUP-vM!f zczW$>uW1*EH+<#XS1NV780b2i6uHG*W47ybxUGOZXFrZi`Dxv60u2P)wDaKbW2;sh zi2b8&SevcENhO4!Id@kQwRuhyQC^hfjc{=8C9l&CTVdG%LG7oc6Q8(hUsf zXj%#KHUl3N9_N$mX}rbB2tUGCNE{QGP2XTBEnr}^^|Ipom7?q5`X%C1bv?qVUAtZ+ z{!;1PEgc!af2wgj9ny(HeBGaw+M?yUT2C(-+k~myUwY@HnS(CyuR~ESU|mOHs1suY z%4sGQq5F$wH2|{dl&FwFdeIFNUgL$YTNZ==J;`kJUA3#;R8MnasOXY8Ei$$fywIp> za=D6RG@BsTCWYYd#5qSvf`}+*>#}923`Z!m@TT&SYSSh3NyHRDHq6A-th+HU*jD9z ztj1bjdEVc~xg|=h4+@Mj@71ZX$;zq=G||_-1C=}z5nfjRvP7wRGNFRlOPqfc9KGc% z@-A$H;istU_5klSwC-diJiG2B<6nHA>dyDcZI-mV3`r$@Qbme>?G1JTD-+o0=3 zhRY2Dy2O`$UXV_95T| z^wyp<`(3|_VeZvUL(}&RPiLiFF61`NGaNl*IZ=@&BV<#3dG2H29_1j9A6 z6TdeG3j%US6b=2o8R8JA_YK_D3|86qn`DrbyW|$yp}7li#oCCHxr>jTcwG?PrFSzl zR$2>gyd8d7Nv^*ptgmwqNGS<(9(g$~ZFdi0Bk`J1B{%cWrFh6_%r?+mRaQDmO*vu( zgYr`9iT51)aln1ijfLKQ=6ES-D}8&_Y^y0~;S$dUSZb9GqoX&`^_h$`hM(#cW74jt zjkAZk|Md7PMvtUsG)9@^x)oT%)g?<-VBp*QwaYZ4XY3}SsXc|Tce~YVZiqK#>-NvU z4j~Kg=lMBA+T(O?O+DR4Tix4^-a-1p{9O(APGBU4@_jss25|mvml$h9ybThLl)-D@TV0n!chO2Wd8HIYY+7rJdy1+>eI&N zYvz;ERy+%rwMC}8uH9I_g#ATl|-|SDEZDJkAZo> z-d6n#P&(6IxmdyH;PVU!ym%$wIyTI!=|`>XC*txas9D#8i(CKus`JK{zQu-JqD>-f z+Pfaf()x0~*ZR7m?Ji_Y6MmW*1uZ!h9F2RrX#(~4xN>dRS+bC0d6jMJIjTYojOj0J zTqJ*1)3Wh{l10;kRk2ilAH@dbCqW8?>0XJ(3w9dSj`zl(e4I{Zww3c#OcZfLqMpYrOyQf+2f4&B6qWZB)TS+1vxzy43O`~cE$T$^n1k3NW=zEp>m?4 zqD6kDt$*O#%cdJZ4&61|?q}WzAJP+G!P$afmU@N%A5~`+7uEYldysAkhYnGCXz3Ub zQ0WpF8U#dy8M=oV8fg)vTjEDa4_!maprn9wOG$U1;eS5o;@on>#on{u_gT+c-$jf6 zV_xRNcp3S+_71Cr!}GXvfL>e|ER>QhhU&s(RuEI=-!3BKcXv7Z0vFvQ#A(D8T&fsktO=vn0hZl zKBNoD zUL{$+=P!ur3~1`C>*o)i{u~E$z;?3Fcm>WG?)%s=ZPnbaVXDnU-LWg3NWIID7|W35 zfMazt>!!k+ImM$y+Iw*rsuLTOXz6fOgliSlU9S?>Mo)*coD9SQvGA9 zX;cdhm?cNmLAoq{H}_yEmXr}X9$+1oNZO9?`gZo(gaFQ6+Xp9Z)Q{UU*bI9?bNFc9!$vs-J&|m$b}kKZ?_~~t{uCf z>qEnbN>aaAd(vQixSm!+ytq=z|9akB?3Mgh{Z{eZ0M{ia{Dy0FI$2_i!f3It0da=8 z+6h$%eUALFEbaNZ=A#u!NCjP|bq6XGo6Lq-%*uL&QiQ6HI<&;Mzj4MM)x&@JTfqhq z-oydR$W{~|X{U$=QQ|;W*Ryo`PZ$cI1NOezD+_x_(}`ot?|j6Qrt|Nj{r3J;y$Gg7 z6|;)EeRiu=6WOey()csEDB}$}wST1j2G4LcwVt{N^2`9V^@rH0<<%Go)Un`*Yp-2D zZfUY}?I#;w;h5%vYPTr#=NS%eacJc1w%_-dAGQV>S*AB-1j~z)gk|6O+k=adP}HoJ z?bkTed=F}pZq|3CH>%{TVZYrUG}f2*Gw*jeDekg;jb1rSm!hJ04=)M!7wmE7LKh@l z!O{RHL>Fs_<%P0yz>j3HS(#S%^AH=*3tN?Ue6K%r$}O+O6tyeG_h?^)(gW>K6wTU$ z`=d{7Q2E{8+6ll1;l-EG!zARdUlegpHq=w%rQ+p{sMV5bi;yBz-4-DMr<>!r2HotA zv-#CIr%gb7i+GYL*+dt`^Nuc$qpTNU^`G9gG*u|Ld=|Pn4_)p^| zrfDk&Nh&j?!?L|Qr&l9PztKejck#SGO6f4G;2P-gc{7+;(7^urPD9}0*z(Sdc4~r8 z=JCZfk5Q-p&MPk??T$&gWw{W7JN^ZH*O|YG7sfG8<8*E~T9{6LPwciS`pRYQ;bib%sX!Ok zkfAbPWj{z`{-h^#sqg821g^_+(ms-WHhjtdT~dNRT@+dR)y10ltE+X~dWz!DyiU%p zIc}C2Aw~5a@r!I(DlcBSul%QGdu~tUO;%GrQ7o>4np@^ihvu0ZrknlOEGSCK7QdZZ zWKPF5dm1RNeTJwhVA<0kzL$7&YN3Cxh`6qDW-H}u(m|G8O}Sk@G*kc$>qmDBD01G; zQwt7vovdi-uICfki3&*puTgGia2K})3_dEL}NwiA; zVcz8YVz_UE{U6Z6f8*8kqyFFtU%4UWmlF1kjS4*I5Y^O7n1865XQR#HsJd8)cRNkfX6U?|0x9)Bi|7^z)3#FTH5{*0McUf@c@RM0_XcPqIUD}BppGFL&3rPh| zUh)~XV68tY#OsTRbI`HJ!10CWxC8jGf3RWDU}F3r?DNoIT+ zt)f|;wT;z8V_o>ZJ^h~UgAtw+7g4WkMh`G<_@eInJrYbXf>hX^P|UpgteQ4!(EJq-WZEYRnlvO zfbvKjRbS+08h9&oZLefZ2O| zirwHxf<}4v3QH$48!jffZiy_iQZF*}CYNWg3fgj-}nf?2XgQ}nX-*996Vm9v|K>LZpp$d&BRN=Nm@fXYg3rJ8UTkr;u<+>fR`go zyU*5ACj&4eU3wP`IFSg%wymI86lw3j4oAFFk-7?R>#NY6EgO`y&(`x+fV z$IlE5bp6ZB+Hs_DECMXkR=1er~0!~GvFM{J1+v@!e%X@{_*%tkWk~6Ys8iJ-ClO_`e~g>3#aTiukmy+#XaLA#8j?HqLvR$DBpvAWm50%0kd^ zxf!V*)JpnfM5*j6RpC=d4jjs^e(WEdvPkgsyX|m20&&xz7uMoL!hyzeGWY!(-Yxq` z|6lqRB(wtMlT@MsUygHSW7@lerlir@C&0Wj$5oQXLI8WPx$+$u=q)tvV!+Riu^hBjvqCOO5)Le{;a8daT1@>fxKaJUIW?$R$&ox;lu=QM> zr%M{oG3y|+sYZ9sGpJAj*7M&@U_9lEX9amdL_wz3JkcjS5&|uO>-57uuM9Z5Vxx5% ziC%ZMe&_zQfzc74fHrP7Tm8yv>*7Fn7tOIW6~+|0D{kI6Gn@^73jFsJhcUX!^}mnv z12d8AIr&SSI27fN3K=tauz0G$+D)pXnq4#Da7UR$#vQ}6@2dQt>}R*> z#-VpBK}YeYp6j`p!F)?giMT(J3Qv0&nD3ubG!orCFsIH(B2L;pfU5==}feztI3 zZD%$6P0Ph8NOCPU;EZC7vTR+~&%pT8kif2wRtNo`)SbL*A7{nEd%lRW^{mm? zghE8?uNA~7V;@DZy$R|O3C|x%wxl+HNn&zM$%f(nm5#jOQ4h>5IE9L6=JA2-$0>#8 z|7cZlyfJZ*zgP<4o1a@!uU7u^f~S~`vw+HkTSOyD^K*r~<1_q1TG|=v4}|Jt->}Ld zEP0%5t9Ew!;-6=vK#`8nKjXbM%}nT zXp&z)i@#HEUKoWMJ>XrE1~OKk$7Yf!8~a^7YGUv0R)$e zA3WW?{aF*HW;t^Sm+^kxzVpMc3u|4b>chJj(KDj`o8O?j<@kBs*Q^E(D$`z=Dlwz5 zyn#mexA%#JT`s&QUAm!!Q8!NC$kc* z%VY)%H9xF%SrF_5de3z)=n+3=v;(&F%jSd|xY>9LeoO{gpGGalAih7R$Uk{DxIEBD zvMQdIDeI5%1{p|$b!tYGz5H)h&r3)|0CC(OV^0a>&U1NF5*tPbP%=$G4@G;CVCU7S zFqYX4W^HSjkbJ@@v&u^^OPd=r8)IU5eXdouun!bv1UPE}5W-OW!K~xQGea5r40aT9 z_?YD=Dd}S{)>BkyztuY((IqQ(PMLE{m;2`6-mLr)r1B#o6$;1duwFmG&M#fc;Rewc zobNaVIN6RG?{D`l`Fk`_U~p<99buu2)5|Omd-QSNyGtWiivx=sb?ahOCk3A{wZ)?x zXVbUk+f*+yXMe1G5hLL!S7k36zKULdTqO;gKb@MlB_Wi?@^~#s{YI@2V<+5(z9i#5 z8X3d>gH|~FWHF}AaJ2TSi-W}*MJZ%le-$yLa9LPVp<_`}4586y=KZDi6hcu0nR=ch z666-4LntvL)AcK=MV!2x266AdSQ$mKOsEVmZy|g|Ur?w$Fv{z4p?jx?-VzLaOblkG zl08*LTO>1$g^d?%nWv4!=qbzOZQA#GSnC3b8ZfoNikM zIYZ+TbWPvP(vfy>w!1d>n*8C--YMmi-BdatG6E=d4#UrCd2jT$!EFSb^AF2?G}mn> zQs5AK=Ov`8PzZ<(9Mbtw%Yawk5i|PCha7T5Bd}G!8|lB|lcR;zPZIzf;2B*!zdJVy zOC_q7o(YGD*eM39P~UtU#}ZiLwC$KBSGkn4hZa6jX^qZ4aR^Xl-~=BDC1d32a07ZS zO|(?NWWK=#qqkZ^qPBd~nOromuO$-5@{(emvX89z1CS*fn$JaQms3*({XNCsSM^aD zK_Y`zR1BPA^ymM5QO#a|U^S`$juxI+foW37e6mcm+dOV3!apH_SX>izG^*wa48vM{0hcZg>)jESV!~2h{NOboOvv%BPEy{GhH(LG*uH} z7);Q$cxXp}f2XnFZuUjRP(-NA&4$1t8_zm=4_G~5nNSHNG?9!qgAS>X7yTfiTaDpz z0R7e2l+?3zTMa&Y9^*0fBFR`Ip#+dv8V*op)R19f$o0;2qoaE@D|HXd%8huKKi=cx zlYR`O>W<1M!n32Y!zp`KRmFYbv{-kADb@0yP>rf6DrYTMvvaA%3$70h8Ymbv=D~l1 zCgw|;BeTGl0I7XxwSW0mG&2veG{e@Y)fIvbYdex3(oPWyM@?t@|1;)t-+U)#WCG_z zB@uIW9t@a#n1wWyMe!Iu1C9{#h4$8O#PZIVoWvz`5Yus%(`W#loQ?}$u=~_V)|G0c zDNfTB0`fxf;*PKr2|VhUW%(x2c$14(x1}C$z{G@yw?)(it?0@&$LsP9FkAKe-`UGu z1@n_14B<4+Kpx|l`6;{4IIj#tAj_f&+90NI5;*YG>FMSCKEi0+=2s|kWhZ1tMK1ck zTxznl5*F6XRi%9xRuldF107#QybSndj?gFM|97xMYdR z4;=%P@2z)Z3~5}hzQCzvyM;l9fylcW=_D3Hj7xLV{$PkVbnLOS7*A3|FC~e~MQdc9 z>N@74Y1(f;$I4X3J;yPQ?^62g})kGL$~ld|+hgl<_6 z&=Eood|LmI)2X%UYe^NNXMLm?z&-?C3x5>5qnMmuySwwCLD97U`vZsQ`lL^N6;kdS zzpMI^NCxxE&FQY5a%k{n7`LjtUT0%0cK`#{EzyMWx6Y@_Y(AEw8$vTfJ83_n@@wO# zY^=7e*>0x`f=@$Le`1_g^?Rb7*woZ9vmd_=BpYbX#)gV+Rn3#7a;LRcHCsu&k$Q>! zPEW1rO{8^hQZefe@lu-s_uKxolj2RV{)Qm@^5knPjGuUnDE8$OT#5=|>_CzJ zWQVBiM3ARjZzU0@v`$YAs*d+3!!NIRbFU`LCy&Fp{!3+h6ioO@Vf%8}?I{VHQ*K1$ zH=;9W3#L#qAp+w)9hK)6<<24$=j_7OH%%H%2{vNk%m4xeZ#qbJAVnx>`}E&=R)O2@ z59W?>-%_5&v}t7!_+h5iKy6~h$9ddQ z#E)bfE_6GqaliS1FABmuWq9zeyVcs0UM2Yr1r>O>dF6^!OI8`I6|TQGxl|A7Wu4Kp ztzygVEH1CfXa4L=6H#vtpm<@#srFeLpw6-Wo%YVjZ)Y#Lq1mqfb3W`X`6R(6L}hL* zV&yZ(SC2%Cqx2!|Q&o^2#bT1{Rl;oGp)|T-7`|6K&n15sx&7Ul>I_0zbJ`zD-p+kL zV!?EinEzMZ@OYn1E!lOL@l(cw#{|JJ$!B7VAU1uw@?DN z!|r8|^kQ8XODEoWE%l}gzxd#vDWa&AWb+ybKYRrkq47iW{z?+HJ|%%s>-Fuxb zNZsW$G)b2%t%?q}N&4Y`T)E2Z-yHL@c5NI`-7ww@5B<@!a_XmL>b4oJ z*0jeYY?_Yh&S}-RxMZz6@+BE&A-ZT0K5M*EW*CZ}en^sdDdS&6W&1k6bIBgm5!o1( zGt2%DOpy`@yLGgzw2^EYdDj|7kM2xhFIyh(dm8(*tAJd zmEwL9`x@O?fE0W3L2hDD;)%_> z4*vUX|FoZE=Gl+6nk|DE^8y%Lq2I7#VUVPl@dOWz zM{7POXMca&Ot5Nw^jpL;naY${-DLD?%hjTr14MdeC5Q!a^_y-bzcb5@A5X+pLV}C2xp$nb)(3 zT_&eDJYKh6hs*;q=4(dYzs1gW`^6{O`2THEvzDpMCnQb-y*0ym8=43f?SW4VU<|PaB8>x>TVb1WAs0eFrx9tG#Z*>Okf+ zD{pTjVoc7|l>9@vcKK$>CUP>og71Ae<<|YTSOs>Ge_+3fT|L)lH$;W;#{dU- zyZE4}*`8{@ob@iO>=40adi8F|jp?O!$53O!q3H4fg-G%pD}C#_F_C?_Zrl&jLH)Zl zz}bVhFM70VeQcYS$y5WixI9CL)qus?-x7=M1G?$16~?Qxd5N@J)B(&_Hr^Du<<NSRcY zF0QDRHT`j3J4TO`@DpyfM|12#K2wu7MSRNGc>>gJ-;9!^OYB`loeudfJ{-Q#N~yk6 zdQA2v8cUM&e(a4j3Tv6D60$J!2GtAN@?RkdUGgN6Gv3$xjHjUi=B3mdPl0$A!Sb!B zXvr@Iy`{UxdYB~1EGE?N*-~+Q=Bj{h7kFa}mtDRzGB>7vJ*@H}`n!Dg_(VBExUQ1P z*+dpI6lNL9QG(g6BT>ORQiU5O_qAZilZ>$(^vGF#lKw6BO~VVi0@W21#h`Q)Y6M%W zeqzbYZ}q17qHC88H2a}D7MC#sIovB8z_*xv#QKjSuVlk&ma=%axP7Bs>|^hiITOUS z3bqaUAsEbei20Zak>bqgJGd79;@`^ppADXX;y65~vSP{qK_lK%Axa~Rd(H2!OQkxhnFsyE^9>)F@ zycZ|4_Q(8>X}VPXzAzTQhYgW6<~h^h&!sigiU<>-tvJfPI{@3>u4t?@A>f??BRv0H zye;i)XoW*E4{XfvyGo^zuud{M!+z|9Wv*c_~u}Gk`k?|x6(-G*?5cKb%swT=ZJLM zZ&S-|n9>msr?j4MMDviW<{YRF)}BU#8d@8yo5{E3u6Vvc7Mn@KJ)2C0xV<?#iCr3x>bRRlDvQFHC_fh|jQB9akN4_?)ab?f^{{E>Nxf{{|dR zS{!<1%u#ai@3s6RW-4i8OO;`+a3C>Kw)P{69yfl7I)~0 z^`HCF=Y*gVctpu|l*M&!4R>Yzo6^{w9XWN?3lXa5+V4@lfDK1+>G8806%Gj9^zaYc z_5Q*EMC{#in?9LDyAzCpUA8x*hn{9Qu{|sg#dX2@}uVA+B+gcL*%WV zyi{%6I(;fxfS<5z{BonGqw8!l#h6lK?@h!Asl0K7UXAp|u#_{fGZPUZeq$!m&2C-s zQpvtss+&5;8&Gge3^9%hQ#3`ETx6fEYJlvS7>dn4<;gpA2q>%&cqe7ht5Z#hLXmqP zXE8i6St^ND@WGPIlAHq}9~9+(MZSBK)wrvldSe2AsxgAKL(XqBWuGyq{d`f-g=&!8y*iZG!5lU6P`^{+XvS z9p&i^$U35IQ;DXYwqLHPrYPhvHo$URO*-VVrw!v3NClGqboeWt`1N%T^uf_mMvnt6 ztecohdouLO4Q>Rj*Q1#w`wJNNv|3r49cN2Y)!wndArD82I7cTtI)**apycVM!n%2II7B_D-|Wz=5N(7zpder`}^0V3)=Y9 zb&@qbkJ(XCO^F~q1R$vX%cT%U=W}e_Q)D&yN(bENMlf5K^MYIsbaT+nx7&WRE;x1k z#R-Bhpxfjwb;43*$SVG-SCj7aJ0y2)s<}JG@<3#Ue4Po?WRW+?ApeadGqjv zGZ6la)EaHLhPF(p=j#~;U;t+T@-d2Wim?Sp%SmT6q$uQ8NgD8+<*X_qR#5Wyg-Z5w z{q1LLc2%jiKvfIcuf5MnbgYCRm+tCPA9EkJsEVX9JdFfd*Zcq5P%`6;pN|yTRobxD z^mmqb2O7L3xNI>XmBf@FCzQj$XW#_S>>Q>0CVjeevzfjAl^%5UaYs2*%NCmd6Rxy1 z0t2<1sKQlb8uS6PF`Aw* z-T}Q&Unl>BZoxg)doKLMMH zq`2|EmuB0cD#!RfW>t#k*Ljbk&(@X<8A)%VPXRVazR{cJyi~IZAj{B*$ zhlT(&X!ge(%jF6tlJLJ?cU*_Xfb)uo(%GX1mu1wR)UdBs)@RB;nXDJhQyuO8mebiB z<`O#1DmS?ywVXFe>3ltmbt>~htN5ft$miKVZFlJBErwU>}uB*9n49(cNFA% z^ac3y#nRS9%b_;GkZqxfLD?*Hv7C-i_c2DJl89P;nyBBnSjDX;!gB<1EZd(}roGU! zSGz+laE9E>DNB+bP}t*YJ<;)^ely7}GaqmbU5yn7nvMV<`)`Mu3bjljt~=22zk1B4 zZz-Y~A-Bb9ZQ;vOFGN+(Q;_3|nQKe<(_5R!L{y`{d1}OIx0e zN$O2NdXQAJ;y+h5eTV%m8t(9Syi@MCj`r%twaV1+48zBAt*Rv7Gk&WWPl{u`St4j5 zfx9Z!m*4#4$=RATMYKtu=^A!kKdf(QoAoA*@BeL#>bDd9`QoTM^$s{_Vu%{@Dm43c zfc&5?^?~w}TZZh04|a5OdAGLwL5s7RQpvj7wX|W_dpWmoyS!Dx z6TTa4O9p!SlBfWYJQYq?%d4@J$pfxTmzT^D*>@+!-u+DO8k!6FCuNqm+j|eFlzPA9 zA))M)n)0EIs29FA5W#y*@~`Z*Ku1i_URf+<%i1HZ5F~Q7Y5m@&lfK(7=jXex|DFU! z=Y6}!e7!`4tll|^85G|iUV`@8FM0(H?FbZmCas7;RtCwZ3vGLzmCy)gum8$=9y0b% zR=9DAoDD;XggI?dEs9A;`=Qj@|CP0o7kP8b1-U9#Q;Br$HLk{aKAA>W@Al_DSz{lm zhl=T3>ZiT!E)K<3kJ87%Wckp}y-Y(jWbdN@o-=@*KDYOyEpbxcua~t2HlfH-e2K2( z8OPxr_~p)`CoBAX7OiYwd+1k_pAI2b_&UYO;>wZ`LWx#{B=W z02cQwo2S~}CFSs!kV57UUf1PB-MX^NYOj4CQa>`K(lYEDwv9U4v!)1mbN=TYQTvMz zhl}B4mK*Q+ByvZ*aiv73sb7q)NGDAuip)I?H{RC>Dl>Ek} zzCv+r*b4OyePf@1n(XBML*Yn0xJGFGuhn`D;d@=DEYGPeOb^hxhrgUtW%_r>Brx;9 z8BIy7I+ENZ{j(4Bi%yQQ48*+skF?`bW%RY8*5NNyGL>1!#h!PEX+M@>4GkOs&y+!L zYv;I#m)j6>uYtFuyc7`FGa%!~6eAKR%r)8aWr9H`-bZEX?IQa`bdy<6F49^kujX6;X^VNXiRd;h!82usU8 z>dbEc!8xGeRB^P|GTd(PkAKK^rQ$G@xn5*O0abX6EcUn0+_Mzuhw( z1tBj6VLSypUX+i%?KkW5NI-=*LHatmbW`z$imX>>^kEWL=8oK43T}xOmeYdsUny(3k*FrIPZ~k4IpHwk> zjc;~=3DEk1zEy~-Y8{^;g`9>Z=@O0)(LwujLe@O9ny)nbJJ#z$fyIopOnBALZwSsq zn&{n4RO%p2fS3bySYnNpt!)8xs$MMR<=#>V#rIoe?CV1|1T`wgp5_|KnP1;qf!TSj zeT3MW*;3-gaLizryY=Z5X<|nXWgvhT=>`CSAoU+9ayZNV8+a7*4eGX zl!Gffnk{tE;?|CW^q5b;wB46g3aU!{)Nq8~rSs9JzFcg0_c51XvHUv5L`;FR9`pB! z@p!85r%lJ-HddV0oyu<(-?!NxQ3pi}okghM>y)VtYyeZIFu&S~{NOKp9D=^84VXr2 zBaX$q2qrzF$cj4*QyH|+q=UFh(W(s2+kI{r3(1kjq=HLFHvZAtx21aM66<{jn|rl< zT4_WY)L&FB6)uB`0W5abb(MJ8Gmyw3?+`BSr5&VY00v1*EIrSNGFQ3fD5 z*q%gP0U;qr`#JX>8TOY?V1j;t4u+4TIoSeb$$+w2$TxP9PQXD}B%G)pL_IWNypWbm z3nM>TDO{F+@gwokBW-&-@0Ccd$%-}syu6WX6?*p=-Jv_1ul6^>fa;ZR&tUk!8Z9i>^|p~{5#c4A*osc@{uWmFlns#yPcInr>nM*7OmOb0l_L+~}> zi9Q7xK7N|R>O_YY8R=3yvbROy6JE|Y6Yfs_s4Pp{a!0kCJUZK75umJqvuRHtI(c`^Bi+{RzdX*4QG=sgTxoN zg~;wt-15>z*IsS?zwJ4Z$>@uN0Y?`;B4Gi&e47v4vI+jvu5^v7mc z?&CUHCh(Gb+X)95HYHAeuy}vFIL`&T9N7EmCLi#ERO17b#pHwRrXoct zy0eX?*=YW~-6OjU0JT3g*Q``IzKq1k^O(m4q{t7(>m0V|DMJD1P~6iSU7+*`^J84i zf01Hu={Ci~Pu78E?y?vN))rTA2mrMDV18&7rf`tX6#Bt-T`}#A zWb0;rbm;`XI{C}e=r@E#D_Ds_$&rQ$JnZuyTV>aofaho!;{QvOKrv$MBZn;ZKNc>d zz4Pv8iwrro6s1pzm~r38$=-&>+G#RE9qd?=y%@RfDrS!g7W+&W&cD)I zCMTsxm*C(X%EZH+&&w?Dk!G)|pk0eAGYZMdwD)&od;c}G=AFck^22EekW6VXToa}W zfw?+g-u|&8GJ)P>XRW44PvpzN<1s*TI0=9o_@x#?)2C|Cg_-j z8HUo<9dfP8t=nOLcdkB)oK?Q;T}*}$%c4W9*_gmo{9g5%M9{Tvy>6J&?uOgG1+e&K+}lJ@U&U`QD}^_Zl~IzvgdkHa?ON;dPpK2mU_g zU%i3feWBkX#xRwxvWqW9}eCI4Euwq}xvpJ-egH8&O(s9$SI4v(~GR-Wbz z?Yop)VEd>BTn3HglRY!LSry2vV_@I}{aSM(y5uG#VLv z{tZ7=#5J6lgh{T(h?dr1I@1Z-DjV+nCZv1Pf|G*F84?9ltf2Xh;~CrglqcMh=5AxC z#rwl^UJaSo8z>UN^8E+0;kL09D$*2TgP!kU_GYDC$ZX>#yU>CY?eJLMan>6a>c@%y zTk^los%yNY{jk_{sC|7{M`j+t4HZjcK(NI!I6LWyq*@#qKN$`>bgq70FKn-gdUh~B ziKsrWt`SI9I35j;Jr6bG9qOb{U4lL>OQB z40m(!{ChW2UACr`>Xy;aVJk!y6EuU_>2>NaVbDI(&{s8=k@&tXJRA^hdu?) z1;LJwO?34y)W;duS^KfQ)nw=7(kW_CH#)b)K#zA!zo&3T=b9ndzsl#=~g;_JPN62>pr#e>R``X9wMZ z_Rn(ohS>PwCtsza!B@OLa<%jO72<=$qJpf074dJyZb{!EXQ3^A3pvgawbW4nAXum2 zQjc`OdPn9h-qQD$y_wzCvw%u;Oww%{>yfLiTcwN`5#V@ozP&c95xe znW><5NV@D*ETUIcRS?og7I_tnGdn8#*=2Px@l*er@O+NTU%g0s(Dn3JTB+-km1x25 ziNM#7Z!DX{%u^Lj{yP_v*b^vs5ofk?#bNSag7J0!vU?&>ij{P8f0BK$v_PrP;3BY_AfE>RapzqK|<%! z_0su>%dbCr-6?Bh@xHE(;|YC24Fz)JIrJ^&A2({+9)L6koa`aSF=XG5LI;-y6J!2u z#XwfSo)@IK@RP6pB^qN{$*$_-aHDwRces=DKckfs=}$&G3elD?0lOI66@b*XbJ(4C zLdNdh)@#Kc-te$R9M+4@!*>gZao*({*S$eYUqs1>6d&dvxy5kAnEIcIQ?mqLZCoMG zyUB)j1H8^8OheXiMM}10)xz==h8PGv$BZ~F7FFz|99SGdkntNmXTIw(&pX4pB|@EM z-wj$T^UKx^xk?tFVXA})GP}_8&|2Qz8@A*}s-VR&%4D%G$1O>(Ve7}=Nw>LLTSq3Q zt3Le0LfC&NQx7pMrz~6#raR3frDNKENsDGt+kB7!PLa9|Z)F_6^p=GDo>2d@#7MsM zQtE5U!B2i49ahPeY*rE>w4;x9`?k;Iw7o&PEM{^lCn(hSt4+-WA>f5FOkAwXUn9f_ zZXN`J%#VJXc;X8_t5+4IJn^md1a`aDqoJP)vl)djg*^L{#W=@2;CQLOsebxWBz7C| zs19Tab8eY+iBFsT?TbW&EG*shZ z!7}4uIrH*r+oQ@@!oAnWT?M zz8@Of5K4`;RAs{xIUIRj|IeYPVNQBtkELZkbHcGBTxCZ0gH4-F=xG+(Rm=#sG}hnAN4h%d#h=`{d#Z0jr5KXmQ;3*d1-dKPN8=s zP$Iu1rBKkzLTA+4gYm>8UqN~)5U2S;$TI;_s?E2yo-gq_>B%p9NE$(4eIuDe!rqnO-UqCHJ@vezZOY% zZlT;VmWjABbzGf-?Fw^(2RI~XJe?8Ovt<*7FGl2i^~ZGa^X9u*4-e8iRMVqf=j6BX zp=w1BDi-sOG2}HEt%iPP7&6nl9KmYg8fgK=nu3C1xs}bjt+iNLPMMR$8i^oI)y@Kg z`#iSdlfuW7oF|mDfcaIH^UZ8b`{PsbthI%<>lpV|E}=zct4LuRpL zUA5zTq*g8H;!b+!yXeqtvGJk3r|W5=E{jO1LaJ%Ie`-3Nkk^W39|>#=<7uC2JR;M! zE`d$8+?mpUvv}L@z6f~ELuS5xkyI>OX!7ZQGOGw)cK4&*2X@=)3??IEyiO}SkP2~) z>a{K}zGUPZAhrdprnsVgBpCajp13$3L7d$)q!+4WCEzz0Mf5+Bm&Wh@{Ua2TpS!<1 zudHDy>v$;Wq*5Tef*Q>UW27=SecFOt3y9S2}6)) z2-)QR-=F-nxaDlC&qJxhc>=hZVWyNwJepl6oFoc79pD9F01bAixEkvolCbu90Zm~{ zE|Zmmz3J25Fi2k#Ib{uz?~xfe>1~oJ4dS7Qsw{tVmG$1|$qXiSP{Ix7xpJb&6Y{tu z?)vhm8(j-QFFr7fmbOe6DA_gt@i-J}TC3#!*Gdy^SgT2RwurdjBhvPH>5b+oeyffv zp*VX79FCAb$(whyyq=LJa(#9Zg|u0xlo&1)qqCmCgJHrKJ5CctG0M*-DLTEFscC1^ zciI#To@z=_%G7yDv5!(kKIODxo3x)+IPY3u-XEiM z2ho0j-MDF#DNX(ii535U8k~=S5?Zo{J?Y5EaQ^a#HnQChv~n@;*mk2<_ArkFv9mT9 z8aej1rS|diCbnT2g-<6=Y4BI}WWBl2Uz3j1A0z=0W9HY>wRM&OuR6+fW}b{dM@;WM zN+{KpPCWP6)&(5Lhhb-;o~WW6{gbu_zYaA7qT?@#(WV?TR=>{|l8c2noV;#2jjUUB zcze?RA0AE-Db1|Uyf?zdLdxBB=y7ZLggK)7be^+NaPC}QChoZTDYk#HYEPj2t7Z2Q zMFLOEK(1YSb5J4Tg|pg^`Si@nZAcB5!1@k(fj@ydgwEK(R8g`H!o-9&ia#ZH35iLp z))E&jWc^-5_bN^P?qiEmZvCjJi^V{|f3ut;g|b7QA>1-pr-vVXaV4Nr;=Tsonc}{p zjn-n7+InUno{w9n<7X|!HFNog6?663(PdlXRs+FlBGxD;|6+P(O_}wX92DF08*d*v z8~T|@`uoJ9mJh2-lk@M#9{>kVU7fAMmmbL94VCusLG;nsI8q!GB*JPbThfY|Xx!j& z)~x$P5npp*jy1BWMV+rUhBicCzLjnV=EwPsx95w6rjOKp zXVzVnVH24LO>*m)ortn85x1F{tWqSsI^juv-M7@jD$n;B(p6XQM%jk0RHU3lGOzeT znyG*CoMV~jUSQSXjpg--Reuq@v7J3sVmbO8CF3LEn_m#7?m8~do#e!$$%4XOFP>Au zv6qK-+@7r-ehj?R?hUMcH9DZ2f|^j?dZ+>~BpEcT6AKz6;He)S?ja%@QNoMMjYVn|X&bfb#s4u`Vy$<)rPomMhac8BK z8m|Kz5KZ$P9y{M__k37W<4#j6>|TLZf5*c;EY8sq%+s+>O%C4X^iw9OMt}i0V*2ZR zhUDFA7;-{5o{so>7E6KekMDR z-&kQN=EjM&S;Hf->yrTNB^mUw6LUpBr!fJ%iE-#-v!S0>yiTk5T-_!4NRTAT?f1*X z!(J4SzMIY}XhJgZ{XP61u`hq!G;ElZ@MMJSkGYjZkc!o6@T%(%KAPZt|NHBmi-SM? zvdA&2+g%!$O!B6mKJR|2`+f`_KOFuCQ5#P%2}moZ!;gC8(pV+ki=L(}ewZBWIHp8>HJ+>Q;~7)7PY;@WDS)a%20KS3 zmxzf^%;VWjccNRdY{UQI=_|w9Xu@`JcPQ?(NO39dEmpj|xI?kx?!kgvDee-a#i4j` zx8m;Z1a}B0eCIpo|0H|u&hE@S&uvY+?4`&hZo0YZc#Fh114&U!7|{r{Dn~1OpIF!M z1C&;RP@PO`icMmzM8rO10W81C!v9wO=I6U4i`wWk`Zcvy=cz==%6n*B%gg^AK%WwI z|5cq$0{0`KRf->DwGI|)BQqMdv82$T{Pz5V*C`L!=xdOf{9D|qKkcB>WR~(mzuCCO+N`fS}?BeZG zZQD$v>#k1b;-1t`bD13kL=1QgnnMDpUCjprz5K?~@)LO0yM`3;&y8{NcoQ3$^%U)|Xi>Ps98rYM%FJ2scCtkE_0ejG!po6Z-Yb(QDW{i9 z6FO*+?C0Wp6%9OMbmAB3m<%?(tLn=+w_0B8mr-aqrD}l8>3g<0Ku=$bo;1`84Ya2y zQPgKT(Pfx+sYlod-w%sM(RAOeLp?OJcfQR~K8J;XvprV+IP@?Mmi-;V{g7Fqan+b( z{P!E~Faw4p1|uPxRj)cJ0v~cx1<`MlnIF#o1-)m#4&=4EUvxoMDxH9_5Xa`O8Y}05 ztQ&T<^odz}o9o5YzAk$7ElCQ~de6l#-dZU=%xh&z8yHuASe>)87uGMTx3ZG1{cXve z&z|@0gMdu_Uye;mfU-vrpyIT)nhNO!{{Uo?$a9GDi1(9PSpELcbxI2*R)Jbf*LM->%$NcLI=_gDV}n!Sa5ZB&$*hG}dzz(Cn3 ztl`gEX5|;mbb80qUonE48aCyGK9oPBLplp3DGwJ36u5R%FVSt0Gms@2Q5lKvJL(E; zKIr>ds4*sDo9d8}nl~+eL_$^goIw;+j=mxHQrO5RFQVPZu*h= z+giPZVZo~BmEi=R_-Rh4-xu}o>phbM1jl=uZq~8*MHfG(guQ@i3Epc4Fc}`IbTE|t zjq;yzN}bhaow+@^{7A3z^2A=f>8ZBJUCu2_xp<63bo^R-QTi=CmL90N>5?cn^SVyx zVoEy{Ms@MAi6;Jtax7eK5D5Y}!5NDwNniov_LD;k1gI_`kQ9M+uipsgoB?g6%bOgY zM>()PhI0{VWjh&4YH4IslmUGRhv zhtq5O*}sxpBw5Mi$63k%IQZS%!TSfU|K+9ZeF0_rDSOQ{R|pt<^wkI47m7w9{3+Jo z!u%XG6U+rXCcc}p3w_;?CX+5JR5*`6&vhddAJ)21s$6oxJl2w224rm_p-flB{XH13 zM#stO1c}ex{%x{SpY~kN2~o9|NF6{*oBWS^HsJ(=ey7qx_J=@jl7-Jl$=pz5Idcxz0Y)HxK=+}`w(-IC#{Q7wEiZ~Se<$7`Oe3INF-paXxjC*fPGH1nxK8u3P~Nz z&8)MN>!DEs(MegYVEpeu=X=wb^sKsjdre#@;&>+0>E|3M=a1Yy6ZQ zFr4bLBcjUM+At~`7*-;M=Q+{l&H&fn@sG*D-X}8Esk_&nE9;COdy^4kxn+OVRfpVp zJGXj;VC|_^`d@w?+wS$~)2}IcqY%?g0w>ipKkfL-aPYbbDHM~Kja0&lWi!#TJ<%#t zyd!dol9Jn~9@B04;3ua%NeEfcT7Dvo3=@fe*1OxAS|INi8siuE};^P59d6!ol21uyOxY?oo z^kK*`70%DhbY@}}nIX#>x%a(HbIJ0{cR&Sl?~cvfU6Z3AY{qH&BIfxL$gWJ3X08z<ES;r_~F@!!{5rQNspXcsatT;j|qmt|N8h3)$mO=m)`lYV#vIhh^bSN${ zaW% zH|J64*8qVv6?MbPC6_LX*ymyx591%<_sLtn$UMy%-E`>4VS;+=Z$#_(WJ8jV%D)8CcAUd zG`aQ%rjAx7m_?Kj!GPz~JIimTNkGEyHDAWjx30&^C=o+Xx4C;H^=(YgMF17PPh$b+ zzTPXppl&`KaWxj4%>b;d`jf3{9b-$8b693HPfl99!9`RD+4=~t!zQAF>U)RoaBZin zxbcA3r}e4%uo5&fX5c zXee1X7bjL?V3jY*)o2JwF0|bUU33VcB?>9Vd5_~%?sqt7I5<=u9uaQzT!N^w;w9N0 zdiw>DZ^3OC!bt($59tfdyFB{?cxpS^S7d}{JDUU{`4ID6!kj>cfBYvV2J7fdoEvc8 zqrP@Jx=Wq!go%Z}yuwH(RUNs{*GxBlIot6P?cl9T)*sF@tWBG0$GS&3EuG41pHpWw z&p>V1p{a z>gGXVN$W=7kTn)M{=sM^G`@p3PX{sgVV2iceA%(XU#!zO&D27%m7mj;1;kt{H5^W2 zn|p~I;#|7@9*Qn8)3`zoU0ydbAPH}^x?pZn=g%91(PBG7{|K@O_8}5bkD)w$Jz`Uu z!Zcz&qAZlaO0Ce}8cGz2=uk}Z;2?Ccirl(uQ2xdh(yQogo36O%fAwa%w|z$DX-X*J z-OqmU!!q&3D$>p(GAGfnR{X_;HpD2$*?6wR3(AU^+#| zLfZy9vAW=*F|?%F)DYORR!o}TVxr1KSrdr7MNaE9+E!z^x}|@*Q_9fDkd=vjg-PiX zek^`TzsR|3Em;#kHbYFLkWNrYq}dE}+CmE>Kl5C5g^YAja%kXu4blEPI_~8VX8BJ7}h?5pBbxlU1pS$71W|)Gi=4p z`9u6%9>>%Q`voWEK)fgmUDhVQ93ECQI&C*s=K0fJ??Yq^Dldi9cOFLapqwCb(cg)2#r{?4&2zOgY#9Ud#WLH zA3b{f+ditqv*}&WrFlIDbF>tj&gRn_7Um!F>6CxjP6OF}PP1H?WsjM&E&zjApeYAN zI9%;Q?Z_9|2z;@X_>FoN#{xo!zVUK3hw;YhZBL=FrmbE*ZDF4C@#R}ClcVXJYCXKa z{9~Y*RPI$943E`}W_Xz^qJ7ME1zvj+!rhZGBFz9TyK+5{`3QylM=Bz5ehipje-K4- zx*Gc$a+%^z-j}RTxk`E(Qv?IA0PptMqU&*6LxTf)%+O;4Y%r~T_R_8904glZR5rG} zf!zy566G`BI3TdR7z29^2PpDEz_{<4>+=>~YnnTY(Lgt1tn&T2@UGiu!JL>qo1P>M zqG7KZ#K&yaLrH7V0c0ka{@ngzxh4f{DLfRAbXC85JN$CHT=kqYA$DSlTXsr=v+7Z< zy3&*fHtFcp~9=Z{_)zs#)!NO_>pmGIn%%Z|%idT3)o#YmDiYzUOg{&SVA8sqEwWTbwltWw z&aLZukx$QrUlRDwDtO1vTNfGIYWGXJ^EQ0_EHW#uhrIVbu}T#XWfr)C*#GdN$Eq_y zchNs>muT1X=}Z89`M!QKyp72r2c7qx>h3n3%Ui_+X;GF8Dz3FwkW&WjDvQ6U3m>37 z`oVS!O5(j0JycLFZ3T`-hwD=gbPWCNci8^=T}PAxm)?<7x%kU;C(t zbF8S3_Zs_WEXO^gqp}|^J z*tyTGSCaL$_}Nu2h&S%#?^}s^7z-cLgdU<$pimweqtO2bJu!*>fEli|ReelR;(Eh` zwCOrS;gg6N$&nD3Nm=00$rw}Bhw)W-{=BD6!-L1bla>km6l?F!$b>|eNJq#Tg$Zf+ zO6`9=saYcxm~WCFNMr;vQV$L1qIta^DBGHR|6;)zpld~MyJcr4Z&DDEH2((SFkL$O zOlOv!7g9RrO}NF+*)zsb6;6WckKNT6L5g0qZe7_lBgrtN zAFOgx34NMf&9?y8MN=wyv9Q1icjHQy=#*%NU!qDldiy+aDBT!$yWE>R7m66>6g|3+ zoM~k`>K(e2>94ec7iB3@DuR-X3Fi^8m7DDQihs_=Njz`j&Z8{}35#u_tNu=@JCJLV zC2=dXzNp)s)-s+0NWAuqgRMlj$u#q;PaBs1YqbR@p%VEl@fGEYeD_Il8` zB{+cbu(jv;rG-q*I%DC+$$y?Z(o0I-RhF;Z=<5UPNp8FbLukHT!4k6m4q6R<59;1$ zQT6^>^e&XJXkj`RdOdu_yvCfxtPS(VSzkh7j@~d3#3Vhqi>-o1FD^~zXua!RIcIF` zzt!`Lk>T@-N3iPK8>VFPT1;pZ->t#Z*PN*s_wA6Cx$oKvLhxhXI^t zh7ZB~U(*ZiSvuAo1MZeffwg!A2JxKB6Bj>D)t|biafJ_>SNl4eoA{%W%z5-99y1~k zZZ6x_T8`bVvYch_-dKqBN^!A)Ru=r!q>VH1ahq~fESDQW6h)8u;naG^x4%+b3svf1 zfm7qN+`wPS^-SbCYQq0xBqaWFs5%c|%I(1sDZiDu?=mk^ZN|MDj&dOKCN?+HPf8sw zT7iqb(M&0n^!nPI+VQ;m3Clpkp`Zi+^JAp4fP-%TdD*y<%ppn)03SK7F2g{ssazU^ zk=v=%_BxnANL+h)nAPYa>W6c@Dy1>o5PL-Z>2F3pvVi`_#PH|6nAoxr9vl@}=SMy{ zZn)R)nC8D4mS457aW)b!bIOZfe??cZJpYAOlKDPzK%RRDmpp8^;WscheTm-~*0QHyZe#imbxU{?xBNbQiW0D~#hTu-;4|qj05JQOD(r$XN{CPc0k??8Rv_w)$gFYWSNsO4=uvzGp%Vn{ zamRZr)uYt7r%PH$e?b?5#h~Ew^XKz#@}~P7>#yrY+OQgT%SUShHC1gEGDiOak4ifX zHG8T~Xf)abl6Z;t-(m9JbTlNnZWpNO5a=Yl^fHO7GhHP~5+Rfuq1iZD(PIe2`>t%a z$cbL!YaW{Oy#AIGD^+np&$pISm#-F3K*pbtMqOWfx#Tc7&OPh>*JwpCaOZ}=YA9eJ zQTj8kQ_O0tRWDSE%H&+ixxXOU{lkZNet~aGu*fkk#wQ|XB9wzK_YFVJR%%IFH;}Ux z1Z6r^11_gaz4Cgw@=FBs+-RLNzJdM<5;Z=Zbp&Y2vyz4e`@N|`v_tWB=`lgfSvt6H zoTPf3M)1q&5B<4Hdxiq*86)Pba)^eCy5GSWTkAFN*&kcw@5E4><6O^SJwh5$jQG5! zd@u7^ne<~Nx%)!9qVmtGfi$%){l*i&w&W?K5sAHtd9F41dac-9s^_EwHZP<^FW!9O z{D@Qw(PCukMVWV)nS(ALYi9E52;+IkUM2O1c?jk0d$+>*OWCU#dpeY_f$9PnN`6S| z+z*9HTd-ReVNEh$ceQ)LiTeT1c!=w#_PslyrvIs7*?zgLSZ87pT7JR?`>e0UB;nBn zk^nGkJuCayexW&@albuYTjN=p8~+zs>hoyEbIYvipU44^)#5m)Y#5x6H!`!sD1aEp z%fhszlxr5#3v>+QL_YuxHI1 zLN_M(wzb|CP(oZ(6e^_kW$EZM&Ev$6nuxizSwsgd%vWmj;v!vQfVbhl>GU$~aK4OIEJ)zBkJjtoNV3iRt3z9 z9kV=n;4ZzuS7`eWqy|~7?Gry-!0`Fr`}-JNeYf}eXPS?77pq%z?G`ay#T0iJbgfzL z+z(v^=up`;+NW zXU8SQ?VZ2z*FCM;+=T+(C7QkQ_gDPH@g`;9=WZ(#BX5BR1f&eO{Pz$>@p57~&-Kpf zMjF!;weP=1T0(yIEcNVArscsR%b6wjQtgS7@>Y6Lk0^@N+;t))&d;knSBk+~!xEnJ zDLf9%50?~kBT(xfoVkv(7oufY_Hvj^DRXU4zD=dg6wex#?y599QR4o8MS9;_<<;_8f5-C}Oog@Kp$zGki<4c)-?^wVsq-4#23)$?9=!TVx) z5F2koH?KYVUjNq_dX%*yPSBG*CXI5y-?pSFWpLiY6iH}49;HE^CV$EgN#l8(ovvEk zcsvrXdB>N!KT2%7MeO&h4`Z)-$=VI|nS8}!ETBhb8mOa`)bd`A+YiRX`|yJJUzpVF zl3n2~u$D>JA8{0`hOR%jYW>OrRJ#FdH^zAmNhX2dbKwt~8n-`frpIe?<7#s1}B^hQ42i*IA(0W3_qAHTtU#FgQa zRNdBjWG{geLuhYh(MGhmTw+tY)^Y%@!g3G|?=Zkt6|XJ@9B;tRFd4>nYpyxOb{IgiBh`^a9U<488}c7dV)BgG5SV z)?ck;P1}j2vtq#mQfgR4-?o$`=3`_pe~(t~;8aKOLxhr55JD7^q)TKn1q&nq&#>1` zCEuw6M152!HZ68;88kNsE~B=_-;aKu2j0RK6t(R4Vy_S5#@=1UXzEAOgTAoL(}|bm zThF5gaL=>D`0GL&hWc|<1PKw_Z7byQ_{XB2+@^gbBTxpuYb#GC%5b8K#GaF(B(qIR|LlU)_1rZB zi_`K0P4I!#4Un2nP>dwvoOHuMj;_{x{Uox*H&u9L)9cx-ewR;L;?~}#>g8~!{M~%W zE!WpV_V~(^z};W=`j4eoBh2SJazlar!>-Wy@v1{~fkuO|&o&1qd@0IuG_FdT5hAbA zznC5l%hW692VZidf}C4OK5&HM2yd`F23I6`p&;Xnu00r^89XqRsYHnr8?Z6z>>k-Z zVn!Q?#?nXkrAE>rV;4=MMoW|Bezr>acVJs!3IAE>ISbvrrxQ4$oBy`^ALFBX@yNtG zF$R?L$H9aQ!d<==H6E^OlB!$;Wf#gN66op0?s8`G@h_Ds$%!{nG_^gXU z=4>r~84S*wK(3g?#$kTd@%Xl)p#K^y(D?pujz!Iow9!Kn9fr_hqj_Ny<2F&sxYr)< z5B-FAa{-;i(oAQC<{)lW3Mo!|M0;lF1-Y9x^+QjHbK27~PJll9Ul0cy8rjGNWs1TW zp~yuq;lKdNZl)dc!2#6y=F{q{)tNXPTg9Kgpny(*-3A+IiVh@q+;b^f2)IVXKE(K~o}nL{0x;7)|sXP5nze}1lKC!;50 zC)tafV9#HiVoXCrLQG6U0af*u^<6%%iD&IA&&rwqjc~O6w?w3ffP_!Z3&D#JGQ;BQ zSVRr^@?bHHLw#_YslA}&v(ge*Y>9TTAtgvbEm=m-ag#YsGns0QOEIWYowrNo6_g@S zVJbnvc+L{*MuByJCn!(NkG^o=oSB-irfw`qBBp>yu^PeOI2MD7GxUz^G`B|18C0R0 zSQ#Wa{@JA6&2B?dsWuWPKXy*i()q-+&YSO$9E}f;R1Ap?LJAm#V?=`w45W?dRGLu9 zqYF;x^s}qIU`)T?h==PUH3Lu%eM;@4b1I0WGyc*&^GD;#kRC_~#NI+qfD2$I+}t>L zw+*hU;-rbz=-7ptH;>LtR;rQM;8P<}^5LR?vi=k~V%&y~jIKoK-MSSu;z}w@;T+P% zSZ8X~HdV&UUFe|tVJ~D3S;v}2R(Y8+IjPDeZE~Y^*`Wi}vf0@9U-bKmvR8$eabrT) zBj&+Njn}^|do2`G=7g{1b9%1HM;01SLT5?gE|Rp#Q;-|(+Bb#3O|&X(%oizUd0IPag4^asY$JyE zM8&u}Qfcyd<{aeuKv}1_R;uauGYoLgcZ9EF=3gW>iP5t*fZy_};{RF9BXs(=Q&EJo z#>lzOtr&iY{oJG>A%arMfs`KCMNm%G(+_%%<(1~#MFwbFc?F?R-v2S?3i#ZmK`J}< zobc+j!5PaL_p1;L>%!+f3@je{GXxQ<;h;X6>cnfWStC+dZ9f zhCO8XwpiATwmB4gzSrv#&@{yR%K$madA0lgWp5HH+fBfz@zuAr8YroN)aQ_^D-wSI z@ka`g$AtvbhacdEF62jbvVQC?o(lJEnKrcd57FDdo5X+3|59X6kB1L_7nJYUxo(Lg zC3)T4a!$hvqM=bb9vQEKYEtvsR<^j5-no`#Iz0H-kLkT8pXir?&%hl%7ttvdbAZ!~ zQvg-jBi};d<;Pr}WwdUnIr*@{;eizIMc_&FOnMLkUEg zLv(QR;CHwf8fTMdxI;}$$^DAk2NPtb35ZJq;fxFAyv920RV z)BwN7^b%gk9k%u`s!Dc-wZy$@+sr_5G(&fgT+*~{|LSi{&N``Z~>V7^vYg#TVT9a?nw_OYFyj_J~yk10}6~QqY zEhB;}7CMKO;SUYdHgW_tAwtCuJ4S@Tl0dvo)c(=vV(JSt6pf{XG#@c~dx2Lpn&I~Q zSAbgfW5t;!C(H)=N0pdICBSw1-(k}RD5?8E5ThK}Yu>abxyGph(QN2XLY&@2>%>qGyuE z-r`UdRuxz-b6tKU(q-hb+p%`>!x#le7MJlJ!lptxiYbuH{OjulP*>OCa8AYC>vv1? z1!$~j{e%)Xfisry<|DF+y2ol9-#O9Bw=FkQr2I%t8sZa%Dq+!Im8xSPquY~vj*;^H zc^0hJ8~w#GdF=*)=Y{OcP0rkRDaQFN=LML&pz-)a;*NL1`~jfR_2TVNx#Ib`&GGE@ zdQAcyHiPV|Y|OH@yOj@%``R6?(D_+C+wyPz=P$lv2|jVk$G!sd2PDB1qf|k>62*z< zj9cSBqAfq<<{t@^-H?}ElNeuy9M!pwR~aQ8baZ*bjTx^(OTcAqp3Ck2s3r=pv&$l7 z)yFecJ@%gdVtE&KSF3wHRuaByOKd)JYkt26C>)^M_-9a5i0btU57oe(SJHaYq@+oK zRA({kIdtWjf$j3{-KFh#ctwQXzptbUJohqp4|^R!^ZOTV@m7$9(!}6AkElMCAq{ z3g;#IjzI}Dq;4+9h|rDA0mHLYdF_7qT6v~39{c-nDvKSzoNVraudh5EQ&iqb01NMD zifJ;0J@k8gC^BW2=;Ox|c`D~_MmG$BOqOY&$cazWnLLeol<_s#ZSOl7)8)rgN(pE2 zHlP3J1rSRC^S*2VQR3oPW;uobb8L;Z@fvH(7vf2bpn`<|eV(M?^{lk3A=$_~vvM zao1F57x5R{_$GW}kHdX==bhbBDrYk>wCArBi^;^5L<{EeVpqw;ml47)0>wd+h(SY$ zK`eMu=5Jej8YN!md+xnYbSi9XcB2t8xgyV?St+dQo+Jnl;E=PDM^S>DdKd${R>j69 zyBT+cGe-EzvoXaujaF+*x3AJbVUp=5Q2G>Wve^DBa7bQlxmMB z@O%u3kh_{5!@0_MFYn%JpCCgrBzItqB&c#4#}d}b2?ZQP@jL=&IR(ES zHY~Y^z}A&OA*U}{Q?SqwIj{TKmu-D7vPMe9q5vk(M$!9J)8RCIY|-RA?%xj_26t72 zIp_?59WgTp7m{eIt6d;hpXnL#PK=1 ztrz=PH!j)hQ$|FGg=3n*lEr&k4vxW^b-tq`ju>eyNY|kZzxT9k(ELZif+>1o*aPgw z+c<5TGm)TkZp-kmoQ7oa{0%h9&&@+K`*x#O)riC&%DWBwYaEbO*sfv(i`H9TY(Fmy z<54&DM&jQQq%uA>Umqh2%p_{BAfVnzw`BqAxfKM!61m&-j*E@3k;u`oXb@g7 z3r5BzZvLohp81|VT_PgJ`L~2bMP~O7&d`q|P2xd&>hb9yS}y8hpEJ*XxiOIwg5w?- zULtF^L{1!lvI4L20!;RtU6bS)JnKmq>a$a~2TBQUws&eb@q8yv(YdQK-1uRGOn&ZG z$>x+0U+1&@Y(vhd(%dH#(z}i(T(*d>azJf;_j*6R1u?EJ(wUK8{KMN0nFZpJBuWW- zbRkMBJ}JcD`u9SC4PE5X=CX(PdE(2o!2t@^m*lq_cFd$o(Yy}D=Ie*Ry-5< zHjA6Y3}CBYs=c_rk}oL4yw}>3DG>`}yrK&h{!x5y|2TY2wUUrR1u^*V!tl{^&@7Nd z^i$Gd#A{T;m!&w1l+%w>SW)`@(OBSxkSSOoAe48AX(~)CFQ6r9eiCf02yDE9N;r5sMWZlGzGq=#5{fL>Pg$WK^l=JWRiZ zEiW1qFTYR6aOc#YMfLFyUwA>aR7NY&mhI@1^tnENTOQ`OV~;%x#Aa;UuSL#+qko01GR!8T#|1n+Ni3aH zG2@e!PjY8H$}acB@vXK~5&CJgu)Y3a${kkUZmPodEb=O+hX{f+w@LaL-eGmsh)Q$m za4Kf001&^kB2SAlJK!@`^lFCW=gjQ8^EvJ?v%X+q`RH z-OgUTcSs0#UdR+XuiShl8#YH>ny&7{wNhN>Lu`%8n-E2sD81U;@hZqO=;1UL@j zujyz_Sv5ot>5a|VoDR4$g!Dmf^cz;T@Ss7qAm+B`rCB>_~IPabI-8anYO>ySJvIpd*ansL1Mb}Q| z%ZNyD{LlVq=FfvVxhwr%+yk*I=hoksq<}7DlJCMpAk8fl|3QA-KHl}wPgnXGX|4&m zmwoBXj85b7N0iPzaSe0-`xtw=UQe4?Kn@NTNv5YfBbCf6AzQ?zr*(#u3H&D!S^!rH zPx$o+jYcbCqxf|{0lYK{+KCoT9|voj>3$RhS9~P47|6oa5(i_Ll-eoG#OcAzxGD=$ z-Gehb05fWVCDAXH^ZEPx&%!{vbQ<72j8LB%DOYvibNcQ1MdMj){VM1Aq@!-u{4&z8}*NJKr!a>&xvp$UBM-|A|e%e5XV9QjyEu@S&#l-Yi-h@Jwb3kRnw8 z8KpS`@EyyKgupOfqsekoxc}H_Z{#_NnIv82}74>dfM|*K6+%>>U5B4hb$wKfwpV zoalu*et16~mT13`hp#Sr>>F44JGK;`((^*NsmEY?^`k7;u_4bqy$(q8UCz-UL)>VU zmv8eEtMS9ve)l)%p`E&`tY;47KBvnhQDEY?u)^ao)3p~dA85`NTl_DPCDs{k3`UDx ztAmK@i`@xfYR$hqdLCMgU3Z)4$;pPrG7*0F0kJ=#D4Uc|-+PWumt6q^j99H&-5g?I zA`{L^EhCHFA60i}$;RvAn?S8krTGUeZ5}bQoOtDE+M+|C4Lik4&=&B$m@GlEY8(1UVWSYVDE1ILl+F~FX z?tJ1i?my16DKvfOzIVJmK++YrX=Pq>w^jFf%_^VSvRYXh(;NnBnDT7C)?=X~5sn4; zIYJP))KB4WV312w3T&8F9%a&+D{?5{0H9{uJ_T$k!iRO>}nm;WO@kmm;-^DOC zc5i`WN`BtQAv|r*nkIm52_g2Rv(r&YQ@HZ1D!Lv`u3^yY%yZ6d%&4>4a-K@Tb_UTE zd^xWjd8+$T8i zTCpPi6(j2aT~v3ouwc{0u+74X0ZvJZ`&mkQLDGr@aR_^Iczr*s`(qf&6Q=QfcWeHa z=tJn!+4zgB;vl}X?c5uD@Vs?sQ<9xB&oqE8u>M>z3-iOamywhgl$wx4lZW$y^+qj% zK&>#Ty{BelksmYx!u4kSbUAVb#D*xYI(EEVX2_(;XRgI_O_C3PdAgE&obE4sq5d2? z-$NfC`NQ_f^;g~;0pcr1%V2j!@y!0#7yAvQN`X^mzIpm+wr{IRM)r(wqQ~WbrxCXrXf^_`$cA^7ANk)(YXV5F0Y1VlFXL-Q+Z*KS5*$%sUa1Sk) zO3A21(PPyoEgIlokuQ#|S-@G(o^Y0gxPrDI)xje0IBl72=6Bv^MkqDZ;*T%YdP8p z3f>yppBCy7Plas{SH=d0_BUN2rLTZK#Zson_zpQ+VkPNKTL*C2;|^rG4mog-_8(z~ zr8r8VtYxMrojh`nF82rVBu)m$(Kc^oig8WiIM$XjH<&PSWJ!ANeN{j23Xp95ajwxt z)L-$Zq`cI~GmMk)4*@TetFrXG6YUE0-r7mYB{5cD$aZ=fJ$G7~-s?LW3ycF<%O*&N z6~pjLsQO-`A^+S#WaM0DzS}`ABM(P#*1ze+Fje6D#!mmJH(FYzHSV2Vj@MSCrm?Xx zaa}V>8gbsmiCm9rF8*i@72%p?rhTnPMYB9DbPyE(U5b|7fZQI*dv6hDA(FK#70uqD zGZ*JxkG2U5nF#jiZVM&WV;*pC0ea*;lSxY;3^WA;;V$R&9sk{MInGAU<%vYw7fk&J zB(xI;+h%CdlG~}o3f$B0H9V}WDSd1af6U8&#mE~iAS^FYQpgwxXeoQVHXZnoLvMKa z^O9||%9#4~E^$`TC=F?)tZEKYqRZBzuqJ6TC7Fj0r;<@=M?NKKf`Y{M)5ucaH1wUN z7bD3(5(M!WY-t?V(0h8eUIV%%Jhv?>_Zjtfba{r`xiF&TgDLtFIVt1bl5N#LTqP$$ ztS~OSE@a|SheJ`EV4XTr ztpEOzuN z{^!S*&*S2`^6%3nOo{Yi+abG&%jUqorjJ-Rgfgd*_;A|LbM+G@jyQ~+Vbf<~j_1pA?=NZASPN+dLkG@4 z7bRGpk>eow)f}lbUcWG^)jhrzp0$o`GE>E;aO|^nukBdfvf-sKf%wPV*!`MXx)yPj ziWSt>P!&rwQV`JR&A*P9T?X$y$1OBkuG?CcEOoC(Q`;~()TYjWOu9pdWYX_|#r5X1 z!t}T-g$*Zs8@D5r8!5n9_>10EZ)DJOCitGxn*)RzO8yUpQu_QStU})M5r$R`=+P!{J`D^rM+@>(&ZdwF5xwX~0WC61_q7Am*tj_)@tI!hK+q|?C8Srou zSogbXr8rsO+RkB=lR24NT9wgpXxa?ZZHjp4e$U=EGo`z6pd*Kdp9}EuX%~>Cj*#fh zGTa`iYHHQn+-2P{|3La#P6CZ(wPWX<5P~F-rPv|W&||1uap1q=A~5LW~9` z3WdEnUdW@RAmdhTx_s)(sV7c?ayoxWX0u(nYqGSNR?<6fTzR!U<3ci`#ux$GkS>~p zlz(nNUIPVXs8ILkF8|0)a;9Zh7F#R!M)GWnEL(v8Z+(gKo$H=qsy1EalqRcmSED#P z=7r{Tj^Dn1I-WaQ+&_b@z=R)IFN6u$ysr68>CDjql|)QzATe_Vj}c&($8tmBizEhndwq z^~5oNbHY2Ad(7DJM|KbIKvb!MPjWBl4Cu5Sum~%wpj_cMnX)d|Z~HA-iTzQgf4ON$ ziN#WcwRAv-%J0tOIot|?mH>QNyR_$LU-x*skbLea7$hxyjM5rM6F$ z3qqoF#e$_bLKWQ2(R$wPcb3a_wPeX=4&_duF)g$;e;#$Es5gaX0d4kXeU2+qtCH!i zKlkJxqaiZHM@W>MOz`P*PySXFyZL@I(G#!5+HUr6Bq#A;lQWL4hFD50Xz|`v3^t`k z-LLAY9t@X@H2?`SSh2W11I6!xcTy_=x7R}VfJ4r zvU;h7BK?~>vl+IP={@Lc(!S$mvB0oPv4hT#C2)%|%n#zPR=y~g+AydMKe~m15*SzX z;M;&u{|bltYwe)TtVwrfe&+<{0fJ)IRp^;hpT2w>nJY73Wn-zw&P-1DR7eX2(3SGbLBH$}S91s@+DYZ*6TWRIVpNM^ebwPRvG+E&(o^|4J9 zai5)ku|T3p)P_rwns`qCj2H0`N?foy+>4HT6*;%|W?Z2};(gsOTP@fEYKU9V#kG=M{XDNpq+8(?nE2lR`llpkDeiW*%Kwus90tP-({I14 z%=ML=+|vlLtvu5`96bu9Y4i-Ud~|R}P7tr`w^P`B6juE2d{_xUIY)*eE{3ctrA?5JNY&_Sd90(T0t+MN*isBb3cbSDrb1(D$v}hC8J*tVP1%TdCML7B0#cunAM|Y2PU^eT|FMg& z(aDoLwLi^bRE96N$+VDLV);R|@g1@A{QzYIUlF@Ra1YloZpfJVj+7S-!ZX_0CtnnC zd03!8&L*inCNG2kJ>RW09bAe}r+*rsDqRPPuBv-Jw*j1b{B#(WICLT$g{W%4Yn7Q8zft zGtdRW6P6`Ay?(j!af)hQU{ZFiN(xEvg?~+si{@x`GUG^m#Y(ZI^+U)(^tW2qE_nuV zS{btt3NTgw?g3F=>7j&eB^77p3TAJmK&LzuX>3CE1FV?|L{n@Pdg;EP)8&W^Q<~rU zaCgxORQQmG-mM21uc3j4R1(+RDVD5PGg>W80+iQ0RAOLs`?DWo5-}H~>!$OEpPbDB zvXqBQ7vDUd&EvjgF^5o@78&fjgH^PpY z03}VU&m&DmB4~7a@2GL}vp4S{Li<^XXGvW#_-H;uf>{4>yeG6;MGa3NU3f}qZgzUq z`KF{cdqAq*O$pKNUvWHy24)}YWnO>-s=mQeSZU{1S5z_Pz0=fynWl#6ENSAf`U)luB?+2HnAu}#c&2lTXR zHUw8RjRq6~<h6vIr2q-PxDc#-S=x)ZS-_7?q&p)uUv$K1)*TGYcC#$ix)N=G!5UG{Lg>d!U$BtF2jC9TZ)H8@dOJL4EZU3<2_6A0~faTpRN8A z&>J~^s1E3~Q9>;^XjF>IpaQJT6PF(=D-z^&`GZZCxm_5PqZiui?76Ff6Mm8`o!70} z*y!8C625l*gn-GgZ@)mb(nR8%=*N(7hbBFa_u{872AA65d%_}Kk`2n&k}&tm6l!D} z5+jMa^b0@8jdaP-eHL&E$skZeShNervm|niAiJjff8yvthVQAl*Fy{G$`qVvzJKd# zqBkVN3&^>oqsLxSe~Y zGwgRcgS;;>&P)oJC#P6JOmr+3h}oD82y$1He5H9y{0$V=`R56^oF5bG=^AIu15bS%$x zFDn&=&qxg6>8LQBDn#a_iH@Vod0)j`htM&49`SBteue(|dLI~)pNSy;L8~8mMeKM` zeg_bS;+VvbdoqX}b#NzEsr<-`!Hl)63t-A4gy1p5YTPVdWcQf732+A$2hu(!%XjH*a3XrY!22Wwe6RPa(o3I8y5Yuag^y=>JgzmH z&P27)uC(c*4~zMH1`wov|4$1&aY$^ZkT4_H(YN^tRPRfE8Cp7p&u}HoS#>X}`X#+? z=ss}3p`wk0t3+-6dA|Rmu;?2ul+ihsLtVbCwTxB9MmdPCouO!x-MoD1a&Bm=hHUSO z{gZ$tYL^s8tc{F4gDgcx-=uTqY0*Y0+~&&jZ5D|R>DF;cm;O7}Zth4+Z8(q)j z2@xUuvsh1KnkEsO5B8ZnHdfZu&ovnsd_1i3PEZ8eR#9PhQm>5uXz2bb5hQJjQW2lx znlJUdYQ2{DxIwWNld;QgZk^rsei=RQO6*9jE-f7-l=70N)5_W!ywJ+T=(uv>j9pWw z93YQ9fnr|ZI!xnI<;#<>)LIIDbRoRt2|EXrkGEXhEpkH!(&S3yaw-*;DTj0Jz#_2~ zy{SY&KA(cXBt`~=I%%XMR(uzN+9jr$=5(4?B_YJ#OX8L4CfOX0=&~r zHx$+MlJ3i@PV-w_QbU)2{Sw)OPH~zhwZfx>gW-(c)@~o?i2Ma5x!>mBuXujK@E+=r z-x5bjO<`7k?mk;{@cRZ&gCzCTTIfnr2SoP})M%iEpayinDGkmC0Tg+Mj^c5X@C85>7!LkxE6{Uv8VGmeso+vCKNb zPv>`jZEISXJ=#|zLQF$RC5~EeYKc%3t>!@_A}ax3HkjqDp#>^r3R%17yJRI7iSaR~ zj4qwvWW675)r;=)>y6X;cEv>ws8v$9$R)095T9Jq=NXQu|D^G-kAQT-yAuKya|+i)8U&z(|6r# zjvVjK&niwEkVLBc%m=$;^TA(Yyk3jPktM7`VY|S~4<2>{+XWmWZ z7pmSJe!B=JvtapWTEKuGno4j=K-)ySJNapvRz&GH9Apnb$*v_fhJY1SiM+FGs`z3njt#NqeTN~*@ZF;?zyCZgvNFu2qXq(j!TDNJuF2a^)jFV0{ zO;cs{f#jp z=d*lmZ0uzJekR~gw&`tv#|YKbBUCSpxiZ0lzMX4|DD~@&bfz^S9oY@67(`86b@#XN zO`!)n7=={)n1GXK}I%RAd^+ZNGd&!BTT8`xAHebNuUDUDA7 zI!WTAaO+2Qb^c|)JWyugI;EKx=*GJ=&-RG#({bnHL*j>q;0wzf{a<1N!LWyqxp=^5 z&53xSID`5Qz06i@{Ts*#4Y0hSx_j=dBJi$@{y-g*7^jOEi_(E;PeGX4HBSQ~^*w}U zyG&VF%uc4lMqAlr7$%bo_U-9jd}&uyZCf>pw`(Qh(I@UEYkp)&|AafT6_xJXPM{|P z1qDFz&w~RiPj`oEyvDU!_oW;BmIj~E|G4#dFw+V-Favd-15LUoOMoTx=jiBRt^$NX z@M2A#%z1#X`$HSpe0=>h@+WLGCKuA}o}um$4VIb}1xlo|PbID|DKyz-`>-Y{BHBiw z+8aI^n|aloU25?#d+RZ9QYfUy7pp_33H{CspK*`iw)KAKlY|O<$?tMeZ!15>dKdhM zylk|LxrYMUGE+{a!RZXpE!U;qJckCw0G;LqrVSnkpxdymo-8`!+(GPm6{3k~7Ee%% zJd#&-wnK2HzWIjn*)r27l|B-%*_JbCu!!&+az>s$&ct94SmmroLrmY2-|VQrY2$70 z;JIZrmh{sQ#Juagu?RPS`|Sj1u1g6(Y5X=AUwfDYHozwBiTE854@|%Bb?Dnj9+mcb z+zQGtpVcG)@Bf_8Xf+3T<|Si@=X{c!=7ezuS89#xRfiT73ygqLg`Rllt*dsvM)7<9 z!9G1^WrGg@)3T>KXq6D!OOR^FCPNqf{F=|_Y=vq6JhFTu_#OTG?`JF&NNI9#UI-i& z>VS|=4jB~UVE^rPvdvNW?3?>uL^pkc$>QGJw>zP(g_MH*^n!DtDeK%rfbXm)o`&%i z(rd|rS$SpE6nKgfN7!n&2%LH=I>T+pIHxl=N(=cqzq=QlYbveN z6L>^LmaX?Pv>1ms#4(#?_@ifSn?F&ld}UXE+&)>FcJ{rJ?~_UUCDbyos4C%2HN|a> zyV&`kWq+o^62RGM1Y5+#ex+=lZV~6m&a?wrmmk(`W_T@PbnCWYSC{kP3=!X#T|v_V z;J&1@d7?Bknk|F9F9a=sJ5T|cH3CC(BExQHQ6>uyGqSmV4@@3SLkBWNGgQe#u8A$` z!I}qxmDdNC5t{z2OvG&QF3V=t2#K4Kj;j*Lm3Y|et>D>-7Q`9}B$1k0{R4Lil2G~0?6%2!~g0`R3CN_H3?F=;> zlo;PI@v6}JjTgdiPO}%<#d2snOZ^wEGX4HAt1B#18GkYx(#!z)i0^Gst}@Bfsd^&= zv!cI#4nU2m@(%iOAu0zR8ihO8%lG~W4g}jfV}fTgWBDvmlii=uuc?T_ke@)_W+8F- z?9rVMIP0q|Qg!+BSMH!t>YxFUZy?@I-De`7DsSSoHGUnySMGK`cf|A@$LGIf5sVQh z#g-BsKMQ}aU1?&(x_lJl%X;TIUyLTteik;~vapJfB67&ZUWV8e)hQ{K9VD^0K~|Y$ z7lF5O_tfytgYx%|xYBY%eoU5Ugy10x|E6|O@={^Pzy*Y3b4)()LK}{55*yqsz;=*P zf^X^IovNS4^BD^*ei|PL=@&*EefRsucCo?)>qOy1cBvVHM(iEXWi{8sh84}NbmAPc zVBwd4Y{v7}2k}r!^qw6XSvk3C^qQ9t@cqmH2=20?hRS^JU2_glmQc}e7WDsiih-+N zJsyfW{va7V&FZfqNN`vAKJUdSzBa|+Mc-N3jC-h zV#_?DO_oH3<*0@oh=&!2jm4Kadu4Ke<9J=;D=t($fk)yolpn^%df4+pM)X9-y?DXh z(Clx^k<}@aDV0~e1xZhfw7SMjCUi);@A=8+#+)=j$l7K);N+TZ{?L9Dsyq^)+i=uQD4?Z5ExQE( zs>Q7^Lvo~WLP4Sfv-j8A_x*E9h$mu}obVKtzMl~apwB(2++j+Caoe~v_phDjPKupM zG7^*0qlI-#(V10KJy6G>+L!ZmexQ=d>vmN0aTwh^GASY02ZLbPTA6tUyp%+%Mj=98 zJ37P4Nz_JduuT3)WwT&%y7{82=%>fuCpv4*t~VS}DE~@a@FtF8T@1NVA!!w6$N9qm z$QDLcLV2(e6MTwqU(n|^{Nw~Xi$M6hxXMB|DGm&J_ z#Kp(j9@i9?oEF^)k7e$eu)Ok&MV<8X4#UQtoidKSX$i0y@<_X@LFX$btn*A2F#meWX~-N>Ng=c`4>Y%G!U>at4zw^s1o2ZNzEJ%O4xg$5Xz7B75R zv%qg>_#!buJqov7Cg?xsoF>@-O*xXyK)?c$#>77r}jE*~{H_>FJ^ZO_G>HfAKNs+}pkuBxT%3lcRH!}){^VX|L2?`i-FZ;_()V$k)9 z&@O^lm3FVPgrI2T1x|QeZvYK4q?K+N)x~{tO6jEA?B_o?$*}0^3Ee12`AEDr_#A)9cP)k1ioM|$Kw|g4SkjK2v|$gvY_|Y z4#w9M#wmAaXNFFYb!oEx3v28Y+gD^s*knn(4BBF3V*$*T7C=)u&Y{MV}u?_2oVC50({cD|?P}tC{yD8sp zi0?60t`u8Yurzp8Fm$F8n*a`?Im?GNRyJ7gdr=2`Z5=g*ivLw468jCKn$gnoK(J(i zCw3xHPz7_m=F{}U4`$KVxJGi4qr@{o+pk*co4r>`;iblZ7JzM+_Zl7yw>x3B(eK`? z>}MJ;9;K#^yR78@7Iyd}Tjd8f@1}>VL1MY zE8?~@QS@$AmlHEtf&d1CrjzwF1p*qG-GOQlbBv0qr}g8pK4+%1SGvj6FWSW|z%RtA z*DdVKy6~m_N}LXBZxO!S@4UN1_}*1YwS55m>>j&6D72vzj={m_+(9LfB6Zqs@&>Nb z2p=n~FFlT{bj%yoi7oJQb(6P3MqSc6)?5NqP-UXuZjE$&Zxa!V=mwfK`L3AP=EEkr z^;c8#zYUxka?qRdF>i%$&^41Sj6RJgtVjJOQ;CStW-%)VDbvnY$(`TuI-B8?xOVF$ zu^)sR=%|(WsSKBYZZ6Qaw#W@m%&fDqKQw+aoGK&vq*2dd!3jL0Q+JANfi!{cb% z77DdLX?3_M4m~R1UwNt@dVW596GoR?WhT3#_&SvFPsYsNSCRu_mfSzZT2nG|@~FQX zpM}o)L>gWe*9kAh3oTN58<*(J&d=Rke)5JDPwJEyCsf`f&7=jMo`n+|Pb&tbyMdy@ ze%$9)%!1sv=yk$$wRtpCowg{h^m5v$43h&A@t2Fvx72}ZVkasfxb0o-t1g(UQ2fYa zbXx0->c+p7-E*JPR%v0#tyU&HFOEUFVJFece%WofX)?Oy%1G+?c-Lh4?V`_pu=&sH zda5F!w2S(TLU?6PIUOj95a;X9h)x3Zv_3>r3~|D(P6onerHu}xr`L?o8B&Ua#{Dn0 zt{049j>QKpAXBqWMyBbvHh@XBx<%iWk_&aXvAqVngkUVrJ@HZ$F{g9fua+f0W;Ke4 z>@OQ*a8Yeg(?M%mdbEZFtf5NN{=26$9#hVLd${0wx^sB%Ss=Cx zZ_$xF>&clshI*TM{30T6Siuqad;y6y@g?ncSNoFJ=^S;Fd`x@VVWZi}B7sNI{<8b6 z%@foAKtHX+4V~L?^>h_=zg#gVb$u48*I@pV>IYFn`;vEf$+=Lzb0@8(-R?h^S70Az($Du-drZOz+MI7iFpWmWfyxWTA( z>c~HkOX}A_Sx38gaiH!!*a-n~PD$~j98K-b^RE%;Nwe9(mhj(FdGAK=@ELuXo5Wi7 zk`l&0Ncn=cD3B9**c(IaN=cx|!&w`Tj>}ce)8V|(2GvC_>v5a9^@RS*nYz@GIm{Sc zsP*r{7Prm~4zus5*y+8ZOY75m)HkNL`RP9X=RbZX4z%a-XX1`|dtGN9lw2%1T-zdv zr-xGpNQY|)vJB- zaJ2Zw^7PFa9nA6_>v5rH7c(OAn>zhrBlEO1CK}X(Xgm!SutzqEY}7QJ+4Z{-2-W|?QD6iNGqCn@F&;1@iUzl)N>}bdVu$z(p(uEi2)k2 zV^Ga@<1>n=w-i5rKZ`IfaGKCG>XUkL>yw?K&Oi(L6eP1kf~@MKSmh=5NOG=0Uf>g- z9BOtmHMR4=W0~d~v;8<39jbe{1Osg3x|Ks*1%}w$J_yVicf0I2E1%I)EdNVzG{bBt zv!NQxl@K-Jl0$XBrcjc|$LCkqJNtQ8)FlKTRc5bU z3!k*si{*)mz*hQz)_5`g6l^!^FAtiSsgNvltl54VJr&4|eDKRv-oVJGFRx`k#4E^$ z4DzJ9Q?_CK~4I!WHA@Who7Jo_T4LfTf9#Es<-egrV$o3yPuESGcx2lkTx=`+bGNc6Dom_ zAVNel*1_NM^Q6CTzABEcWtKXLyx|BU<~ag8R70K>)gl}A@N0>ST7SkpM=E))Y5Rwp zh~9Vb+8=i?xUXp?$aiQNoEenTVQtJbes;^!>C!CHGPN^QdrKWNOT87Q)?L)fjs%44 zPKt$NhUy!!y8c>=w6PZLdW~}dkGs1|_y_v!-;bt0)V2pvW@&?+zwh!SwZa!PzPI7V z4aR#uol97q(}V#(3G+v!K7qJYJsyhP9&1$9e-6~J-a~^E_1u$vpG4S+x6XGl)N9?N z@a%S__qDogSi2j1=7?TNu&>T+Z#P@Nn4Twt=;+(4HDpBNnbJLu&IxRN8X$8Y^jdWj z2;vquqPKwvc1!8t0?eNKqRo2r#%0wnX;%G{S6S;ZR+nNE(I5*IEqn!=sQ@8`-l9jK zV3yFUQ6UAjJ?o8uNa>vCR-E2BJ>FjhaNq|nE=&eZdnk8sWy5?}!|4l?&dhMy1)84P z!~s7@>}FP0f||~eF(;Zz?zxWq%c_ZQ zlO~Kes+63wNg<{5lF{OrY$f8G3lV*_wm*Opb;IUard}wrDDQB}pDr$tSNywd#kZ^& z=8@ackU*F29}Sic8`&{S0B~~CdD`Fe>@QfhvQ=S5VFxd@tL32sMneXg`w$jW=t^Eb zne@Mq7Zr~6nr>^;#ZHwj)nvnRFyP2u@?8?#FZ?CPsy!kNVzsxa!-q)Za=&70RMWO) zReDRS5Y-=@XyPBLb~c;*A>Jg92_eqGeWyU@*m&G!3(Q9k>a&CCuN2dcm=Kcs_B0mc z)%DuNBpn5jYzYSz5k@m&+&gYji);Pk>Gls)I+E)7-Jhd9z#@o==JH?*qZ6yIbX?cJ zAi@EY#gEIklODW{B6hOI=(x=HI!1mD4?=3{K{$=XdsS-n5Fvyj12*14=P3pVlbO9u zHT1ybOG7TiDysbX(t87k?@W}j#&eT8CNIOglLnYzD2|;)9`na>0vp-ac^9`M%~zpD zS3qol;S`5w9)5p&%0}PL=yOwEJ!Ptw>700_z&Pdtr6={K_gHYzqp+-_;!QNRmH3Ig zi9wA)n^!l3JYqtDo-TTgLppge{Vx7|>#-E0zgBpvQ=OYxV5uTdVi(J2(- z)A8c3lB9pHbx89abcI(rG_RmE)SL7Ea06rM#mH?ezfw5?W0(*LHL@uk3ZK<#=}~R0 zH;Lyca@=v*T^+r*xck|_*m9N8z)XhZ*b^N^Q!fjx4rDfr!xX2!sS7U(Izh6b1St|B zkMVBh=?3#atMTE5NyqxyKN#H_LXZ+R!N;P?r;c}5`EL(yxZpSTQd7Hh%NA1S{Fdtm z%@#{q#z6cvuXr?_F}A`oxW&J$t2@W4FHG9nLX6TrxIf3dO(5QDSVhuGXRbig_5uS% zx)rHF$diPIW(wv3sTk5glC$IZFzckhFl8uo(Zd9K8-A?0aCO zn!N=J>ZuUi{j3dGiMc-E3w*eU3cNCYbZ)!w;H=*C(Gi29hJnUJ!mB~+^qJA0gH|=b zW#P`Xxo5TZRTV*7hh-gDgJ-m}OjFWbN|78oF9I5@vao73W)P%}ZC3C#U zuS(zQ`vyvk^qg<{bejLWeQso~wi0wT$+RNp8P3u*GQPID`QP3{DJA)}`1M`|m-Nw; ziK+WqEOcX9{+x^WrI+swl4&?4Ayb`7q2u(kbD~TzvJIapZJgq62S#gxR%>J~QJVV0 z_&Hq+zlhOmZFGm@{%~jKDw48-6P7BUZs!9V+-_u7;^q-(yArc-DJDJ zis4p~VO>!UqC}*11Uokq7E8Xx*1ThJc*>CE{3{$c3aC+0_mMUOpg{P$O!eI_{um$q zFBg4G&g+KZJS{s6`@yPHdLHR}n^jJ3e=bH!^3riUXqklU8{0`roNLiu5vh31ZV_e9 zzyf)X=TcJEZ6~!;SBTEvXhJ2F5}iZ5%W=N+tqodol0^LAEAL*uV(DRV;#`T}*ysW- zzQr#CAhFQeu>s66Yzit2IDFJ?!Wu3cb#k^UqPwAXyKFB;wyg^1&u96HtVVET6#4t! zzMPyZ-735@GTiA$?T<~P5 z>*RliF~n;4`B)H5%33TG%ooEOxd<@v39l-V#}hjJFURZY$}^g;9GM})vZfhU<2ai4 zssa{|1wSS?|1Y>Z5=_QC(00R;#T`N&)^st)Md%HYL`2k&NA5`Hkq1X6yL?D6jT-r! z^#yMg$g^iegr7G17`vVGmJF2!nZ+-@3-3MFri{*BPc&(s1G*f)3rm~D>@LkL@tZD^ zR@S9t^aG5kwb{eal80WJ%_FFX@&hH}7m_AFGd9#9$w_VLVY|jqGl~L}d0**jMzm|e z7=C-6oaGXQFr}b~Y8$Ukb*z6bFhec8&DY%bU(0F=?H#@2A9sn)X#vd|LH!{hMl`VH zR6T2%T=%nF85{3ZBlz^IJV`I4oUnu;gqwO6SPYV~^I+Xt14EmtNGrV7zw2yB&|`OF zWWw*Rl1I8^O6xXKymW2>Q)oDd2r3mX`jS8n$?Ew1Cl6zaplkpg)J>a|@ZTRsCy5qt zm}=w7RfMM>JK>$H9r?oUq>j#<(&rVuS5u<_8b!aFRqtaHz&0I>Hr~h3Z`Dg4S3NR) zGA-ANCQwPdzrzrXV>DZo+co%pzu^)KrBw%>*fDi%e3U5PdwX81hcWY>^Jkqwr> z>L%mge=r?_+i>@AoR6LvT2Ta5SJf$*I#ICVXgf~;Uz#KnOTkSY1BWVK2|ECZIzUSm z;_v)Bk*+QV0PYl3VRnPb>xA0)?Az-fB0a-?SWpoyUplD`VPcpL*22e2Ndgb2gkww* zf(lvF#`(QKE1?DFjs?mf8LV9IOaw+$&KFxla9Z7AWB~CEs0#D}$lXqGe+a%@l`eg6 zE1ZVQ(fsd8=|I^eiCR(Q9$#^HZdJ&}3t#1qG{}^gwUIWSY_Yq3&c%J_-Q<4FVg{}^ zj;-4%3Kmn--6YPxs*UVG%gTQZ81ts`uo4q;l4Mg5Vmynun`O4KnDhOi_i?Yh`@OUZ z)-nKbJ}d>(5=qUn0Vmx%~eu0H%4L8h+~l10RC8@bNHA zg47s5xF^P9$UBZF@sBH>Rrdi3J#J*J^rb+}CfVi>20tj)6pLWqnh)~8=#V0jiNioD zIxD^2*i33YpEgNEraRvd?6YBmSb{j!zS>p8u!KZVcL1J*A;-F+58up5 zmo7QRU)&y~($lB8h1^k$?C(-Rk0I@d4nhgEb+{4g~h$mPC^cIFQN#PzPuQ)UgDt z&2bF=R-7m0c=;7U(U!9TzWGo>BOM}H=^ULi^4lL38(yf&+aze`dJE9}dQ;qwh;Hfu z9I4eH<-1BfEDvyFucpYLsb}v3oZp7GbsXn(4D8yLpTwx|gkzATa-LPr!T^&$nLeob_Rj)V1mSA&5-Jlp{ZA? z!e}-BsW-L8CVJh`T*&S)(m{3o&qORN*{p$rEahzeNZYWKw@CfiyfSjE;XFRrZFpf+ zX4e2CDCzR({F^FItj5nG!Ev=VV_Fex$FSwpyQJqcN{?4FNpCCWOy|7WRK^t?A7UxE zfooRq=p#w%Md3)6o#ibh8BI-;bOhkEDqd^gR?z2>R zIeLi}c+c?jq^aqomGqKm^}Q>#L3f4+zP4j4G8pQ~PJI~cDzqVwWv76`)we29NH$UX zcL-i^NN>j*vnfamwE_E{GX?9Aw8dRfdGJhonc2=mHH3TS3meH!VFu&u*X{%Z$K?Jv z&EB;uMy?$C^AV*o(zaBzLc^IN=yYK^DEV(%5OJHFM1dT2fXk<~C~@=~8VmoB#~~o} znngt0V+~W5X3x>hIeIMd81M|ifhyKpEM1Qi=SbeByY_-Y=_EEsnxJ=%wC~W-ru-)Z zVDCLr%)kpl%OH8vkaiI4TXwmkJP>^Gk|~fYq&(2IO#WFR^F|^SALqiE!Iyk{5I=~n z%a=cYGqol(9~5H$`T>1Kli0Q3$u1dkHlaO!+9-6f_9W)6Cx(xQ$s3g&RYwn-OcxxPX6 z*0eP=JUpvS2}pJZ$kg<;L4VCZ;_%?G(I%~MFrm~NK<)M_vrmsl0`3AoItYU2z_sAq zZ5VCP6lcmo2m&#qw7iqLWpJJqdw_p9`UekY<1y!zzvDIRXG|$EhR$vCJig=|YS-(I zf_rH1{_ztrqNAqOpR)4OjiDcZ&%?5Qwq5M=$R>wY6LGFz1Hx%jkZ`LYQ0h@Wjp=G| z8xeVv@4`nsM^6QbsU$-NAC=NKunp!!ECXnj^jErR5iF~KXl}6O6bdz<~UH2II9sKy1Ir&T3a|v+tw)|QZ8xK2#rX53k zW8JZ2fcbVhB{}ei`e(fh*XJ+69sI1`+pM+(<0snNpzn;8bgTNZJry&A&g*Q41S+FQ4t)OJ#(Qus!8CKw^~X(Mfi6U zK6KpFx1%@gj6`ALxjVOv+w}QQ%h)mg%$nZN-ro?sv+g4&X;zmeBIEJW8V5vOYSb;}J_q8j zT0_4MZvWKwwORf2F)>@wzJeVQDE4h`dO8soDx_~cXq19T$IFQF>}uR)s`S#J?#?eJ z#`!d?SN6>G9jOQeF#z@lPmPY9(w6#=Rs}mx&S6lUR5%6(bMb&4uMVbrEQu02wFQUe ztG@`6O{JK6+-&v|foUz0q9kw86{Y;i0ZSx>w4#{8y%any>qo!fS z;)V2VFftx$iuUAZ35I|4B^YQL*!WV62ir}}#Q0#;)M}hc-^s$6Rm7lgRzY3@9*dLY zC^L6H*(4?+0u~tLcZgm{v@EpO1!k zO*P_h?I%=yZ;>K2ff(}hnqGdl0}|4H+3E=CW{JgYPRTY_b}GZx$G&YCaeXGuX!5i( z-r6fXaR^~F?N$H$t!^cxiRbtIqMxFtT2hu1q%q0LZPWzk3E~BX4EfhBgLbmZx4*`9 zlLPo<2V6KZ3~yJ5FP}Q3;g0L3%ldN7>o#6D@iAV%GD3p8TD(ezcCZpp!+lmUzA5uMS{7HZQ zAIG`i{p54OgD?Sd^QGSIg|V=s-2|!jRU$VW&D!9Wi*lOU|E@tz)-ME(Qr)dNq|YtZ ze%`HM9GpC%k_fe7tL>#*(qT00jv3LC@FZmXYHaW$!_>N>x8`Qm7h+ZP3au@6hQHFKk8?9z3tp2VuJREbtDXN4OH>^(6y-Gt>QNO&k(lFpixl59SwW^pEVlRcz zh5zWV(u`2&0a`QoI3r|7)U+QmKAo-TbyHe~dIn6Wbt++qh~m8-{}MrfIgpLasHC&B zRFTX5Ndu_MYA| z4Dodax5OIpAM{rzSt^SKT-qG&^;Ow%fP=-!v9pS+s`j#2UjIum;iXCJqLWv@!5>QE zjbuy0Y;3cvoX`*!DvsjR@8b;bsEtcu^*)i#rbTL%R<&5I$T$q=WD+cyE66i@Hm7PP zR>r8#=g7e#2LV+Ii^Qv_r}zAeuNOx*+0>_1kHgt8d{xOY9G7J=sP{Rqy*X!~jjyTP z{U!Nq{2+_}6c$G37Ec%=;5D^u#U5({`j}aR^g(|#*iR5;Xpf2SMu&xtF1yF9F&cOB zp}muPk*IA@NdV(Rk3?3<_|6A3N@xj{H)SF zDH%pyqv@whm`lD zWZ#nADf+dS-XOe>DHyL@uN6f+awA>;iU0d8UsL_vrIU^{$KT%~wYEd#KRak#1ONv+ z{vmmjLkyl4rmzTsU#P+P)5xzBOtm(su0BHv*`xkgH;jDBu9IsBd;bq_TZBPAn6vLp zQqraz^`0j>fnN=kCiHTPs6;W}JB&$u0kfh_^wVX8pegxPe7X45_f^<7qCVP!rs?aY zOtqa-^bgG+q%#{z_jd}6-CzS+>di?LP%+dVA$g_N7s=o>Q6JaOf3pX^|{SvHcCbevit-4}n{^>WY zjRUDn6kgvgq)zSi#jhI_GXBNe*3IB zYR>}sNg+o&&zibG_rOE71L4H3Q^%%zQ#FmxnRA~#LuyYwqkim9P0Wty^7=ax`>a$& z3C&C!B-=~C|5uc)NrXuJqzIXQ(x9Do6sNh(Gp?BW_qn>He{x=wu<=2G=8RSeo9Fto zL%>r8pc~ObQ@4LLi<~HR73K<{XB1|cu+}Ilj>W+(5hTD>t-yGbp?c0_BOgk~6f4yA zB`4hfCxowWS26W#9KpWczVqV=7xB6MgOJnK=!WTqXB(&j5zI~UFw<2i+qd@z>)RS? zbKg!9lonp+s|CI5e)1D+vShk%u+UTbNmb{qj0j!ezG8)c-;M{u~=YUWa8 zJ|C~~W$#*cY-Gi(hGip+$6njj2n!_HWaJ(*_&tjX}h zA9KHXy-EE`Tzu6ipZf>nKPX%Q7(0be@Sa!#syUSl(nn(7+vvxhcT@i%zxwv_a|fCl zZE^7{w?2-WcE+!V5;llQJl%Y6WxDn6+W>?L$Z!7jQmnrV9Nj#>ag{l>DhZc~B7`m$ zTWz&w@nLWrDMrIE(C3tB%9zwfR+N@%I+Mh>`l{}V-^|=h zD2sv_ZTivEyXmK@9|Z|_{GMu06|W0a!*du)GMyDk=12XyuSW^gW|yorw>e1edkVDy z9$iDoyWBXyLNSI!#ppjz!7-Rm~LfzOmD~-+1@PTZoN`3{jWZ0xk*0>HfQXz`%96#^@7>ASwGACO*TP*ocp}y=&9go5}a6D=k2&ppF>5Xa#QKP}%yk!$j zK+bF#&g{*z=T0s=ejFKBY(;9j^D%G6V3fxU9{+k9qz-o06&X;M^_Ynp!eZ3a(jU#6 z0&HP-XJ}N)?rtKw&##^FW&KJJ;Yo)%V;Vstd2P2a#qyq`%b6byuc;y0B~i)Pc@rGY z6w72=@f;8kQ`f`2J1LCwO0WOc)7$|ix)05y0%PSl#tW-VUgRU;4aUM=h^mOIe;Qgb zqh1R`NDXVQ=>mvFdXD7JOz*_y^nXXN1?^pu4Qsn(gvkWd&~X(Z%mh>$u8v>askOdM z;gtRtZn7qvRx3YQ_wFC)zB)y`T|xcq!BCUQ62)4G3I=2$GA!ZSi@ck!9S>%KFH2>j z8<@%6Xfe@}YAR@-|5Jk>&wo%1)6YgvowTUBnBQcy%$%MQR^reSwFMd(Vlm=G6Xr9J ze&=0PHZj@7RdKP2F*7AdFszgkP9X!~22K&<2@oD8IJ%SY$~Dk5bV>rYhERgGhOE&9r~p#;KEPim&G(*(A)0dXT}}ytAV%et0^j!*V}B0 z97mwt;TFj#j&+1PzFXz|RHP%*uDI%bnDk8Gvow5ZZ^8CsFX!(uqCX^TP}_&iA;QsA zb5lS@QP|aZ$IQNy{%MlOaAKoP0xj^F6lb1Q@b@1t*!c+=`p(#$AN)i|;T!Ky8Kc}a z5|)dNqv3>DEY!^xI@23Ip{s(lL(a*G9g-`dBq22`jGhcjfzZy-$dzQepih8}>>PS~23AZZ@JA93Ql&o^6*e0-|1Za11*Zye(N#i-jbNE`l ztZ4Si8YtY@u?H3d&p6XgR&-MkN14^_qg(Gtf3${MYg_bo&`NL+dA48UI9Owm7S3+5 zy0phkc?c~-{K+AVvOt9o864?qWbfMDK^EE$mS_3LG@@tq$1sVp^+!9e*aF1 zv}E5?_%Z6${}Ncop{?;=<2d&JFQ!b0)z96a#-8<{*V{IoPZa{A5H*b`Hu41l=!_N1 zrQd`Wbe*C1!O5HCkUs9UO?9a0ZKxECqmMRln|xQuMJ{{Xui&ZI`C!&JTF*CiGP7A* z(~fcf>5rc$C7*ngUJ zB%PYDVBK{|maNDquR!zoDKRD`I|JA_MP#hsM7(p5UB{_Q_{Y5J1gZ4NQQ5pfLI;D} zuzTVKl-_y$ZWhR3Pj7vpRGE5$u_CE?m}ciuAR3&OQ#uX3gY}xn7~A_bjl_T<|s=z{eOP{C^CDn zUV158HM5{=fEBiZ52ifUi7b5tESEr^spu93c%b}*sH*jcSjLd_{mo6v=@+gN-KN`p zr_!072W)b@0hQ{y<=If?#5!M1tNT-wVm+{o-S^;xo2=fUx}`H*XbeNI%o)8%VXp&Y~G=7P7m!KD*zBOO+iZzhlb%LpQ&n9?{05=!$Lq`44)^!v`ao9Xwtaf@-@GlCbB^I~?A1)ln?AB~9L-LI!2^!6RfaC8Lm>M^*Bnws0*&xd3J zi;{XGARfjrd3h7xUiGM-0mEpLHEsv3cX5vHz~^8-K%EfHF>je-g0LI>vK`ES9dBGU?9iITUq-7rN$B@_g zlSesBx15Pu?cra+Fqlr-2zcDwpXK-dN@`pZRf?_qxlL?@>da@z{ewkah2A>@h#gcC z5Go>Jvs~{jfsYq%r9MXITWm4auUN?L5zJhvt%scyngjY22wC`sKxVHEpY2XAku%|{ z4NorBT`pgQ@&rf7^u31P(Sm>UMDn{~HpZm3hcVgYRo0P?0e|TxTlLnkI`6^0(%zuj zXyGLhq(TZQPGjZEvj!-OeBzosk{J5GdWqv5et8?=oZOv z*Vz)6upUq25svVhNk~bob4QX{3IpJv0{mAqE_1Zu<3Fr=*O*8wMo_A1cSGP+_f^4kN@T+4B~r& zHGYIL+L3Xp!)?6{<`+=q8tUqv(d7xV_T`S`jM>`j4oGS#Md{hsEWRNzHhKov#$}y^ zC$yAjPm5peKE~VxdX(A>fOB7`u03v<>^nio(|k6jT2c05C7z3q1RkI7OQ$B}Gctzm zt|v{L@8l~j;jyy8+&x-0vwLoH2J%wg&Adp@8psx~D9XRRC3rV_Go_dhiXu(D zp9__eIemfrl4%^<9a%M$^82puKjB+g6P-GfV0()Tb&)zajuA_n-H$L858w$!GRu^; z>Zb9fRH~7AfkZFUSZX10Nos`Bfmm(0?YqyEWx$sIGi_gjcslWdWq<)j8$Fg*?ghan zki7L%K7{(%qg=jcCRkk+LsDDg(!4H>@m(&O%<LFP~x36%)g-VJ{iOIFgLI%U7Xc>|abE?v>2e7Of4us&iz5rXcL^ z-6LOGMY>~O`1g%UcYzxni6Cg)jzW`Fizs1Onkf1I(R9{fO}=j%-xw0o@|A9MsC0Ly zN+>8ugXDzK9b<$7($Wo5B3+}qyQI6jyWfZ3alHTX2ghLBbKlo_ey;Nz&y#a6x34;> z(3s(@oahyRD_Tn{3Yi;^Xeolp6WC1TA}<1+WtPvkQ`Qqv+@Dd)p&nUVzO9W`IeW8dQG6q5LywG=(LchceYI>?q_XofA$x2tur2rQFq{Nd$%N+Uce61dySd0LV+96_#-}$cSTc;@R)E*;l=| zjZCR7T*M_rKfLL>0zI(wt3vFJVxhD@I+cYn+Ug{dybgV7`?Q|=ImEI0RS9l>!DVfE zB(g}xqjm}fyp%6`x;vA_n_tj(P)Da1NZ|N3$tP1qP6Hu&cJpLxwf6yTTQJ(Mc7)sO z>`?kR<}*^-GDEgjoB)JYb$~mJnzw_c1)GOtOw=!xti=X1$*mi)+@14Ri9bobpmIQK zjO#tCCj9Iiu#{EZbIg|DW8@=Nd^zt|n_P&k-=(PPZd`XOv&eIfLF8T788| zXT&XR=P@!TSG4>05?GH-#dx?d$O%q+cU_bu%&0IeLyd{mc3WyS^i(ddnfFlq)`a-W zgQhlC1eS%lb2F2-JXSoJR2F~T5gs{zgU9z+Gs9;~R7$oN=+8QuHT)Dx#D>&Eh1vup z-`Ci+m}1?oUZdrx=oCogg`lP>=Zj(Z8kiP@AzWx#l-6~eMd>zl(!vyoF{lsgo^h>@ zB;~)>g#JI2Au!l*_NHp0COutmM8}p&lT0e|36%=vz;*8zHFM7(GwJSx|EgxE|JxxJ zm*St099l(Z+!2C%?nIxp4{KfR$d`MEK&M?>bOKvs7B+D@U8(W1d0|HH#nWNhI8|mpXPuShkp0Fs?yP0}%6O2cC8hRVgiQ?-;{L(m3F+ zcOu1qoaCI8iX}xUB?0NtqUh`IV-skx0wvH1H_StlV<&UT;WSD$j}x>U0aymIj2~gP zgmPElFj$fksG{vDd?neod~_q2!R`S)H^w8_~P z1%XmuQ1uIjDH9-fT0gB6+rQ4|AfhUz?fs?)kda^+DnnImSSiTJFjBqy&UlCagp0iNU4ln-b zX0MivjR$*K)jE2s!JiO3t$+-R$6{@LmSS)BY1R|SEE;R9;cSNAf17)_FZvX1mUpx7 zRqVD$k@tDx;W~T!9`iw~etV5QPhBrJ>&)POTi=s_-3MGiIPGXoMiEZ-%j@=zR+I5b z(p-pNI{jgL@JRmn#dSS9r;MNTY@Vh&IGx7u(1*&mc(lq& zS`&puK+ZPzFT$fr@`oCY&%*!wiPqCu?p;0$T>o=0!K{OeIysC{6e_yH#8aZyDQ}IX z6>ldMwV4XW=ogd72YQ}wK5(mEtIQh=G`XT@_(dAvDfbo?dpO=-3=Fn#occxzZJKTA z0V&j`;FJm-FCrj*`7G-UV?UPNrR5|i$?lz=1{I}TSZje_`MAA_H?bC4hyfgpd(AgQ zh#XRWcv|gMDVsP<|OSuOJ>`AH+#A`9M+_kD%lcCjDq&V5;8RSj4Y~FqH%1#Sf;(tK6F0TS{lpOV;dhTU58%}S|Oyz zr0;w3iF=dRzf?NbCwk?G)QpvA+!kH8kByb+i`Hv7EPelbQRjZscd2{Un+dM(CmDO4 z<5hOue}K@h-|MIRJY!w^xsVGS*c@ej8ZH+n1FM zg+zqpM*GyepJHywb`1DM$W7#Qh1Q4-TTA4n9%QGczt!VU$^%OBg5hAkc#p%C-|Pd2Owo}ub?CdpPz*4UtZk#wWHAnxwf&Bj@0O1^;4tM zJFoUaZ<+7@G2K@6a(Sq{7+vfQ{HM)WWFg3BgxlNhKuEs&dx!;cMTM|D~^_OMdoRBur%c{-ZzP?9Kis)M8C|MdC7QG%iVSro$jo&ov<0w5oF_a-t)dVQ$F5Pv{%qyXR7x= z>u6|Snt-ud#zwdF)+q3EXP}6U91}I)Cmdp+tw6vh#bSfmJdx%e$b~2%L|KH6P%*0X z>yb$;absldX^`9aUC)8?{?fJVJ@K&B;hM~D#nKqLZOAKD(s$Eed0u0|P@WqoLB=J? zy5mir{r3-6OM+!u*N2qK*IoR(T>T1jCNw6~BaIG0+&M~~Y}e!bgPB1~N9LwutXW{E!!GMVb94y8A+@4LH~t(R&2R_pIm8 zDfB~t;0*7kOdpAyx8k`J0s|p1;>;BtE4A54AjWc3c5HtvV{4-;^u}4I<1Sal^NqOO zib8aiWR!F1*pNq%NMbcVpXc~%4UZ=7J0G&nko9=ylowTS*f_SurJwSL#1q7Nzzxoz z$Vs1vrbkVrkT}MoIpTGi+Gw2pQs{K2NRTV({VrFq@Ue}5%*sTMlYByL?`+BD-(WW} z6Pk!h0W#MMT|v7ot{X1h%xdnr_v?Q`R=mz^7Kn-*aSdi8@wK#-RA3I898?i(Sqja~VmryZoKE>*a z-V$rFD6CDt-dVW6f0(KzmQcyL_F7ai>P~p6S=#?aP5e!izG{b-0ulX=`A1avr>=&` z5e5sByv^8f(PyQ8uWHGS-`_>@^@!aL?${q}xOvP8?c zF0PUWVTG4tW9FpWq$)gMu4WAJ5umw5hgY zv_t?U&MApynw*W{jaSmpmW1E@yjjYzuFGGqH<;Jn5Y5WtX@ZaAubyH;qfxdl8bq`Cg`fvKpOO=>{m@0G zp8}#MW@r80;%Cz~rd%(mFJwB4FUHP_>-S&DT0z2<#`t6qIMA;6)~W%)MpqI^@T0Rdz$Sy?gXa6Y6Z(OLSp0_5tm9O!%TPT7c( z>m0i@I|Bu~G&H32aoM<(QWzD7M7pHy!`;OMzQ@x~APA!f#;YNY?GW4~#Z5(?1ulKj z*H!#9crPkNcsfavfWJ0d({0NnAtx2_mz?vf4Du;-rwI*W+`}wgW(NE= z0y?xVP&vm@W%S|SyuzofEe$>7FcO)+qFsf)`wdmR>HE4A_$PfPc_!evr-wC79w#Kw z*h45!fw_lDP8Q_H8zmvkf0}i-Kz|PPOp$xgTWYV8u2xx6#EymX?}>TyNx*9JvP8`| z&0r<)l{5f-FMJns&iW9U98o4}i4I_r`dAL(4=kufq8_n)iAsAwF*KdvavejE>bWcp z3J-Vr8fz)dw z*;()8j!P3mOA9m!lxjghnOP9zEGkMGq0~oBcKWD_lVG-$0GmSSaa$iC#E#k_u+w~C zX~WRybR!EFy7-5cv?U$*LdId?lVwbrCY*UN_^21HEP<}l=agBlpyu5#V=Y5Pj=Rhs z%C8^e{V_K&qB24he~`=PH(YP`6F*@o=a3ozTF2e`zXq|A9IwtDAe>p)wEk7C#b`6! z+ICWt22u0iu*!u}@V;4nN({Z2wO8q4t)-aN2MRv=fy$d_r5BS$UiCyVeWh4m!8|8I zB_{dz%$RR5F-S2@Su#SJqgN7Udc1qQ^#l!m%LsSB$SAx$@A=(r$Fj?+CCAMZtACVd z`p9w7J5Ec7N_@`0*BU*qk}@_gYQm zPPhq;LZ(Y5`J4bbh@9#6+l>U&V#gz8vb@V(fAT8rWLi!SnMuO`^y-oq^`+0iZcQ*X17<)>q_a?G}ytX-oPrpl!Z)zRLtsFA2Xw17H?gXD5 zwW+CC3{)-ln08k-WFb9^#za!#;|sknYWj zzo!`7SDbj#&_tMjM$^)99>_Pt(?*or+$k1%+u*R4e^C6Pltk;g8Ud09oxq=MJhmRK zxBccd=d#pJak(?^k8^>X|BJ+7t4ebPhyp3d7vah(X-cv!YZz5S1t<(Ux9b3=hQmzr z-s>TKyH5CKEJtx^#YC>nw1k&EZ;v_?A8AtL6UQ>;CSTpN!54NCwZrm)b$>%4Oc8}Mhghduh{pN!CN`*k}5$M@9q6J3PIkV}Q^ zw5%Adzty{?y~{7=fwV$a<2fq(zTt4@CaGhbNwf4FApcW4*eKIl(#PX^{%9enw9B6} zRF-ghyhGqK{*$1c)E;m8e(**k!4}$h%V&H=b}EiT?!eyz`mi2bgLVFaS&!ZNhtWRq z1rab;xmqcn?FpJtAKy&=lFoX3GzJGIS}^lfS*dmJJ_e=bP^3166i|9)uXyOa-Gt7( zyNj0MzF%E3G9a!*H;qJkL+}OY)Xzp0D!Xv+Va9Rcf`rKP_&~qry7OwnjiH8Cv5-U109s>C{-E15svi? zk3G1Pk5%cXj-smbnC(K-i}Ui|CCB~N2yUJoMHwIyZgMC;3#^csY?>xy%_ZDgO#Zum z$Y=N*Fcd3XV)u9?Wo#i3*zUU^@uGY^h=W&VLoq8nzVSaod89t2epXjG7P~+=aKEU@_@8cfC6~`ya z{UkUhr^S!P7aIF%GXJ4jD%Ss&nn6b(L-SQhum- zAMV{HygL#n1y$brv(HcGUfcMXqFvQNo{$GE+vTN5~yjgAe)wDhvQydC4 zyefQq*ecEVL$?8_CV7c;0ximt>i&nM`#=aDn3~F5lfsFe6W?oT8_$eAH+aUHC`}+* zt_eubzxT3gcYecZTpJM*? zNOY(k*GOFy-t=ek?|OnmN`e!NZ4N12G3#3-WH|n5$<0?h35sL%KXymkVqs@l8R%Dk+Ii-r)lds7`+Rg9^NE{!-ngVW`mOh>>uF?uay zr~%do5ATIc5EjUs!^%Bmj|ZRKoOn;v*NQ^oF%37rYNiki%a~~ws2cc2@|v&3{9@{v zjQvXElUE#*v>z>rC?*r>iX}}!);J%0g7zG??=o%Edb$HQ60av@BeR#2L@LkDf%YIv zE5O7W%IEy}On$m0os3Ab<%fZ*(GzSuft|pyLfz@#7uSc!5 zDjv(k{X#qW#48xWB9B=P7wk#lzPL|~x!iNNcL zqcynda=zgYF-)O~^QcMW6kp;CCWq^nxiipH36Qbl0*T?O?lVwWOawCr(vx!$eMSTU z!iU(**qSqguT0qw9xl8d_%R;HW3j;>&`fH3c(xr!1c$nNS1&aGi$rUc2Sa&3sL%u+9{WNuJf+zA*qKb zVkYyrBf)wg)^Y%=fSf`Qh1;7^$8;9ML~KiJfxf81SHha`fKWiiCbjOg07VW07AX zCvu}KNMlPtcKW`tgF%o6yYtw8+_u5F;&Mn28Qx)Vss7C|AoY!}N5{KpNMxJ$Q;_nr znQv)5-roJ*1Il$}MuQiEmpdNfg(D&C!ByP%b)n1+-JVPb3R)|@GppI3TM3l#$s{uJ z#WmmUZ^a<$dW8!2>vd3)rAj|8VU0MQ$DQN!dAA@jK0go$;{w40M$)`$tsVS~xQNci z#dHI3$!ewee@x=z`H7LVqve5;_hq^-7l?~TQK~4j{ZhCI**<^{Vg4B%3G$VGN3q;} zsmpD(cc#u-o6sAUwggM!=rO@aevX+cy*d1PR*5; z+^ATo$BYS$g=}jvWohfpI1YMxbwvf2Rq_a(a2J{#r3IVmATWDtqlkN=ZkVkuP-L%{t7}=0yG9_K z@b-ntED<}6x{p-Amtw@MwkA!%tKv*vx7^4p}AT8jeb65r%B67<&{m8 zv3*X-SRyXbTWzs5e(Tz-x}{2L%*HMDR@YQ6mPSYG!L67h?7=EwRzm*)T!rnRqk=vt z?Fcr(FE7n?kJyO;j@cQjOG#h8T<(LW@#bbe%Qen8{L24dtb(|23P z$iK`*Ri$Q$#vO?W_hr^;imOoVtRC=LTBFxCzg;o1papcb)auUO*Dt6EsZa z7r6w=NsilfoD7N40g9Y4(#lm{Rg(p>uPs!e*bA?7?1lx=qQnzKgi{{#DDA&Z`7~~2 zC!SMD5gBT)6yZi5nYqngnRJGF*rzu3`IYV7-09C14YQhBjJJ!c8AIJm>#9>N} zb_PTC1|28^iqovzCw~CB1`8i_VNNjojgw5Oup9);o$~^7L)%5oniTK($&t#B z@%_lyNtG~MRb=Et3a**o^`O@+ce&~GxeCLFJ8oTDIwsNWiKyS2^8)WD@p~_4&Vf$U zGlADC1ZVm6Pyq$s6<^w01DD?OB*Vue$l&+xe^W^uLEYZ0uBr_2z6<4O-OoWRT(4j1 zcd2r{xI0wgE7gvjPB4C6{f;^02AJ9%T<^`o;I#nd{DOxN2A`o(_SLGVt27^?gZ+VQ z=Q>PPW$^ypSM08#3=BIN%v5Sqow0kjUf;Mvvw0M9!hLq~zHZYRacWOu;qV=TpKRlU z8eI*!=m;h!Ua2RNZGF6By;&#@QUYEG4^yYmoLFPQ(Qn(hlE~Hq9oX+k`_<><#=HJ@ zw-*2;+1ZW4KezotLRqP(Uw0vT0FTl6yF-Y(!gc)5C3N@YXxC6wiz+ z=VQ6hUxOspT}D^#xxuultSh<{=eOjf+wc9Idx!h9HDEdS3%Q&Fao1T1=db_fY!6;` z$Y`eKc!pZwzroDL!({mvrFX*{IQWIK!{YKI?HkM==$Lj=PaU|YxX5{5m5%ir^vXo- zapwH@IPPQE?uJvlEPD4p+$}t`r$yXlKGqCl7y?%?ZIFw)aXXv?#(bz{Q8YGtU90Vm z;T^Y;+?**n-}rELU|Lwc@zZ+-Dku5x0de6w^f4=Ks)`f*@i*=R3C%)4Q zsLGlVrybmtskZjdi3+L~Ade=u{SkBje)oGNH(ZCA`)Su6fs;3u9TN@fH`w*2G}ADX z**$@2t33|5^SyBDjIG0b&VrK%x%{;f9pHgS7P%LCHhYM8F<)6%aKi$${%z7Hq!}j4-qqcDtL5KL&1yf?YS%ToUL*m8Wu9=9Z=R-qFU8N<}0ylO(&v6gV9n z{=ne-xr^F=m#kCMp#Sb2<}xzdRJ|v(u?F;?tX7Y~Jd9CTgDl+hB%p{S0L{bay35we5_J|W?%a!h}@U1t5 zjFSOc32jifDFO&}&{=*H+DZO#0w@RC=M3c54sq1o6xKq*dzH1^pjAjQUjgyOJdOCOE zAQMmv$ivWtJUAF``o^P($3-Ab%z}3Bdgh>--Ek#4wiZ+k`ups^t={@r+%A1Zszp}v z22!ulNaB>blCBUM3QYat0{))Q!+OoZ&jQprHRXKQ9tmR>^>Ay;KU{DFsi$pE{teGF zR+^6%AINniC_XG=ieohmrT+)@DNlxtzK9pe^F=_%AJfY0f#bs8<9D*c0GNTAZ0SE3 zv2CQ`Os7(24r@i6UIXSHoo5)=wHSB*shjH`num?t2gNHVemFU|vD(F5dF(&+{Rky# zRGV+D0drBE9mpEQ*A(BbBjY~V@=UNr59(^#9LJK;t~mb1W*P{4!NGFY?h*>>GLGUT zhYM?MDfUwVqbYq(8_q6w4C7!I`0ORzjADb6Ncsnwb=OBE^*f1Qvmy_-C(;Atl_3-r zy1P^*#VjHWM!QfV{;4k9V6IyL0>_`K*&%g;%N25#Y62GrDaH?)IiE$Nu3F}}z#Wj-^#fmiP4rh2*+vIEaq4&Zw4<%n}gc)wU-KFW@% z*d}&f62|*jsDc}V+krct;Z}21`g|o|&7RmxXs~h4E zuI9s2X#Q1eUwv$NPEo)cvI?%nY?b7a_&H3JDH8cBPDZ4YD9U9DYAyL;N z=W8YXBKCvxx0RXNFdG|*J2VfodTOfb!s^}CrVKB)I-LLZaMpHkhulza{!(wWjWBa@ zu3=TDhtefsftyeN<2h+5zE51oRiZ?Iy`aOZIC#%xcF2d(EQzaS5j8?^ zl9Jx-cuQk3Zz#%R>e{p!!deD6zqLT~b)2z(E6>$v|0!3Ir!@G@0@p%fqSxI`E`ym_ zP-KakbZs)P$;-&mV3`};dRi)~L%fG;nF&e#Rr4(GUNDk^TvmIaDnO2AOHDGZy)LC?uZ|sGmD*Ib>%!!~=t2$7=$=5|5%ws99U6iXy@k`$1%lK+KM;n=zAt z@)sE>9mRkXTmU}f>;KrHm4`;cr#+x&C zOd24JWxXcRYDdd_yGcDTYeV0qB;Ko`Q1IPDwvJIA6`2mzWQG>`(40jY$nWm9DC8ZCv8RHj^c}I-o?*iu$ zew*@SwqBF=ggMgE-9fJ_`>0-nUnF$SkS|Qrwvo;dt`}aewD`o=Ik+rQA8q;P4_o_d zHC)`w`c&WZBzjo-{>u3W&5QhvZL(2*8tdq!wVs|Wx+h?uDhFxz!4Nc|_mc}Mus8M% zv{C*5wgpL2j6lmC_sO~xO8a~;;^i5K_ykMkW}*MeHK}}LW+uUm##BmFusOi}NOz5# z<}!Zv47m4D#E_AHFp(am_o}edHY8q8s z@a`0zHLq8zrW{{8ewvxv`Jze<+;y-pk(MOF^3l3vGo+(WUb6?c2d5*=@DsnjKiJMI z!bjpC%9X{_O3+Yxls_4T7Em*k$HSPphta}&`QYjCa%o32Uoo0db4)3h+QF3dl>t&> z>txa5D*{|`)g-oDIMQ+y(hM`vA+p`ZMnVQ@oGkr2I_3uULuK#|S|HI<3LnBbED^T@ z4P%f7#CQ8N|FA6Uc(X#mMAx3>nc21Jt3>C0eqQ?l&YKrGY7ljNToe2{gjdH0HaM&H zT9ZQy7{Z057}2D-U5%lJND%7`0+xt{dE5|*$Yz>vi+Z$o8g@Z54J#?r)rekth?(8{ zpn*j^^NZSryFxHcg3Jb}cblWNAD_S#Xo30Z8Mnk4aJ!}AHC^odcP$ntY;GpzL++z9*kj*h*J`1q z?T;ZLjG0_iIu~hT?E4*;$yDsRE2F=I5JPutunx@HFoiBV@9Y`cm zv)_7wNSfF{Y>_E*3(iCxXcx3rktdVNGS>OqLZc3p9dWNEg%~JE zNLlbyaBJ|?E*d@4)FpQc_m8j2SxO|#2p|^F9~**0<2;LSpJlIJeHKBGt+C5ha^~_0 z{Bo`Nd=)swxJcf9?W^o%9W}nq{fyv>N4USQS`_r4-3 zBaZntNle*rT?9;iaUS?&3d1hk#iP)V$`0J;s9MSYSR)^CSPZq2=nC`tAuAXT&e4cs z_o&Z|Z9wd9II!trwUq*MPvzbn$e{~ z`K^LDS5lI8UdHOqCpn#8^-G-$PVC-JeeBo0nAL_}sPNOWXt6UTxyjit_!98zU+$v% zfo-BBmTDnE*L=g9b%}9;nP29gDt0s$(zg=<$%xX+UG1bGa=@G<$!nfLzNXxryNH`a z^XTFJ{9>JPC)5&kziPT<`BfqG3t?By;=3{e7qb%j*9#ZtilgXsaat zAjlMSZ=TLV^#raHVM>PRVl(XeqwH*ycOK(8J{R$Kl3fSEQr5PI3;LgaF37HBC#T;3Z0z8^vt3-%c$&7auda+gzIQX#fgwkceL22{D59ib%vfqbS$8&jhe|nP_P<`KW zwy1w8&!|*I2dvSrtnk5egEVwqH`imsejg%;CF_q27<|G;ciKAU&KDYJ%@_(|BcEkI z_pq5oiQg@D9XZ6lPc_#mC}v$ybuv`#sQrBKiqPj zFo<1DIdSP|V^Hv;n#B>*CS4ry{I+N3Vs}crj%lB+?%5{Vjt!eGX*)5=JM+MicL@Yv_xess22@lSa-U5~Qt-mT#3&b+j&-2^XRlf627PGA+XGgnnLg^#&O zMq6KE@V-7-=rJuI1wRXXQg#=Ow3(=e?6 zXD$C>-JbQI`HS&?zwuB{lOmDxx5ph`Ik+#Fg;rp)S3-efF|05(o<`@JWC6FmJq>7p3W!XbZY2+zWdbY7Y(lQw)$0CY;f=hvyPbbpu5l`?D{LgswREKMbrmZo*aFGq1fs%mib5lTn9ohbOI#Ze(XH}!KtL-29~&mlP-b)M$kGCG&+NYPOPrc zh$~!pgXmcg55Q=g+ykVi_yls(BzjbmLz&mH{7-2gX-FfX=EhX1!{9y<2s(pgJ|6I_ zG3yqZ;}$!>>pB3Y=yjkH5C0|#DzrS{Y^!!JfaTNw0%J%%m~1$|eB_-imfs<{z8*JA zBxT0WyBFshleK*=C-oL)f~71xxZXUPG>G<8Sf;zR)h)ilo7AoEcFPMj7Kma?CHKPW zod(YS8Vir&>RSyB=acMEh2QYwC%oHKJ+`=-T7dbb3fQ7@Cvg z62F>HXXT%BP@_UEhrf=r{D<+78Q*xBJqQ2ZIGiER4+Q#tsk=zJT4g_(-Wo@cWG6EX zLPGT(G%z^E+17AQZ8QmEDx^0UOZPb8NGBq`j)ES#9&~#o zU*m5Q-#_LR2lH~JM9FIsFnDk6s%V69CO@wsskAd-5cmKGDWjMDo#^pyZUIO7^N#B< zDwkPq#H&kLfyEB$P7(m!Lkt?B+-&UieZ2M251@Djz&jfGiaFyBEj*+ZtdqL`(m_%#XeEo85BA|qpRo5q> z6cU@di+hfNcSziFq~t7jPe_*NQpKVP-48Ix(M*7y^OHxU4|*H<1gHu6asq6k%TAZ$ z0a99j_{;7h@9S!6v}4ubjttlHuTyU*kN<9_IevYPUC5!@*w3fkdEt=o;<(@3s#IT= z`NNeb=>k?N%yMMW=2=lIi@9Txxc9D#W@~))ft=0EjG2`?hp^umu z52gwbL$aQ0_w`zPo=ZQeYM(N3QrGir42&_Fo$*;g`uW1@3s<%Q{}L%up)%UXpngX85Ki{<@ZUZ4^6%V ze9%Q@41i61ztX85cTn}nV>*-m;QNh&@HkMMgn8YrTw0~TSgcCgNg_h68&0|2^9Qli zDR_7}zNO4ybpbFZeu-;f2Irjq>kdQv={&h)zedSErUUq2{SX2XLIbvt(I-FGGrnV8 zWfd%lWoEPAE2&)wwWeh69x&UM_N#xKpusa#vQcf&;G0vQ49`twezSL}ZK$_VxmQ$# z=1^<)MI(xfb@q97bk07VXspvD7C+I}xy*8QEei?fkA9AP|DvKJZXyDbO}`{+*Sxh1I0{q-0HhhwY+n^c4(GAKx1m9$nY=XnLk#P8PoH+FGL(n#xz2ID8)f8#)>y9Rz`@LrZ{VXkA*0e`s9BBX{|L49D zBArneap-l9>6LOiNcy~oy!_I4Cj-v)+$c0K)Dk@61XhKLN)Vg;vOX6}zQ*IYZf8dj z9YH9}pF;T8rU;NO%YjUCuAxApGe|Kri>2>rnq{Tyo?Vbe(bXto0WlowJ~Nm(pGeR) z`|q~c-R|&jl$&RM10`Am-R;F5QpUwM=RIr1Cv$jQRJ_X-i83yfbnMA3SnrArst<*? z{KTX~uY%0}H3EIP2mf4Uqk*`A${BHN6oh4FdCIK^8&O9fn3a3H?9}f z9z6AuXn0inNpL}7)4RS;jM2x@9yIh^*A!H$|3Mskq?$j}cmowH-KZz2%puf*Q+%$N2+DAX`{c|pV$yh&ue<<&zIb?AqLe8|Q_Sy& z{yga*ud*~awhO4WHEqt)Wi3yc{YaL|21RE)w%+SM zEpFXzC}<%$Yyd(?=Imf*MKZp5mz5z^Z9p{t%?kNxX_gs+{*Mfx(am{A z5WNLi@>I4mAnIumI+-c&H}H^5r}?9_N@$YFaf6a)b>*Gnw&>KSNv(Sa{Z8TtyEu+o z=u5)Ysqs&X&yGX9t$9RYPtXc2NjpgGh`|<~&ZVT{y0BcZCd~aU<|ZcS6FbtoA@zXH zY9TTvE|TB--DBiJCS>;O=w}aO?nTx5v}mkl2&HN>|6II{yG6HU&I#=j;+|@l%9%V#b140HOfevtsWn_ zKpd%e&RXa?n2&6jMN6`U;29g)1)X=yD-!MMT-zPP+5(7%(1ZDGHC^q5Rt zhM$(UKgG7@VhConL@CEFj`S$7Qry>Zf8-_PrRU4t+s@PvJ}u~K(6MwU$@*qgSV4>->kNOD=GL^#s2v{X-MaRU+_~8vQoD zc}1SfG8@%<@zH7;*6;*5CY%;}pwfXYo!82XE$;1#GQYxb!I+e4phte3JA@y*_ml}; zUU0cG>KCzTHz0vdGe?u`-;Pkx!SeU8oL#_vB_c(B@mLOLuZv-OD1T?k*;}(t?Hu_Q zneBZ1Caj_HlDm*)P)5HtVPMC{(KD7U_u@iicpVzY{+%+z5xys6~St=szv!Qfs{5qx z1Y`BSx=ejPi2+;+#6&)~U4>~M#LJTAZZs7~|Az?XH!y&Q1wv%iP^i$i%Q|?U1UZm` zX)8dJG3M82FA@c-TmU3JVI#$h4J1l|$cbjPxY@0>magsE{vAj-BM0>gdLDv4{j{}b zu?5+l#)uiS%QpO{xW#-d!s#82j=}QU{Zi@6U#KUH+ZZn`KMz|GhTe$~Lv4Rak{|pZ zS8o9nRoI68?~)=dD%}Vw64K2g2qMxd(jYA?DP4<{G)i|!Dblcjq%HG*j8r_ZxHIOLmQ{&usy zg+kWxy^{W|{H=y*JzuO;GNA$Qj8YxpEEPOGdyF`_1~&)K*FQnJ=HDK*18Mv%#^4FfZ*2k=kpe{BlQGHKe z`8~*Qop3vaK2TAo;Qq}?VRswjBG17RtBL52P2)3v>)6=yo^#h1hu9H9J-DK?kxl2) zm~n5typ?)PCBicWw2isTD0k_Rv1oW3z~zDKVR;*Vme$E7_2Z@IG9Pbbi5+J>@>OD- zVnO-WkUa0~3^D87kmc!$6u^ig% z{*W5l?BKIX|1I$>Uk!v85Z-f+(>!(;kK}h2Rnpao(>ce$$`i zedU}}VFro~ltZ!*^Gw(H!l32;)Fl*D_w`4taRy{&cPpa8HUh)QW|i0E_2t{}y3JD( zvx(@S58O&&Fd_3i{A>^#8&a!U43IqPNciHQsS2D^LJ@g_^+#5poH4-sNjv)%@6Uo( zGxlMdP=PyF-7Q(4-s?IATlPLuB>ClBgLpo^KcPtljq^pV^5mBy2bI|q6v;u|wRxI_ z1EBG7T{>Mj*{{t78)`Vw*h90HD9enqB}dXzshXV*Q;mH(q;!7qz|DJxQ39l`pwMkc za0h~yMgxzfXdouGWT8$baZbReHjFq#;DqX+UXT+Gx|b!6LC>k06slg(t2j$G z9L)R}O+ij|SXj>gPu>5i$g!Whx8RV0i-_p_WvJz6T{I!V^)`}Tg~{@<$@=lYs0!~w zqYK(S$lr%E)Q3yq1|0oNgQlI~^RV1EQ6Ki(czvdI>N{W6+lEix`orFFLR%GF17uzC zL3gJAa=C3c7W#@d`iR1^E@sZCS{zj9HKaTgcrTlU279!IU_5@;uc9F_rXQE$I_RG(C|MT6+>>HP51QKpHIFXRzCbc>pj-yD1hIdF!ngXi5BrMD}~o0CNN>|Ko|ACfa6lqR8m zHG)1XT;wN*CF?VA(?$8rwTW{ah%=!?U!a>p;ACym0+%ehcjFry{dB=cEr=JgT;QOX z^fGZfz^hmKYDl!2RsyznsI>s}hu)H%41xtlJ!XW3%jS2odbym3s%}ymH#Y~4o5Z{3 zE;W2{X5<_TxL%Ep@N0C&5WnNtm@dR!Q zEpgO>HoPIhf4#WC6hPDAHspv;*}$*q8wNad{eA7xY<}GPfH)Xsi-^TSJ^1H$m>Tq+ zu@xPJd41;dm@3l9oAVy%AqzoU%rbsC$PF}HZIhkQOXU3(i2DXAgd0K0n_KW{wGi}p-Q{LmKpO0u7SL0aao{{)9lEX)>XEeh& zPVBxX4~AY>XgrpP^~y=vM(uCMV3{gvbI>P3Cj;F7?eCE~VmOZyob=|IujC@47SuDZ zD>MO;&^2mJ=4p>p_2rkDWrWZzQ};>yX4rOUAoE@W}jVWf^mg{1#t=;l4=we%stENJ05HxsfW^ zI0+tbrr5aj27Q;+&$#DPeQC3j&asCl``h6CF9w=B3_V`Fe0y<7sQmm(NEjZQfI)Q$ zPS?5%oE7?L6;UU!*XX<{>%WDyPFK(7d+TorM!}g)XAkQ(%TS_=g$4(}Gd~StPKao4Tw|Yp z113eiQrPqP+4>Zs=b1mC;d-iOdJcMHUO;W#D zeWcfSk;OztbMZn&ZQyhleEN>MW8_qoouf za1Am=YvOg-#&Rf={d>C%gA~sqK*;?$5a1@gzaujnT;i={ z*2&p|0$X1W=5>^ zDr;1P-HbKNjWb)|DpKu+sL)~SvqOW$VqD|VF7P0&zG_)f>2p}iK%tgf`lZIyyV7n9 zXVHgqX<2ant7gI92MJHHaaLKvN@yJ7VYfA_?Nw&V!Ladn(I=r=yc9p4IP|daO983vrj!X{o38cDf~hc2PZt&%#>xNWyQ#*W9K&9&=oHTxNldOH=>$ z1w82q`1M5)KSlpXDMK=np(h~l^X&O`LQHy3Rc%LWQwcHlsLSKO<52E*Yz@W%!>R@) zRDi>-i7|g|_K3jqUO|4-9rJIwQC~ndD(m9AzMYl`1_B9uR*u5P?c60mLaVCUKwyLcQ*f>GxYrWxo%4ONfik$>aJMT zyJLb|_g+mulTDM@k*8?SQ(ujM* zE_J=UlKZ1R|Js@F>c5BY^~FfE4?b&vfm+k=SaGD3`M9Zyq6fUb*=Oua7c!q0p=uH9 z6D=rr)Rm6!n^1ROpV_Tgs+yhz+|@NuN`UnyfSW}R0J$-`2>R+OazJ4C@Y{)kMvxWM zsOCu>&_I|4t)F-jA&{}pc-yq0;_dt7p%2!DK?s^Aqds)K1x$`8tL#Oy0hP{bikm;F zfsG&b5};Dj;}AZ*0ps=7`>U;yPxuQy+!bEIMpk}y1?=_%bGV4C8h7c}iQ-xzvO=~M z#@|IMFKPyoo}=^d2<%>(ab%D_jXx}C3GgYw4G+M$a`HOVhsz{yFLoq2_FWV(ia4)r zSNPtqTZEeeeW_YBCA;E@`4^PNS-AC`+?%Bau?4Z?Hv?~8PJZs%ylSqPuG&f0Sa&JB z&5R@qpf>?>FO+^iVqZ`Hf6s9Z0vGh=K4}pRHUVTc|**4OOoq4yT?8Jjv-+-NqFTrRz0yGdrR8-v;QE~V7)bd z1vW@uZh0?m7Oy}-kAReb_C22@X(xR=%ia-{iSFS((>mlaA^jGg5!r$45!o=qdpJ08 z_H|%7ZgXLP%NJN+qnNhvl?UNxRx1e$P?X>v=YyFWK^NG4=k|u)N1mYF?%vDFe;M2oEGPY(aQ^~?>kbw z@877%jj21`3Ab8qXl&xNONz1gFY!QbMHF(888wW(-SgNT)SfEVIsWe1VM`_LDy974 zl#%}-EK%&ws){U8e9fZOjKJQ>&SjRfM^DDN?A)_It!ao_j|tuc_o~68u8mF6#aRZU zW=#hUK6nUw>mgQHi~CS`BB7~gG->Q`Z5cX*qL_71mqD*>RFA1ewEsQ>V9XmpwALCB z94JHmk|B#gD-+Bw8Mz5mm&(=>$je>HeIS?YboU5=A1nYTy2Y>6b_s%Dg0Fi38zZM_ z`|T2+KN?Yie;Gn=|8;CzHQOC%3tIwu^<5Cf&_N!y8UX5nAZM0ty0v(DnA=sG{fN#2 z(6Frdw_N^ApnH(65I%OFBdPhUrmQop`62RIsy>PMPJdM&(fN=F)|~as+m4qM~dO-?Vw0>I%i<0+!_C z5heA+$g!8I7Kb!?{uVbs7QHuSHdAT)T%TH*z9^PE1#*)t*j6Rk*C7o-O>urS13&9? zO;dIAPa4L!LFtcU_{gcY9efVol$`S=DKFZsw+2din10IFA4_p&;Exq~ypJbWU=S|P zwIMTm>(TnHxlQ${)kFQy-!^n)rR#Mx7Vtnc;wsOTW6g0aB8q)L6rpRiItRSz9#HIN*s_>q9{QDE|jnS~R7Jawn zifze23kmW88VF_;!3A6Yp8vol5i+ewn8^_ovWW&@)EmHT%&(g&y!9L~sa8hsP|i*a z&ZYH~58w-o@-q3-1lZ(*LP$X)@2w$)CGMPa+g*SceT2cehZTG<^2%p-q&xLi=6Lbo zO7`|x_S?kWn+GE18GSK2W!R#k$(dyx--Q4q6Z%#6vtv!UiRsLj)VS$hVN0Q8>vEM1 zY^U9C8;G$xsEI8HeOO{?@0ye4w1Z~?w&aRz+#WL#FsNu~4AOg$VwwJACFwbcHRW}& zCjis6F9nbmu~9t`oZWAftOgN6+&(=7xG4k? zD$gnu@IhRGp<@C?`%0@RB00T7LH9@l#wF5*`6rAQ89+U%cTR;_Po%#;Gs#J5s3jd6 z{PC^ZJ~6Dqp&2l6bco8XEy=&okG&lbU6g{u=baHe1Hhl|Cqi}%9?k$_rc;v2A@zB+ zEfbKMIdB04zAiUoD%;anmt>bcJdSpTMs8>eQ>AY_vu;N0U$)TdTg3laR3o!+iQYWt zfgHy?GmjHSnc<=s`155Ojt3>vfR+#^n??6&_sh5x|FbHasfY+qLWQ{bl`i0R(;)|* zT&?8G;)7Qg*$_Za<-s+_%vt@AFYg+Yb|5ttOwoMCfNW zxOIK*Jp|#X+;6w^K*_04+V}&xUXow`jQw32xQU3XkR!8z#t=gxCn)d4X;4PoM z$inM%zu7|z26QQ^#W!nTvJ5Iq<-C{z=cly_QI}o)Q?NK#3`9n$%m@>Qr>{nnn(tHT zEiL}Gkc&uM{20ME$pGXoa_Wx&-;ngf`mS^u_S)og0W$z1o)Tzs$IM=1D z9-=yq@gPV*`bhZdrRhn6pIzSffVD+kSqbjeo?<`OcR|pYFtIs+(>jp++-zkYcvcvk z6W*v*{yXZg8WO@%Ww0)QV20+CN)@w_mj*}wwaP9zWg|fh9*cP!Mb0Lb;@M*Z(LR;z z#gu^iOp|Q<@7B_7`IAk9r9 z{m=olCBr^r2->pRP$*po0BbrD=N5s{$^%CTzQtX@E=BpKk&NTV6$HyH}Kjfo|QR|A5p8H5PVT>z|3(G z&tvcih|`jU04?}OzsX&*d?C)VQKeK1A)SO-`L6QP#nG>%;;*%*#FnIj6zkcU~k zR%Jrod(-tT)FnPpJoym|Zi>>YnGR-_n4f`I7D~>8>)FK{5%_}$!a6S18>?rK9Pi~Z z=%lVyl$gyu9QqVxk8a5YO8sybaF8)<1se(j@dWtS&b#SP>$`q@?p@T+HRn2&QBmGT zkQ29ByXbfIVHix%tj4anaT)g%KAko9+ey`m!J{2mGB57Bn&5B-BRY;+Ir?lq+0p#R zzLYG&FzmDwOY2t#T8h6SNHXy9bh%XLvtE$6^%;oZfl@w^AUzIHx*6ZSOesloozyd{ zT-%Q4{(Hjc0w*mDMoOfH)E7FGk_?XOq=%%2QJ{{-vj(_Ssw6f>gn8KS9Ciilh zj%@$&#wgBiR#?;ZwdFlk>Qq0M0coA-mK9#V!!T~;IZXY=@;h;KO@5Rl>cttn89m?- z(p1`S)%Co|=r9D+AD3UKBQx%-Lw3>$h6dTO{pc?lYkqRuwI!5g!%pv?=fma>@>-jd z)bX%#SwL@gCNBMmmUz0R!>cju_^{B*4YyZHKqGbKU_o+d#Z4Xl&Ht!FHa7Nb8EA*l z&j#9{ODg-GI(_=ndEcC}Q%;%e-Q~=X-=tVj5d7r4<@Vb0?TEP#fT&{khg098hy2M< zwsaHK;A?DX?Q3DnEr$aTO!~Ibf?9~00KUVh@raINF> z$1RZ(2HMtCfW_z?An7owyASP+4VpEmu7!1?4mjb`ehA{GtX^mD0Lig`Bw04$LmWuB z8NrbaVXhm)GQTvi>Rp#?rSR44CgA!yvaAm_9uLx|A{w1+5nOuR{R|*78(zV%VL!e% zyyka^pPkrhH*XSPE>rH(Kxq(6$S%NUOZ0lp^~KtU zOH^a{m`$si)a?$HKXfD0b}zHNLSW$xZnnhCBbOQyBX#r&_#bx|tAo0lh2Y%;IaaWb zUt%)#1xnk>@S({44s3|kN8^tPHvjMmc|h%p`lZ?Ie4j9Yncx2Vm{ zhg~-YfOkaN-rNKKnbh6P!0r8n+n|KvGGE_g?TBz3r6ENBeSe_@9}}{fk2KJ;eUnn#ej`>|P0RlW=Rx z?!I8tqr?wvWF#Zq*s0e}{v$7`g@LC@&5j-KD4!Mv6msl#RefV-G18MR-w*F6WV|C# zReMlmTIfPHt_>?ZzN---TP>zB*cyqm)!O2;E1C-2A=zDTeh#UR9be0*{v3TvT4vxfb^Nlf6$j*%((K zh@Rb}@GH~}8SgO4Ml%db}W_n3{kUXVS)24z;?nx5el-nVF088uve zW>zxE*ClJQ&{k6QM*FF{@B(0F>_*K(SbfRcT}Sa0H_yBBwp3e>R!&YAidjvBR|rz zZZVr9Ti8Hp6ctVHx83;sm--HG!PJao9b)AZZ%h^dXCghzU6f3ANP>vzVxOrx9T@G;{XXSI0xTKKPun|8+a}9 zSEHN2|DPA48RlEgpHKOD_` zM7?cLU08Gd^~itM0Pke_hjm)StQCO<6br}#Dg($*Vfs7 zpW9;yAWZ-mGSv6ENxIjk1Vh7dwYa<=^V1=5=BI|z-heCg2XB@e(&q4W69HV((*ZbP zlKoh~^2I^R*kLKhQ4T&oXpP?gBi&fno+p?FA3nR!zveq_8j62mBUuesQrvC6+8Y3N zuQO0vO$xT~T>%@d&@K&`80(J{G*L4Pu<-qn*qe|f+bz!<^I_Od(LSjOr zClMBc!ncoo-Ln?UPa*{S#pEk^M5auhydAJwhqSn~w&gxAJ#?r}7=5%&O;x_V%RV;W zMOP^>s}n6}d_Ffar05Y2`m^w!L3&vdI4cRf~(QpA; z?xg1xj5rVZ*~#Yvj(lT`Q@DkGt|#&N_7E=CI_pS1ijg+gFv^V5v`j-yXs>!NOr>E@ zJq4dYldplM0G@bjX7XyYroDcDi5DbfeWBR^hRd!Pd1ru&1(%e~&zfwj(WbW|qqgs9 zFkJ}yNTjZSI6$%Vc%B)#NXmCIqt(}vv=oGN{)LdLRDYY0EvrvM}=}+}w=p#r* z9gGy4ZLR`vb&7rg9@PY->CWZs4nlWqbiv{v@1sZR5EVUt2qk0zNE|RM74qDH$hSuS z#c9QT1(;6_TSGcv>~L=GV*u+%3*m5YjVwuoXnOYijdO>30V+-(i+L9fkaL(j9x!kj z9Pu;UC!{1ik_1*-W(Q!{7@rUv7|VF#UW?&{EdeHEDUdi!0wsBR8&%c#d^_PXry1No z-HHB7?nePRYXN3A4ny!I7CpN&ax@>?rvj`*aZA3_{78M;n*wN2CTFZ#!*G}n5-gBB zAcAomQJVvT_AlgzB~jn!)jUT_ttU5#{Di#omEvN%mJ1PXUah%DKQ|*iif_5n9bd2; z=>_ziJB|b;h?E!*JDS2~8S?`*VfgP7rzRReBhyX+>{g7YqrYY%PRIvd3K zR_2qyui)ma=5(Knar-MF;%3jijeNGWo(c~A{Y=cJ_5k6+Rq2MUF?vPpYM4YDkZ9z? zaK$aFm-cjQ`W#IP8D)em*h(vaXsHucCS|<|ustl`BU{UEPn27FNLmm~Z6uZq`gb`| z=J()SZTEEx4FA(LL>`3e4#5*OAzay@tthmzWzBA%G#q-2`Xa7@2Ld~SUNE_iYYqUI z3pz*^Dr8i?H5`vika5qGncK%AHz1GCfintq4kLxJkaBME0M2eoE{e|ZVljb6vApw@ z2)>{+AX36OQwcjT-K*c+b0Y6Hx@k1vd{O)xv$qk}BCR{>)l6G)@evyzoQfFQ78(}M zHYzgatOae2cOWDRnSOHr!v>>;cT_`uJW0|wY8>OWiyOJIuKRTksUQE8z ziw?;Y)2GA@iZ|$&a7GoXY+f>p0gp!NEHR+cjf}zFHk>RzM3?LnauPoC;eik9hlebt zJ8687Osa-i@;I-ky2||?Nc1uW+HS)!4F5*l7}V3nyJ%x-FaJ23{8@oa?Rxxq>dXTO ziNl*9{x6gBNzEtu<;zOkgNZU+$82iXUn~vp@vyZ1?FIk=!vwj@^72Dx&A|`# z9>eF6nUAC6)Fgfq#*X!l>g6tPLMTCbj_?;o09EN5S?u6hJ2w9fRvYzl9$f)Ozd(BJCX3&}tI#BH!~hfY=u#D{@t}Y2^DUWXdTx*oE22w*{r--;iiX|_*r%ro zI*heD!@gH%VMWF1k3>cNRPPhoMgE=r{7q?k^TZ?PVt9Ms-?(Z{Kt))E%=owNYGCn0 z2v==Q%{Z%oK@*u6*_u1vo3Y7byJC+oJc<7;3j=Y*00EN9D1S2|HAzpSO8!rCfT$FOXE^E74kv-{<$!hE*k6DK?HXm)4R;$s=Z|o#Adw z`W8Y2;7Ew7XAN|8Qqh9>ogIkHli(|kq~?(jlf+HD**M~gSJr9Z{K2h?8p%IfKYdt+ z1SoRsp>-Rp2!Blm0LJ7Xn+7S^O2Vv=_SMV4W?MMSG{LJCaesK%ksOpJVz$#zHzAF} zg>mw_GSCplyP1&E2aV!}7ljI0F?N7`a4|Efl0Fv)J@i-JME@G5EXO@>DD+cj3ZREp zeA<5CO=RdrfZI{%nsJ5|yT(;rA`RWiKnyIdy}%WaC`nVsIyR|9c9?o`fSqaUCAJ`5U3Jbj3IdsxQi{xHzdK;-;DL zVxN++J7e!Es3g4Qc6I+h?J&>_wNelX3SQE*(Qwu@E}13iB2;?b)MVQ*^6YamA!(5a z*noz{GVR$<#!^7q>J6P|)(32?vKF5S0ZI|CWF&yny;|7#S$I44 zyBT?vx}V|f_5Y7UKP`EEJrsZ`*xdmC0g8e*Pp+LD7Tqs*eD)9yR+9aW8GE!cWm{#w zD3sxB38U3jGh=t&LhV?}xY#8(LyA(B(+yCc7dea@Z%uh{rsL{5JnI{_SB<;(QA6oe zd4?~F`@NrLgF1cE?Tt?%iE>%5t&<-*frwAO>p4vsnh~I#?`;%0WR3R=PNn6do+7X)fA28N1`4YAt#?0Z_H0Z3+`&G0l7x1L7G^E4Ke|RH2F0&WG=Ao>^RVxxXF@RB zFRXj-nHe+Di;(7v+S4swIfa%w5b_ctT}!GKimYsowVIS$bd@5sf2tcoUQQPOwnCQt;cnkurN(+T*I3-`+t!=h_d4UyOQH0yZ`)qU&ZA$JE}##&nLQWX z$cHe5#($80eQ1t3XuDBzkN%54oaXZg(oU+trJjchp{}35 zmvs5HAzZY)KTaiiJNS*MGR-av452(`{f?zYK`TMuM^Aeu8+&(x6t%8ZwaLm2dkgX< zKtbjB(+_oqbor3yx>FVsJK9FZP*Fov5o*wXyd<%*302j4IR0^!(88^|F z-rxwhoUWQz5GNP=1M1CO)Hi@qNT88<#JX4!_mdG32R&=*6nt)vYE=1A)>yOp#=mqc z^UyI(K*6YawEuj=lWu8|s?+}8z0SF=IDft~MMTSg7F%pr3VY$k;Fj3*v?2@!G_ftm z4ks4E8%}OAEl%XcirkXdE(#*#A)F0dc<0>DB@Swd786J5owg=4xi>jN#8%G*`R(A18-~mkR6TwRt{^TeY=f z-o#0VZ+;g41|0n^1B5z;`MT~U6YYLmTp~BGs+MpZ!kpwK)wQ3JW5tdCcZC6#2=UnD zI+F=^?EQpnv;z9l;w~VfJADA7WLcJgrWZ9K^{xRKkJxt6j};9Pq@IjPDRQmLynhT7&61lwu z(&x1N=kwY9BrmHDPnfT(J@?SmeTmCSX@tyPd3LC0vodBlQ~1wFlclC20bJMaEkhr0 zO0X3IurcoA#;3IZAgiIAECRhcg)_VnBF8Jl19L8}jCdT_ zE8$bhO~4u4pz5HFIJ7Ia-K!&_noIVEp%JWl25|4g=LBUbvjGq?O%Owmn>!Gt!@DSP z0Pj`cs;JBn?Fl)bK9Yv!#E)&wsCBxvM)?7=wa{wTgS=J!0wYGJk`I4Zl7D2^x>_#1 z#_TNKhRY286+MbA;Icj#XT z7d;Hk$QZT!R^7pB$MldxM(^^gv1z>I*aovW%~x6UXY~T}nMUduzhp^2&-V|9Pyz?D zS$MyyFCMA8^aCj(@Su42u2Vkk#nbqite=y0SliP7F3wQgbqWOXr8*g|?KA+i?F$gM z%wh+TP~j6o#e~m+mcH!`us4cgkzL1tq)~w-(X|sWlm0F9TQ7btM+=ZsK{PuhwMNz- z#3=8JQ;wf;7lOy;Ae-qfYA%4f)fKb}VMxOB5~X&ZoF zw>!rf`8P3Z_Y<*Ns+-3v@oL^ne&1-S3h>uUxMT!p<{6k}Oa^oSDhE1f4QOC!?v#`P zS@x&{qwAWclin#{ZJ?*|&sePaxwl(3kz9*sVYzK zyRy&w2c`|xJiF(l)#T?6^p~R#0Q#x!LEB&N-A&%g9yX^J?wJcb>Dqnd079_mcs!QM zL&$9x0W`kGeWRL-(NN$N4#I8Q6?w##@wP}DLJ-W$%Aa~l3jD2&CAzj-?d z41-H1NybY#m~N|H`>xWp56sT~8g@5(D3Oy&ATGXYNT%WWPjm;D45gkD+?te+iv2A0 zJLu8q=ls8>^zkTNPA*Q}qFSOmwHONnPu26rf-6Ylpn=EB2HOuK1nB_ff#Bmq+sv-N z0oB?si}$&W(XXoj%}PYyp~lsv?@3_?$8Ef}x=l28JV|Tiy!sV?SmBd@LOZK5vd#5? ztdNTp+kywQRCp!~K99T{NU_SK)sqs6vBvw^eP>!ud!v2FS4=1aIAQS#J9r}WaWL87 zB1Rn9j#D75z{z=4eK#O(R0^26l8RN+jyRj`cJ_eY1_>vb`Fws#sVaEo44|EYPOI@z z)&ckrt$7>&wQXGPl*Pzc?*TH!$f+{DUAY|0*!ZH2x~;$S>Mnn22IyAn2iZTxz@*7P zW6fB%4XE>(nvHF18Viy$}u{6kMzeecr)>PzaVJYWxzUnR)l%b-ns&ui{UjkwQt4s(h zl@Tu_^=JnX5V(e)QZ@X7xN`-RVxifVy8t*cm?Own{7xS~%fr@{z8oZIH$i8j0$?}&_cGCQ$!5Y4C~1KJRM~81fCd@D(*%)< zdjOdOaCG&_EGbe0Qe*w#Y2`^b1z2!zB2nC!axj>IjL(EwKsOC=ioc|x3T(lw^GPos zOFOo6tTFC;C^edKDf@7~09A5OaZ&wB2Ng8fs=Wfx!&WrsxKV53KYg?8PbI{}K-O3! zKQ2uzinj*5h#qtg2_fZSkMnSA9pyJvz{q=(+8!c^DVXzj6pWaE6|E`AS{BFP6d zSqO(2>IolSf@h(!)t%osb5OxZ1hB@@LoIFU z8i)wcH=V&pUvmp%>GMG?=#8`=C1cT3{-eLE80(tWjat@|vRPC;h;1^#;S~JDRxk~Rd(Oy`;_pjAhnSZ{%^?W7f9%EVSeVc_gbT~4CLLdHlwhytPIH(c|{uaxY$ zb8Y%_KTH9ETU62L8C~{TjnArWBCAoN?A8Wti?im?anM;49309xr{$;bk1)&mueIR+ zewM9HCdq>>|Hq~c0+AaU!k<(gTY<>qX94>jZaHYY>0&fOnvi1H&$eP)kb4ItOY`j*Ps17mz-o~)-5wme0(rU@Pd@6NZ- z-~(iJlFG0P4(yV_SJl3P@HhBg zFk!!KAeL!QeVtI3r*xb#ndKILXzlQ|fCU0A{K!6aX4c9|+Q3oyg5fAz8n8~ZkW2o7 ziLh`S>~>NcMeYFN$~~K2DvhBRAMCfL;K36y0<0#Qacfc;i-r7RVr5lt7Mmg1puD76BYj4OfgjTksdy$8uTtSWW|KSflbc)FJ7=>P>H4x z(F~0QfaUmz^DRz-D>a-sy8?hRD8;96QIRbL6VWeGRIt8^16M=@S!*O~%==EwSL74N zeiYCFVx=wOv8NA{Ta5rQW}kW%2BpSerQ+S@?!AiBXy4~lzO%$Ov`_%;Yr484n1y~b zZsk@#eOR?VG?Z6w+i=h`yo)|cYGHu5sZH7(B=;OEwZBTsKC~icN9lq>LS^d30Tu=S3EI8F@zro|FPp*AI?-du)gvC>9Yp&`;cX68r`)}2q@nC zV>z-GI4}Zs`X5+`iTo8Mm^a}VhD&xw+#Ia70Ls4j`79F{gR#oSmq{wf+~#yHZ^x-; z-rCNLSt9)F-}+e90x$V9%{?YD{EULU%2~BYflQBoH|XJW z&S|a9h_J;`A*rx5!QH-*NgI|KGK&}4sMI$=f;^PLquE-#-zc*NN=2fF+j>`I;6hk@ zY09lr*D9^X^B{oG?0eUNc^SJseSIR98Wz zYP=6cNncXEq7ycoMzIjg04O;`|hsNyvoOuG+DJ+fVA+ zM)iI#E(@!ZIiV-4RKvL#*9NAZevkz7dX(AY5?TKp##tfAQ{j2&YU& zJI`icT)af4RaX;liL=tYdTf81Dv6@MnYfnHjGyIS{&W0;C%jl|DzP)(6K%+COu$Ka zbY;zsd<&<)#s>|(ph`W;qo5nA-8`SC)K`A-+1QYmHfkcV&=5cmrq76KbrRB_J=wv zE7gAwdO$eC)>w|IAClVECl@<_VJX&Ls<$d46}WaeUpTXQdWCM)B~jJGK6%$gi#7QA z2GjQ|zpqyR9 z5RZlQ!u+KI?kcGkF>^qkc5K?lcpz1FvePeHPkfL|t1EZL zAK;_1i?3&$?ru z5(d9X<^6=NjBfte&i>s;6?!nIl2zRCt;_XLQ#V@b>f$lE1^O|$?d>5>H0hhi2$#1* z%00?=H1PN=C)!WHhdvVTDf51?#=d!ybjeDAXxQgRx%a-pbbeyn5*HLQ_R~$f`=;JJ z7~gjGRtzT^#=dk1_y!qZ*N{$XN!_nKZ>4m^J7UQe#$0F)ksqAIS=KUd=2N1N^0uBP zbpa8gPZNEOcs<2JZ2}PfX#V#Uk?f7M2Sz5T)H}RU5jzDBlyE3kiQ5BRQ;Vo#$b!Tu zg?^3Q!^E)jGgAyFtH!)V)N|0kHyW+FED($CD?G9>%IEeMaY#AQvei3{-2iTx8(yUu z)AcJ?h1Co(h0TYS6G$nE)I@cJ#q4WDWtXvtp+(8^C>()^n@rfyWSpt9Yec?UeXx||+gfVoT5Shf6qV^Qg zCNv5e*JeU1ftw#>4#oQ4$%OI#@0P&WHCXQSi&!`_{u)Y?p;l_8ETX?-((&q|BFpdo zkfvf_TVJ7+jaReSx{gebw3PVh<=bfXHOA6z;|^6>{`YC=W7CMqC<64|+^q z^V^nJu=aE@iimutV52A_pjI-GV~LHn3bs*Nl{6L`C_J$<@I16>wxhR6?Q@CGLqFJ5 zQp$$2WgliTPPs%()f_ddAS~L^gYWoU^R^_^$0nkqUyo@XJ}q|1cZpw%(5@FUPBmTz zzKD{p=JXS;s2wthZ_XGP7%*^l{p^);Nz(Ir;(b%8#wQ3mATzKn5iSw$JNO4)4*Rk zFzbl7eHZ7SjZ6hKyQd#$9kJsS4S^~^%w(@fCaWSCzl4(0+cSN!8}D?X-j_A1&SyIF zz*KB79|4BZ*}?wxWw`~f(;sdFPm2vsw)Oap%XNid0EaZCrTWIo5dD6bk zxU>JM36d~IS$Z9sM>A$!qh`ms6ONmC#yOe+4bzMSj$culX$7e?KQ z^VIE#TFL!82aJA9g?R`_<~dzcNN^NLqW97qn4V_a`?j+(`qiWPutgUD6=ZWyI^6IR z6L|0N_jR~?Eu!ru%<9R`KATs_q4YsU9=+?64B8h`-lqodeJCwfdI|jX+fTxyAX==l zX}&d)Yq=5s@9y4zi1X4ObAOV0rO65JR|H7*--uPg;5{|}YMt6aw5}R~lG_Zp(~6pI zO4u>)jjD0XCFS3Yta1-S;jgfQlqnPH#;t7@ig&T3F?D=C2g^#!jb>^@{?M6c81bgx zTw0o%f&8W`qNeA2v%%Nr^N3e3ZU?j(TQ`kq_kR2{H1H>Q`03`|uJFJEu%pt`E6gK4 z3l`F0dR!t`B#!2x$G=x8KEaj^?z8a57O%ePdYvKd` ze$6D#r@O(?{d#n^8&AX^H;J=Zo_q2tR|$Gr=ddq%)ef_s6EOat zw;i}klrLaOZZnJer&W{@6ij|UqahjcEPG)o4V+E+n_?|Ne-4Uzb*x^Z-o?wbT-NdL zEZ_X}wr)(}?JsC5L4SpHS;G5{R;tjSOEC;8QbVt``o?Gz5KQmXMVfPuf5EjieJ4;# zdi$8Yxa~~&*^RFnYUjv|CuTV$(Rie7!yCha3wXYCb z%~F)&IhU^eXZejs=#_lqyr0bPfce(B&$7@Xg+A9Ob;uZy8UBbELPqJSOE6v8uO9*y z8;PM_qlZQ*Ud3bk^`~+Yg0)ha8`ypIf7`1oMUipF3!^UJp}0#ACi%|nj~S5}D^L~0 zRS8jT&O}fkk`x)XXdVG)PumN?1lOi6d;PYnoGVI7kH%or#y1`f#GY`jS*2&0zsC4{ zN2T>`AR72r|2b4WNF)cWlpI2z#`%RD;4dP3{YiGl8^v#$f753YwbnG67qn7Y_fs9v31!juR zer-WS^*cRhamV3E&X|*kolURdt+zV=A5~u&7G<}FOEXB#V9+pxV1NwWIY0*&M7NI=}cQu=M>i@j;&a>pvU5Gpp_*sqpFz?`& z7^B!9FHp$N@z-Q8*CNqymE{CiX6-sp_yrJQ< zjChufSwsEAP61V&+0Rj4v!BVlnI`pq+FKx&f&6P>h5pH({hrMf{Qi6Iz*Wqs zft=6<3_a}b62&8o!U>@dJGl~OJqFW>Ge9fC^3h(MWKaw(TzGL!Mrv=t6CO;642`7~ z>`QKnv;lep2nc1$hXr1oA5&gczMueAKo)wXRxJ2FtbgSuAie7E5CL>SC(5mNy2@pt z>2{JK)m38-;>F-61Zv0he&jKMZxa%#&UJ`;J?3Rg7yUK$_%5D$37@mEdTzUY!*T<)AxadyJ=lMHX+?FK1>netLeQs7wo5z zj!7mWuVEvL&bih^8iJPe)=z$ED9$Wj(LVtcng38 z{C(b0f8A&1gYC*0l?dOi-~Q`dcyz&kedk@gAM8q8ksQs&wa3?187-7OdwH;&O(!Sd zGrC%k8_k6d0wt#TT9h(Y#NzeKG)?M-XqQKHP4SdofuFedc795nCcJY!+h5W#`M~s+ zlJWF3>FwE}>W7mtcULESO1Vi+l@zJ9csyZlk#;UF|GAff zlgbZ1s~NCD{Khz(?TIPGR6?fZDp8krn@!>!;v2xn{)ReKjB(fl2hJQ2WeBO~f;MKs z-}QelGu6|jaC>As*9S6W@qc^+LA2oj!k4lK-@8la#=O}(H6fC#Y9SQhGq^5No$5#c zV3ka(g_1Ipzj^bQvH6W=l9!fixk(hjqm&aL&R2Jp5nD25of>Lf>y=UowPf2|@Fa8r zDjD$*p!J)KplJ`eYWFg9Jro40_qvjbXXXT2eh%-8CYleVhy)Qz)@A|xi^1^GCLS<{hEZC z(8io-)O7lCTK>>{uG(9FtiH))Eq30+@{!G=q64JDH3oeBV9pz zJEBgPk~XvYQm?!R*xuKiY0nqDulnAgpcw8iX6dT_IjS8io@Uc=WxDGY-FE}JJ*m)M8HqZvom=;W>i;$qX*tQ!jBVaw*hYegM zBwTe<;<$_gu+Y%>3~7YYqRB4@;gXI?dY^S05oYvxK52 z(!qty<$-P2L)rib_3DRX-XmlheE-pJ();T#rI>D9Q*@h=x9P3SizoX5h(~N%LB^aF%z|hisGl=(Q z-h(V@$Ra~X8?Z<@EYunoyen1lje7}MB=SODK=(H%Duwq5id(PxLEWgRVoOhf;f3?h z-UiPyEDD{a$SCenUc)lGbNR5hFySDBTZyjy6+|p#tz(tWYU{^wT}jJZmE<<~h*~M2 zsp73hZi9;Q@4|Y_xA-Ww^|AMPzM_bH4!|S~cy@%k9#+!W4H^)2y&XA!AR+UrR}q85 zvbFP^^WzFt4{Thncvrhs9Q`uNA@AZvR6mbf@CxJRe$yKdnjYwKoU6nHO;`Et+OP&K z8l#|-1u186kP#`#oe_ybc!A?hQQz0_{xR%q1aTBhZGMnc+I0~@O=T!9FJ1GiHYcMc z@k>S>#dg$x){q{74|zi;>(VJhpneF>v>enAb#pco|8;;%3`;zfC6o{vr24vP7Favl z%{t*|AK^*oVAv}ZPsw{Yk@%7xag-R#B|>|r03PELho2BE5GPaKduyNw@jm&B(hS1m zPPp*RCO00kyHR(Pqb1lJQs&RRBSPAx=-YeP#e zkJsZsav}2?ON3dEh?N+^g4R5mx2+}t^;_oN69p_LdP0{Hue70D20|GVH@|q3Wp8r7 zCq=~L-W_g!Sd6@G~vqo5v5VkL_tv7YbJy--NMNgmu?&G;V z35tUzO{;{=@*|Wi5i6_%sA|9Qa00z6cX-=l#$N`Hm}&<@Idh6g=YzaZw7{710q)We zd-*0J_ty&;BWzlFUef7Dw?QZf&c8#&rH0%#7H|D7O3gFmU~|8r0xG`{w9V)wxz&nM zYTCHTg=Weju%;z7H zDlAPYZ+@1=CAnNtR#!x9^eX#I)#~kbu}q2WPX{LuG7GHSOj)YnI%|5d!ufWDV&8y5(F>I~+Tj z;FPzRr_2|vXP5iAUi%Y9x^E}**NHS4z34rkKOOmV`#c;WNnx=93vUI=u65nt-X#nU zsB>yZK)59)lh3Y|wu)H%MEFu7nR{3;Z)mbtDU9tL#>+_}h4m(f`z?$fMR~cAOJ+-j zlyde5y1K0awT3WXfa{s51xHvhz!C8`5;9d7*=S=aGVIC~>w5_$GU8_bo=jna;cP57 z`s{{Va~ue=D9rJ;IU&xN6!`A0oSf1^4Xo2Sro@| znW1)|wK4wk0i{u*O`$9r8Rb2k*P0D|nU3am9-#J$NHRc6QMI9yi4G*iFU8kdV@&NonZEs zlcq=r4>3V=x|dS8Nah2jNW-z`v;NYD=L~ZJZTP-$NtU1*~L zq|pM}9O(n~gRnzfXnZT%1m7hWDNR6cqJ-q+;84*xrh;f9So^qbaqXFY^3lEk|2=L^ zLVq-BZ_T;wA{hB~`F@D9W*w;-YX^`$UF-~$n>4-Qb^N(=Y zbRE8ki>=>VU~D5|h|HG~a^z~}Tta$pxx_hyuq=EEr|f*TF@XqoYVurU zJ$55t43f_<&byagnXmu}jBR5cQS|S#Dhhv@lYKnfBpJFQv9c=V9#7rxx?6Q!NdAs* zmIGqZSYE1W@S)!pKa|z9OEPGNp=Hf$m46iZ211Q*{=i=W8%F_$^#gMcuB0$ zal6hmFLM3&Ufad?yp0ixIeFP8!$X2ypVjB=U1nKSn)FYFS?u&0Bf+2u7j)`L+gW2d^K8v zC$CoBIuRb9K7#$kl8{Y4ETSJia+1I~*x`%E24Rbgl~-U4qsW0UzwQ^YdBbI?qMbn8 z|5p7Tjr8ey^QVPi8HHY+b+a>Gd1CBMB5ES076_Ksj`77u-n`ePG1pIFXL*dF+*#NB zKk(GsC(};kU9_eynIx558}b~clamRdX#yc} z2#WKq3E@d^la4{@P8AzbxdUYsU$#!aTKmgry`?#&ix)_-V!!yuG#}N^mC`z)Vdb;P zWFb8^?wj+U#cTbR)Hb+nd1%b=ZG(4^_$<;RI?Hq_3keTuIf|W2n-c#7XPbod`K^xf z5?xR~zTNmW&>oO9=@zQJ|lLulXm+dey@1p~t%YQ<12^*yJQwwZi-d&}D@y=tM3*h^VwR>R{r z+@uGsHQqzxuNM9PeJFuJ3hU*A+c@FI5%=HljHk9*8B<^s%03;8Ln#RLnqJkXgQDR`ps)Y$U z@Gz_QH=Z%y6MGy>z^*`dk!~y&U7E#*Hm-soZm~z*jqVaC5ZOzlrrZEv*DuOUN%KXB z!QU8x&U|xEmAm(IEjN@mvhBT!Ft+vmC3|@;>-e^|B8B3=(u*ltHNsRL^^hdB^kDf- z49COH%m}~kgugGSCir{r#&H2DEpBwMeVJ;jjV9E1JWkO|S(iC+F3lV9bh?TqwjZL> z?_5{)J6UyqfMd-TZO=GXt|j~_lG2m?+J;yEhBlM5*nbe|05${6YJld)pO7>K7J zgOwj|?ZoC<-RRb-;ImEacvrmT<1(1Y!^A^54Br_1{BE+A>Oj>@KVUz77m}EAG?Wk|rVUnYXAD~OwEex@u z3vnVbW!4H*tdDKvZxF|Zhu_QMy|2!K(M*gLSRWjNo z-_H+#W6A2+$#YpPombND)$JK3^z>rVrORR(WlhUB3VXv=YgQDhEQW)}_nX)!F|GG5 zY*S^ltmu5{OdaseyM0_zj)u^t%V0;+RAto%X;^r-iX$?^*HCyub2XR4xGj| zYZ6sWERDt4tw^keE=#Io&F4+Ss6G;sh$OgX(5`^;?GftlYUTny=EeQ?Ohro&)8FP0 z>C2OaIRGp2A<^XaG#2*uEUc`xs(bn73j$P+$>*hCV;!e4E)2GtDtqsAh$=eIOJ6`T z63OSq(oFmg-A^`0X68Sj>qoH?^{wut^z!Cx&lbK6{jR1az>D$>5xme1zuE8mUFbIb z4hT=gHv+F>GYqK_3>B@lc|yHZcA@#vR=WMG z&*V1b{>P1HRT#0G>eJfJ<`AQ{O)9Pv zP%}$Z*|%BXDjv^l>_=EFx6?;Q?6Hqn+Y;XUn%$YZa?K*H^nP|!id*z;GQq-E3XE%F zPiS;%y^p)OcZ$wl`le*pKgM16{zR(iI|D$ta2U)!B9vHTW4N#xfQz*7_cOl7Mg|G# zQzCjMWOxCgfAlCR=V`K&8C}O*=+p-eM@(jhdo2dYg#I-A2p2pYm8CaZ7Zq186Jioi z<0ArhWCs@%gsM#g>tod58EArJM}Cl>Uo0XfqMsYd=`f$`w{xQ4*4BM6XcPT}bBp>! z=Sd?AfpKq7R0NW*zU}HFfCUy z&W4lITifA&YY^OJ?KTED|2~Cf;UhPy9w(s|vucQ2GQ!ui&C~7rRM;JhV|x!KEHZY5 zWO~W|DZXrnR||x(|EyE9Pu-rO)(6_o&6M=#^Kx&Jcyuz^8VqA!nK-LgWwc@N`R0%>5G-MAR;m}C@(`4h)|EQ zY*&=qdz#VSyQflD{vc6hp`Xtd(@C@dVd=N_X86L?rAb%(&DOVC%p5+!Nya*iJ1D?4 zq%83x-+F_Mv8lxPVA}kHvwnJKo`c1XX~CRr4r*!NVpAbto9QLaoVfMR5=Zud&L8d@ zx301mu9SqyI&h}k0+!c}WR2k~6k*PM&<$Gc9C_Y6AK9s@L(fM8*ug! zA#lrk+%-M`-!(|R8~>2`3cH=)WuhX_V)6|)#Q;3)7rhG*uPT%?0=)Q$@AYMw2C=-9 zC$rZo%S3sINCX!284aMD4?@rJHowUZ`2+WgGoZT0eS=nByS-ZxY688SY_a9G^|c-w zRt~OH66qiZkYHm4kfKhfa1oZ}QH`|A-KL<=?KbJY9?5haKPYyW2y&J|Dcg&YCY7)& z)Huq|rra#5l3katm4*tYegcSs=`G}Mj09kZ*iIkRotXbfFGcdLp_G3757)c-uwewJ zpmyft@gyu6AD8T!5;yJN_n8S0f%{c0yR6>`U2h0Bd&WrE`i0*8@LmTqt}!IW!^3lW z=c`-jGv>7~NVAwnI-*_LJrUABE~~yeJy2H-hPIfpafhpL8Sq>#_$)_>kZW0e+x*Nu zjA9ihVHXdx&e z%>d1G`)H}fFVk?G-+(cEem!64%5rV3i-g1DqQeS%#6gr z0V^bnoJWcvt6nWt=xEYXcn$!;Z4&3Yu2=9oe{93m@o)ye$pTrE7K>J7VowwL7}S#Q zh;GC%G-$@w&FhhgcB~Ze_jGPPD01Q$dUggFgLj)_@&;*aU|M@Du`B<>2`qN*Be|fd zw=B@=aA#jY_(adW84=f&q1j?Kk#mcZXP^F+wvUG|7e{T4f>gX1y63jmfBPzkLufNu zkhUZC%HyFxF|QXv%}%qH@`4s9-2M^L{i8m*N8oeKx$vw8Qx+q03X#DvJ!lWOC!L@F zlN67i)hwCLe*bAw5;p?@{8q)ZmmUAk*bO2i)7v06IT}jlJPOtVgD^#A1p%}_RXYL3 zIYoiERK%)NcsT`$9xgPXw++ajxk@|$rSWp9Z-`$*;#r)KnAE4=Vuj#>G_T^q2k$qY zgwvRwr7OwwC;KT$MNkao@&R`B#Wh?kf`Dp)YHu6lQ1NZ+$B)GM75KKfs@7mf^T~{# zw`6*^^Qk5A@;x32l431yOjhI(2z_tE<^a#>SV+ReZ9@h;m61CU%?nV*+Z0oZtHJAw zX#(@T4r{j;XM3d8%g*sfkso4Rzsc%Zkal4?-e*;P^?>P_TrjAR>k32F0!5yE} zES8xDzuW0#y*wFz{r7*)Zv9Xh7*X(*I0?vTEHSIP!bM-4i&)3s^f~qBcEg{n&vjT6 z(5$O&s1ar}Hd8kyV|8t=%`kaynORPO6dTJ8oO#*cS7huAO!9z(eeVhTRzYJq4a`J# z>^M1ib9KJQf~-5B5RA7Uw;z9--h=OU3?CJl|Gf9nI&BzGsiDOS9!7*ySVA@uWX)yd z;*zBJLUoOmp{ec~C+nT7=JSQAwbRw?R%K_WaxyYKoOzRcQY=__cS?7sn759hOXwQC z=Bt!EFTm4;bbl15Cy5C!jF3`tjQ4uSq1IWbA}s3FD@*f@f;ohCz^W~p-bQmTrTixqV16^YenE=HpVrCyxyA9q==6PzEzTn$YCX5>>@!J(N0;D;O0%ucPN>79sRat@=+aI8rKa@u&qmT zWj5uO&4bT?^JO^&rOUoelvq?8p~KH3vIAX|3SD76=4qEbBgQ>BrU_T%JEkI;(HLQ@ z344FPqWtdIo8#>Nz7#j4@cv9UJXXqW1SGy2hh5I1iYmYMjb%l8>3fD?YRj;O&MHb6 zKhpohV0GN{rxmAj?j5g1^Tf9AjraQIyJ?M|ofy>LZ2O(?x{YQSJuiE);aOMw#aO!A zgrJvH;s8;@0!8`Fk>ity_+s7cq9j@t975X2@MI%a$cRK+@HBny5{m}9#2!-&K=pj; z-Tz$9_-!~CY{yoN=Hw~c$9_YGkqNS9I?dE6D3mlv4{YsFg-Dp5q0t=$I$^NO6=wer zW<3H@5ad}au@hXv1Ac#DfAXwB?k^Npz>GammWb0zH&S9e$xi3H&f!C=Pl)>2 z$k=1%UY-d42-)F-911t++h{?OYW3Mt6*}K==jN^$HJK_7B~=VzpIJl|h-d0v&nb=z zP%V4-7f9SSn3@wp?Jc6Ehu0S#5)dpA(c7C&M;?SP5%yXgq@5FtG?E4lY1>^depT3T z5g4t43Iq@xOSN>#DMW<=@twM$nn;3y#h}`xWR7@6l_bnC$7FU7oRxHF%#KV09^Z95 zSQBhc-|uqChV3qQ)BnnjWmy}X$U|l%KhSDypV2!ew;IT`~a-Ar#gT%UNH zR&dxle__&Q^ZV0kZu19o6xl93JnriIYLfEazW#>p7A?u^-5%^UnjO@Mj8@)pNN2f8 z>RyzOr&iTERyNbBY>Cy=VBRSAvW#f9#i@>bs$zrYXv&UqL=jgLUvZ7Zl7WDR;KTeX zMGsFqAA59VM8CAH58VSEN=wO9y^=mc_7PCbXeF=zkmqaHS8)d$ z=+h;2d~GpJzgvFR1Vb~|ZrE<6$3^_FT=@jD)1N^7PUOL0y3k>G({|}`FSx&ciNeW| zlBZ*C`jcUjESIV@9{y%r$N22a-p#~aH$_upm}$YT*&k(y9m7526|uKT0-aR(C*=k6 zTE%KuD0XYKFq zYPeA$Di5zTe5XO8wUU3(Q za7>w)(|QVhhZR0Zcz)xKh_QJel|VSAUOWNA!Hpi`qKj&DW5`>v_0c!py}9(PuH3gZ zle3-5g%RNp(2yXXN5da_a+N)I-u6*)*STr`GD(DS8)&O2!NgZ__dOsfZFG9eowRKk zPx0l-Y!gu5B6iZ;7dN_$!mu`HKjEdU7c8-z%cNyvL^-UQrl(2~#i~=bANy72`@e~e zXtdPs+3e?CA$XM0^%k^*8562=T*>JqP8E40nel`F!I& zbpND1oT?l(k8}odmT@t;)A5n4RgkayrLeK(aah6J!Ma_s_7~EzOV{kKP6p3MB=7B| zq)h~1ran0f3TBZ#QHegDf^`MA*6(p=XFqwS*Of$@UoE7vu-jrwHNs`VT~;~m)urSk z1UUiHG5dG1x489_AD1zWgXASMJIeXfwn39&2y%vn{QESGZ~KU2k(09jOJC)p+exui zs>Vk7x$IUq(zy+uBK0JneXOLM-$%J_zkr+>Y!BS+kX2*AB z?$Wd~>M(U;QWL6dQ_EPAe%j{6o3VdbmHUN=fU9 zK%U!gi02J`@%w8_d#Jzg=+L@N`N(kToBPrkRa^4L*l zv^~!mt6t~YMA8*|-AwvA^CYS?Vb0`f_&8iDJ!kh?(k-6P>YSyBne_E;ouoEE82&4u z4TQ(7l$zuS`x5p)+zz{X8pH(29;ETuq5$wvq-Y|G+5Q6iax-{0omv_iiJ2L|;F*qa zo^9AU7*MANbYZ$iwn8Ydx??>gEESO$$SzkC{_DH1fBTKs`}?44q;~GIAWlaS?Hx6q$G(&q$VXucI62n4E)PZ&6wwfz{iC zkrjUhf6@3Mw>(Zi4PH%Lhv`AM(WA0OK?T$~`GkQ4RwU=uy|~bpND0+}^+&oql` zT=zx-rv)7+Q8BzfJ{kHu)IFZEyLO7!OWi%J6aV*1Bc%(>lE|42ava!r1w^xip)#N4 zD(yzPhw+1Pe$V_(F4-uOba2J-*a-8nc!VI*9Vs%3&S{1Rr~Lp34&3>a*`rtG>|62!(ywa9douhv=zi`k7Nf{rzS=hXfe$!rQs1Wv}h*XX> zg4rOth)@%r8OauY`46>_W|kWl@fOcL%^q<3Ixlw>OMH3f%Kq!C>rgJH^ZGzvl3UdB zncfHMXR{q2hGi|eY^FHX%wf5loy7t%V@GAD@4md;{LIiM;O~X5$Q8ShFZ4{^)BTgw zQlz5u9Fz51ZXK!(e^MweR)GHHV#M)p-Cml^?X}|%%bNN}X9DQGq4?sWa-Rx&A^(cU ziO+mKm;fm9bdM@2?|#8qzt|1!l!LSqOGo#d3%0aG`!V~=e!ty|-EXoR*KEG-y8hQB za>t$^i#X$-@#ZFhfP45x;}6Q7S}@Iv+gC5W7b2v2Tm0;+_FSmQ)O+SV`wCvG&KvwW z9TVTIRD!dBde}P0_k6R`4CrA?rsSDD7h$Q|s=lqQt#iSYQYC`es}TF0%KD36on{I2 znN+cHajM9WPd{dZNPm9a0X1t$4u%ayLH5XQeJg4sxA?@?3|&4)uKuG!B*Kw{AJ4SdhEcUXT)xwq1QSc&|YxTaWfHQ0VU2vt}uHFGTAQ zCu zY8i#BRs0rvvoZ_f%&6I@lk{JH=CeDE-%fSnm?+9YO&5ajvpMjID6Zs_S17J&A)k<7 z0~=+m6htYc?(1I^jm*3<$T(^F$f}0|c^dSkS69go#OBRmWo}n&4m5_OvG=rL=zP6=(%KH}^@?|D&SoH09nj&{Homl7-gQ zg>c;x9{aR+Y@(Yq3!FGF81Ys=ZqV@Fp$Z74V2OC8P^`{rURN=Yq+*DvndcIs77{`=KO z$>L93YhUi0Ojoxq+1)oWvNhD_h%SC1ttC{b?tZ5bQ+Hp|n~TTab9byFF?L(s{eE}s zzvmdBd&Hr4_zb>#91MB?L-)YptVQk{!=RB{s*G~uyp+kf%=%Y>K&ov?2a)*dx6j1W zzQ23B61Yg1TvbP`)FhiAizYylA9bgt85%1)3<-g1{b1lFqXSaJ#RU*gYODEL@0d~! z)_6Vk`v`pXC~^a*h$`QV6&h$i9*AH(=@us@%!6xkI=Dyz4^yR^hbT4}*4PE5qAIQf zUXA{|``0O7-!YSHuAKJk!jJ>J)hv}r?L(2;=@+j*{BNUG@zEVI&Hj&hQr_qeJ(BQm zWX*8-=uwhYB_K(zsdyw&C=BeKjEQJT9Um_(^l#o@nkgln`JVURs0@IcyJgRSSDD$; zkjC1WYwLOG5euSn`>Czi`uew(H|nvS?xg!V(Ueh7xUXw-$|$dBX&>H zyXfTLlf;#Gd8vDF3#^(AJ)R-}XTLKpBmcR*c=lq}q4j+kOJW!(@gFsN^3$ zC3+b{E>>>M?6NpC?w_{5fcA-V)?ZC^&2yOZgwUr91d**qB8N9&WA$Y`X>UD`XI*?ZL~HdpBZjfeA`fO_M=!Nz?muzWv?%5zj|i zIdkPj<%Q*rO}0{pY^n8MR?0S_WD?&hJu7V9ACbVLqx4C?Htfo_wf7&*1e2Wsa{4_6Jv zp5~H%wO;lS)Bp7allKEBe2gzpyA10htpDm+{PfRTb|RDc79p zPOYoJzvGD;*-cU~OG)^Ef?)54UOck~olA(C`O^n!iyGoNcMI%P_mi~d{WqxafM3lO zHUFB^9(lKjbWeRD(G?qv#c6Y6c!60}ny!w17Og&n^!wfjtCd-4=S;a8Wc4z=ksgLm zb&il@)1hPXnpE&>x^zv;K|L6@1>?AjM}Np(&v_-+`o=lSn0Q4vXEpCrzaG!0FM#)eW=T$or7{gQ;bbr8jG_#-sd*>Nuy%-#0r zBS&$O?dL8q2z1Aj-XmUX43l6}j1i!E=Po9F@mur0#Znf<|9vKHM7-(aT2~JxOaDIC zZxNdTv}=!~uwu@a;umE(&WC?%gtVD|5NbU2ItFI2kdGeYcQJqVy5_Ees8XLYn)lp^ z*1J^Jxo8J)=CeMT+eY>6nDN59@JC?4De&?qU+M*ERiR zK(d+dD`PWOa4pkVs?553>y;OI$WX;u*2}@yGX1VIFlBYjnJw+LrP%w=GJUR3Q~rB9 z%y6rKq3C#r$h3#8D_FBa;V{Sq7|1HE`}J+e#l(ln@9*X-{^jSz4pFW60;()gV2Wx2 zl(g+l5Z*&Ol4^e9OM>ba{EmZ7!60TtP7E zmBh6x+s**D#MYh4T`c_yL|($3xb>G4TwYt(EVRnvaI50o(N+2s`1RF>QU|GZeN1BQ zULRID2&4~@pK5_Q?3Tg`oRUR(RD`(pZLhzQOnVZOq!)oP75w1z(tDed6YZ9@CV7mD zVE_}fgPqrl>&!*3f4zdMO?z!{52(8(9!giIJBO6#Py#9%y#702&5hILm`ZUtDzxxG z_tN~%)`n*Q%0Dp2eR3e zTwF>WRt13I(0lri??rw1@r?HjW_R=n2t5Al9gt=r?1_~Y|Hc2lj|EG+5N5P+SK99n zYJdcbIFq9XeO2Mn2E*vY>6eyK*`y2DXi}izeUo^7HNngGI-@ay)iF#ZNDwuhXLy=)a_=G9W4Z!X#1?tkx{#OD#GNc4mByYGBUC0 zK+y1ygN5QVGog#yKqkD7XglQJJ^#rwf_00Mt8GVSN=7D(3@xF^>{|}AX(>%<1MiiM zJQEgzy@{n>90$Re)Oi;I+>@YN0XGX5zgDMs>Ssw%MneWCMSmbdVLXln`EwMu<~%BW z31b3g%$?Ef*pv|#c~(z^A7UI%mE0e3b@!YDKpa1^=+)$H8aYBXhh}o2az0gJ@#SQT zpYW{hILKa@QvGcsJGy*??P>ph>t|K>n63x4TE9)Qd+)r30|TE{K~rJY`mC;n)uZ|c zn3to0XJBsS%_3!u-i<*~=9)uIU-A zPUpOS#}$>&;uS8#oYWK=GMjJ?h z`wI9#bf3jR<4B>;LGt(CrYlfr+862r-FtDpDRAmL%f@J_LD1#lRIyXCl!X^a!{cuP zx$oBU#5va%r5DZ5k2afuJLA@as@WiC@a{|;&PKZf`%H4(7PwkgM4kX=7n2a^EcxNM zMS4Ig5zm=jkm$c4Bw6xWF+XhVIlU+`R zU2da}vp;-m$GP_J<+;O829T0{6g7X|7R)GXf-=S&Z+TZ3NG{+v#jWk^VM6aL;KxT( zMAPzP4-%t^>Z0n5)2M#1>P^D}i{RhA><6d(qISG{US_CcSt#d_MoA32RS zQe<+^fxSKmwEeNlaQaw!Q-G9zDShR(1yk0`*@nQQw|3DLcF9G~TzaGZ{|?mE

      =uW1=+9>kFXd+8S#oW=rJegwBAC0u~aLYV(2qGdM?Bt86yXFze9 zam_u92pp=?VB;UP4S$KEdrREB3K`=UN?wH9`qucL3zh@z)}C$ zxg_4EhvC{r2t%2qe?O^3jxhdYv%PZbU6@Jm->mfidnqK8u(C-?Y=^8oRg zIz38$ev|k!aXd+;5`*|_*Qr(E>9|SZ21=?0VC#zg9;*XigWlUHn&>`YkVt;PB}rgW zM4gq>Rblko55IIgU!9rl8H>zrfEQS@azGOB+pF{9dVMF5!SfF@%4xLhfg+|zcj3Fj zKR5>&@K|kjokLB7Wu*D3ei1XFo`^U$xE!%wYqAI9x8U|Oh;0NPnlLV`a>~y@*ROgh znyWb&>hx+o1QBfMbfx7Ch#FdYZ`5skC!WZ~cj%c;in0IUp^nfLdKW8_Aai-VH8nB5 zblOry-3NjBfgYq#5Gd8#u7q|4wudCo{QZI~v{e>UR`#SOwB5a3+3m8gF*Zy#m}tyh z*4{OC_93nVhH7K{&f9h9?^RJt@x`+%P19jck8tFtHR;=x-5<6>E4Tk^4typLe?XJYM|4w(iLgBOdpEJ%VJ z!Om1(s-$;-^Y)_vnL7a<1)r)#BHt=8D;1M@5G4VwC9WnJEZWE|@^di6OGbj7=mIG$ zYO{_wi#CRD6zmJz4Y)nXV_W@-$r4$y!U^i8Yt()8fJ!mdXXle#Zz6zg=t|oKUlz;w z!!V51Qc_--GJZzHErbKUuyLEaxH)=dH&rPc18crZv5w#?EQZc58XiNGl(%3||4rc+ zPKR-59rJ^qRa@gG`rjekABv&t)Pj(&m3J#_&ph|NEu&c*j@xOP&Tp90^3~ntX~I*1#Lqh_7cdmT$oGn`|Tof{3HxI(!EIJl;pPf zFR1rEBpE>u;wCXT*}hk%;fl4MC|}4SN3;sM_JEji){0)S7E&S?dcf%$`9$erukOD( zq6R})#C@IWtK-uMi9<;kWrHDycP3Ls#mB&c^YIpmTJQ#fQXC2A!skL@F*1D5$GO8q zmUgb0cOr~o0D!rVU(7PRVF7a+rfp`!>yeD8XZHKUB0NOd%)AFfQWVRzQ|8ex_?Eie ztq#x#Eo~+)<{)EHikZl6W7Xt_(IV3K+PoRm4X+6DV%9pmIAk}CON7QfLcG>`O&gbAF0FYOqn*I zFVc_<^P$}*3DdT!S&DR(65>1KYN5Pcu5aox_JJxSmpeLhh1uc;W7r}arA4|3`tB-m zKd%>PU1pi+dxjN3?+q%7qH9<07*|gU!+*B<@NxVRy->fep1wP71(1g+5P#vpSfi+$ zCwH=dMY8yiP80uUZ0Ljtj8V_3@l~k3A}gQL<&|~g9KZ^Zcu3yZm4WD zF|OSQGgVXFg}w%TCDgo`q2%69^IWzPk!bd!J|LitMU(yW^{iNLf)-+V!Z79^*;FH+UGo{nlthby|3DEm z28NVj(CJ%zL2%*m3I{t&+>y~jgI8>#V?G4I*P5?2y|W9FX(SD<+1U$fX-p;1@O_5+ z_kWZjE*p0Gx9|^sR2l1qlaGfAeXT&RoWIbo3}0c!^VtUW7{Yd$K`b+q z_;^E*NFFYd)nbtUJfo^ zyq01skCu{&k~!#mu*g1;*cjp!u~NfgQdKPTwwLKpChNvcK>^H8SWv_4Ws@&)f9zoo z9nbKn2P&6LL`KVx_cF5g!DDjkW`Z4D(g?XcGGx}3Xw4%wAURYZlp)K}%<5yTKZoiG zUzFE{gF%?-KE)>aaWSjQgkSJsQ|dN`p5rl^YWT$jNBQ}Lm}l2lCg}$#f|D)yAgwoa zsdbmOnTS6sG3oO7smM+Sel#YVbFxeCOOW6lTK>3Kn4fdEudDnYw%$6bs_lK_h0Rtr zy#eXmq)0c?B_$0CC>_#D2-2NOcY~B7C7lA&AyU$y(k*Pdxs&rd=X}q-%{0Q!PAu%?r2z@+kaNO0 z?fM8J%>6ZVG4le)-91ER?#2Z+V+IZ<58Ov_w+mWI=BMwf2Hkw99tCV z_VV|`0D0OiMH4&jd2CKu(MJG`u}egi{cmndXnb!d%>9AgU7r76%Zc|I>3obT={c~R zWQ8P(m&?Oo-84|DrsNm13PW07RF=l}nvX;Gt-am&rPMLw`Phw~1Kl&^aC^Ks+5KE< zPH|N9?UJscm&G4^dLwG0vPNrlU5`G-b_v{VLZ7#!(OxT&!LmN_Q_vAKw0-9P0WXu;Az zKZ~7y>3Y|nd!|(|dFwd{4ndI^#qX5}wlMCqQd}Cq8o2+J7qc81zL}#MY_EfyDp~A( zZb&L4s#8{7K7FkrzC*Icn}?LuQ^0IiU^tAgBVX!?7IcbsQ_wiS0+bN)4Qa}J+Mg7_ z<^osf(RDXjS-GD{n-OKw-6}wgP%+CEjnET4C-qcDJZ-$AbaP*#r{rhhRqj=_*C)XW zv`s9VGu`Z3`NAhQ*wkk`bpU#JX07Mj<-tmSDf^1ui#uTv6mO5RNP&l;9|f*(fg z_T-(L4|pwq#DV2^hqrGEt|^ck8ItBfzc#(Rb+9|6C5P#I57RvPC}Q-pT0A&0`rv%T z8IlL1i!RbHq3XS7BKkOGG0ajY6ql+UPs^8!lb|qMs{c1j7*|2chW70>GZsZkk=l~K zvL+qUDt*F~sqRBXmi{1q;{By^s~8yaxxGVSu^--Vf#W;=So8>~k+E5Eph?A6&iTp6 z;&r~bNzQd#QtkW7>3Y5_9=NbwT0j}%Y@hIh?R`!>q_vR{r&@j9h_3*e)Qd#woz9zk zY!J}<83^8sUt<|_nttMOw(?jYx-W_|(^+FBl6|EwnS(1qzOh?(35`4SZN{#IzRN?6)G1FsS^#3YQTTY4+^XcJ=f|%jIz1uRZQbXR zSv3>phfnT8_ZxqRK@Y!F7Lw4&I=aSXNbL90*M6UxEND73{kE1UD)Y#tQo9=Q$|GjjIKQYbA#PsC*^%?Vy!Rna;O#vt3=BnIi~~m& zQ7GvvyNS+Ko|2}XbMKgKxY>Ggw}@Ezx6^T=2jx+3C%Ge;l_hl1;@8juvi2i}R}s^f zpO`(riTgfLJ;6*WY2!_b3<32#q-jm^9HH#q0u*WX5~qy&C3zP2*M{cyzp(Kek$;(ZzxU<;X-1hqwx06pGe2`L|LKDFD+vc5i)2ZQ8>Rhdkjb%Vxx4e7a1DbE@<1D+$+b zi}|OAfhrPvf4+OPaQm=|xF*&$bCpH~F$Do@XU7)2R;`5D{pV z{~(};*$*#pca=3CMh_CC%zRfZx()Pf)WxvCS#B9wu?wKS(>Hd;ccrA_`dz=yUZ<-n zZ*$(1^5J+%?EQU@$S>E&7f6pSGBTm%g5-|<0RfyNTAQ^ZC(h;^xMb+w_10*?JAULX zi|j8%nt^esq3dkO@(V$Oc1q6Mh{ReeP$X(Q_>pcMxzBq+Jx}EUq9WTf&XarI8Qq>H zht(Zb(SsGBmZD7exdAquP#~8~z{Cxy-{Y;rIZ>yO$y6a=CKSgO#Yqt870)+A5YXx7 zP@fDi=&Kfs!@_mS1bucT?N056gm;_g9^jCpBll10Ar9=|q=zjrbm{k6BWRk%@ zHFmSXZuyN0H3F;fZY9&t+?+{$`jEtF1Q{MWz7K6u2n!mwE|u5)y3<7!r4Jt(j(AT- zbVW2RQe;vHLxw%q7ed<~T4odC3jOwT093kA)l89Ka6`pJkEhIt0kG{>58{CH`0YUM-~7el`Tm+n|$#m=0$<^|L&sxoQDqo_0m%OmhpC&f8M`06yWx?_8OW^-7 zwQZL6T2Soya|m|^q`X9Y6L?6EtfphnOOcS!ydDmFsfgQJXCYPL(q(gQ8Yc3ZkS@!~ zEnz8gvP7@yGjP|1zAE%G3%V6zsLL8w$vq!R(olQsy?3}enxxo}070Jgek}hflO^0$ zi|^k4HCV{Q3$O$u=R(;M9Cl)Y=6F+9o58`GEL9Nn5$RW3&o@~QG|>s0>A#|Bf~I*K z!6FUbG5AeKd!>?EjFUZkm7|nd#lc3>A+pQj)eD7<^1&$a?D1OnjC&=Eq1@2J*0Mz32>{gj3qRzR89{59MIW5i#w$A8iP|H|3X!S zjI6iX5GE=5nq@%Px472YjKKhKEZI4sH0Ry>@OARehZO6-uO3SvC=us3=aa1=SI57G zUcbCq_pZ~jL*t<$a6A!nt=m6D9}@0W+_d!IjWeY1=x{7AawdyWL{4Xv=pYsGmWHGCfvxzIy0T4B9aVDPahg9Vvn=dfS|1kgPaZzUu z`15-ZXp?47#O@xS-T0?O{Omb&_#difKFKu% z9iZFrJ7iYB+oSXM#P77IB1#L67C*nAEGMjsTnyNSmRoKvHfj3y0i654Pi75;f1D9# z%>{Y$$*r5=tsgc{)OG3&sU${Xil+GTCIm7{Qn<}c6y+>%p?)9YgGfC50UkrFHo60JNU^YPt%km2tWq zdJZr~QSm5Uu`TAM3Ssf+i#T{4kpeTl*e(iaqF22=_ZHG$HB6sB5{IEd)ucr4>Dk5{ z4dLGOEIb??=INBM3kpcS2ZA7^+@`Yi0D9+~zXm!jSzD}IA>2d+2#GB!y7oa;%yl)4 z%;%C+&pMmvq(6Zkr$82>XqfYLk&s6vcZ;4*wDlp7NR=(;g?p_;r)j6)-GW*`B@Zk1 zIC?C)rQ1rlkN3swEr-_n2%drf?9g>*CioWIH$m80g&T)8-#HNDg8XP?Mh?MyCDFWp zzb7qwUBvcAs-7P19i%rF&C&?Bjd6@gE*i!a?tg7Q(|!=O^&*Yy{QHlq-If~;yT-o4 zg)@YVavklC;+pVZxl)lZ;j;9WrLX84Fz&vzY-0rpYqSh^N5AWAvPtOjb?1!FoKfMG z=%AsTgRiukl$6Mvj;>%#jRL;6j_cyTtOyW3nxI$TjXU5-ahdC5o{1*;GFYN(!YodYpZ^d2D5H2aRlXf zx!QWA$_Mwx@=vO_@uYl;7<9MNg?S#(nLRj{dIM0KmWBeIO9p`?I6+XP8ykMKCBfJ- z*FHYBkAhU;ZY*veN@_?b-Wuula@R$4vm0tf677)6=JNDo@~sf-8O|WYk#WuvQbu?S zWmF#8?k8R$K*~Vb38PktVTd7v8G0!b$2FjhYH#5k zdNE zBWvEFof>5Rt`6~rt}cJB9b zl-SGKk@AM%x!RS!;3VUaelx`eg?yR+1>P2xleaOWnnak4 zfQm_AZfe!yjPD3NH|q}x>;3%U%C7AroGSOrxqnJ2(3L?)&AOSwY9>8oX$wC1;-*IF ze+D#;;Q`o(5f_!azNyus%=>n2y15+U3F8%&N6SSsd6fPEGLp6iBi!ygToaG7@S`0g z;dqL%n4NcMFwO%P247|p^qXW<$$W;6qL|DpjaG|%9A%NAR%j{tz0ra0pKm@`R|YyTk^hM}PR*{{v`t@BWpn7ut84B!xb)Fq$&fTE`CdWe>} z()wj_tqOx8x3D9^GfPa*o0c%2QaVdp0@2C{UnA({5GUy8R@J-Fl%|v=mHoo-VF)>m zq1ekzq#zVjxkZ0kJPAD%&vDYX_4v{`X6Qka zN8PLLimrBt0RA3ZIO+p~`E}+^%h=);GVklHALVc3>E=C%bIVMzR`MFj5{xYkU|LO} z%i;xEc@N&*T{)xu@&5dE0#al8Tr`_ry%)xn#b5ZyhxZSL&b=X*Sk9{)<^(NDlTF}a z3ucLaU+SE=kdm~JAxf~arf-tCqVJfWT*T~g6vIh0ia-qyrTjVo`+A|C^)`mvjdD>6 z%+KSTxz`I0fJ6HlxDeF$93=8NJTL{dQKVA+H@8T$cgQ=6QM&bfc+@u5dNoC&{X-3# zy%VL!3DE0RxqnyyZ=%i@9iDm%Kj4(#9O!ob&YWo1)GyOK`hz4&iJ2|qUXR8KjJ36Y ztZXq+&0QPaJ?!y-BzYxNdTVh4F!Z_H_-`Y|E` zdmKQnas&`Lj>_3&Cvp8jRTkO;*{bGCqpnrf&c&hCe7@vQAFhnJr;3tAMQxd1aW`M> z5tx$GZe14PhKa)@3xz79XisnoHJl_65pUv}@yD}h0Q-WrtvaX- zKj**BYOVV9Xj$>_{y$BJHvIeA(6@V{4j{Vg-{|iLlMHJ_IO01_Ak0d+T(8ZQ2(dyw zg!o0Eml;Z&{{nc_S#7_0j9Vx9ckv6m*(V7svTi8WHnE~Un|Gajh~Du)M$;b=q5VO# zGi*zp)UjQKW9ex4v53qhbYw6d{@Rzc<5e`Pxp ztsu0jkXW`EKenGtWKA4-Yv*_L>v)!Z^W6O39xn}2{PzezZh8|1LU#x%uISGINjnpj z4ch3s^&ld#v#INs;nFn47IYMp^1UbIZV6HMxjY-(12hb#g&%c-ILZw#K`ejN=}7AU zN7K|Qy0!ol$GvM6wjt@&l4xx`vu513?PPU%I6QpEOfU#XV5)5bxl|lHyp+c!67k~B zKAt~=zVFo$d&xy~=DlGW-$6Y|Bf0IjTLvcHG@B|GyMfEac7_0{|DUUj4PCrv{MVLc z3*!#R^~li%+2|RLs5%KW300|U3V@qxBKi7Qw= z?J~5sAB#iTpH+W8x@vsAVY&q|bn0Vl0N%CZEr4@gpQ*70+}ck&58i(G4aR2KE71ZE zgfh&rm)!prP8k~#O68iOg7cK(-6-;8U1ge9H5F|N?jxCxz=djTPOGPc1b_SuVo`{xd&hJ%_5JTe?7Sja5f9`Dp>06R`*a9@?m&t zxWrLJuOt3K`Jgx>$~t?r_MTeCW`CmMVt;~$gwkwvwHwue*<~@_rcN0r^v6p8ni9AC z>qk9OZNtfeD3)nj(QcEqe@%1&$Dd<_dOposP5IVOvs*nH8^Uw1_nlz$#NIhb?zP_` z(TAt}?3wYoC0;)f^gchFoAqudMJ2U``^BKRUBK%mp4sa8xMHjX=G*JZQeAi4Rbo#U z#A=llEmX_KPZNADtQ<)}U;hIaN?P1ie2-Jptk%_w_sP~uJ)nn|Xk1s)aqNHa*lw5g zv+PmwHDKXmdvNqqKPA%h`2h}U^N0VE){YVII+11X?7t#0kDw`-8LESU%@;s5+t$qX zIk!#^sR8z+**{rs7l;_|ZSn|!S6QGZlkjO)IWrR+J{XetHG%GRiR?k62%%jrKOmTf zmc>7wFPJ?xxpJAruq|n^S#QwNIbdS_+Qt$(!-eZb{@ngFX?2_aP3ogXL*BK5$?z0C zUK0N`+04_zeIw|J%4F;1l-sS1_OJ3leI3@x()RKr@pwfIA1+&41B>KvbTO)e}fR z tsErjQN9pooj9DtwkjAh&2zx?KH zof?TO-w|nAk=ilKrxvjvRZ|ze791^{tNS_vge=kJBGP`GGV50gE@YINAH)U&+&4LcGr^ zy;42L1cpTwP3c9^Er^4d4?;dmo-X=fe`9*?{QcV8+`hIzWbHV!eMrH_etq!LUH}3&4u}@Y-HwguSni7lPKj;!?WA_O2vYo)z~HM-Ha?^g$H`%owjW#Q z@GQEY?c36Jv2IGK$8#bCisSdHjhsMSOki|&F}C!09qU-koyRR}fXN!ktwxshX!`X^ zA4zs;4`z=r6@fFT$jYw+&o;32PNho z7Zgm(nfVOV0Nly{cho%1m(|=A)5)Fl+La&-LNK<9V-(2)h*KNG?*p5`8?WeSOX-yG zxv$60^Gxd*Wyc38OzaVO;#2mQNcke&id;(1?F#E^x7#DAJLn43Y)m0j4Vy#?tu_8% zv{}CdCv0$=a@G-T44a^wP5_UfHuF6=WeiHn+54T_*%IR!v@z&}u^>eEfF*3ABQIL~ z0Z6*W+uSAdSI{;Ni#j`4V^wszK3f|AGq?-4WHDdt10-)Nx_$lVCk)*JC89IHn@YU5 zJ>OI(sSrWND+l89`O6(ZJy`jnr8XYcA<*}@x(fc|!%9tRRe}EWsIZAai%rdsB0aGY z+&tYA5<1A@b{}(g0+>0Wdl!$o#BCeoFe_bmo|!DpSD49fOq8bE+~J8L6@f!zAhKWO zu!#3fk&9iU0JFnL(C}U26iguCvx@na#{bw5gcQ$?>Wo%?pngzla@{eXuCx$VP5D-5 zJto)F4q7^;)?nh;yC20mYBjh;2S99}XuRDrtbaB)-2DSyxsh>?^On6%Rm zrlb_?%uLN!TgPAiy1B~s0vAuS#^y;EIt1L=S5F9ta##CV%YV4$?p$~v<&2-Wy~KX_ zDr_6%TFz&IvYmJu;9$wNQ_(}c5145iq{0W^cr8Zr6)T-ql)fCpRFA+!AQo-`(@t0e zIO#8gn=y&>7s1T(X3lamB~5D%&iEC!O=J5hOm|MI<&0b2oQroI@s5|tJQ#O~l=l<3zXdkPHeF(5jmj_|Md%W2!j zcg`o{eE|!i`YJ6KMP5XXFN+tV97Jj^{k4-u6Jjs<4I6O}F#7Bw$+6Eu73rXmc!6qu z-R^Vjh$F`rGlZ^LcC$(O@{{aFQXIBVi|JMZ$sAH8y(T^x*3hOO*Y3knVXyeS;RnH? zg_O%wgjU^>piS{w*_fbLS1SEaidmFK{5fbesqxz(zT$5_Z+u-8MbRs>k8?d_oSBpN z1U3!ZKwVHUST4Yhf35r)LC!6cZ&>Y5yZXGwhS7>y>OR;Tl@4UgQ&>37p+S9AZ+^Zv z4|Qc&!IPz5qRMqx{g$e;ib}e zL{NT2|J6yfhUtr`M;-Z2EB#8eP8lgY`~E1ojO1MRp9u_2(5E&0*pQXaLZqJ%6?`;5 z-X4*Wz^-{Y|Ezp4%^xMuSnd=aoO5>fD=vPIbEqY{EP}k)>L*VW*Ld*n+u1Dz@*fYt zG90%YdP~IG?!3zB%@j*wn$2id`8b(F>Anp;i!av&Gv0ExHOoY~k&&W;*MZcciPN_O z{9HIBy5a&1yV*R5$P1DbVr^@cZ&xWTgB)rr!tS*;wTA%A{%h zwoG73mD)HLt%P_gE#YvIBt0zhj>4Bz-WQw8YalkJZMjmQl%z=z)dyIiY4>8tW0>I# zDI}&Xz2@d138Z8td6&zi0)u#1X1VJwqQZb&}Jrs30P*|)pau$R@-e;O{R-TySKK?nKE2FnbZ)@v{uu1tsB=&AOxo#5TUOtstz-!H?WAqt?Be|g$^l-1DKhCKi?}NEYPvDUJff7&*+EBbpBn%v{2W*hQ0$52%){ZIOQG^%P2I0RY9d1!~HwY zPukUo;xntdxjW8A{_1Pgs8Z3#v_r2P7R4n+CauVy9&9ZGCNhH#Xoezjd?Y|?JY}X(HvjabypRxwNyG}v^xS*|9YIPf zsGRbetD;>ywhz|_ioEK97I+1l<47_|2$+10PQ#Fe%_M2p)~EvS&vId(rlZgvNH}3@v!cr;t>0w zZ~=0qU%n?_Y%pTG`J4F}ZJ3uct!tzoe2%sy;T7XE<3`K4`fj)3>*SmHO@>p#vmk9(9@H>i!+x4LS7}kDx=7X(u@;Cctk8$u4OvEAA_<7D=uDBk5PT3p zqWp*Z4qs(pwfzmlMG2cmZvJsH@~vddZ{~Y+XzZpiC=7Gvy*CU!sk&$CgOOZLWzZB< z&}Vz-4Tg%{&*n$MHMZ=&ckPRYo|eb{F%TJ;JCV>1XhHFa*$vgzCjV?3av{i61;(5v zMP&+aM&rrrTSkavp~YBS1ly+C#%>YC#Y8K@C#@2-h~uIwx@)i;yF;0)=Nq1m%mias zuaTK`cJn^li=gqu_2-nO8bV|}v4YT9oghcBD=Tc>vU0x+$n#b^VR&_&c9>@&u~X4C zdcOF%ZlB2ur-et%0=tI6MMnycz1b!$-clG+Q5c$q|0V@JuO@6*Tvzh&pu%|Svq{?b zl$A3DnzObx(#R;6=ab+53w3(S4zZSSBz{hM*+%7`8!Xwdzw#pkc3?zzNbT}NBY;z! z>7Lc8c9H(0!ON6RGsvaF-may;)bRbvk8e{LO{1&`?=#7yaJ_f$gyL%AR|bWX4$h}Jt;#JwxY1{}WEM<1Gj{XxRSQYEH7$u53{hXzMUn@A!=7`l$Z9#N}_9qak!MmFHGHh?vb8e0XPGjYEcl_J2a{ld7ev0CR z)YYkQFU*B(SR@p@8GdkeW3c&=(Lm8>aIH?I^51j&ALB!*&B#ins{f?$ac}hGzqQ}b zoA+C#YKfWZk&WuZenwyfZB>9%!k)oWZr)oTe!Zai*g#CkNLPAG;Vmi*I!wgCk52|i zx97~ytnl#*?$IbJo2M|mPvjPX`zLk;VcFv=NHgih@F@Rw^1vJW{sK9~THeAGEq)ZR z{j^w)R;@Ol<%zJewoa)Y^IEq1+rxEN2md1$6=pAbEvTE}`@|3?{AY6d5-@YB8EM=0 zqgk$$vZZ9~4_7g>@L&2y5hUMmPNv_`e7(%%{wgpjHhG`iD?+dvH;CE{TB_Ggxs00T zz8%=2q?_yHj>B)Eb&9K8m8i((!`RDwvNK51Q9(9SBrv7Rn!)xNr}{_1ARYiGkphx{jxsZu4-lXpL^dH=?UBA znX7wtW*8-w#fNaSq6?)IW+O1lEMRiqy53;kkgkc^*1NiYH@Q|dfDH*{6-B6J#p>@y zV4M%0E(nn>MN|;6>L?u9jPrB$z^p?(apq9CsA;#>327>$ME4br#%*`Fj)k7im@1E< zXEni&a^Ck|`M=)0bXu^F59(^iD~XpQNz10jDF=Zv%dWerMh@%|7z9&QMwu-%})dkpb(p|5x0^`FCcdlzsNjIvJwZi{xgw-Q|HAtwk7XjJ;D?Gr3DR@G?#rS^(HpMOPUsi#s%{E z^H6lnt4RcuHa{_SaproRKsx$DJT?!3%G-E1vie<8WZCode2Z%8!R!%_>XMc4!bg+S zG)?vvqtB(4z+wC8aBeW^w>{ksPXPj3&1}PKtBaAN!Vi9q+9CNahCBRUY*jO zxP$z;PY>97*Bh(1-rAD(tqVsQUW~Z(s|&a)>k1#yPqe%Yk`QXNwdwg|kh2|CPECiPtJ1^vTh#_qK@gL2g7DLM=3 zmkD;x$B&~kOM2p3ayl57EPn zOGwC1`&mVvzv-qRJ_3ZEdHr~%5!>10+0kx1cZI6g&u924n^fi}lBZm1 zOZB&fXBA%iI`tp7j(C_IbiLGikoL<)ku!T|Aie;vSk!-n^E|c*42)TDe zCwR$aT)pGb!(Uoz-z9tlQ=C~iXL?`*7(fXq5vrS|%>{b%Nm+BIBUe~A#vgiMkEU;%7wD_*n@nF{8#^E4~XF<8Fv);(!0mvaoCbm6bV$qclra+Vv${k}7l?vq45 zZu^nYCt&%O%);~H8!67JR19jam(#UlWpt{rzktvA8S~jy-LJ%YKelRxjML-xR0&k9 z`ic0sxN4kZTh9U|rM!^HdrS)W5MMq_e}($vAwZqSx#vfG@2k@_?()+exD{GEWhEB7 z)cIF#cy%5F?;aMvRxc*#0xVaxg&=jLW241rquf+yr#MClGQ~pXJP4|MgW9o2{a3y(81%7U>2^rZ@PZ@@o;pR zCDC<8LZ8k2o!ICKOUmFe-#h+p$Fs(BNEzDom(55y{yWq{4mnZWxemNcsvtB!e(x6Q zxD4dN@%6e}sGVF{=wY|lDS(2EI0n?R1=0EQ!#IvW#B|g7RBOpCf1lne#q%WY?^n+5q)a>2;1KENbUQwOU3=vtmXzJ3FU|AZ9X$dXE+jiSO zLL4Tc?7;){<(>uDJss%qYpLgmP0sM}a+QDs%;fDKsin;J-9an&4tX+v3Zx%2k>6Rm=kO|P@pKT70c7GZ1Ujb*)M~%kkwRT0F%NEH- zh0C=5_<;UMH)iB(5QRBXS+oXhH%aG5Tg9$Fa-;(JdU1Qq%(}x44oBId&$O1lIb=Tf z@X9PIIbrf*RY>f$u}LfMM2C!Q;Sx|wiGYH5N>U~X=>o$1*00^F_n(&OvuJ%#OU|Ht)m#;4)#xSYu z5}qdfJ;%Wlj8xRvP<06g!55uCL;YOltRf{ej4OKwRRX^GJJg-ihkKB%1=uSCo+7*- zf*CmD*r~=sAeEtm^MpNPA3Y#gxIs|1Tz=Cc-Me~lh~ZiHsMiK;86DEcG}Ff~Q;j&r z536_s9OL&L(ZjES&`?ZFU3dWBg$Kc)V)+a0!B|>79Om-?@%S;#Uw_MLpWAS+w83tg zhdtCS5l(nl{aUD!j2|BBwf^L<4E&%)p^RkrnG+a-@=>HA1X!LjAXW*WKi(^ zlKz(=^T>s^4rMk#Qq$LLG0V)jR1p^I(f2quaDf8^t-ye3;kb428^2v=Uz|F+h z?#$SbDTr-Ke?*f;^*1-BktT=klYFK54J;UjCStti?eQVI``83UAu|eU@hrme{e3MlhY*YojK01Sm2+fGg+hNcy684qXVD4~H z9|QS2cr?rf5NF&YQ6}&Eoa{~4ZB`8>%*kBfRvAL16Y-Xy&TidMa!;!kQ)x9>w{8@s z7OR8z7LTc{uHLWo2pLD19=}slR(^{ZBnwRG)1nC|k|3`;MV1g<+VH5_f2*XiH&zY< zKvJLaYR17H$o>C%^>gXe`_Ecs#aw>A0vqLhY-j}hK}7AB!RAM8UMP!}1ez%ArQjf1 zlutu0XEBg4{yH~S8kVca2Vw>Mg0fn8G~VoKb?T$Ii|u823gUbh@ak)2vltg!^ngVm z2tOJ943tbIhyd72_~V4%{9(IIH_6Es_yU5;8@o63KAFVu@EH zCo^wZA+BQFEq|_BJy$}1|8jA!zs7~lypctfd#!v|MUPKMK9amZoCk^aSe=sZ^$5&- zTOHl(4o$#q^8$;bUeeozK#^k12)YR0pnypSxzZkSC6`n3xu)~KDq}h&R*(fpa4QrU z+)?Vso#$l~|DQD{WBg&OtaT@wwVX8RlXpz~^}(Zr`}SUm|2zFJ5}{`4C@+RTz_j*j z$hJO;d3mwnYbR_ihmxZaT1#V2MleXxL^V%h!2F9d-6s~4h&6xW@s$;x^dBjOlozz_ zBdUw&4?{aAEN0mdWJvZfIhxft0HTav^_kzvS0@q*yIBS+3Gq>CffmiwY8pEv zlMIsrY2GoeaL@eI;|G%|29_0*+$lL2SnjwL_5podE@^#S8$Ut?a#9!LU)Wbs6Y)M2 zh?KNV7S@y3B0ey!_L{A>UYbiQ4c(`D^ z(tJ5X_+hONr2hWTh=Ky+S`a*|bD<|3{=)`{eeCECUa7LMJF^n+#?lDI zI7K@Pozkt|Z}~STb$f^zf!`+*U%tg${DXQXhKI#L^?I``^-2t=r)M|%zZJ_r$K*AF z{<5sHY%RtQID^126k_fKg#DJs@%6QWNdwSg1Tmfcv!>L#d%rxd_?cUV)T-Z9OwP92 ze_%=H;fdgjV5b4!BM3eQID_{d%e( zx*Q`@ZCR+1*fW2)N$DRXne*`{v(ufHs?COgA*_GDY;dq77wYklTkxHhx~;$0i5qO{ zU??egGXBy!b!ijy$mL*6Cd3t{nb809_NI_J$5g+~_NQ z&Q+F$*ZZxBieKeI&UzeWFhj7pyo#Fo)E*vpu?id(E2k#--M6B*-}TvaJXN|xwAIwS z7)+y+__K(2*1Ung7JUK1PyLTCj1~#syWbZ6=6iF`-xt!|PZErs)T;TtpVLV7$uGXY zs30S;W(7CVlKU%6ldJ(qA**H~34A-MBg@A->@FH@ooEELamUQ<9~ zB&Gk8T8?pp)#J5widg>Ts{1RyNc=ua$mEkRIIaFc_iP$0wKh6oGCeva_L ze$)T>kAZrT(*JeK-Mch?jz6t;v;KMRWAI?c#I}W>&(y!@qz=J4ZTMH6oejOI5x zqW#$NZHDK*DSKAMG_DN(Z{VXO8)QSbxBjj%n?lRZ-*>(Q?m$pk zEaNqOCdMPxPe`7B)+1=me1;|5pIU9^|EK<=ZGlUsTg*!Ip>pnPR^2huBfB#?EYNWs zv7Bw+hbp{ZDM40~7`7oo${7?y@U>)CfiWPZ9xQdT$k_JHFOh@Iq@GW8OsF2W)HHRV ze5*@pHvQ*cZo}_IK%^{vL*tq`|HrHBB1TonBM@PfAFvRsBlPV*2n?#c-#j9W5Un2k z{A<5Epj9h;S)q9%+v;qpnao}*r1ov@_TDA|!S(sYt257o7hQ)Z64$VD(LPQwk(Tp& zk7NmUQ?_U7xZ~n&`I#+vWF80$*l$}TNmO}LW=9@;+dmWk-!J3<-AD7^v-S$L3B=fo z3Kv=4hyL@IIbn2rz{}SUmNaE=rEk7;@P5%(DO1HdU1`4^-3mpC4cm#5SRrvU_&)#-+xC|5EfS5DDW6`ew*2L&?`0>CwTxIOr0^UW*P}0yb zQIUlZ4qWi)O*!lH+Ly63g4b-3ahn4=ze;p49eS#?^P|K~@Vd+T0A5u4lXejuzwN{i zvkKekG6RCVt=hr3ilC{}ipu=1Bn11@61*f;ZwkSe_X6~{!SSoerE`L)$$q6&d}|0W zz!1Jro<`uYc@L}=s`By&-AQ#j^#u*e}8hn5=N@G z2Rs+ORCT`)p4$zfb~DwA=f^v&%$cv_5*{QT<6FmjpfTjxhkXIOE=fZ#X-N)*0zo`hqqi${z@-+K8dyhboO|68ny(p zb4reARS#j~MsdotDk9`-ANx6}nA^7RKES>`jwI(_4x^8X@kc{1G#sdywB6?a?$fOS ztQC;2hKTtJ{O3&clqIFWFs28bY4pI5oqTI4ahlMx>;v%Fyslgqz3aoxcYmH&numLV zTxlQFxE?#tXt6KUyyoZO%s$^g3+7fhsSK2ynO1RC@-Y18Q&2;F#yABQHb(EL?Yw*n z!ej8ND|%s=E?}=sxVvlotPxm1J|+>wyVs8BE?T;v1gc!#Qp4SW{bdDMHe0RurVFtV^#Sq?pIAK3)m-+d&o2PCmSukH0iMO*GF;_QDI zIHaLc2M~p-7wSctjHTJNz$f!&hjq&eJNIF|)d(FKw`ou{a4+=9jFv<%KQ{Ll4j=V! zU|H!;deYn$bri=KuTnB*uDl$`LFZk!bqT8BC-zOi@YA5ialj#6@WJ6RssIIkuWAT&h4Cq%Ml7BS((l~*NP^Pj9S=1rSMTXJ{ zKuz7!%aU;>F=q0tu1m2yJwX~XSeO=w=|D{YDeYxYtUtA%1IKd19x4~@5?zh00-rzV zl!Qy~T#L4t`QD;^{Z;Uogpu%}i=8hapD)>1jqN1yjNGt*?Bf`uKD!s2LKt_WL99mf z*Z=m6E)g+5MS?y1qFN7@#hm`$)KLB(uHG^%%I$p{CPo>g22cr!8B&ohC5LWAM3It? zp(GR(q(MTuOF9Gvk?v5sySt^Nk>*{qx7+{kc|Um^$d?)Jd#&p_6QZ<#{RdP6Q+(qS z7z+g}-9g_&CXlt+15IHkP@bEd9;^)jgpWeRxdfkrTM7=zX>?OMM?k<*%nVi{#r%Ds zX9))rLnnBKzGPxUX7-jlhlGzoY@b>;^F+3=*KK$`NQP8x!=q5ma3+|>$%TsBf4@f7 z2CDcN^dO{-ARSmOpbqHCw6sc4X%PAgjSAZ|7XZC@sgouIOUtJ(rBIVe5hA--9Vp~J z96#jtZFan7~6Hk!Vw;X?pz$k>`{*Ip|~T0$mDf3K501Z+8v5 zdC*EF#jszpG)|dlKkMFXs$FM=N1vZCl~cEzzsf!|=eaFx6W;#B5hmE4er2;A z(f1uTxmrLo-H##uK3*xFH)GOd<`c{*F6j;_b}bZG@dBW$;pC{=#$h(@Y@6&CZP<>A z@UBm`$Z?+}THLsyAzchhcmFk2Iq>y`Q02Vuov5FyMvw}Pl#nJ?rx6Y^?y4ME@ngM&KZ0^CK1T1S4iy8Bf76M97BC^6!b!M#+& z9y8sO)<-i>qiVVE!m9O4X5DIL&32QG%Hpl>=i9NhLCG$A?L|OywoW8rrCt%!8Oy|IJ7zUHJ{bpl%o~18Dat&kQ(7 z8*tDB={HlGPyS zRdlglr_z3+HGq`)b1rB0=@4!%uB!W(f!~^2i63Ggt?tsSvdR^{=`ZH5;6h-}K`vmQ z*>_v(eU#+DozNSv#YSU|*AxIAS^iSh;8{7F@WRpmwe`FX?O@G+aqqZ}NrBJcLP`17<%oB(tU zIvj-IRtS6GBEdAxk(The3y zyQ;V`J*rKUnhL*&M(I~SFfy&9Hn@)ZYTj!I0m$ZBv3|?^P_CNE&%QK;GVv1en6!RB zQ<_Cw9)or9Mh6g~tR7qiaI5=izPZ1^I~OJFr(x_O)?rZ9%SY&mgV}bRO{nCAdoDi9 zdH6}M#0jKdTDG3RF#3toFmG04tN1E)Q0@hRk%R>@bu4*NpLXFZPGk_ zTBgAe@I`e0XDzWwo+OP}nfOc+P%5t9$1gU(LYKj^S={b|(9-J19isKn3JRRzep7FO zJ}}D?z5_(9Xf4+$E|S=TOHqmk77$?@W(~8BqyTThdsJTi?R}oAL`7wN1^gFNt#;c|CyhEm-6QB}6)7*+z@PQc+S8QRg*l zW+Jz{Z_2vEPs`pL(a$NYB`MzDeV%Q#^M-sN2@;e+daLROpZ_;0?Ov>97(R}~9s8uh zGVo}xzZC#o?N50KyVd=_gM<@VU0kLu2%&+CEwyAB&uzqjGtf6JMlwnv7?Q$mSt(SY z8$pG4`+Y0fwJO7W^BAjHNwDPI!PsKeu2O2pfg=6=K@2rscv!#>g-U?rD?WJ=kszJHcrAd-Y0vo3 zy3H=b{Jmou@rV98vKB!dsd4Tslhdy9sIilyGlIP-yzkov4e7?Ysrhjdg12O5Yr0FI zoR8qkeN*0RP=hym*njz+@cIb=po-=h>2qj&hCeZZS zPSy0|P;$|;w~qAV3Xp2$x%gISEt2_2&S~9Sa&bi$anh_?C^DJEUE$XeLhXur0yOK*Wbk^>%4AVlakZ%CSAmqC5&t`6i9j5y zew|KUR_=W;IF)GWRC?qi-*5^W58^2MyReDX(CKI1(t3$n<`nmvlZfk*l^(>dE_t=K zwT2o>W64$yFU60AE#=fORkU%6np8AY=3;W=^%z5Gr$x<}YQTm}c z2W;AiN-#HuzkG6=%tMZ-8?df+B{8GHrs|Q;>`3cV=`&5Hj|F;O<|d`7FAleekR8M# zRUIB^%*oy0p!8w6`RI*_uR7%@OFEqt)W!T&2v_r=JSC+YZ25SKXVA&N1jJsFcRcUs z5_f93G0Nt4L@t{b8Cq3gN+DU&J;ua=oL~xe3~DI8RApYdjJs(xKwHZ!R>5;rY17w> za*dKCU!0WiG4MC*H1c6S%Z(LHdxrA5PLH%rt3~OtstB{K(SColKJ=ATW%_@^OvSE4 z$EGm9q@_;GIiFL^Ew%r5XJdH&WI#GstYt}N?n(|M=J2eQzb;ui*3^aKPRhQX&w1Pf zq4U!k{;yg!H%bXT#!Zcz1qyi0Pz8liU0# z+4&O^Ik{Bl)TsNg|GN zgT{9x0@-v51MJIxZ#??+ZNq~o_`D%U`!N5|KW$i8N`1<3ya7^0=7QyNUTvA*S6WB*FUsXWs?#qPO}-=$<82>ruc!LNwh zdU$w>YvQ*S?^@NfWyr>0Zj*OMm`<;I)aX;QF_h$St}*s~2PV-hN|oR{57bHZpyZIP zFY=L0_b9vyxRvgcvFR|>o*g_=bFZ<X&qX8 zCh(&W9GwNr$&m4gT*J>&tHZDsm4Iq7j7f(_6mkYl9f|x1C&#7IKUN8xYHymkoCtxl0OS zYoc^epZ-{(Q76LxJB(LKPC8F?+J6z*^Q>vKo$JZVo{s`vL>>RY+K(N9=>>bnR>XcQ ze!D)0f<`*AU@6n_qYrNT6h6AO=X0bh3-%keq`}3orA1R5{r*8}X z?}Gk7jkTtH6vz#AtU+PW0N+XOWq;QddFxER_Jez+uk4qM%I+D}4RBJU(}dL8VMhQF z5s=1sV%?W2J^+HV^S#=t(U&l)GOQocB8I+`QF!)Apha6xc^G+lY!rMN7^;|#s}_R+ z?-kw;nk$bGqngzwO0oxcQB5@zx)p8%xe_T+Mf&pjIRK zJdEziyztrK*|#Tr2PizslXB<7_0RJsVB^Rc-vW!iF#veDf%m5pgp2X&LjgzfCdkNN zV%_WERF(A?I)4fdC-})Ov%mQc0M}Tlg&d;FXPvbjZ`5INkun{(MPw;P*-90cYL!~# znqeq^2j&_D@FG9s38Nk{wP4cwe}-UB*xkaxN0Z%eNpfaqp8fsupF_n+;7aQkv2V$j z)|cMROUTXvBh$03YBaqF_VZ5(@5-kg6QAZjk&fZe`>N%7d|3?^(x({(pfd#oZ$Ih# zC8@Rz7RB&;YS}sJv`f<$tz-cJX zO5V>s=XB-}D-J7)lH`FANN!Z$26C@IXD#|426CWjc)b`00TB0#f4^E!VJVEQ`Wz{F z50tY(p7t#FdZan~if>$7px_PcL|$uOH59p>aOHP;<=VRNRp^+Lm+d0it?C&e$IZ9| zmmyWztgpoq$>20w?{y5j9{+aAu2nOFoo!l9ltkXLKmGkBE04L%;Ni9qj2N0YAo2655r|nR#dS_oq5^`aV9-NL3O<3tfvviXX>0`_I*@mu&>zyEzVQVJxzq5_UMC zn%K@@W!6d1K}N4h%0115XG)^$6SvQ`w3{rezw(Jlzv~?sxNl>wPUgg={1pI2>l%ee zA1(%Po)y+Zs4)I~QB6{C6bA4g{5K1cVR{jq14QzM81NuHi}VlHu&2u?X;AdJYUeRz zqoO6)vszGpNm3Hd=@+zOgoIpk>+E~-<7q@rMZfT-tl{7oKb_A7xBxN| zo&bADvemCJB!95=m&8MfSlhVCvJ3iB%i*wm?eg|)J-6uVhZ`NfwEV!|@<=xA&7e@& zZA|*JfovulX+RaS**Kf)L^8f%G1q(&n?NHspOg7qG@%Tf8;SrPE%6VIMV%Pd|MLF) z|GR>T#YpyRoC^MY@%8~8#73a)Fae*OQ>+IG*y!H5t2UsVPok+Coa3-<~5cFV~Ytq<6-C`v>V1{Gn<1?vsIoZ=nzK|k% zPyR)xvPg!*q!kqH(V@s9h^~w`%@PI2WxE7t}EP}&t z=<=~FxXXAOJP+SH_fZVWE#<0K8+HdWo-T6$8B`?Q`$wqow*2#YBK=^J*&sB4$`G8woHuY$N z;sT=KWdBv{+tu!OoBwXAb5IWt9L(K~|6(FE=shZDzgBOtup+R~E+LE>{Um}J>_%<6KbRtylQ7L%~|(MQm}22do0`;8A4 zbI%{NVHt*Xa`8m%M6cjFkh% z?AIq?bjm54VWxFweYMi1+AS(q59m)^Rn;#zbVWdMwFmyxEb*;Pm)Uo028=fQGyKZ9 z>=vZDtCvNrruVRR6x?0Yl%1|a!=D~GNjwa!PKOE?P*rg zxAe}un|s37K47f=p0ue~9_d+fX)Z~o)TUdm8rbmGiRtIgv??~Q&gm%Q({>&;RdVZ) zYVMF7)KF1Yc`=@h{Q%?kTd5aVKEjS7lkZWkB@3*?iYhY-FJ(s;5052R$s1AR|HmJO zh%F%IAo>eQJllnTfJj|<7&o5Z(2s4sXqIQZ@aq$HVE*>&N)md2+9`cjJVWbtEUpD) zACz8kEy+N{D~`Q$k8vJ8)mI|f*PvbPm=7L&8Qd~ZX!Vru2)+x)=syL6WmJS&mm`#war7g~hkF=Ppn=b8wv-YQEhn?9WL zUIrY(pi$qAAGD`+_)O?JYL{Z(J$-@m#5Kkh`U`IYzD9oxRTC9&5 z*9jg2wMH#L{bl(!R^;X~lu{H}6i|7;9otXc z3e`^|(1tlaTy!zq@S{x^eKW>;TzbAuE&zsq)(In3av`QW-k0=-4H~ZdU}W{YnQ@Yx zG(xsoO$6j=r?mN{4j%)&Y)z0n&5oQASM+>GvbnWQwZkYoXk{_Q{o)?bsSP{i!|~kH z6V&o-@Gerf&mCC`BctxeD!nY?NO*wv>|KnDOoN^%GFl0#S#NJgYQrW*#L!4f1 z*v$UDz~yW%WzdH7iWTFhL)|jesx@vW;k)k!q<4pLOv(wFuDTZ|7P&8~%h34>3CL>q zRCs69jOL7!O-R?3zNbt5JWl-4X^_W>&3v3freVyqvxxg8Tz}N|a_Cp-$^)z*SES!b zaM9@BVx%P^P_p^v!um?bshQI?zMSK9-1-9II~0h?>10jyDlD^2ObfZ(9*i>hzqQKd^HpW>JyJ*)bq99m+X3q32Oo(B1>E` zMD!H(odZEmL+SOw7Ju-QN-UUbzTD$k82~XBq+Vagb}g~v&*ORCBv0`jsg9Sb6P)aR zf~`G-MF65TJQ#@B5{5r_yaD=S*@K@f*pCE7pKlAqzyAKl1QSyzMaNI7W98INUJ3Fr zcB&D~^pSBmbG3i&9$UxxvN;UWwjESI1 znr}d;k)%wGF#G=YZ{gH1>T{T4Mm}IKwCt2WQK#d|HkWL5snDLm7h&t^_)YN4apeco znLanx!W_?)$a^2dn5a_}a7C~=@V5d;N3W3<@PwG882W31QvD{QAf zFz02z-Q1V-ujFhsT%tRKQxQQ_9id`u}lpR7rPW%ON9y)gfbVqEm@=xeb)KD`u^{*h9wS9 zS_R=`_h3u4#D50wx6)$FOY@lK;lgTX6m9guI}{}|O6iern0^U5skF<|tbfCGwbDIm z%?^LSAMCzm+?o$C;O{)?qJdEY~N2SaMFB zcfk^tFIG|mzwrN{1TleFH?iGw!?&L73P3yw4k|4xd8~fv^A(hliR3`6qZIm^x)khs z)gD5dlFh!hkCk*e$0XIn4;yWnKGl<1iyw~fuRB=(U_D#L^SN>Gzt8j!!iWnNuPM>O zcKK_%E&riRa>kH>#ITKBpH_Mw-KPWHiH}4(GGiZnF&{DIb$^|70W&>MHx{>|*~^N( zok-J7`huC3L^<$lae)$NWwTWr{O*gY*WrKww0Il}g1|e<5n7yDp2v5k;Kvq_eQZ)C zVmWV!RAe77!f5i_c^#`D)OOlXK>_j$&1Qqh{TyTdQOxWq9qgs~R{l}{7aLZQMD9_r z?zr;e-ZtZo2-!|jV!4 z4Vn8qbdBr#CLpoPhg3CNo7X07^*s2&3|QPH86+(xOPdFJ5Q<0AI4RD>CkfR=f@{*lai|k7o^lBD2?oR<5^>xSOjvqo-B<vo${g5@r?dblp%xJ@hN(_Ex%N~@vWk%_)EHSi5;^`sI-S`e@ z|CLA2-}oKn+_mq5ks|$2_0cRbvEAAce8p{EQ8((K58k_K8xBPNKArs`gP~k;rF*2u z7`TR~n#)CY1+IJ%NfJA?8XmzwXz6V4vpF`!m+G;LOHz-}0?%k7TuUsM- zzRo~SIEr9ewVo&m2g6HSx^&=E?XcGax7l@amL}0^3jmcoC9eoc;J5ya^tbXywn_Wg z>-3`5&EI6fUY2QsGs^U#0P{s#!nCC(`*39W7YE1VfMEyzJ*nW?zv1~oz8pa>!kbJ0K zK$*_=T%NGWaIG$g2;zVF59Dh1Wt8&S5 zg(;_|?429|jl*TE$96ul}P5Og;qRtdw!KM_4iCuUPWCES%g3yVaZh?|1huhG8w z*7KhZ9ekEseb=!J-cFc*!gcV#RHQSi2N^i0)j!h%m(bQ1HqEZA{t{Po5DvqOO8cyc zC=lHrzkt1q^Su%bK8&*cU0FylvZ_Wd0Hgg~_R$w_k|F}7ZXrP-tMLyXT!l;tE%p~x zPqFc)f#>^k^jTjcQG1#n^=DV*eP+u>US;Chzm6a(Pb?XaRfn$8*P&QC4XX`_eiSv?S!jID+;jYU)R!hqYth}TNU0l?3Iyw;ksDtt>5B7m&$tK0 zl)9JhpM-cM;qdmY^rjSOIn=%bB7`zD175lU&j)xU(Qu}uBw^8wZV@^Kban6NYtY=F z5$ZZ@&3cfNi%vrNJbhi>Zv~!U53>!k3MAve#YC0eU6U?Zv;0~qvyrb+Xh=yQa@u;> zT#IRdTWLCa1R&3R)%;PHN*Pd6fgu1y$Wd0ABInRDAQ{6I*poCwFHc_TNyHvQ=H%Z9 z1A?!VjxvT@`Rlk4nEf}G-g1Sy?>6V|fdnlm0~3VtyCWJJo$!v51&|}^>IEn=0U>u9 zYg3iQ76j<{wmskh%Wa`ot&7BRI+cS<B(CC7)_=O$IcO6x)|zm^G~{7OPw1OJI@?rzn7)@D2(|Ju@6razGjK-Wu}F20 zZI5;_@4DYj3fUAE9~1u>pZg0qnjjJ|HlY~Etk^!mzIGcYl(Wkd3HAzto5i-@CCo=^ z;(wX3s_6~0JiC_vpyX%;r+7-lYmN2toaOnW5sYcdw)zAqUP*nj zE;Q+?D0>jz)rod}WEujC1*^c;!0NpD?hYFm7u()IDjuBna_v~c&qgu4BZ-{!{VIsW z-v5;f0vq3^r-n`_QZ;n4S9>8zpeLT#5=0tSZI*4k+-q85etMsPyX*YKU?NZ>jPU$) z-e@~qzwCo1Yj!>qlNFAGxVF3HhZNd-Ohoy%{+c17wIC$8Qn%K5O|Xe9yF^u4c$)Y! zmB0@v%7ZDRw)62-kLr~V43ro=8_WYzr(yoFRFM$8z1?oHQ{o0}Yhfj4#NuXL`&r7> zxom)(S1SB?Gea1%+!R1s>b4%g^AqCq`bWm+;MQF)YB0dl0dIrn!L1aJ%*DoSpxsnv zJm=JIF{7JsgKGJPCF=XEq#JxEp$%jLI79Wg&>PWi#+lv3p(tFsLqD4F6 zGTVx2oHTPpdB!E{eZ`;4S{qI;0;`nS~b56~Hw+Ij854hXQaWW6@p8ha1 zKdEGGJ92VjXIXIxqd*ymZ;m;2_wFw_tWseLA&+Mo8OmR;4N$22%1pd?Gs7rP5NX^N zhNyH#mdfP0mH{30Y)s*qVfkPu8MWHlvIp2o~i?hJd1EZNQ?n#9ls=CClZ z1A3y9TP+?@C;D0cN(qblS6FiMCKlwScaz+9ZGP(M+!kPUK6uog?e~z>ILHe8loDas z{@bY+#se|Lt^esGYQ|?;@Kn6ah67`KBW=|YvPXmI&)}vLIe9tGbY-Q;PvARbJzN!? z@NIx)5iqJ8a*M4R(mC|}D!gotN!)9}`zYjokdHnwb)YEaXNz0WDSPL`2-N?*D3T58ChA)M@9s92a%PjdRG&B#Ri;^JgG)tDS7*A2{< zQkDyktmL0Q{&@B(4?^_qb%z$k$P3UHAm(Aoem`Q^MKiZ^-r8V;C#S!KH z)ZZ`mHnE&5jR{x1*<^@VE^D2;HOIW=-~S{QYhWq|h*mT}Upsc@8~GHN9_^EX$Ve?Y zRQLQxTJDerOehC+=03f|y?#`G4m~XsOU`IqH&o9C=`oi6A)OGA5+2bXb&8(Z2Piw)P`({JnnI@JjPH&!&-Epx!YvI^AjOCRok4MRr`q1B>{H@FIf zz~-h_y8RP7lREqX7xEWqGLzXyrwc@5G_CQOaE6})l-{HRPc3Rk=<0kw+DfO?B6>s? z{uMx);%GrPnun0Not4CIJ#p9Iq4NPsMD$d^V(9J`(Z%G!K2vUmqIBg+Ok$Q}{)7Sx zCHwgGA<(j`DTcxQk*gK2Mll`XG25IkIKL>W%Dqf4lTQ8q_b7PLKHS9;R_8uu`A*+z zqv`Z+25qr-C3@MH>go14qz*aZ?A+^o)SS)yslUEt`+C3g-A36B^a@x9*nu@yDVr0( z8{K&C)1}RTSH{nbfp^=+=8vll{s{IhmPnTg#B#HvnHjVcA6OW8(0JoAxBzcK`P*s$ zlOxey3Wi(MO!m76(ZtV#`&@w-Y#+{h|Od{+FhV3ij>_cTnvw zTNu@jOo|k;b|rKbgY1DYfnw~8z+uLNUf87BZJs4&YQ@_< z;kC33q+ac7O9=M>5=QT41#`x$x5!nOYGYbVBCH74t{R^|JcOzkeEB{X2L;*-!Kz)R zR{ES@OKrV8qK0ChVo1uPLc`(9czS*AH0}_sPJOWaqcXspA*9>=o zB2q2W6i8N<*{goix!QqXV0B7Jw~trd`O%rp>4KCHKtb!!5wa}LJ~N;-;3Q6&q;1}@ z>}@sJTIC~k2D&akaGCG!KNc(zSvy&MHuynwkXHBGPf|stfOiK!(@eY1eoZR1xA0Q$ z5y--6VRIASnJr5n)dCl>Gh~p`rFIndRP>&Bcs+y@=Qv@l>tjF{|x5AYA#1wgYK# zZTEl|TkXmAxS8JL&KQxSG09!CcAPa3keaiMznW!f>-q}F-#;(oZx3m-xPX}Sfii1t zv=!*!Ma=Jc&}xVF_8d^hys<^b3J8UI@(1IGeH@<8`U_PwNy3+@!wNz`8haQz$qn0H zDUn|}^gUT3knn5>W?w&ERa8)T!o3At_OXCbm&EqpxkZ9}C&TarqZ_HK1fPQW3$)c= zov$J-Ugibda}WAxMEYZAx0Pm;Ov9f<$=fMc0=~!jpv8p*=?3$3F<_%$S~|WmN^<+Q zq_Jc97T7xEI%C+>+HX%typG>H{xmzZwg9~e!3x6lxBrKAaJ=yg`p`Z9w>fL@olW+4 z48w~1mLvmOzoz9Zo)&1qVk67ZQ3lOan4(O(gvG$QF>X_TG2~ZV`+S$C<>JNz_RYpa zT&D}{r!zXdHSfHbx4%Evb;_#xI^TFK-RPTJb_HBR2h-(fiGtrL5EqX8*2sG-17uLN z1!&rZ;`W|VyO-WNnvRSGH1vSrbGND|$dACFvb&yG4K8K0-Dth~xN6$SoX@E9IqnK}m23X>|4BD#+a zgPbt+IO;Esw9%R@V{l#%TfuxGn4TEG7GiQt;^dbgra$134ZpksfdW{{i_1P@@M96l z!JP<2cGbaamZ1ehXl0zm*OaCugVAkDS9&cA<>X+T2|uL^itdT zwYifO#dPfCAqYxIswuoEDk>|vD4dL;d7(uE^t89Soaak*I9pfqfuu%E7|~Eou>JfH zfFuCX?r7MVkMgk6c(qg4fP`g12wH#2Cy@52wjh0JF> z$fQxfU!y2_8BX+@2ORV0ByK(=?evNMBh9`2mtEDbfk5X#XV)!g<4%mb&80SQ5`$mS z^1Esm1+aX{cHlV2Cga~zMoQKrmcS>L)b038@@;<((12X>B9@7ql8G)4b)A-PF|J%s z=9iP_bKLhLxwR*;!Us%Jd;%pTyv}7R5s1xW>G$?WULWd7-JokV?jn`5J z1E$)jb@O`RQBJ7QYdZ*tr~1kF(mK-AaJ1ff)ztj(iP>urW``ANC!w;bky~5!!zSh< zzSd+@_GbdD75ue~U~jtH1GTMhq>2vBM5nq(c%ajGB)k}LmT0#fmv)JgoZe)OwOY*3 z+dYuv6cCj$3Q>j$LeV1o8!I&~!srD)`s1=NLSvfOVo2@+bI;Bh(3{R~Z~_8al6W_|#a9Wsd8Lrbk*F6)JOv zT>*ROkI_d^q^^B>gl_y#H%sr5pMsO>{0T43`_D5qle|^!TaR%4O@MctKI)KCq+@wrWBHb&co!*`7DCC+}AMbk`H*ZpQEBXuM z8MPoeb*C4AbBlSs!&i(Jbz(;YvT)MBzO+rmHh&1p-UxF1T9{0Tlg)>MZ*|T4QGfjk z+_C2LfMn@UrGtgA3rIF7d%W^ZjQ!7DNC(}KXnQ^{@M@(EWHou?U@Z-pMS?dUX}77Qco?+1RUDb!8$?K z?k&WIMv|jfxQndP#KAQ{>^Qs|Y%VOyRsCk0n2ApL^`_SJP-9iF$a-NF#UfN(5!i#+ zk`D0kO-=i2q8RIgpT+nOcM6iyh6JPhjyclVl}4+41BkTAS=Cs3ur+BXb#_M?i1JcSPyQu&!%$FLjz!TxhTY?b+jrmD+?? z(n&+z#o=>KAJyC-6at|8{NTiAxd%CUX&2l>l{~Uko=tW8=syxaL@b>iW0&*w&&Tnc z240Ukxb8TCN#o#~RS`jee&o_vI~VCop9`QDttEKz)b_ z<sbRC_MG_-5F_`VQb-P;B(*>GVR ziEnqPX}P2lLyGnJje&-HHxf-SSPHDS6u^FrmAXV3Jux&2eeLs_DdKi;;^ihZ4X9DB_T;TWBa9oGv#rRx}clRm^LUq?a3!Weo85 zQ!WtI@7Cwo*0@`!7tn0WY#`!XQ_{+>=yQ=5iCm3HEE2F8R{RGL#K4+rg`dOIp!h#p zZx8680f`adT=g?MHD$!=-&t(sA;1cyb)%qtJBL~6cuR%E%&7RFHhTrA$)eJ=DkS-fLA^(t_dxV&Y zOX*I2zOW^1N?E{cK{*)Sbt3$z(m{03+FTpC8cBNO{GiVq9Cb!Kl>xlrl;7XXd%d>@ z{j=+M?V!3Sb%}9&bnWiwH#~EOB z-30XcQMA#w_IERgMLq$n6K{-B7LJo+JPFAyfF7y@za_wYL`jK3pyp!At;>mNNGC>d z{?fji=ewBO#q#sAS-wb<a$vmb%~T;%zw5^tQzn!&=OguH<5PRL|V$V>&4!{HVS2;`)}cPZe6u-`!itO4#4< z9HOic;&+}Ye#%w3aP0rXpZ^u00!xHx?^J|(5UaMvKNh#LFUVlssCf8TFa2~`JkVrc zg*!g3TOxTH%`Bq{y)%m6CQY;9d-x;NEM9ZidTuqO`++xnrqStV+l@6FdqGQ@(Jn6| zW^q{E?Wx;ic-2=|#8~MlhE=K*kBFhKE3ji-$Np|T>Gb-Lxd_exnLB>+A{>lB!W(OW zzkAERBkJBi?Gu=%5VK~rPfV6;2A>0I#r9pXa35DHm@snm!P41}NGamT=;R>&(tBx` zuiFqfUy6=I#W>Rtn zmbK4i)J9jJNh?Ovrh8z~BZ`4wp$-VQ6J%%ueA^fT9N|mAIsS=~01R?5|Cnj%-v^LX`{989xyJVE36oCxGJ^FT;f04@7+u2 zVYrj-QPsDTMm6#N_`=Y>-eFRG7;heEq!W#|srNfx=2=ZFdL- zLQleiwL8QX((b(l7LYG3cZ_fcY(YrEXKPC-At`Ezb7QJW+ct>5Q}f&15-NFKbcq&> z(uEe5+s@Nb@cw*FJ&L+aOOm^DKxDs#4mW6Bg$2PbtkekE{D2BtMgD>RqYzTIMaIBb z=J z^H=EyBGqf+QUiR%Cb&+TA+fl2XtNBT;jw)H6Tu1BsL35w?)0IaDjGg_56F_A{*4;6 zt=74HE(Kr0XmX?kQ>2e_NgB7CrsRtAH`?#{G!Saq(Uu5TU52JZdjGB+2R2A8f>3WhA{@&;3-C zYdjCG#VGO&H>kXio%xo9#Id9ZYB|9XVVo6zKO@-x@%4P1n6QuNunY%@8iU)yF2}Y` zUkuBAtK8wSSH1wAuCk;pNj$WfnSp z4^I8VLIn{tYskY?PxF^hUNuwqgCpIY*80hrs{i@H(QiUkG6C=zcJp$MoiS zLz3Rt15+u8YqA!k9Yn)xmSeQNV!8>|Y4P&uqod3g~%gtfWtAmGEv;DuclNZKi>O;x`&zD59S;>1t!UeyE8izY>6%mbFV+ zk9dFOyt*jgh}Q5vkR6QKRbhD9>Fr2k6jtaLiiFUGz!{+@Gwa6SM*wqU+sccO( z$8jtPNRjG#n;U7ARe&C~Nz(Kk))-^gTXD{P)BBb5`kz8LN)TMPWbVLTnezsl_x=hl ziT&zRiM{WKygXMFEVH4Xu6q4MZ7su@mZ{Y8+NZNb?`^ge{Y<BaJjXPVjg2kpsR6Y1SoQ*>h&OOz$wWD8GMH)3%$1U@fr`WOP7kzOIb`Ez6 zhOM`w5X>8IsMVb-PQ`EUNG4f=b8M(6ly;I zI-r?wNebkrmJ%(H(BTnFxNzph+9I10pc`TXF)n6gYuI;Fzav=SDr}~jnyncg`fMdH z--^PPHHyTagdgkdkGHN9aNnR{-OgFv4wS+dnlhEIn3wRi>zyTcwUZ-qFK*iP;a#00 z($PG*^Mg7C`_1v0w@xcH*#gbR1E|>7CMd&8xcjGyW63u0fmflz`*Su#SjoF5Z#;W- z(K2#x47`>U=F7Y#%Eb&Kp4*EOx4EBRQhVf~Q_5bmYg`!+D}6*lg$b81u#11vXVYrz zY?I)SsP-V}HEs?f_vd(x7NU!CF?RhniVcPVrgu>u?4aW~ZsLpzyEyw^uVTfCCfXqk$gs~m4E>G8#Lnim}q8qfL2*LUPqy32K1 zCn$tYllqu_c02GqP5kF&P84gnylA-Z?XK1x5oG_aUs{5_vzfO}Wr>tKcTaPx_!PG? z_>v$qzt(DEd^Xx*8o}>dzYIzoes0Jf zP*s7nj2#XwEwr3USuXx+cUCc5fsB;zLi883Pw*+4F4{$!NrTk#F za{lvu4pkFhWKOqyRR-lvrdKu-A4O|||HX?z7}pqdEL3Z1_gEaiU*9B%;6(qWx1E!4 zL51)qmq&YvETLzCCdJF+_$ohr#y@mU5M<&&SfrGbZSPxR+{!qd*!S%74O+Ab;*Pkt z=u9g*D(=c5!xKw|)Go_@Ta??8(<-8zrD$%XaKYUJ{hX(Q?4tg(r> zkD@NEuA%GoDW9m^pThAiI}{6Q*;bPT7<6W%RE=6XXr_fa->-g*r+3R;`DyachQH*4 zaeLfq<|VscxLUpLFK84Wy@k`0tH|Nmu;KAp z&kJR9CwPT_f&7QgMYlzeKA)8J)b&a1`2%^1tvsFD!5=BcI;KvM%^k#KlMlIMPxW;= zB?rc5E4zc8_uBW19d)cfK2)Lj%};je%A->vF5{|`z34;gdcuLcrzXe~nKHuuPjFsC zHu2o7qJ)rb_r3A@Xvb3blvfeGg;RBu>F$HvXF+!mX56ZY!Nx|F6|Ns@N|zNrT)h}| zPqeO4E*W+_A%CF#re7;>YQ^NYbMRT{gcZY`PLmDW88!8xDF#{@ z*7^J~!9y`!=YNjUR8H93EHfUCD*45`ln^mZ@ze!h{lmF-^d9lA7q;li-%%KJlF6js zU3)D2>1T1rHB8nXIX&0IXkm~)dcS(1MBAwDH3ex%RbG>?h@4xrz$C)$d?6dcJ*7`0l z1L9=ejFcB$BTXR5Vy-$Y!7W~XPqK1kdmYbSl53?oI<=gg_L`b~ek<_u>uDY_VT9zX z=SJ(_A%2~T8Xl+JR{FZrB8rDQMq9wx`lY%3OMcZ^1qJh;aXhK-hovej4CaI-7iL`P zrcVlzcv4>1Mbyr)Q><9+uspb|g^w`_cUhOjEl6=f5p6LWpyVJ^rOWUF<_;xXZDmqN z+Xvm+Gmb?E%i`-bTr?ll7e1=tZ!7>Gf6-ToM#@0A{4Wh@&iFLIe zk5X4(vc#6rn@^@^_&X!Uqzx>C&)M71+_H&{u~rzkuhC~>It zIcP2}N$fosn-@>OmJ$U2`O;i)8FkVtY*fE3A&is3!_9X)-4sq`|BI@{LsygzloS7m*+2*;f=FuiP5k3-WYFZ)N=IwzGt%tsJ;;f(4*O%RC`B zsAR+oXa?majG16IJm2E`;s+dye~6Dd{`JIAD?r2(0aMKLsu8?QE;Qk}P!Rmo0hip#V(h)D z8jB7AKyRoUCN!vpe&AXWWxxK}iQ@{y`N5M#|FVflSlsd1aJqf!!0JJ)dTK{I5%g9L zc^$BY79ynNvb}hiz5I|NQ~nDz%=m354kFXc##-(l#X=id?J`EO(6jsZy6C7bUkg^e zvp*}|Twh21ywn-Nui;%D!kD$3OQ}j#!#P3Cg_)Ugi{%SGrz1bMYqXT8O;u^K{EAD; zZ=TazEydpo(j3)BllcPj02NNge*=B5tNxbxqbblD>y8SwEmw~K)WrJ`3ih6)@JHdKWq@yh-bF(g&_zKj zMfH?UE4&Lo`1vJ}c^@S)lH8HHEsl`%-J%J>k_5&0Be)$1gpo>7350uu#rH)iAHz9X z{ZYY_E0|F@@-NgSD;!s5LG05HBAX(cuM8YCPhhf|Nkt{e{7Cu4h!+>O08#W)E)kk$ zbYBir#@-|EGIH&BG>K13jZDcgqj@Jx{rTqS_M#e0q&T7o^>C{1GSzEN_v(xWY?PyA z&pTXUuVkGch5pvz+giWa59suvN>%-c zE@mM|KFgFoMgL4tS0lW#0OLumSFE&WC8~p7Nd~gVZzDnk7I}`zppTj;j66E=F2wiJ zb-ThM^YyAG{%Ek`So(JS+FJw#sjeUY>c;~FNCgJ>#&W)6@a;X;)D?TZam9y3hlhAg z@2R`|qx;&bSn!N|`qZg^l`*WX>g9}XhJc!Z)zyQ2>l4P$m+x1hNH+Akdd(#Ba#_)} zk(1%Jo2v`ZPl1`J>@#2RG0j6Sg_*>U)x@o}gXA(T5XyE+0r~Vrl7H^Ba|1Z#hj^9; zCzSj5KCYTIn~iqgHyp3FQRfHz5qI-JPMJqG7v$W6X1X7$Jm}3&^j&LQcHhh;zkVxd zrF78${k!lxzvc5)u44A_N8}=(-ofW*EQhRD>u3^JYg4*;rJHiz;YQ{uX9{nVnXWYq zKf(>TmV8ShYP9h?zpc`U2gZ^j4||A8{p#^*ZNAdGwKEzXTSkhT%1IiK-^J;3RrcY; zMrm_^N!)S9TNMogM|jPZ49zklA)e#=2N|S+m7$`SCkf3S7f-4VPKDnIRyK^&O}b@X z*7Yt5C;8IOMFA4&_|H0hRiGfeBMi{NGc_c+?v?b$#-I= zl8)BQ;Z$SHhWL+#~^7Tk-s4Gp{TEU)N|J4XlNV6bb+OCCKeO zTEEW_v%K7!{9RMqFkj>_{ti+ClA3{|+^W9QN4hT7SLDur7nCm+H2=s(sD}MWthJ~aC`YXoJ zZ`GO1K%So|nQxr9^4%`Jymdhh^nMlvdn|R0V{FZ1|A_CG)aBm8wpSnOx>}-=;-_RRZN9fdAjeN1J13&ez6L2|IIBz_OI;|zOfX>X_>tz@^qiMS2mlLH7LXX+6$^X9UH}oqKuN~@tt`tPET$+ z8Nd<)2bMUdJJt@0x91^j!Ps$vYV6MOw8V%O94_0nGV|s%gGx6I^6-5EbWXM^F8i1{ z91>pEU&Q+UTFSZgm}id{JS84~FI*Ajidq}=?4y>5oYnQ;KV5bBG?Nvuuz9!A1I#wy zE-O9#DO~0R)~q)_<@z|zdaLJ9>I2AQUab7PjBw+9i<%=4_qcLKS&#Au&{W&CTU_C1 zz97B42A(o?x-bqiCFcA+5VV@8XJzC*48iXw;$=w8k*T(smAcdB%!AQD(y)9+@zUaob#cBI-%We~Y!b%{Ods@eS zN@|(d^zDe%JhTDR={I!kr`yK&12(?*A#j_Fxweg%^NYC$pc>e$F0CX#lAL;l@0rw zA8!WSWkWL!-R>RB{j<>2A|QrS&ryBZkTKx5Bp=0y;>4Dt^at)HrUr@Ym?wKG;y(d- z`R?-?k(+aMOSIui`uaFEY_Fcy7j$$bn8D++44Jfw4<5%!hYC@HCplv~-<~%X)QLkF zVMFw%IzXxgnkKgDXcd?x>S3FP-CN@7CCx>qJORg6Fi4W1|LF=vT91C-3)ev7>zIck z_CKFN_O=X-At{PVm<#Ec_)Rkm1eo6AhYhWPXTJ_VN{4v?5Lh8X)|GJna7o=lQMPBw z6o}Ul^Ded~v|fEz@O6YG;RY7}0K6dW5A{%4GE@o!Ay(dc%*cx1c+RGSywvu5=SJWU z8ngxI0Dd9;PC8?%CB6I-VgtXA{ipNg6Nu0Cf#`Z}-sZbZUuHL}5!HDLGIF6CFm=GohjVRJi<`CN8+p_s3)FAB?(tl zmUr^BvU+c{UhC%M!$Vp&0q#^Ho^jTsC$T2X8<`wl+S#-uHofEaO4g%NRRC&$SO#i;srxJz$l= zm03sZ6xwSlCK{4i3wrdT&T)QBlJFx@G#@3#jzIBB8){HO{Y%(0+C%*+Oj>eEWa^P{ z*FF&$Y5dY+dsr1$_z?vyTein%JTQ$EgMjp7Z{mcZ^er=0)Th@i*I%S5ws_19c)#l6 z_F5;*;-Rsk>0L3r?i388O2(wxVvgWMPvfEzkv zG)T@9p(R{?mcZHSH}hGl>I~l!L5#g)tFTR!pgc!@%DpcCK-;*K@piKcCZFN`ZiH_9 zklS^))x?-FX0ls<|1801wAb!z9d}MYL#p34UO<9aT}R2?D8}Mu=f$o_3=Cn`siZQU zQVXo$Pm#{`s0VLwkZ}oJl2BO>JP^=MU{7hk5*=Bww5~~uC}7x0;LwTfiXq|u!tRLd z+@loXk2VL+{_Xvao)`8F5OtKfA()Odg*t4OiDa$5V;Num1{Pd>1spM&8tD!Lnlf!>MYdWj-20<(s2N%9CRw{S!815OGv zH2ho=JK^VUX2)Vy_&s4Ty3>q((tAg>a;k>umNg-PjMv7097RSE9`?g+J@1QTp>~;zcezQ%@e?~2U`}FN1l0#+=O9lOu zy2irY!)dZ!@Y638`^7YuhMJW(>RzlXXTuT*mSKiA1k$};zc>%I{wij&q6jREPrS&4 zu=kdXm&&nu&G`|6ZxK_5P(F3`4{2Wcc_*CJz!L}bBD!C6v84#2DrKRT%#YY=lv3`3`8M}HbLeJz1UrnCS?aKw?CRgADXknUg^wm8KsqP32is2 zR?e0-G4Y2z;YwQ?y7fWa!sTno!wp zQ=c&G6F&nvD7Z1~b-j-Sp;<#ekHs}^M3*Zmz)>x?3-VXrQYJ%FF-WdB-u+q^dmItP zk#^w|%886X!Mhj7fK6+`yi%^@+&&xTo@z->7$NlXD52D_(aKC0H}h@=#!3)dQpx3d zxwWPCTp|^Fd;Cak;s&o@Lz+{ATW6v+A7ToL%-<8P0B$))PYOa_bQcjTQ_JJC`XLKg z?BL_X$xoeWwVmg}mrmw-Z;gM&fI4Nb-T}Hl2#r8^v?wzY?g5AJ6jDbd5i%ZojulgA zJ|!~YQ`j0+UO9Shy5Q;qFByX3Pkk%A7+%jBO;nfbn2MxXr!sllb z51LnbX5A1XF8YW`{r-Yf!IDmCjAp{tV?{}8s1P8Eq&7*flNU#+bO5h&<|G+?Y!Moo zU2>G2O6?hSG?*SL9oldZ#98^Wy!_<>?e?f-D*MfXtxkEG5ceU8oB*@lqTWPn6N8t1Cn5+1wF3pH{ z2Fpz`2dxKq_J6hxPxs7?vRuvfxAJNg39pR!6`ikEM&hyeyZik`_xv4*{Cy58#1MdE zhf$_*H9?_^(vC^_4EM=rHC87}NtfXrL0Hrs)=uhF(a1puA>L3!raBLoRxRadN%>Su zVx8HK<8F%VRV_zvs=1VO)9qVueQE9Fg;ih%)kCZGvAtE-YKgieAF5bWdUYNm!4x#e5GI_k-t{IzwU4E)OSXAaDpb|6(nxy&oLMumNt+@<^g^gE1`t0>Vmt6j0;aB)`w8c!R zSu#twa6-TPV|Ut{_3La4pO&$7--a9i_gqAY0=jG-;FQt5K-A~_WntLE%gyM`#b+V0plYYawSI#6Uw_x(zi@gdfT$xt{;}+DXQ~Qv z^eH#ruJF!->Y(8)0oELuxry`Yih62mZkIHRX&rXQOfb-DfJY-&9%wkgvLRDlVbRB8 zWNMR*5;YY+L_XjOUtQmBc8|!_G znqQl1$IG_Vxi+bdY*lB-@gfQKDhlne8D>);Rpz64zx?;s!;e6SgzF|nmM<>KZA@!bvsMq zZ+~fmAu{^QcO|>jJ1qZUyb+~M2JuWfoz@2KwF?woCcRh};zP2$k64Gm+KIE63=&09 z0t6OG|j7PXgL`!V7lE2NEGf+JFCECRKQ%sRk6wT~MA=?VS?Y z)>K9A@ev4h_QC1o^ZakFNl>(SQO5ejAE;QZSqa@wrjh4&LEZTDmIZWNCV}2tYy8+D zpgsG=gT5cRZs(5g(5OXw092_cLgz22)@Z|aWh&*+!A(}P00Z4gingGVFCZ ztt&JD52naF zQEH$&s0Gkr7Ax1cj+2=+KlH_lTr+}1R$es-3iXTA(3jvi5G)k`@MJF>F!M^w>{mSj z=*B+77xQ#bnC(j-rqE$|=PE!vt9NkkkxTXX&qzyI&M%MX{+ms-TZ zU;Vfhp!FE2D8^&Uj^IqL`4E6bnbixF z;;^K}x+wpl>(_ce*c{RUiaQKQ z^0I)unh!>ba$06WDM?B65W@$WFb1Juj0NH8vZ8;`{6G&rYp>|pd^ea(8k_HQ5Lh)N< z`o04s?e*T%;>8|~_8`xwK!t6NQDu&W z^QZa@61nCzXg;8>$^rmw;-L6g8V@QOc$_X(*gqbsu|fRG0pat_+?h#{>wO$uP%1Ss z540O@$2mR{y)vD>RClVU79$x#C~7}1ezYcIe}B?fH6r{WnA+|K;IqWk0YB^@IN~F} zu<7Zx#aF|7v1|$whMH7w0pf+|0GxH0Y*HOQBQ+z6yet4Al)+tomSo*k;y*7AkVP^@ zn|k4MC#_a_5|2>}tscds!kbk1-#-vo5)!}!*O@d;yuBZ0Ib+&>bW~jRN$rCW>n`Om zqz%*6loxjv;p~X9{*MsS$Mrc&Oir8%)}bZ;R@$^zw7Lmq z33O08P5~IQl>ot|=4lsqIk=~h_`Qc8P4T}QKasRKT+ z?v+B)W8<~Q=4UasAC%|i78hVJG5(hDAa<-slZCFA5|QeFS-Y^<;u~;m=XKrRzoNv4 z;L3E_p(x-E3hs@iC<~_a{e~VDRUGG(@Fn#0Wj!^|1YNR04l0}z)gXu%hdBH({whi7 zNBJ8)W}UUA7|aIHT}F)dB{Y$eo7UiE>a7zU$_IgkiA%2=zAX>&jr{;$lDSiGE37M< z5f}%C(r@jwJ&3CYGc!BZZgyplFE7`_?ydY>GG?)fd_==UFH~c~v*5flJZ2;w>h-wT zSb4J9r(15iKv(^YM@Rj)0qGx9aiChH=;w%_1N;O8ePb(nRmW~`V1}_63+85%$}O)Y zKEpDQ7}ftUSpN=IAsel%zdC4XaQCgPySQ$|AkWO_xm5>DL;3f8&7&xZv<|So^Cp^d z6tsGbpM(J$ivRAEAjgXht$}()QB{h2f>>4@UkTBRDd;e2_=2D5ev}B%GX@~&@z%~= z@En_WwRLtlogJ(}6KocyP)o8koo$!TJ(pg;#%)W1&OZ}|ovV@kD zgAFC$_a`M357G!8N)tA3)Wd)XNCFE0I-BQ^Lh-9SSpLUUh55KRZe@IMG+hrLSSF4_ z5{*H)x(1!N^OdK6z4S_CbO17iJ#A_tX|8hno$Sr8`h1dolj|?eNb^ z$BpD{vG%H4BrS4{Wr}4^-D+*jvW44%=SN|bW#MDu0iN@*Yo68WMa)$D6^lMQ|7v;L z%#yj8*;50a8T;qMuyOt{AO3faatGEPgX_%d0%n)fL>#CQ&N&=O9y&Kz z01X!L#K3h}^8N>58DZ?toKbw8_>-FFp&B%J{;}#o{Fk@z@rg_hq^3yFi+|ws1<(8H=ENCdv!i^!esdC<2NXASFH*sAl>WFIpmP>LEJ}%J`C|cLq z81iK;ENw%t2#=NqM}Evux`3;!@=sU)piQ7ffq(%SKUjsort%eQ zl=&A^MAR>q7RkeD924Ne>3Ph#NH1xaEdMy#o7a!vjhA%~S(V?5+OJra_h?ld7jCuG zK`z*yoEX|_1_RWV9_BfS(YX0Cv!Mjwk7Z>KcyD{*pV&>7Bu*N?G+en60$_;L(!M(p zL0&iOvvICJa+T%3zj?G;tgfu$`YTOUr0?d*I-1wz7LmnVm-CzbHs7^i^Vpf?Bf_ER zkN;bi!+{jcPgTnmfu-{N&4#h3(YB@&?apL-%vxP9oW_{Fo~W#}TIP7+CB@cQMbox+ zt!df{a}as$^pmVJ$Fw1ZHNFqUk;Bj6<9x{mEgKo~#@$)yPL$6tV#uBpk=v<@j})YH zih;!~%6kL1F?^9V?c82tE+GJGS^Lk+DC;4O3J`{0C-r_Jp{06vVn!T}@(o5M@sHL& zZLu6B{#7XYl83m-O1Hp4Prrtjw_@&)j^>8f_AY(biz~3OvAn`2p@kCjd%PzXi|4)6 zUk(my0!w7+@8h4Szf(wbYB`ev=e^^;2Tot@ln!AxFTAZ@B~T!GV@*eIt+w(w{oUe& zct2(!D_i)FGr6@QnKKU_+K&fnOvy$@t-n-nDKJkUGLA5%ruR>M?AOnnV;Ib9tlKZ~ zJrG(e99VWulV~tGu4DHNIeg|^U2R+Ii{^ljEyzRHdpo>z({f#HDAdidQk5q$_pM&K zrNN5#!5Z=7W?01C(y#rNF21fA{H6`5>LlB`(njj6##EmEpPl?>Hr&&5U=ouVAQ&n9 z6)as_jXET)bZD)eOMbZimsxgz&FHFa;T zA$vv$E5bTgO;?~li^SA=?ql;yGJ_eM=H<6%BC8DJXH(ooy6BqL^U^2MN^(gZm#?eV z61@g(t2?ouY|3_8SrQLg$=*}IHUJAhA0~2%UKz^Qnv=hNS#Zse0(bR3haLq!wdGXg z)yQPrvKjBhe1!y~3StkPEneuP3%RhkV)c>@*AZ%4?^jY~>8pn}lCvXMQk8?6?S{u3N_1WnXIg;a>U5rh=UgpDk&or_ zq2DcE#E8~HE6kO3$o|&UxdBLC7W76P$-aG^YlnU{HD%LoZt0tXYOd0Azi%}3x`6>_ zNhUnGKBHxsw>lRqf;V`C3K=_X*@fSgx2|4fXK<$1Z9*yPv;-W;8`(Qh<0ui&hT9NB zX{2MuIE8`&%gHgvU)hy{&R??*i))*tT%>hVACIJ9sl{F@P7{#`M81AMU|!wzJ)q1dZ*W6 z7IL`0Hg>NTwCGIlX&RLb^U@lG@DPiYhd)B5kz|~u)MQ5eP@Bb2l&`1fz4=%bhe@;0 z7Ug>s7qbQ{!#!q{!G>x|{p@rVt@1+g6s7V@dHrM^ozY_T*OF5Yuub)=pT)u5H%npO zn`JP^&9qJUX2|BV1mz4tT|?PBF96xzKN%n|blC=@6IRZ_bWIzA-$3V!MAkeqt!GeT zZ4Sh=M&GOED$K|3SE3anXQRr7l!i(VfNbo0hZK@uSsc&#j5wNq2H|F=b!rp^d!v;d zwI8^Q19T08#LsN=O6-}B0G_dpguyRG>VQ2@V}WC5vA|0-@#$kpzxWX+sBt%M^ zQ{c6vH5eq0xD>Q-uycZ8F)-Dw)+DAmZCTc%RwE^uk3j`mZcPfRw{@i7gm5LX8?fCC z9ZAlQ(vlAodLTQ9UGwT%3+Bl=S>8arZc&XjufHHAZXJyFhRZzE2Lz40MdzTl?5-(b zF=PYJgXR_C+hjMA&o3Zo1syVfGd6dB@in+33!mOcol#8ZQ$>sGG<77s4t=r>HA8%# zZVrv65zE1Qw-20ilYaMOUCNn*+sp;SMP%y0+49j>IUKbpXRfX_a!!)~s8IL8heoki zw=2OO{6ow&Fmp5Ak;=3mqv;fgh|=cS+zsAbQfc(RT%i~RJLp2f^{3G?tCT(Av-6;- z8Zit|YLJCoOks9xP_@7%IQDT{4c&ix0~%}cNe-o84{9ZSHSsw~Z}2W)vHY3Zf2V8oo9@t67U1Q1Q zTAq7dZEW525nHEIL5`ZN_gPtjz+_hRvz*q$ycJC=bk|cDJm1ivdQ*%R`Gl^NGIEwC zR*>2{!@Xc{CWkb8H=A`HTql8KXjZIvy*1J&f8eF4TV!sePhi|&-{{^}s;0u;O3EcC z<#!X$iq*Ba^TUV0!*w$B?Zs1ttmP*B%+x=#lW%DDV1w*Higa+1LdU%`X?ZZ4(#`$E zU=k%~FZBaGGn00W6y4eSu&!E#nllkrlK0?^0Sn6wI-xt2OXXgu$$TAkLWxma!Gw?e zItqMinyK44Af_l@2`fjUH)~d=+7I><05C6bTn2K7X5AIIUEDEwYpHO+@tYYs6gK9-{efS}5;%3YdoU1B zC-j~Azm5pz29HB0Vu#O#VDUAxS!iw$)oK9;^r8#1B`uc2JBVkXDqRLh7i(YuKR)c; zC(b(>cQ(6tO}`REt|&ASvbmze^a)KXa>xs4L`9tvn3XM%gXMmc>l!mutimko33Ba4 zDAcQK02YvKv9`WBg>qHAa-D*6Ufj(brm;rcJ&|5h2~r4+t0G8QWG;5ESkHI_!Bp1?+y~Z^ErO|Be==^V`GgwgNP9F zmCa1Om{}vEVzp@oIkHPkn}$|3GTe$Q~t_GYKIbLErQoYvGN-l7) ztDI$i6eLNdL<#f$RZx=9zsQ!fQnvC`%OLWx%*8wjvROql>y2H>bD>JV0(a9uHqPz7 zL*gbWO^jO z^wcvRe8Ucm{P2kDru_1iGm2e?VHh?ULFeTVoBP=Q<>9x=KSvkQJ5mU1xq!-7IlI@? z4{Tc+UMBpE)Qsp5EP0Q5xutE-_*bz6KIn57sWtg|bS<5!4v z-fsLFks}d={1nfO=+&qhq`gkf@6sZp z5mRED>?k&-(&NZmx6bOLMkzU3^7MzbnZU&m#EHRa9Cx+BcBh4udo#Sr<17;Oak?M! zd?-;!YKq8<5s3O+w6?4hSS8Tbf9q%@>WxI@~KesU@A_jNWBPoXfAO9^s_{Ww>Jn=g>w!)P(z2~ zau6Tt_jF$+)xsR3QN6-qu(JEwDPXa*QA^S!*bSmMQXKS26gc-EJIHU2^i@>Ekh1sS zn&2izE0e8lR(xwSpgg|+ihF&ie)H#0>KUFgZj{(61S=nJ{{dRe-S6GT8IO=4b7LB? z*x@>eb(eVmz|RwpOPlj)lD3grxVdgM#^4~W;otHB#%IXUtP=cN0DQg+ELC!QV#{&P zhTk4m05*4#Yp|M_c+6XI4@wA3F;6DxMV*bdq!-BQ;DSP5!4o+u)=XT5o|pc^#Dlaj zjprq{WF=o0gP0eOWP}cDl0C!3-d0rGFrz5#jF{QXj21FCeh92oj*WpKS$WHzuGWrh(k<7M7rtwu zCl`IIU!uky)tm9%xA1kwDP62Cs{XE_Z5Xoiurw#h539D2u&?V);AeeCEPajmi{4$j zWWleBem5?0L#fRQ!d|u>o7NRRCwru+d}i6K=?!Xx!@6`19)&b7{65wd>%F1>Rlt!P zxr7jx<$RAXxS@gZGNq4n(2GnV6sk`<4U!h z&VrKS0eSj=M;1Pswijei0=qt$SmV-dT>ctKe*0oUS1S5`HtmC^lmt`vURjG>G}oL5 z>}ZTa^~BBrsF8TaeY-KEp=6o_m_c+^^0IBF%aJDCVLKe=-{1(UleyA3?&IGE`a2=o z;akixYgfnQfx1re0s%#3oxII9|rA&FCgKB)@6Jtd%LH!sJtf_(i| zWf%(=`u#lGtE}{F#_Z;$oaoUo?oj*+y7RUPpW}L&yC-E#Ce&a0I6Ncw!A7iz_loG0RuC0bcjgiL7H~^LI{2x?3rqE8rFnr- z2GaNYzTuOoTVd}o*{e4b>sLIsMkOUCvdUaV(cEF0u=vgV`jX|I$WQW_pz3VW%k(VF zXlPyF{Lx72Yxnhl3(oV0Ndctj9i(6EzBqlU(d9^6Icx$Tk)jMGV(%wi6mDX%VXP7( zA-fVHRzme7a3kOEk5WaPGDzLWR4c)G%@t*TcX^|V-z($Sl#BWJdjx!foUiLrWIFqG z2xt8~z0Q;z0zM6CjxBDTn%YJ=9X`&y3|xphdP?5=e@9~g>#bn(hNxxJrME;UJBOL8 z$|{VHwp{>6@($grDJGxnob)W@a)~>tp=v=LT`@FGPPk4!FYrZzi7X5^vJl3xv=fMj zex11%q?4%-P_iDY1Wk2Ykne71dy4faVz86g7jUs_Tbzk6TBSKui>#`a%lPz*fZ+%D|1Z+MCkLa5SAuIe9>S6rdm?z#*hw1R(h>^d-Eu#Zkd8%y&-lkdA ztA*oHo-+CQD~17hq6n%uJ1Gh&-yQ6;XP*V_(QiMVLunUxTF-0EbFD!iZ8SG5oGi9= zp2xCmz0UXkQu}tN5aTCYL~F46j(ncg+W{(ilW=|_wC2?IAm_aVOSN3bHRolgc~Mp^ z^m7wuU#$J>^79o~Tu=Mei!*r5!G*H?p-P=r!-?lwve;^bhYS7Q=K2f&t*OH`Gw^={=l+}ViL>F zlC768Nws-t^srAKKozL<-d`o2T<`L6z?``k)+I=3+kSU+qE94^q)GvY53e(Bk=RS| zUR3}2fq-%Hzbs>bk3dFri??KeYr6)OR|T)7)6KCg2g8Fx$T{Q_DwvX*xup1;Vw+{w zN9FmO;+t7hSx;R2S5?tfkX0~M%v7SM@8y%yAq2TPsN^LfPsZHp#Ac4fBlNG9T!IQE z2bSsE*%|W~*eMRff*j1J3@-o5yO1`nN{y?LlGS7}EUNrd@dKlK5QEU$!Y#Jy6_kJBjXSVs!!M$F?AO+ljdjlaUFHB7%@Pd@y zznGR5yOGFT8HhqY3rQ}(d%5Yc`sEf|N#C>1k6V7YE)%G09wUhs?h_O%qZ}5b?h~>7 zE|v;AVf=B=UL8>$X-ShCCOq}CeAat!`O~^%r2$i}N6lKX^}cxSz&M{c;~OLfRQ!*)d}XR-r!82|ksa(GCLG6l3#_bfXPSRe5_ z4N9wuCJD2;WEx131=Bdv(v!r-u~M9vdabvyXeqs?S-LIiLx>-Fk9MJ2^t2*Px5A9t zBby0zH`uI3xg+Ej5!yMMtPPk5CU0%1X~L6s-Tn@Jf#-pE@!CVz*hs5j1pa78819O9 z6PNu!_FPVe_IZ7m<}bSrU(fbH=SD42V8@4MI)XsX-5v) zMXXL&y_Tw9sXx*4UZf)b8e$SNSl7y&E6wq(hqGM%XJEoWOTmXVPn-@ueAiqfJ1$+s z4JH2<>jgDi`+5#=y>xCWaw7(BHKle@b{(a7GSqWIiK}eIoW~xbE`gNTn21Rc4dOqo zmmlCi4s~@ai|DOrAb7VUW&2qQrQ4?Ve@}K(YRC$ifp_GUF~00?v&WaZD`7Y`SQnuf zSzRSzR}+7KZ7~;JkoF9pH%5Y>ZD6ek^~DHo8avSg&P4Kth)*9I?^6XZHwkkyn%H`M z>HS50m!rzeXT|HUmS0R|@+6hcX1?~-02M7VA3gaJQ1Tygx`G4BBfoE_xavRqXi#@5 zVH+xV%SGR?qgfd$@SIa$qKPdN!^;U+@5osg-6P+)eN^!;E(9EcR66ivd~zjfHH+V{ zzdW2#oEiT?ewd`F-hB)XMsiA?lHT>`uS`(JgTV#qQPvb-}L)m=zg9iT22~ zw^PY>C9ag;Tlg#Z9RK_2&Ljgkrg$A@WkL?_JpOiB`{Halux&`U>hWS{t|x1|^=!aD{(~i-I6Zdvm zu}pWtsEE#$9%>@KRm%~m#<{WdR)7C~-a5LypoACOiA3C}3GM9Jr}aY9Un3qrc1FCh z12PcpY&@@hdcIeE$Yc;^VU4pUhx?J&{yalP;`~y0yy^7!vg(RaN|-XT46=RLIqWsi z%4{y1{nrBYkg840YI`~hxvz&*D(L4cR#{xSh?nsaB;`KQat0ZF)-?LuPfLCj3nR@Z zaA9K-c){ZyOUVL?PdBhG3hkYU9Mn~@PH@7@KT}Qx>q3A zee+>^_q6rOF_!6d_ojxTEghz^&XCM9Du0ij? zt*33rw(=X>KAL~O*R-gpVZdOInr~u^Xg1UVn=Q6O_OI(Q0U4R|=&_ssI>|=e@#P9= zsHn+z>$mgYC#`+1;Pk(rLsX0sw`rX4ssBP4jS3-@ySGZ1H2lK?U=?;ZuKM@(q(@>* zs8F-<3NP=Narji|M3UA&-FzU|$2B=;Q6hqolzvB4jXpy{EphR0$8nR!&X7sL!1V}R?3;^uBw9+pQxSUbUQu0H^+}{ zMrj*Xj-PPJZB8-NYZNggPl9Rw;g9k9tw0NUK7buHH! zWXS0V!FV*mWvL|$nt{Clift8mSKwe6uI6`h^`fNedWCDnixbx0bygpJP%m_%|D@qf zRSn+B{y*l*zkruW8l<(m?@|eR3(wO3{GY%Mi8i!yXd(sWy|xxxTY>3B9`vd)!_2PE zkK!RVI73^Z+x}qj7JRT+dAlS=aLs^43)9*u4vFPx%R18v-*XJO$mBqKEiDv{l)w?v z0J_&>x^>*TmU?RWwe!=jHrU=L!?+A<>Br0|&U%9Wvy%$~jezg#TD$ ze_Q?J9v~67K9!rP_HFs|%e5s@nIKPrSrH=ywb1+g#e8R?B(Ykr*|TB@5DWyKZ&Kc6 zP)Yz3bfY5evQp$FKmz!%2Ijv7a4QT#R+zBwc^{|>W6)UyRe^Tgpgsa>8A%?#tS}3Kgz2C)Q@~obyuLi+Htj%8G$q&B`0@hyv(|t; zA_2lDL(VNzd$b`Y^@7bgY2X%HJACYW{+u671M@5glMVop()P?_*6AIxIjEk#uSMC1 zEwD+sRi`cD`(+VIExUPcP4|y(4fo-zBaZDVy1-R4xsd-va7A&Qucsc{# z8EnAVI2g)55vFbEo``Q5jcPN&p+hBpZc5xI=<*BtF)RTNTZMWLl#V4Ti(EZC9M{;u zx^oI9LH*F21uFc3i1ll_gCOfnqjMYdiY%xVs?li^ka6OhgG zzdlMf0InNbvU-phzs5QbeapXDdqw-EK^^1G9N{6HehAVik90>7m+gwJfh zs#j6}Y`N=|I$TCLkx$)=zgVx7Y62w_j%N1f@OsBYIsf;yu)uAS}`~lOI zhLF&=XDpj=$p-T05{H`rO0jvn#q{muQG!%MB;wt_s;OuyctUd_P6hBTyi2mznO?d^ zFAU8mp9p~2QurRm!2_!UPk|vaPVY|bvoGTP>;vEqwgNqc(fAQiq8chrF!ZTF5Cn3- z>a=x6B4Cp$JbN{`2iiZfd=Ug)4vI7isUZt2sb^atx9Ku6-F=apOShVbbKnSU0ZNeN zHa{K=u-HbRwTDSkbuGMkWS2l1JVo>A8`+CFD&RP56;@xq7*6GpmX+%hE5;xm!Cw)7 zmg6Z-0CmiPHuOwUPNgq8!2m;}`UR>?hw^z_prKq3S^QiKA&A(5aUu|Wxh7`4E>7A~ z>ZAZz2%}L*(Q_0-EBCg54HYKFPrzN8^ybkAh9MG%?Eja?$V#CO$O!i9iSp43DzCWE zSjBRukKdM4rjP$Wvc3W;s_lInaD)LAh6bq_T2v4aq!~&O6i^gVIuw-#>4u?^Zjlm1 zx}>{PN~F6xlrFzLivF(uZ>?GDDqPQ;v(Jt9%hf>zjK6 z+J@0!}Yh7FBH8?Tun{Qjsh^>Pz`G%PGAZYadv9I zI>wh`5H?o-psMVDn*b1M@y0kBZq7wkJ&z1ibnazATIt<>+89;cNRo+~T)L z5@a~9g1sGS*=`lkbKUU%PFTIUGrUXD#OsjT_ z0lM~1eoALEV@>MSq`v371=bp|YZFzOZ-$?E1cJ~SAG12IU^kiPUz^| znSsp27feLyGUz=9$z}9%$`Rw@H=%8f+T^a20q}(cGjBeg@ZOMKL^KNGc>KNu{C7;x zkvQ!#Nkg!HBmBqwttnu?rQBi1m_u(k8$L67X7#R_xG|M7l;m0sh#Ow21AZIfMz0>> zI`u>|q{i6^?F7&LytOAV>gtW)HWG6W{HR$8 zz7A~VJI@whj3=~INd07zRZf1;I+66xk`2TVq?#aKvRiVqHOs4O_u@Pn?8vRWo)+im zXYxI{goxP7?0TbR@mnpv0AHLcG#VU$*VA;=w%EnvtM5%RcjMDWaK91w4)f|{v}#Wm zmX9sokyoXu)b*j#V1@zb3H#_g%%7kmk|}d3>5Y*(Uw7NrK)YmWYV)=`0+wIxh>lXH z4%)KrMkU83V5$4jedPQ@wa|tkLy%=RnLRzYl%makQ~|(7>iu_o&%6V!%FI0ounl4D zjjy&1DG?1p^hQc)jCFlCSJS^fd{WA)$ldf3)Kp_jxR2Vy?`qNSBxgBL<2(&RC<@GO z7g&5Rz7sYrC$O4G@N`6i&EmB=P=MeW^jaH`eadG1w%75}pBe)i42wsB`Q|!QxKbW^ zRZ{i}Uwm&JP^78CRS3ch|L16EqgEQ~hae&4Y z#94SNdYA1=t62RuEbN^C+M4+GG&P^mr&W&weUso=?Ue0=_mIwQ^HO}Xz#d!A->(!2 zOvsvWGX;qKNaZfeUG&4j!+Q=`GF>m+45U=K-3)A>3grxNJ_#GF-}0*9l)F4&F_88R z(J@ph+vy#}ygIs(ZF`rFA4Oi(VHtg4@_xw~{?s zU(V9(HlhE6B8&2BfR^e7`*O;=dfAVHbhbZ^B z$5R4-ra|I$xOU?Rcr9sj698&vgP?=s1(%UAk*Eg0VIrjqXIr`N<)9fE`eW?t8IXkT zKMRo*KL+TMBH!Itr%e0Q`v!U`<;|9Ik860_ix+5!eN3T3ldBCmrsbN0-m6Ce7m$1t zHWOE%2bBMeq5#&?qtYsgA+#i0`KwFAw+;8M7ez9@;PtL~Z*yk%n##MxFT}Qm)+Ubl zMO$HQea^X^9uzVHP;a-o-T*908v$e=E3(6X?_v)o*Gq%NQ9EWJx+tRN8@>fMu6}#eBpQ_Pai0 z`kK4*_q&VU$N?_LvSUs)`|p8ryAOwb5{jt3=zd_21`MzxN~IG6rm*XBnEWWbO%ubX zp4H-3_UkdrQsG8H^gp%mx}#Pva*(kp`A1!kY>!~iq{fCY;*sayS5h6CXVUTXvGCw- zEM>bHo-~)GS|&020cy-nhSOwV*yT1p_ZoAbLd%I!_*zI&oyfeKj$&(UqN>WJiq>bP zS9|_IWPbAobbT=F*~+ixR4zpZJEQ%J??dk!Wi9!bf5Fd09_2~V za_VkvKT9aqyaC;|&bR%xR1(lMZMu}yh@WzKz(akRvnVHuH}EZm)~m2;ghn>0(3_>i zjY<$5eQS^hEE~peZ?~BcT-cT%qKl!EYB|cs7z1d&H}{tYRXLJ_JO~YSOyVtM5*>G* zwrcbl{z*dJ`cO!(KrBodMyWxQs2!)kq!;l9_>UpDn7WD*6Vm}WRt!~#k zQT74PK=EIudbH%8;b_GF2z{`I%lNLuVQ$S?Mm_{hw~r_TBINzjdUYok?V-3PWNd=D z)khf&r=Z3ANvPSlWP*iF7I++cM7H?Fk%#A(=_hE32)T76U7uyXU~LV+^A3c zuA_8Q;Fwujc?|>z)0J~R4J(Nf*s7FIqchm_4 zg!V@x=nySm*(U+y8>VRcna5lR4qQBv_9!ANHq#v*?OF`9!RQ~B4h&tr_mN41 zhfbsT>Jz9?T_ga!GVAUBn~kKvT?xEJeTwK&l;rk5_g#Lbm0zXqf$5zd??0&`>fo0c zL0gtuDH1%tMxi?!qu@8nS`6Z*$MvC;J0388mZ{mXV4EQ7q>oO6v9>^CesDXV549tiwoprwMFKKb>!K@; zvo)rl=-xVidA8mI(+IDb_XAw}vijMG^DQcs7E>Kti49$cddzLc=z4Dz@Hm^P?3SCN z=737mqbJb317H%iOUfrJXiew4Yy$@R+F>yus^H~%;!|W;co4tv6@5^xRNg7=Cai)2 zg0p@BD80@pW*!b(_R&a4PhIet%7c90_^Dk9=Vl%ySlJtfv@GrpN_u`&;i&4%f zNEhj}WJW$q*+)PNJ0&m_n6pjV7mp<3W8u(?7@Hk1wAi`pjx+>aw?MaQxlhzbaIQO` zoI{eLRho8MZY9t((!l^I$knOr^8E$a^)q?c3tv>xYE9RE)b2(X6`E+aDtDiR%;Vja zRr_jL*u1OG4k>VsNy*qf=K_M|5ze5^ib@hzm1vuazn1?PdQ+Z&8u+QaPZF$V1@sJr^%L`H0&`5PC^B;EU19RmN2IuYOxzU9uu5Dr4J_ zm;Q9^B37+i1%hwnHE|2>`zu$@>tjYs+#=;-nSFI#LPJg9hTeOom1q*Z(BP6H?%S2e>3}b<)JuD2!}@bQWAVn-SX|2S;J-f zPdF8CgI}RtGO-y%fqqnkY6Exh2@u*$%&Gd^B7MO|OWl{VY>s#sgtfOs{nzgS6Uaad zP@n1m4un}1@v1+kuUx{ERa4Nd0Q9nN56#AptYT8=*WY4%u151H^%)~kpu+RH*^CNk zSg?D8z#|e6L({Dgm>=@hjV7zBuu)!Yjo<2zu6`pNq4+1W!bR5drETZFwY##H(Gk_H zU=c%L@I+0M{b}axm5#-5#Yq1}J!8t2g_nmG^93z4l6;6Trwu;()s7A0ji;x~Bl(XN zIi8C4ayU#53>1*F-cS3M^+( zTzQeP7v>_h$pn3Y{MQ%S@$Fh(y=on8s|8A18JFmURY!pi^UtnF&vL4dUKh1W?ln`J zJbH^wp+SIM#~mE)3iDyYVxnG_aSR6;{VM^}HOD||F@-?k8QFD03cNAT;mh&d&ohu1 z1NLc?$Ez+28}dPt<*|H=+q z{>8ra^T%cL=_OoiSE52#oAkbF0gcT`%~nQ=GAn@sS?pr}=V2a$ z)#X>uU=w*9sGZroVBm6^nVJ9X@Gmmt*MlT3!L*f2K35|1OS4m#;*GYi4Bx=;AN;X3 z{I@CdP6{Ix55KnB>A2m8h*6@lMxn39#bp^d4~06GLO9hwE9w30rTPxmTJD|@&;VWr zO2{t)BJUF{{Pv#wdm&FhS33{V6}VddkG|sgY^X*O0T~qezp~`8WFpfw7CxJ-Blub8 zm%%Z6-}T!sdlEZUJz2Vyn+0zMzEa(bugo3#^9s)21ehzJqKx^UiZT#8FbB-Y4yG=- z?=!f0l|az~m3h(Jso^Kgy%K=!qK#i=QQKiL{P6RwGjeY_@v>4y8U*P-?4*xW?EdHK ziK=iVE?b!0UyxTj4Hl@Mvy(yK`l{>*tptH0qo+kz(@EiZxL)1+0`he{d(3}_>DNm(;=%&3?k1Q$&iOlM zCUOJqn^kd2)i67DJ7`LQ{kHZ zh}JD&UU+aQ^}hh_S2jz88HB0oGi5*c=gV*~3n62qh-jdd8eiw4hVaSxa`le6VE}c| zqTPR2&+kV(1cX_$HW#mItn--v1`;FmEk)WwC_nAs_qOp2^)i&Y#rVPmYY_dua*uw( z`xCXE(`L)Pe-t8qeK)BX1PD?dh>#?N{2s1a6)6nvfWa}b1-YV(Zz-TSA}H8M)7Hwp z(bf&(p4Wpp*%m5Z>J}3t&%~@v3)JuOi5?=QGprDYAjfU*OO=lZ_$&%%Sp`;a*_VcG z1E*PbLZS(+m@;qc^28fT)KC696ySjXA8?AJHuZ4%Xyn)9nL+q`YXR&TRJs!)(8Xp@ zt!6>%dtRd9S7KM`td@Dfbj1RYR3bokhb-k^!PJCNB@Lba5LVSW{pL9|#OsL7^6UMO(0to|h` z{t9i-ubE8*J>biBk=4ZK1MUdNz`Wyrats2C2$aVg!}0PWwBkBiCJ?Qn0PeW`XlJ*; zaoD1$y5Wd$RTx_K`SUI2c@PADc+UH}Ux^q9h(wIofLg>wcS5_7$LSBHRdO}6*TGs& z+XqjON%N*hoErq$w4+%&&x&3%ldvcR1F6$iKniC7w1?dOTrDk)@E8gwl}}3IEqXK~ z4>Un{Bpn!_F2v}8ZXW6gY(O0VV0z;Y)|IE9NOo`k|MTb@G`xf!nQ9+V&Hv|@a9qqW zTUg2*df|TF-%dkmrD~gwV27u zk_emKZW#d+c61L+E7%TXQ01YaKuPjFT7$u2%)A9?1+<-l`4E6sYB!6SA@YfLcI*br^pp1IH)SlzJeW&uaivw1;awoi?pP5rS zgGVJ~o%O6&{L)OIynAqieb6;>M-X>DatD&3V&Q1{QsA#}4XynFbTzI~L5Hzppm%M7 zpfONzYS0HF7~Cdn{8nTy?)j7gPE#AuGWey>4(J-p*i;u*K~pU2lAR8htb1Z5=r4bs z6xknBZU&tH`AQukpH*%>5dcoKnD(S-2mF^z6hg%dTslGB>f2*EmJv62%v*U|?8-|# z6_H!ahdcjg`M6<8CTasY=)6~UGUrbiSUVt&ky(yr8fDMg@2#chp915EEd4kl*V4f& z>5aRsj6tMhPJo7 zlqd`aZni{SY4M9|cq-0R&mY~CzDD``_+FU6%P-D_T62A$w8T>#U|wj z=I3G|P{i2x_3a7EE>VZvs(puO)_rH2?5Z&tAC!uj$*E+6#B+ocYpu1Rty)dv{G)f$o1@h@)|k20YWse#W~i+>j4Qe(a4-r@Ob=8xi^x zN!76B9(tWd6|}wm5TV(@*7S;}&oPTa^5w4m&B@Jl4~nF5nSmKlj(&pPLQf64;?l7g ziM_Q6HmmmI?XNU9HZGZ!j9K`P*)6_*-M#+prRDaZUhFLH)9hzp*DFg7w?K_O<2BT` zm6gCqIa|yPiul2TNeut+2hD_K|0~qnHVa zh5jfhLALhsu&C?Jri;9TACNLFx|Yz_+h;yXpTP~g4~*t}bBu-yMhG?CTR-Dd%T{8V zR^XAbFY&Iyg(;@fphZPk-QrA>K7M|EMwKvPE<*iIgZa^nZZ_3)6* zfUrJh`PQma`)fZBYp#cA-qyIL*ZekWK69X*S3~ITX8i5AZ;Lc8^9^=k7`VaUgM`Cm zWo2O}+J4dE9I#Asf_IJC9GsvYs-PEB0Cr(ZbvT;Mc zY-$woF}8i0-=nSmu7uv`xdEXu{9z=Al?B0s9`X{ZB*8|U-bQT9dkM#l2ZmowytI$C z*jP<(78Qnc>{BQC_5J5}p$SEec+XY7c|m{vGPZ26So+Hbb?W0*Tyv;ZHZ$6{2VWjX z2uj}TT$)ZNX(8d_;rnL%b)#Z^c1%QOzpTh62y+)-H@c$hYZn#8&*7qd{xiq7yDLBH ziN9VwJ^WEPH+DX0e@)%*2^b<6KN7Cq2>o>f2Sk`YI?&AbJO+VaBa!1-)73)u8~Dh< zBDp2J^RM@-S!-vukYD*E>2pKEb-P}Kl!jL*n^7(`HSHCx5h>nPCV**($W|+n15R$d z`8X>Nw7a{^-+vX@NGjbl=$}) zs%3(o-2OeuVEvFhF?wP>bOi_qx?DfqSYidu!$_GO4@w-&?i=mXV;Y36rF7i-K5&nl zjjT4*W8PCZLND;GTBjKQ8q*rRD^I zawrfmdbZzj3`CfCdmlIXk)`Uj1eQOUM3Z}+;CtUbJ&*+M7ffh<24NuAy@HFD$?hn( zTD>)mP5cJU)n>oc1=<{*bwDAj4fw5oT8!M$1BY*c(J=S@Ept$NmXne~$)GOHw1lts z7256!&_zl&__wBoeN3NvQmM*iH=n(qYVpVp*Bm8Yq8gperSkiIqGvXGa>HPWINC5_ zeU6Y{yV%qw= z5Qr{ZP2L1*R4HJWe+XL5pmSJUOb==cd!A-KofW$)8lRrpk&uuSjf1V0_Ys+|0GxON zY;g|@U)*o8yz%s-!uwdR>CRwnb?xdh->1d#0fAJTBdk26!y5Fei&RM?^9=2B!`!KH zTdT12XII;ap3uhhJar(?znMqg_3ivYem_p_E0RQM}eae1q0d72bmW=fSn@?QJvw=jkRYPIt1lw3Of2|6a}3 z8aR*lQ-H4(+TI1AfDGo)%HsVSpe?nA$}}NaQ;PzcT!38rn9B_8@D{JUP)`&V(XuDDh} z_apRyX%KK;IeEChOpWeBt<_!21w>Kz)k){$`{)K&8}PJZAY*?7v)!V#AT5x}a*^V(C0;g+t#`;eRr!If1aCMMPgen}R+(iF=R9w4dx zYG0`n52c6)GPyKj&gwvf`zKn^U%wuOYjLopW4ynbThk8EeY-Swr8S*)AMf5A%h&VP zu8|-uF-TN_w7nbk=a!A^eE!cWsGWqO_$RNao}c6JC1^B;YKe(PjDY1wI4+J9Kh&~Y z_(y=({ND0c84xQVWFdXP*<^XVq6E(Z=-LK9%6jx5rm4AE4jcqKG`fhr14-*ifZLJ< zSw#`u@de$4TC!^@tsp$#tpt*8f+}FD6w!vd1I;=i_WtQ54m3!w`7QP8gu5(XAMj(^ zl~M=zBRjbF|H2gaxPWqEfT!9$@6nHi4b^whr+mUA?mDuZ*plcle12iO|nryHGC2bsC zJIkr#ijF-o*Mu~>TNDru;b!(r>wBVl9PlgFYw^c z4W38o9rJFPYuuAYj_MwrI&4tpm|L{s6IaX!e%2rcbs!;R}Y!R{sXa;N=$Lt zs+rDPi$fi;&Be>yBw$0~{>zNzFFS3UL|7c|3X`0 z{9nHFYh!gsATjf_`7KF*|D2vVIIPx+J!Jh}q@Lbf)cwM!uQc2RGlGZrxp^=b`#DOE zBoKBKgqDRJ4u9|Y_a81Qx?*Y9@htlM{_A2)Ev`UPym5MZI=W7NS57Vz)K%Jn#`%0t zk|dDnVf;cIa10wY3KCeO_L(6cSfepstFE}b@&ur5Dr`0*fuY6AdOY5l%4s^hqdJ0| zF9bOc%-#wN@kh^snpa9-*lDq9zHU5(vNTBKvbiG=)L;@7)#Lz*9r?VrqXlL4e2t>E zCx{rYx3{g=R9_7jq~3bjQ_CY(a(Q)AMDeo@;=kt$Ch^t{tghQZYmy0$hOu#%&qsQW z5mTx}u>OghoF6(fa6UUUCe>PPU_T3lcQweGkMAfM{=*n;y94^j_QtbQKJI70cO(KB zE3Ou0*BMQV8qJIx>57T?Br1ySeoo_HXP5IMzmdUL@Gi*V)MRwT?cdM}i6trx??3kU zRQwVccK%#$mPibjUd~D zwgO%R3oti~^i8-Q4zQD&vAo7CH`I#40U}s=RJ#-K*kwTo-*N$V2VUyw>DdMv4Q~Rs z@KA7{V!%{*vRMm&M@zP#F&hT1l2M`!P&>P4y&q&AFOAi>{2~`{lrJ&F0Og>{?FH(- zENPyytl8(pBqSd!JwiYcc!i&`1Q_!@%uyFO1o#_f0fDEB7>bP`p-9($iS>b?>-N91 z9WwzQOyn>}qCCxXzPzSRV6LoF03tHCHQgYHi5jv7DD*%Y0R~XMc@InyS?viC`2e3E z28wi_mTqr&m>1}^5Rmo250bP%O!4dZ1eLlDpxB#w3ZE0FlmxX08??S^f$=Dx9l$~q z(J{bUnx9kXs%GlfVx%6$I_yK}UB<7!BkgW9y~2bSs$x zCCr=&Cm@9#0l@F7_W>r|p$~Wxk!{l1FCoY-FfuYep1XcU^HIIOmm%eLWVV_<7)NxD zLMFuupjc=O0Y`$j8Ey z@`sP z6iwHk2Q6ZcmOLmBdoz+$TT>VU(QlL*0%{Is@OK%Ez{y!`2wVw~s-vG@h1pX^-cVD? zsoHx+2AQ@pXj<@Pl)3|T-jd5w%}=)HsxQoYl>U$#BnED8f%wF0)td_>)YR7i*Fwou z+LqONrT=b|6x1(T253d^UWrFF`H_dABN;R{Ljxu|&Fm|<7Q=shJlwb47r0`6(Az?v zP61af_;36M{(L}==`6ROy;wK=`xkMnSj9oKUf!xt${s!^`<9nLC*guHLg-V-& zNz#+9MS0uX5~*Z7y1NR;29@;jFw_M^?baCe&H?=LzH}?s-m<(%e8y=fd9&9+vCXFD z~7BKnpuEGjV5FP)(I1 zyS&J&^Wd_e>8mb59ej6Iyn&#-Xrbo73|Q)Jw1fS#I}9Y*Q~xK{aaANr#8^@e@;KiE z__ZLxsT9fNc#!-yWfpl*zxaMBhUtwJ+reM03#9)|L1CpqhQzPC-_-hxfycfk35~eUNwlZe2M^YA3;Vyj5Lj_Son3Cyy!bIVvzW$WgNjKu|19 z1NdHwujW0Wm*U-#)+IneJ`lKEnD+H{!q6enw1Ittv5bKOYInf{2VQRqmes0{_t&`7 zLxQ_e*UDR)C^WJdsMnAOlF=NEf>2Kot}55%SZ9y;^;e!vRe4uoBfgWdlP3T0O4BU+ zKA+-Lv3KRj-{}~>S0_*CKnW6dOL3=rRg_g;pKu6UK+ykMmU9g-hf3JDbS5R#JuZZz zv^k}GoPnoXY!{)XC)5QSXBL;v;K$RMduQWFC23+}pES0Myc;o{A;y2pT3zuNq6Rvv zL}%Gz4w0W>V-UQ{$KC#{@s2ZGyEJ*65(a({t+=gJ9Ifa-sbK9B+^J16QQ>;E%R0s6 z)~oTkMdpL^)*B{bKs1Z&Cn&MbFV9qOitgXy_XvwSs#u+_!$~4?Pw>R4@HQ(Ed2es? zZmkQ^IKTTt(t1y!grniuJl9KW@$<*8MNQU!gM(^$3^AmxKN+5D^>F|{&rdjP#gRhy z&mon_ih;nVzrNm(sxiBnqMW^};>|a)2&}!?~1ix?N*a zRECZG#$F*%e(Q$s8>|f-m(F85a~z=XhK$q22laA_`ipr#0&bU6uSK z=ks?<2y5l3O}xk|7mmXrZSB|SJZ|fe;q6=HdAR@FAVdVy3j^m=3=`{Dh&IJEwWr;| ziB&yyaS`9Ll{0>LIDdEgFb29ryRbICsV;1|$z}WRzFvI~-hX&`JZiC}Eabd=B!CDG z4Nbm_yeB2d>d~_#fWRPvJq?nS#LslHDYde`FhljuEPC8&;Qasp{jZRTBxZXU!euRr ziJXzEjOQT}%oPqe3?Boet{fmP)p$;KC!MlHeiaa`_-XWFaAG9-zWRsK(UGFzg5m+} z{i;Q6r!~63jnH>**No-|1}m!eE3m6vgs(59}4Svhu?~+U|nbtvsctrPhVQPBw~ou1{OH z{^W-&*iYtB;=b6L{~Y#pq!lT26Qkm&2{6V9wte3#^jFE17I z@Zm=zDn${+zhV2Y>!{-LVcLnqF&<=F!!NlF1nCj`}N9QOxXTc{51LR zy`*<-a6R}a=>F~-zix8~%I|=IJsMi3c|KG5@7CUUm^6U8xoKauxGSSP`r?e%D#2iM zAd_=Mbvq!vUBk=O%VEOOOiPX4lsbkb4|ZdqrJ`!Lq1UOqD_bklTGOznn2!LvQ~1fd z3FE4q!l5r~OCrVlG?lsIe7666d0>2ldE9z-b~+PQElnDP{)~AZr1R?+2e&jv0PoR! z=}%FK_W*>`Od0&+?$s}FoI3YnhFV`;FS)U4Zm}}^WY_FoCn;rjc!gGWSQztvBYQVt zVr}v%VRyaXp`cqWT)RGG|23Rx{tcn=dUeq@d3@HysENX$NmBQywStpE+Qew&TfN;h zy@th6{+Y?%a8f5t9R-VEN$()p^w6enj3Hu{M<-urA^#mhJXhC39JtsO3Je1R@n4f> zN)H0>L6|oJuJas7c-&LquewAn+GN5~L3H}C==Ea*t+GeEGafIoy9G$T^ibqB()w~Q z``<;2Q2K&U3pi3f0Hzb1=r;H~sK|x`f(^9bTlsM;#$vPi&eDUJ+b;1^cckQujIu^F z%ip9Mjh8Wzzwi{$_eaKhWdSmnWKmHOgKY`JsR zh2t|%QoLSsb7!nx%mdqCsy;(&o$f_Ho|apS0!_RoOKTTx?-d)#2b15Q)jw?KEhl*L zsG$4)dlH6!#@C$zbS*AQ$Ikvfdk-#Ql60a2XyEbwAm0SgTKkfv@$V`qM1s1k;zgv7 zjmj89w6D3A;_)+pKwt$x-*Nc|6&6qI0v$$@&h)In zyu1AXahrKQT7958+i2)>)6-0n&~<3spM`zCyw}i$>9wC&rOxQt50${$viIgx}|IDH))L$FQcjwCU0!|Hg0qcCn_H=i!gY1cV(&~V(es!I4kKbzl!z&Aw7#N6+ zyHethG9Iz*sPnVF+}xP0jxt>oB!b-hFvKMZ=`7)T>2qF2{Jqbggkwm$p6=9{kNn=Z z4rOX9x7U1nCcQ3GqahX_;!U@_9KhE-ZgfxN0|w+k2H@<&4CUUEzpw9u?lORnm94N| z?^lCaL0Rc|>;tYp`z(tl)WiCxG=R6Jj+UtHDOv+p(|(z`=&)Z|aXB6Z0@;B**a29@ z%z&O5M$9ZHYinD&2f7;-Xkwka_2nzKl&14R5xl&H9&$UtHy^B#%wsCuF;MW$V1+l< zq5&Ip)CbXcjv*l--vRfg6@^POC)9E+|HpikJWx!(B|I$jXlNmjYs%1ICjQ%KuSDwl zmD$4c@cK{NgjCoqxD%Svcjz_4M_A540sk$lsr?!}h3&h>~_;7zp)xH6jVRdfVx@FOMllh%6h1zz<=`bb}xp z8RSJKUSITaV}oK&l$a*OS4>V_^({)zTWlPe@u3(9;uXIsjj7zPmn;1v=gnx_prru~ zsY7=u3fcB=Ns*}*rhP_@j>6C%Zw!eS2+gD^ACa?rV`xAY?+!Vg4Xo@QsYg#lWc)`b zcvc-Y-U!@-vvOsM2udi1!Uxg?$DqhTYOJ>oa~5jEJ#M0N%fn2%gr)cTSw;&F;qHe! zZ~IQMK&=04JPI}|G1VXv;H}R98=Jc7!-Zf64J|EC!7LnKq!N59HKDcjWxz38=}%A{ z|Mb$gvuR68>dq_?;~iOm!s@T)>vWV<<*9#rThIaO3=As115{g^XbX9xXn==6?H(!X z?9Ci5MQ9jXw4pOO)G;qcXRvK8?(k9whLm*M2~9xpKe0=#BCZm~&R3k4SHDB5IS^7w zN2y!*dX3k!*Bdzi1cp0h4w^lVi;o}Xa`q#Ey}HhlAl3Qw=wY%gu82%M!4UH5G!sGH znLQiGJ(a~x54L`;fG!Y$J67*yO?Tj3lSXr2fE^7U0sEOapxtX;UX*6hu{}%rf)?O) zxNI^}`4mW8@CL~af%;Q7O-KNwUI)x`W&}cfpVMfpG+#%f5Cm;ej&tQuRVt~&z&NS7}7v9xs|GZqtgfLI56gj#e6Cko=`#>-z?1%Yv z4fy2014f8TdSx$xLQ(jzQSV5)k@oBji(y^vMysojh|j-C7lh4r7I7_Sf5JMtq$r=a zG#4@Qe7~e`oF(nYn-<0!DP~zXtf zGnQCS?8Dpxm=IB#_UW}>O@|Afe?P(RmY)u;Zzr(IL#tQ6rzoIc46s}2PiNP31~TNt z)D)}~{KMf-a@5o5ya8fipm^(EBOOY>d?&smJ!g?qm5ov6ZJ6AHkU%#3&KRvbL*}nv z$2M@QTd$2UjtklZPu!l2Hr0!Ntx&1>=d1{>fowIrNR^A&v6MY~_K}wu%7G=|LW0Xd zpnl_5QiBX8asA|pz=?e7&RPx667ZB1!ElwI?eP4kyQ|L))+ zu3;CW|8}=9>O(3@bGvtFth0h>$E}9nUeF;h&aR^ECC3%b<4o{1{Uqs7ayvP#%8)8v zFs%o|w_=!jBlVYQ%yC*V{I#93t{QS_+PzC@uuqQl) zV|=6$^HMhU2%fWiJSK!+F5P9xOSk?{&(>9pC=n-7Oyova#IJjWYvYzS@$WMrUQAy! z74k8)eyKe3qws2|y(=~4vpQa4ZUVVC z6^Q}4YMavQf8CS`kzwcWm#G_;*eoDglAQ7W}-M0(tE3-P5(;U{6Mbqtn_v&r6Jam`s_ice4bI8I5euaJTe24_&b1F#mHWuHERo zd(L!L^k+D~_^<1^IkLK*E`#T-*1K`j8v~Z*n%jwoOkFrgFZS|Qx}ORxJbpp|8w_9Oqdx2>3oX= zql@NuT3suHi&W*=CRDza^aWL0dGGkm@iQUnuOg9M9Yy!Oi>yl8R_*e9Tod20O zu$PcH5sVAQchw2cuOAnS0pYW)2O*VKXk6TNX+P55)$nlAbTAXqaX3iI3vAnClnm(J zz~;9k@*P;l=KHbtdvW&jaddQble2&)B*5~_x5))K031g|N(vKg4JdUz%y@LQJGrvO z^ZrhL{<ugg95Q)&>2uV2e> z5=}*jyS#pv($z^^k=PGbL1W=pgbT2j&(Sa%fWFOu?}Jb-9RuptrID53tIiToHkzeX zqj|9yPVyX52bkv_#O*k|Xe7E_8msLtV6e&SF*l z-dn!^&H&k3R@|HTd5WUs3V!D|PwdK%%~^u(*(Hj5^ncw1(C0|By*L!wEo3`ir$%60 z-_TIx1dw2Jz`hEA=*iLGC>jy_{;xRz%1=y0gy1pg3I`28dC)(ZPxj{s1x&>bfCPDL z1U#VQNw2BggKuSPRH#%Dlo*eG)RVYZ=zjPmK}_pKXEXvG!eZtD@%o2l7SGFoh{D`f zNJGI!x0PTNK$XdY!|plAEZh(4lwtKBhnv(%h)GhUwu$?I2^N{CPD}g3mv_%WUqCPy z2(@Qw`y5InqB}}_9yjr@RfQIu01C+M=2L)Tr!@rlD2tN=^A>BL{#^Q5B7Eb36VVq$ zKebOx$yjAN=Lg#E2>+>j{a%L{tW#_J&foE6TyrBj&VS`*gbOf_tTYnN58!9wJr$r! z#U6McpnWEskBzGg=p0~mEcc?}o7KlTCm@wfL$ZAs_=qUmBMnjOJsGM2c0aOcm_f4;S= zL82jzCGj{0zw<}4cxb7}*3_v=rpk>&(8Njs=(LqxmGU>Q-czCKmzG|N{6t&US>`Av zh^~CYQLIF}pH!W}*G>U%pPe9(l1l=1wAc%p=luEQummt}%TA8BgGr!JgY?aA zJ>I*(%6s2fdK=W`@750crqo;zjvB%;gB#o??r6_G$p;zDcPe=)P0{1u*<+J zB4ZKV2f<4LfG45F375s?1RU>wYD}0lEJ#9RjkDwV*@ko`LJnn<+0KfqdMtUl2W$N3 zX&_3fkxg`SI)ben15kV`STaR7P(rqYNr|-e21H#IhJze2e8#bO`ZYHW?_U)7EDq&t z}5CvqF+qcuiq2dgLmCfFI56-BE_00*8k=U zTQ-I^TvR*YtfXW3lp!$X)YWM^OuHcFnyq_M?fS$%eVpVShrZF z3?oDgB@Zxope<2^`EOY33ULJBd5r(H&5&$7K|(Y(YeUnxxOY^vZ7)a&zY}#T-^j%Y zS=*m<0RvVJt=GaKq|4ezd`8P}vG+%CYH3QBgH{J#@cDU8>?{xZ6?{+X^*>tGrYf`Ofw!z}pDhC@ft`N_I+OrF2-f?DHq8+1dLLIQI zX$8Gm_}1Pr*lV8qkPw_KrzK?2c2akumFsYkZJ1vfWP=dtu@=>h?H)p0ktwcdwS0jOm;0=rCUPI?UBbU@UGlX!#;{4C-ln$;CDLE! ze=NEH(7+`bX3!w9PNL)_vH*|Zmz%pIr|!aCT6s!$09$?BB~O+8CG>34jSCSKdfVd!UQ+af+BnM?>ZflW^#yvu_nSWCW1(+clYUKAx+=0-^r#+~+x zRPPo>P7JC9eXxU;udWG~I1gYOmIJ4%^*+Yy$un<`90bYdeC6ja+|H`Yu$X-itURas zPZVV)iW_%QY$0k;mw!G8=yn&IMBRjQYnyPgOoutJo8jSo-laf73LKOke>eVY4x$Iiq&lrhq6a z<+Zt@PQGr}$cJWKj|9u9~P3?IR>G%6y6Z|?|@byNctNwQUK=v@Iir=15yuXJN+ zjnyl<6kd9;l>x|k*-A!c|GUc$+u{%@HQSP>T9>pJU$o?K1->8c6)9HWKu$dT+Q(e} z!YW;}s36>&n{v=9UcNUOa8zP4<@H^&5<32riGGI(%0$}Gt#s(N=&!&PsZHD(a9LVK z)91AcJd*ci50bcf_t!#Jht{Ew+uqVSatIMA5UXwN>`Zk^fpH_?t~- z4}(64p<<0~Kpo{fAjG9>52Y)!qItS|0BIp50`)@|Q^En7LgdH2tW~gOG&VIY8-fGt zHKAo=985RB91Oy~>J@qZmemEQ(}X$Ldm62sx6HnDFPWEqTdwV{1~ zx9lV9Uw=8~^Lc+>ujlLa#_hIZWlxtkIxew?Rggx+02%FrH`BG~bD3U=M9iOm?s!`t zT8>hGY56F=++#xkM4mJFb+pOHUv|W^|G&Yft?-hcIF@g9UAotd$r2v$E2}Zalz;gJ5c>8_Z z8pI5~Z?S-IAmW`!aK9QOWKq1R#~ab2aF=M^kbh>xmr=<(UjZwE5mESd2@9zyLCYcw zZ+*SxDSD5Q8-A)>^Exl=S>8M>I<#i0UJpqTh(%8#C#<4BdSIufHif`P z2Ciwa9QbG#Jz;*Uel?IqF*xgVxa>)}I!DVFIil&AnMa;IKthdlqZ2P4yYR8&P9 z67B=j(WR`Flz@nCPa!Emiknyc^ZAYQOG>7vua~WTaJubYl7SQiK#uALvj>#Ki!cI7 zVD*HfWUSjLy8OW{&{n!fWxs7eUgh>FyI`4|Do1G_r9A_F57gKEZ?tNDb3~E7b~K|I zUZ16!7ZJS=pCzh$cU$bIHORmz3ec8?Rd*WfvslSm-Fg*6X<<3~@Gm5BsAl;D4uM=( zI4rbHt1LX1r{1l4Le^{)_;HD4jBMW(!ym=c+dA5NppyXy(_1&6d-(B|LF8_Vd=pxy zveI-5+b;dCKAVk-r59t~N{o9QxTwff;Bz9RH-PJNhkif&4@JPNN|`Na(YxDeLOCcs zw9j!@*IN&*tpzla(gT_7Bx!ZQakI@&;GGEbuK$gmk>?r-d6FLR6mBa<0%dhCX5I>; zd89l)hOGsP`@_GcG#BfCGY&4Sel&W@e&4zqCvsL+8biXMDlA z^%g=%{n#+|W6cTrVSRolSRsvMC1>t_#w-a_ma$8EM7{4~m?goOBeeO!(ONAl(MWa< zVf!bC-)g(|+YzdN z;_ODMt_NKVZIAD{tXaWt#Av5VwfwaIpXo_h-UI{U@pGc`t$5f><_8q^{gOA$c6slG_943;+XXH- zN=JGJDm9m}O5apm7TkQ2?nbK{gwX_dd}nFu+=S-%E9>wS3Ubaht4(ga!5M!bi9D8+ z=y8m`Hn%R{@!_?#>e`a(-29P%BSoGCu|mshqkSUusjkG?a<{%$C?)90?3QNsL2nze zcDncZu#@)0hWeR7E3q!Rw#bZ@>=SzIIND%$KYSL`6#P)H^BsG~kK+a#b3_n74u_jO z+p!{qaL8GasNz-2{jZsKcl`6`N%$;ga%qLvil1i&Q_7swdg}HnHO!8D`i#-yi$<37 ze5BOcp<6u*&7t(xGs}6lCXF!*psRIMKSUclaJLmE^M#)ayw<6vjsscjeL27q$)gbOV`7}v~A1+q?W-}cijpUiS(&J=1}dXc?ED{ z8x*!LQvBbigc&Lqzco>=B?0>ohA4+;*bz^t72Op%>(R^Q0f!1%edXnmqxRr!j6!{U!UjMM{n@lPZJAc{?b55 z*q4I3zzjpxj53ncgZtjOs1qzcmmo?I4Zz;sh4XR~y(Pam&PS-7aPm&8+oT00aIfaz zgUpO}25w+l7!@zY1n&&474YfZVM4fu@`PvJTL^B8qy!_~%rT={ZdFA6Nm6L9;V!T_ zZ%Z9?x=$KDlw0Adjo9Aq!A*w{K6DLsWUF*{cZ(`0%!o|=kfV-8@L^=3a~-p3`IRQv zk&di1gU3xsF1%9~f_AGPiazJKpKP!}IMJD{-lw4F@i}-KNM*5N^@oXS3)n~cIJRG4 zrV`gNCNOZ8c!-A5))QnIBWt z*6zzz=T3YB>Vsc%!WP+Fb12(x0OcmkAWDFh-2Vzq(ImfBjB`sL zHtd<*`UQT*y}%0^dPvVe$#U@`P|ib5{EID%5g;)YRHvQ|pkKjwnC{*^s;@R7At^c0 zP#dv(llBj@hW3_Dn*_xK@~5bVT^qAxf(ft4cIy#lD|L}a?*!OXvXY}PNqvNOs0%Ua z4njOj9R+pq5RMH~VT_D>gu{mTf~J$C|(I6{tIa2fwN6ec`J z`_>RTymMY2J3Rd$WTPr~bdJp4-Aol}{jCZ86 zu^FoKn+qy-Jy0=sqxe4blMnRM5vm?gXHD7%VS95@^tc2vmb-W)NnyCnapG34b4U;M zugTE)p#q1+kqYyDyeQ=dym|o$-TJ8laOqu8E`U_i3s7mkXdf(zb`8x#ish5D)zf(d z0KiYmqBS2u>@sMRX7+e{7sJLj2jG<>ncxrlgRBT6q9!zp+5yJ}?;b{Qn--pON$3bVxu0#&@NipR(D;tbreYw~8d&>~Nf71{g z9Tf0FSHyeIaxGR2ht}d4=G^ka_K|nuf)Fr9FBeH diff --git a/docs/mitre-map/detections.csv b/docs/mitre-map/detections.csv index 4701026bf5..a1fe43a7f6 100644 --- a/docs/mitre-map/detections.csv +++ b/docs/mitre-map/detections.csv @@ -1,390 +1,105809 @@ Technique ID,Detection Available,Link,score -T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 -T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 -T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,47 -T1086,No,-,44 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 T1105,No,-,40 T1060,No,-,38 -T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1070.004,No,-,30 T1107,No,-,30 T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 -T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 T1059.005,No,-,26 T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 -T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 T1192,No,-,24 T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 -T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 -T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 T1005,No,-,22 -T1016,No,-,22 T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 T1076,No,-,20 -T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 -T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 T1056.001,No,-,20 -T1018,No,-,19 T1140,No,-,19 +T1018,No,-,19 T1204.001,No,-,19 T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 T1033,No,-,18 T1189,No,-,17 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 T1560.001,No,-,16 -T1043,No,-,16 T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 T1555.003,No,-,15 T1503,No,-,15 T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 T1049,No,-,14 -T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 -T1553.002,No,-,14 -T1074.001,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 T1087.001,No,-,14 T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1027.002,No,-,12 T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 T1045,No,-,12 T1027.002,No,-,12 +T1113,No,-,12 T1041,No,-,12 -T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 -T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 -T1063,No,-,11 -T1073,No,-,11 -T1133,No,-,11 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 T1574.002,No,-,11 -T1518.001,No,-,11 -T1059,No,-,11 T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1100,No,-,10 T1505.003,No,-,10 T1087.002,No,-,10 +T1555,No,-,10 T1136.002,No,-,10 -T1055,No,-,10 T1100,No,-,10 -T1559.002,No,-,9 -T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1119,No,-,9 T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 -T1564.003,No,-,9 -T1560,No,-,9 -T1143,No,-,9 -T1173,No,-,9 -T1090.002,No,-,9 -T1003,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 T1218.010,No,-,8 -T1035,No,-,8 -T1219,No,-,8 -T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 -T1132.001,No,-,8 -T1102.002,No,-,8 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 -T1135,No,-,8 -T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 -T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 -T1117,No,-,8 T1548.002,No,-,8 T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 T1027.005,No,-,7 T1106,No,-,7 -T1066,No,-,7 -T1007,No,-,7 -T1059.007,No,-,7 -T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 -T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 -T1573.001,No,-,7 -T1023,No,-,7 -T1552.001,No,-,7 -T1555,No,-,7 -T1547.009,No,-,7 -T1221,No,-,7 -T1069.002,No,-,7 -T1021.004,No,-,7 T1012,No,-,7 -T1009,No,-,6 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1037,No,-,6 T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 -T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 -T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 T1027.001,No,-,6 -T1074.002,No,-,5 -T1218.005,No,-,5 -T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 -T1059.006,No,-,5 -T1223,No,-,5 -T1573.002,No,-,5 -T1099,No,-,5 -T1055.001,No,-,5 -T1120,No,-,5 -T1218.001,No,-,5 -T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 -T1564.001,No,-,5 -T1546.003,No,-,5 -T1027.003,No,-,5 -T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 -T1001.002,No,-,5 -T1040,No,-,5 -T1070.006,No,-,5 -T1084,No,-,5 -T1015,No,-,5 -T1194,No,-,5 -T1075,No,-,5 -T1110,No,-,5 -T1090,No,-,5 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,0 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,0 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,0 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,0 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,0 T1158,No,-,5 -T1170,No,-,5 -T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 T1102.001,No,-,5 -T1102,No,-,4 -T1003.005,No,-,4 -T1124,No,-,4 -T1570,No,-,4 -T1014,No,-,4 -T1025,No,-,4 -T1487,No,-,4 -T1496,No,-,4 -T1574.001,No,-,4 -T1036.002,No,-,4 -T1036.003,No,-,4 -T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 -T1093,No,-,4 -T1094,No,-,4 -T1055.012,No,-,4 -T1561.002,No,-,4 -T1038,No,-,4 -T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 T1560.003,No,-,4 -T1110.002,No,-,3 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1213,No,-,3 T1020,No,-,3 -T1053.002,No,-,3 -T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 -T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 -T1027.004,No,-,3 -T1090.003,No,-,3 -T1542.003,No,-,3 -T1008,No,-,3 -T1529,No,-,3 -T1069.001,No,-,3 -T1097,No,-,3 -T1197,No,-,3 -T1104,No,-,3 -T1110.003,No,-,3 -T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 -T1188,No,-,3 -T1039,No,-,3 -T1550.003,No,-,3 T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 T1486,No,-,3 T1500,No,-,3 -T1071.003,No,-,3 -T1518,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 -T1071,No,-,3 -T1067,No,-,3 T1091,No,-,3 -T1098,No,-,3 -T1176,No,-,2 -T1187,No,-,2 -T1032,No,-,2 -T1137,No,-,2 -T1564.005,No,-,2 -T1210,No,-,2 -T1559.001,No,-,2 -T1080,No,-,2 -T1560.002,No,-,2 -T1115,No,-,2 -T1218.007,No,-,2 -T1542.002,No,-,2 -T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 -T1547.004,No,-,2 -T1199,No,-,2 -T1087.003,No,-,2 -T1090.001,No,-,2 -T1218.003,No,-,2 -T1037.001,No,-,2 -T1222.002,No,-,2 -T1567.002,No,-,2 -T1134.002,No,-,2 -T1191,No,-,2 -T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 -T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 -T1213.002,No,-,2 -T1492,No,-,2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 T1201,No,-,2 -T1125,No,-,2 -T1565.001,No,-,2 -T1004,No,-,2 -T1055.002,No,-,2 -T1109,No,-,2 -T1195.002,No,-,2 -T1069,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 T1480.001,No,-,2 -T1501,No,-,1 -T1070.002,No,-,1 -T1558.001,No,-,1 -T1195,No,-,1 -T1042,No,-,1 -T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 -T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 -T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 -T1183,No,-,1 -T1493,No,-,1 -T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 -T1561.001,No,-,1 -T1562.002,No,-,1 -T1186,No,-,1 -T1134,No,-,1 -T1126,No,-,1 -T1074,No,-,1 -T1001,No,-,1 -T1172,No,-,1 -T1504,No,-,1 -T1213,No,-,1 -T1216.001,No,-,1 -T1052.001,No,-,1 -T1211,No,-,1 -T1137.002,No,-,1 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 T1568.001,No,-,1 -T1123,No,-,1 -T1137.001,No,-,1 -T1528,No,-,1 -T1056.004,No,-,1 T1146,No,-,1 -T1546.012,No,-,1 -T1056.002,No,-,1 -T1573,No,-,1 -T1543.002,No,-,1 -T1053.003,No,-,1 -T1534,No,-,1 -T1483,No,-,1 -T1546.009,No,-,1 -T1574.012,No,-,1 -T1552.004,No,-,1 -T1546.015,No,-,1 -T1001.003,No,-,1 -T1218.008,No,-,1 -T1090.004,No,-,1 -T1182,No,-,1 -T1574.006,No,-,1 -T1174,No,-,1 -T1546.013,No,-,1 -T1564.004,No,-,1 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 -T1001.001,No,-,1 -T1030,No,-,1 -T1568.003,No,-,1 -T1122,No,-,1 -T1565.003,No,-,1 -T1220,No,-,1 -T1489,No,-,1 -T1550.001,No,-,1 -T1556.002,No,-,1 -T1010,No,-,1 -T1102.003,No,-,1 -T1482,No,-,1 -T1497.002,No,-,1 -T1200,No,-,1 -T1527,No,-,1 -T1494,No,-,1 -T1070.003,No,-,1 -T1096,No,-,1 -T1214,No,-,1 -T1021.006,No,-,1 -T1488,No,-,1 -T1055.013,No,-,1 -T1134.001,No,-,1 -T1021.005,No,-,1 -T1138,No,-,1 -T1026,No,-,1 -T1070.005,No,-,1 -T1037,No,-,1 -T1565.002,No,-,1 -T1568.002,No,-,1 -T1098.002,No,-,1 -T1137.004,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 T1036.001,No,-,1 -T1092,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 T1497.001,No,-,1 T1552.002,No,-,1 -T1491.001,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 T1137.006,No,-,1 -T1127.001,No,-,1 -T1145,No,-,1 -T1552.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 diff --git a/docs/mitre-map/detections.json b/docs/mitre-map/detections.json index 1613403cdc..21b4bfad81 100644 --- a/docs/mitre-map/detections.json +++ b/docs/mitre-map/detections.json @@ -5,1309 +5,440644 @@ "domain": "mitre-enterprise", "techniques": [ { - "techniqueID": "T1566.001", - "score": 49, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml" + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" }, { "techniqueID": "T1193", - "score": 51 + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" }, { "techniqueID": "T1204.002", "score": 49, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" }, { - "techniqueID": "T1027", - "score": 47, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" }, { - "techniqueID": "T1086", - "score": 44 + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" }, { "techniqueID": "T1059.001", "score": 36, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true }, { "techniqueID": "T1059.003", "score": 34, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" }, { "techniqueID": "T1105", - "score": 40 + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true }, { "techniqueID": "T1060", - "score": 38 + "score": 38, + "showSubtechniques": true }, { "techniqueID": "T1547.001", "score": 35, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, { "techniqueID": "T1071.001", "score": 32, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { - "techniqueID": "T1107", - "score": 30 + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1070.004", - "score": 30 + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", "score": 24, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" }, { "techniqueID": "T1003.001", "score": 20, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" }, { "techniqueID": "T1059.005", - "score": 26 + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true }, { "techniqueID": "T1082", "score": 23, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" }, { - "techniqueID": "T1078", + "techniqueID": "T1082", "score": 23, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" }, { "techniqueID": "T1192", - "score": 24 + "score": 24, + "showSubtechniques": true }, { "techniqueID": "T1566.002", "score": 23, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, { "techniqueID": "T1203", "score": 21, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" }, { "techniqueID": "T1083", - "score": 23 + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" }, { "techniqueID": "T1005", - "score": 22 - }, - { - "techniqueID": "T1016", - "score": 22 + "score": 22, + "showSubtechniques": true }, { "techniqueID": "T1057", - "score": 22 + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true }, { "techniqueID": "T1076", - "score": 20 + "score": 20, + "showSubtechniques": true }, { "techniqueID": "T1021.001", "score": 16, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" }, { "techniqueID": "T1056.001", - "score": 20 + "score": 20, + "showSubtechniques": true }, { - "techniqueID": "T1018", - "score": 19 + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true }, { "techniqueID": "T1140", - "score": 19 + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true }, { "techniqueID": "T1204.001", - "score": 19 + "score": 19, + "showSubtechniques": true }, { "techniqueID": "T1036.005", - "score": 19 + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true }, { "techniqueID": "T1033", - "score": 18 + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true }, { "techniqueID": "T1189", - "score": 17 + "score": 17, + "showSubtechniques": true }, { "techniqueID": "T1047", "score": 11, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true }, { "techniqueID": "T1560.001", - "score": 16 - }, - { - "techniqueID": "T1043", - "score": 16 + "score": 16, + "showSubtechniques": true }, { "techniqueID": "T1543.003", "score": 15, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1555.003", - "score": 15 + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true }, { - "techniqueID": "T1503", - "score": 15 + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true }, { "techniqueID": "T1112", "score": 13, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, { "techniqueID": "T1049", - "score": 14 + "score": 14, + "showSubtechniques": true }, { "techniqueID": "T1136.001", "score": 11, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml" - }, - { - "techniqueID": "T1553.002", - "score": 14 - }, - { - "techniqueID": "T1074.001", - "score": 14 + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" }, { "techniqueID": "T1087.001", - "score": 14 + "score": 14, + "showSubtechniques": true }, { "techniqueID": "T1116", - "score": 14 + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true }, { "techniqueID": "T1046", - "score": 13 + "score": 13, + "showSubtechniques": true }, { - "techniqueID": "T1113", - "score": 12 + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true }, { - "techniqueID": "T1045", - "score": 12 + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true }, { "techniqueID": "T1027.002", - "score": 12 + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true }, { "techniqueID": "T1041", - "score": 12 + "score": 12, + "showSubtechniques": true }, { - "techniqueID": "T1218.011", - "score": 10, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true }, { "techniqueID": "T1021.002", "score": 9, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml" - }, - { - "techniqueID": "T1063", - "score": 11 - }, - { - "techniqueID": "T1073", - "score": 11 - }, - { - "techniqueID": "T1133", - "score": 11 + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" }, { "techniqueID": "T1574.002", - "score": 11 - }, - { - "techniqueID": "T1518.001", - "score": 11 - }, - { - "techniqueID": "T1059", - "score": 11 + "score": 11, + "showSubtechniques": true }, { "techniqueID": "T1085", - "score": 11 + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true }, { "techniqueID": "T1571", - "score": 11 + "score": 11, + "showSubtechniques": true }, { - "techniqueID": "T1505.003", - "score": 10 + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" }, { - "techniqueID": "T1087.002", - "score": 10 + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" }, { - "techniqueID": "T1136.002", - "score": 10 + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true }, { - "techniqueID": "T1055", - "score": 10 + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" }, { "techniqueID": "T1100", - "score": 10 + "score": 10, + "showSubtechniques": true }, { - "techniqueID": "T1559.002", - "score": 9 + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true }, { "techniqueID": "T1068", "score": 7, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml" - }, - { - "techniqueID": "T1564.003", - "score": 9 - }, - { - "techniqueID": "T1560", - "score": 9 - }, - { - "techniqueID": "T1143", - "score": 9 - }, - { - "techniqueID": "T1173", - "score": 9 - }, - { - "techniqueID": "T1090.002", - "score": 9 - }, - { - "techniqueID": "T1003", - "score": 9 + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" }, { "techniqueID": "T1562.001", "score": 7, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, { "techniqueID": "T1119", - "score": 9 + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true }, { "techniqueID": "T1218.010", - "score": 8 + "score": 8, + "showSubtechniques": true }, { - "techniqueID": "T1035", - "score": 8 + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true }, { "techniqueID": "T1219", - "score": 8 - }, - { - "techniqueID": "T1569.002", - "score": 7, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8 - }, - { - "techniqueID": "T1102.002", - "score": 8 - }, - { - "techniqueID": "T1071.004", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" - }, - { - "techniqueID": "T1135", - "score": 8 + "score": 8, + "showSubtechniques": true }, { "techniqueID": "T1190", "score": 6, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, { "techniqueID": "T1117", - "score": 8 + "score": 8, + "showSubtechniques": true }, { - "techniqueID": "T1548.002", - "score": 8 - }, - { - "techniqueID": "T1065", - "score": 8 + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true }, { "techniqueID": "T1003.004", - "score": 8 + "score": 8, + "showSubtechniques": true }, { - "techniqueID": "T1027.005", - "score": 7 + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true }, { - "techniqueID": "T1106", - "score": 7 + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true }, { - "techniqueID": "T1066", - "score": 7 + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true }, { - "techniqueID": "T1007", - "score": 7 + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true }, { - "techniqueID": "T1059.007", - "score": 7 + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true }, { "techniqueID": "T1070.001", "score": 5, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" }, { - "techniqueID": "T1573.001", - "score": 7 + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true }, { - "techniqueID": "T1023", - "score": 7 + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true }, { - "techniqueID": "T1552.001", - "score": 7 - }, - { - "techniqueID": "T1555", - "score": 7 - }, - { - "techniqueID": "T1547.009", - "score": 7 - }, - { - "techniqueID": "T1221", - "score": 7 - }, - { - "techniqueID": "T1069.002", - "score": 7 - }, - { - "techniqueID": "T1021.004", - "score": 7 + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true }, { "techniqueID": "T1012", - "score": 7 + "score": 7, + "showSubtechniques": true }, { - "techniqueID": "T1009", - "score": 6 + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true }, { "techniqueID": "T1114.002", "score": 4, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" }, { "techniqueID": "T1048.003", "score": 4, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true }, { "techniqueID": "T1003.002", "score": 5, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, { "techniqueID": "T1036.004", - "score": 6 + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" }, { "techniqueID": "T1027.001", - "score": 6 + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1074.002", - "score": 5 + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1218.005", - "score": 5 - }, - { - "techniqueID": "T1566.003", + "techniqueID": "T1114.002", "score": 4, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" }, { - "techniqueID": "T1059.006", - "score": 5 - }, - { - "techniqueID": "T1223", - "score": 5 - }, - { - "techniqueID": "T1573.002", - "score": 5 - }, - { - "techniqueID": "T1099", - "score": 5 - }, - { - "techniqueID": "T1055.001", - "score": 5 - }, - { - "techniqueID": "T1120", - "score": 5 - }, - { - "techniqueID": "T1218.001", - "score": 5 - }, - { - "techniqueID": "T1550.002", + "techniqueID": "T1048.003", "score": 4, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" }, { - "techniqueID": "T1564.001", - "score": 5 + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1546.003", - "score": 5 + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1027.003", - "score": 5 + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1546.008", + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", "score": 4, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" }, { - "techniqueID": "T1001.002", - "score": 5 + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" }, { - "techniqueID": "T1040", - "score": 5 + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1070.006", - "score": 5 + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1084", - "score": 5 + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1015", - "score": 5 + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" }, { - "techniqueID": "T1194", - "score": 5 + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1075", - "score": 5 + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1110", - "score": 5 + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" }, { - "techniqueID": "T1090", - "score": 5 + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" }, { - "techniqueID": "T1036", - "score": 0, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true }, { "techniqueID": "T1158", - "score": 5 + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1170", - "score": 5 + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true }, { "techniqueID": "T1562.004", "score": 4, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, { "techniqueID": "T1102.001", - "score": 5 + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1102", - "score": 4 + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1003.005", - "score": 4 + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1124", - "score": 4 + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1570", - "score": 4 + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1014", - "score": 4 + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" }, { - "techniqueID": "T1025", - "score": 4 + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1487", - "score": 4 + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1496", - "score": 4 + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1574.001", - "score": 4 + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1036.002", - "score": 4 + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1036.003", - "score": 4 + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" }, { - "techniqueID": "T1071.002", - "score": 3, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1093", - "score": 4 + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1094", - "score": 4 + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1055.012", - "score": 4 + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" }, { - "techniqueID": "T1561.002", - "score": 4 + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1038", - "score": 4 + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" }, { "techniqueID": "T1078.003", "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true }, { "techniqueID": "T1560.003", - "score": 4 + "score": 4, + "showSubtechniques": true }, { - "techniqueID": "T1110.002", - "score": 3 + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true }, { "techniqueID": "T1020", - "score": 3 + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true }, { "techniqueID": "T1053.002", - "score": 3 + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1485", - "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true }, { "techniqueID": "T1072", "score": 2, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" }, - { - "techniqueID": "T1027.004", - "score": 3 - }, - { - "techniqueID": "T1090.003", - "score": 3 - }, { "techniqueID": "T1542.003", - "score": 3 - }, - { - "techniqueID": "T1008", - "score": 3 - }, - { - "techniqueID": "T1529", - "score": 3 + "score": 3, + "showSubtechniques": true }, { "techniqueID": "T1069.001", - "score": 3 + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1097", - "score": 3 + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1197", - "score": 3 - }, - { - "techniqueID": "T1104", - "score": 3 - }, - { - "techniqueID": "T1110.003", - "score": 3 + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true }, { "techniqueID": "T1095", "score": 2, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" }, { - "techniqueID": "T1188", - "score": 3 + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1039", - "score": 3 - }, - { - "techniqueID": "T1550.003", - "score": 3 - }, - { - "techniqueID": "T1572", - "score": 3 - }, - { - "techniqueID": "T1486", - "score": 3 - }, - { - "techniqueID": "T1500", - "score": 3 - }, - { - "techniqueID": "T1071.003", - "score": 3 - }, - { - "techniqueID": "T1518", - "score": 3 + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true }, { "techniqueID": "T1078.002", "score": 2, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" }, { - "techniqueID": "T1071", - "score": 3 + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true }, { "techniqueID": "T1067", - "score": 3 + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" }, { "techniqueID": "T1091", - "score": 3 + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1098", - "score": 3 + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1176", - "score": 2 + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1187", - "score": 2 + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1032", - "score": 2 + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1137", - "score": 2 + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" }, { - "techniqueID": "T1564.005", - "score": 2 + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1210", - "score": 2 + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1559.001", - "score": 2 + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1080", - "score": 2 + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1560.002", - "score": 2 + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1115", - "score": 2 + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1218.007", - "score": 2 + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1542.002", - "score": 2 + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1547.004", - "score": 2 + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1199", - "score": 2 + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1087.003", - "score": 2 + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1090.001", - "score": 2 + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1218.003", - "score": 2 + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1037.001", - "score": 2 + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" }, { - "techniqueID": "T1222.002", - "score": 2 + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1567.002", - "score": 2 + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1134.002", - "score": 2 + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1191", - "score": 2 + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true }, { "techniqueID": "T1003.003", "score": -2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml" - }, - { - "techniqueID": "T1213.002", - "score": 2 - }, - { - "techniqueID": "T1492", - "score": 2 + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" }, { "techniqueID": "T1201", - "score": 2 + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1125", - "score": 2 + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1565.001", - "score": 2 + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1004", - "score": 2 + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1055.002", - "score": 2 + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1109", - "score": 2 + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1195.002", - "score": 2 - }, - { - "techniqueID": "T1069", - "score": 2 + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true }, { "techniqueID": "T1059.004", - "score": 2 + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true }, { "techniqueID": "T1480.001", - "score": 2 + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1501", - "score": 1 + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1070.002", - "score": 1 + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1558.001", - "score": 1 + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1195", - "score": 1 + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" }, { - "techniqueID": "T1042", - "score": 1 + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1546.011", "score": -2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1183", - "score": 1 + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1493", - "score": 1 + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1546.001", "score": 0, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" }, { - "techniqueID": "T1561.001", - "score": 1 + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1562.002", - "score": 1 + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1186", - "score": 1 - }, - { - "techniqueID": "T1134", - "score": 1 - }, - { - "techniqueID": "T1126", - "score": 1 - }, - { - "techniqueID": "T1074", - "score": 1 - }, - { - "techniqueID": "T1001", - "score": 1 - }, - { - "techniqueID": "T1172", - "score": 1 - }, - { - "techniqueID": "T1504", - "score": 1 - }, - { - "techniqueID": "T1213", - "score": 1 - }, - { - "techniqueID": "T1216.001", - "score": 1 - }, - { - "techniqueID": "T1052.001", - "score": 1 - }, - { - "techniqueID": "T1211", - "score": 1 - }, - { - "techniqueID": "T1137.002", - "score": 1 - }, - { - "techniqueID": "T1568.001", - "score": 1 - }, - { - "techniqueID": "T1123", - "score": 1 - }, - { - "techniqueID": "T1137.001", - "score": 1 - }, - { - "techniqueID": "T1528", - "score": 1 - }, - { - "techniqueID": "T1056.004", - "score": 1 - }, - { - "techniqueID": "T1146", - "score": 1 - }, - { - "techniqueID": "T1546.012", - "score": 1 - }, - { - "techniqueID": "T1056.002", - "score": 1 - }, - { - "techniqueID": "T1573", - "score": 1 - }, - { - "techniqueID": "T1543.002", - "score": 1 - }, - { - "techniqueID": "T1053.003", - "score": 1 - }, - { - "techniqueID": "T1534", - "score": 1 - }, - { - "techniqueID": "T1483", - "score": 1 - }, - { - "techniqueID": "T1546.009", - "score": 1 + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1574.012", - "score": 1 - }, - { - "techniqueID": "T1552.004", - "score": 1 - }, - { - "techniqueID": "T1546.015", - "score": 1 - }, - { - "techniqueID": "T1001.003", - "score": 1 - }, - { - "techniqueID": "T1218.008", - "score": 1 - }, - { - "techniqueID": "T1090.004", - "score": 1 - }, - { - "techniqueID": "T1182", - "score": 1 - }, - { - "techniqueID": "T1574.006", - "score": 1 - }, - { - "techniqueID": "T1174", - "score": 1 - }, - { - "techniqueID": "T1546.013", - "score": 1 + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1564.004", - "score": 1 + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1078.004", "score": -12, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" }, { - "techniqueID": "T1001.001", - "score": 1 + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1030", - "score": 1 + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1568.003", - "score": 1 + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1122", - "score": 1 - }, - { - "techniqueID": "T1565.003", - "score": 1 - }, - { - "techniqueID": "T1220", - "score": 1 - }, - { - "techniqueID": "T1489", - "score": 1 - }, - { - "techniqueID": "T1550.001", - "score": 1 - }, - { - "techniqueID": "T1556.002", - "score": 1 - }, - { - "techniqueID": "T1010", - "score": 1 - }, - { - "techniqueID": "T1102.003", - "score": 1 - }, - { - "techniqueID": "T1482", - "score": 1 - }, - { - "techniqueID": "T1497.002", - "score": 1 - }, - { - "techniqueID": "T1200", - "score": 1 - }, - { - "techniqueID": "T1527", - "score": 1 - }, - { - "techniqueID": "T1494", - "score": 1 - }, - { - "techniqueID": "T1070.003", - "score": 1 - }, - { - "techniqueID": "T1096", - "score": 1 - }, - { - "techniqueID": "T1214", - "score": 1 - }, - { - "techniqueID": "T1021.006", - "score": 1 - }, - { - "techniqueID": "T1488", - "score": 1 - }, - { - "techniqueID": "T1055.013", - "score": 1 - }, - { - "techniqueID": "T1134.001", - "score": 1 - }, - { - "techniqueID": "T1021.005", - "score": 1 - }, - { - "techniqueID": "T1138", - "score": 1 - }, - { - "techniqueID": "T1026", - "score": 1 - }, - { - "techniqueID": "T1070.005", - "score": 1 - }, - { - "techniqueID": "T1037", - "score": 1 - }, - { - "techniqueID": "T1565.002", - "score": 1 - }, - { - "techniqueID": "T1568.002", - "score": 1 - }, - { - "techniqueID": "T1098.002", - "score": 1 - }, - { - "techniqueID": "T1137.004", - "score": 1 + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" }, { "techniqueID": "T1036.001", - "score": 1 + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1092", - "score": 1 + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1497.001", - "score": 1 + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1552.002", - "score": 1 + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1491.001", - "score": 1 + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1137.006", - "score": 1 - }, - { - "techniqueID": "T1127.001", - "score": 1 - }, - { - "techniqueID": "T1145", - "score": 1 + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1552.006", - "score": 1 + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1028", - "score": 1 + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" } ], "gradient": { diff --git a/docs/mitre-map/priority.png b/docs/mitre-map/priority.png index 48c40a38d4ddab610fd87661bcd267ae1b5c86f1..6622f39206c7802870482a328725fd09d16ead94 100644 GIT binary patch literal 821644 zcmeFZbyQUU8ZS&q2~tYq(A_ODph&0E(hbtxjRL}eG)M~4jdUa3NOyO4$K7N6&Ux3n z?tR~T{=0V_*U}khX4iK=-{<+n^WDJ;a^mQygs3nuFzAvJuiwJJpw7a;JSsv)1U}iL zd1?v+gC=GsBBCHEB0{QQXKid|VFUvs5gen6q^8)7o1*bn($p7O0;M6CTp|wpRR}4m zatT(X@T*`pvY<(Ivv5nfEiJ%lwDXw>WpgFxUEt`8of zoq5ujqVt)hic&Wo@;6Ze?7%P*jBQ(RFNE-x?_d_&J#rZ_VA6R;HRSuF=#N~2&<$B% z24zYm<#x17B^7l%qfZRrebUAcOFH5rpiT`lEvqotvtjb;`JM)5ofLvT3JjlN5d0;1 z3d}NcP~hsioQl3F67g`;O7|_2$u$g3c-#x0v5K4kV)9sNdzX>>L8n{m?*2EYohAPM z)RCfXbmkvD>tY07ybU(Pbe0^>Fd!Wdy!2N~D+|QW{PYwn_`UmRG|NVF3M_S75uCOJ zWm^_zprl=T2IuuDnk_z_e)X#%INRquFIVamXfYrYHY&Z;o$aS9Xas?UM}-^RO13fQ zG|#4jEzlpBB0kRyK2$11e=Zmx$XE}FN+%ot7*97C7Opg-%l&~|&Y=k+gO%O4fT*wY zl~O>hKU}u&^M`h`U89=gd$-aLA?9Qg=TlaAfGlykCh zzf7h{Nogl~mOp^R0`tZP{uRt)+C>SZsF%2yRZd(^Ei`8`_=~UvT?nrh(|?}2Q|22} z9ui`pw&-A@_ zPsayZ{{kOqw{Jp1^gf-FP*jLTI(s1!UkZ&(46`*TtQzIH&&|@CLqdc=qJ7BCsmV=$ z%3<`7n9J*GIa8Y16iVjEI|Yo#p@@5|ui~@TPY=vH_DJ)Qo`>Fucy&QIY;hL-!hIqp zT}VUsU@M4a*L$|TSMSBq7aX+=#BDRvqF+XnergR*nUDfKS7lUgv6%1@jz`t5Ms>>e7T;~?)( zog-~ZPH*?$ZA@=ns|&`_Fe-R~U`@&#zQ`oe^%#^c#p!e{OI?Ztmdt9-X~HVphvf(< zTF2)tAO*PICl+mjVeaWXJv{>(x6&8gYad>~j22n*-SEL|io@{orxt%+%Xh3keg&hH z2ERaSp!=l27rvkq-33kv6X8`0Ehap+Flsz<9i!ilI%1X|fi5#GtdTB(8ajOoVhMo- zQeCt55b_h>l|{~K7-s*SMP^MwlEp`xhzG(fex#HEVXT-2ZE&TcNmx8>L@2_qB4{a} zNWL8YEc4or_A^13z&A8?UnTOy&+k@wR!QxMUj&wuRYe3!&>Rz91?bbFa|!n=@H^md zL&|5CU+LSAY6%5lBF3#B7d|ZwMACKG7#>j@(N3^2LrbZv@ z+g+lrMyC=srhBHwaVw)P)0DOSrq2)GdJq32KOuFFD$BhuWHpXR#W&LHo zWvgX2eWD|_(!kf`1W`$n_uufb!=uIN$qK3VC`qWa$Q(a|KUZ|&8uHlTzldQZ!;9$c z=I;{kQtcY-YIv&kiK#sfTLeoX>rL$2N`)_UakM1S+Ii2%Qnuw~(~RG2yk*Ea8&w>2 zALV)X?w!gz@H>O@ws-dB^yTNK$zyIgXAxQQ_UX2!D`u$E*wft8Y}1z0M109s;uz`K z!zY{4n-!-xr%0z5(`b8Nr!_5o&n@=o_Yn6Ordb?m`6~G=l7sm^@U8LPI52NHY`t~Z zb9hlJFsELtT#Mvry?wsPcKUIreRFM_X?*6Zv)n-qSaLy5NJ%G6r=UswA>iHsv7^M; z2H&GYpaZvqPAm}iXY;&|`DY^q=2G*tJDAtp4(L!Jzm$uV~WZ-(2p{ZM_JjwTSj2yExdrzR3TQX}n^?u6S$U4SU*|1_} zyOC>bdWNsnEygj#u?q5`-!zec+mYMZg06DDl6;1%(!^q6W@?6NhN;B7+}+CBaIk`< zy!d<5hOjfTL;SMBicNpS=H_1fUiH9H8P4|V5~W?9UF~WppF3Yj^2CcObTYIf0&;@4 z9IIK6`#=D)B7@KNwhUF zu*u2ZZlzASM$10CF0f|M$=c4F>xXNAP1`kAl>q+p3_)C%au<)I)8lB@ad#)TDVI!F zW%s#L?!&M%?Oo6Dz(t&0j+u?mgW@{!3jzxbjovpkmqs^xhwk8EuWvT1u@T{Sg||S? zxSfGlgEfOCf}e(Gf_L@h@(uSZ@JD#5;h$1UGNrzoyc^e2)Kazx-*WJxF)1O*fJ{xo zMZ!$NJjcsa-_&T+pEbXvucWqQ-zNNUYpIhQ87l&-m%_@fzuLo!smeWiA}1k3PHdQb zg@SF<`^B|(xn((JEgNE+je$zXYfedlEN&AxmS2 zZo@TOV_S0`PrT6|K9EY3NDa}Q;uT?ndk+WIB8~(`gzSxsvuPESn76U*+hUeg)v?rx z%H~Zv4Xu0kdnE^^lBEY^dj)BK#u-Y>$#JJ@vew9MGcrX~${!_{xk*(qzO7Ua>!RsO zJVsmmc$fa;C7aF>s}N}u{X^^Mx7-`lQ&h@Fc-b#xH8}Uw_0*P%M~=2`x0pB>P5P3L zY^dGWv(&o^PSu&d7nQ)|XLoD7pVr_O(z@}pxN6&%svjjScb>FvOvISR zbxBz>3H17Ej20K4p&hcNbbBH%-o5? zij$0;Q+r;uE|V&aA}y=UgiTX|LaG=*SQaJok;;WlCWm-A0KpRy{r&EpF1 zH0ko{wV!EL)J>PWy*aya^m9}lM=C5{(5?Jx(V7iehE#EXuzsIYnoqYNGn>?OwH5n~ z$;9jIzQQTLd%Ubrr&6-A!a97$t86^K(kXB&EYs06Ilah!<1#tU`NQt}Jm=hn^2C}t z3yjH($&(Fhv!=O8qM9nB)QiUJyULq<4Av*n+@$CugtbJXkUd#CSxY2w5(~3)bMWEK z&_WeSnShexp@O!1tMO5V+2r!cf+SAY zZ3O2D876mw&-pgo_ZM9cP9S&!ES#FB)h>$|;X+T!-72{?k84LArZ(*CXSymWRN;z= zn+WaBPPz6g9#3QxSItS(+wQDiChk=sRHZBo)ZA^$-6zl2+3#cR$IMSO=-fA-zU*%z zeyFIM`+j%W`Z*8})Gkze6aR48j&l_?NYXC9CEuH>E|BlJe}1cAqPDRn)Oj~`^y)gj zDu0!wp(#&?uYUHyd1wKzuG7i6KC)rkz2OpalxS%!UT?V-yytqze4%x4GmOyzs`Ng+ zcUf0F&NgXK6p8|?df46$-*O%AG&IgOg6ZTt6fGaI@(zWf!Dw6i-vm5`!H-+I*Gsxi z%Eo@}$*oLwm|Akpn1d}3v%Mr+qqRW{uZuzKWKYWDp<*?L;|H_74`$^gAGC2+wEwvn z9C-M(_y9rx^UWBhvFrNUZQ|_Aa|$l10lm4DZu=zjZP1}b37c?m5fRF|4`_7(U)G09 zx>ei}AQmV#66*FaFt}9Ezp#>TDGy;_U{lSM)Ev}gW%vxNEt&NUt@VwVT`X;YU&Fu% zxbOjQEsY%XNL?%~tnB$*1j&E>f)98P{g{QE^w&=u%mvBSWEDt7tnG|QxtKYbS;@hu zq@<(*c811$Z(oc3*&O(vAi1f7gAE@Gi?g#cvoi;?wVeqI+lv=3SXkLv*x8wYUohFb zS~=*sFj?7C{NBmm{k%4^H?T9aaWJ#CB8Bc(Pv6?nL6DprdZ2&){60@37qfpI$;$rE zWdRq+0{w=CjhU6@pM3+H3P3;QQ!sNevQT?%W@%()4;%x`&cn+p@N0wr*H`~Kd&SEEYM5%w@dmxUcWvC1`LcU!1B-FgHcblVljaGL2UL~UI}=G zgWeqAWditz_V+9B9?|ngjp;=Z42&?0g&~4mW(EQ89LP?sWFdX)09|THLSQLr>y|*z4S#NAKy4#cg z!|kzy5T4Fni~eT^$Nnr#1cz!h(|q*#KRI{kDFX*5`R~F1_wMEVy}RBi4ph~4r3xkBFdlML_x%?m5cWo{KOL6V z`$%BCDQ`4R{x6b)iGq)G67nzBQ%l22=Rs?rH|Ncq!nTHW=q|A4Nj)F&dsn*eNz)dc z-d{fT{Maq#gSdx6lY}|&Vk3$5q>m#o*=d^2<9Z}@|H{kjI4ZU6`nktpOUYWS#z)VK zIn^c0K~BLp|6m@plx7m=S*)-Z>+v=x{XBt=i##gl~p@UUiN8eL+G z0B=|ikH5ssjhuB999>$H0>+j9@&ox&Fy#jr(^~x3zNsI>BBlrcr=wT9mG$_0KevWX zq=Z~7QUV-H-l7xgtwMd~lE~t?hBf+1XSj9k5|LFkSs(vFz3k1lg}}wEz1~)4oE5#> zaW_ri*|!N``-%d;JLbGLF4WRh&*%jaTbS zAv(AE1~bq8o-HM*?>>smCtkG+=QV}JjOWA(bw(|oz&uodA zPBJ9Xs+P{8v>jJgROqT({$oZMUmoFF#`Rg$e(Z%^SXrp9WgX{ zxTxMhqW7RYImTU*0~hg;z{-nxccg2OcsfB<@?|cDDCo3px=thiL~y@IO#0W5`5@d& z`@9tI^SGZjFRplfyw20~qT>)(+hytSysAl%TAQ+N_ge{Yc$$Ky`|Fsv>n?FH_E5Fi z8A@7U-Q{u!gS>)`MsRy_YjSf{)7_p;7g->uV8@uM4$0-qooqG|QMw|kojr~D?G{0RIh6>0u_n1hUHHT+>T`)Cy5Jap-=bX&_xYQZuY7$gl?t=5oecE z-1iBb<{T$rZ|2DUj-xZe{q2U(MfB0U%=zAnm3*0a)~|1Z)E`MTh52U|x1KlN?9cEH z{wumz@!_PIDwGr%a}>1@w!?w>R5EMV>qyTh3QB!yTT;tbLq{0RL-S|%%}*tD?XGO1 zegtkmeXMB1f5c!m>qH*%b<;mZ?WT>(pcY5Hn)=soqf&%f4!jVm#ffcSUv7#E@vZV` z8oLa#^I(5-^c{u~7JT0k6^|+3|~- z*9QLr3es~I-H}FMnsM~8wxY@2Op<0^QA8BQjW=MJkGW~3}(nQlKbQhQ`dKYufAe&*GhwBMmwNL7B z+|#BRCB4jb0acA>h44K!BLAeE(^qMylH21y4_;0?7S9aYiI5=eP*YC~Zj>?qjmj)9 zxTuj|L8izk)3VogP-Qz4%y>PABv`t>UUB@8!Zv3Nw)#aKn}@JB&*lcT3M5 zKyU6R;juWc9E7UmW?9LWJ1-um#*2o74|f*}O;moMyG?PuV5(SC*ID?#v%rCR$b3b% z#nQdf(f|9N`BBb4DITBLcbFzugXlX0+mLIlx^b?1PY?qSRr{(Ku?I-)_aLyw;NW+I zll*3ab*xq@anw)iFx>R}`_0!L8dUsd*1yk2{uaPa1BHtZ?j6p)?$&v3ehvJwonM^7 z{4A~ytqI8H+o??#YU~B z^+ChMfc4isJ_=?R6lih`ClOoefP`f5zY~;KHj)=SQ_?-%vmX@16F2Dtl89ahfk^@V zyBdt5q=&;+j83fQhTEPaiStV8mG3tmv(#hWUk!SH^uApI9o@7BVeRX!Czuq`gLOfv zR2wHXVT4@t%|3&UKzxT2=Phum2>?k`7Gpfuob&~VhNSC_SlMc{mqqq2?`{?zo#q``JdkL0DP*%s(OcGA$LX$q#~C_{6I?7ize-O%EzgEW4_i zL$$hD3K`l6WD)V!*y?n+A)dSLy80fsBZ5`+VFE{90PButKgKNQC_k8GJo#A+-=_Ju zCY*=V6SK#og5GaWU#@^gycWS`219s!3mzxvrY6ySy$|lm)34XA_9`J;l^H8+zb2}W z@K{}{^UqH3c_}h->WBN5y8T)PR(|CeHh(v|P^R89?6_AZ6&-};oXTfF>7UT#}ud9j9c=<2)3GVGM^)>I>ZtB+18|e;y3qcx#gwW#^ek21NAWqbg+O zg^R`uF2RG$IBmj*sFB>4;$l_^=~Ll2sYD}{9_t*b-Oe9&ikraPs1m)hB9~j)sbR08 z>oLzVLD4`VrO!IZ(mV3S@JP!&S#86SCnn8mnQA)x@wgR0Oe0F%WAgrH#SQ1EL>474 zR|vP%gdSCK`piGvUu5U4*a4Ub15eZDr2%MpLBpzs3RRqlpFzdzEMMnCMmU(yX*N30 zOoE)AP{_+e`X?PrVKMO4QlQYS9#zzsiU!jzkXZG8isCWlTU$H;RSyN4#&>T`cW)PZ zX6DZ;X^FM18_s$}AePz%*~w1tNb{{@T2SxTF2c&{LoWxC?Rw~zoSSa6# z^#VzjF`SKHouz&u5hdxgyrYh2iqz}T?Dv8kzRFp2bP#6;uqDcY;=F3jXMg7_S)RGk zLpm1|Esvx2B`6pnCRH4-0ZP*c5e&g{%a1n`+U`u(k4;isjnQ&q9T#axY?@*90LWp% z*H-uCLeDBr%SqkkqHZDi0F|Zja@ohT^SQglq-h2O&XE|HO{KR0s+@3m4o32ND)#Z7 z(!uw{vTAOewrbj9U zF)8bh4@NdWWHP1P_$Xg;vtL(r3OOz-`hy)PS&eXL`9p&@h`n!*;H?N#Ekc+oO{eAS zS2Px`RYt%bWCJu}uS)7Uw}m#-{Fi<9jwg|XE?Z~~C2kVNkW+V8qvWlQZI4~XqU6B@ z21=KK${($(M&$V0!vdc^&d{9WRbx4dwKA}~^1L7f)gJdSv=-Ive^Gsglzq2KBZPvm zj5V|Vu_;h~;k}P$G1%SrUIuzrUVn(k9@bYOJ1fnrY{Lnct$(=6m$eUc4{0pw_q#I0C|~c z>%6nh76f1lZ4CfZ%5R2G(vu%$3|8_nJ6!+s5otjvfKVllAfdt~qC<8E+g!f-mWO(jdGt zRUzwIs%qKJt0T4c&H5==7nsI-OGhKY_ z9ES15pHfW$VaFQQ4HZYD&hxG&r;c_nU#;j?`pN%jPGR2>C19i(@PANxq9o;~ajSIu zozIrOhmDu+$_d$uzrDo`QsqDt1>di`BBHEMupDJXOn-x~ABg1V4@_;Q1(KEEhU>mu zaxf2~yW_P*5E~Yr!ABO^KQPbt8XEt~SD2S(r|xU9kF7MW6ez2v-scw{kLa_1*{fP; zGy{DHVczuIA>3w1e<(bC(W|CL(z2)P84;)LMn?>A);B)W4kuHH_f%js6wgRy6f2}1 zitO6_*t?*aw=738h$3We`-Yd+eX9!R%CUEqh1*}5gcmp$mS#WJVthFuxjRJe-oam9 zaR~2l*unfB`m3zVpu){H-VpSa0n;3#y5g-ncYO8JqdJvf*ptT`YIIv)5O+W^Y;B(B zQ#4PqUb0N|RC8Z^p3&70$xUgwPR>oqGveR->Ni8LzfW|IFzvbJ%FF(_uzXlbONfSG z)a%e6#K~S6*<$e)#R@Asl7!0|#@WrM^$C9g-HjwrSH8U-B=R!co^x4&P)ul+YkqP) zcBi%{PG77&|BB&B8w=ukuO#px;)&tz&c|-5I8AI0)NJz<;AGgoTTbtn-|m_S5w(lu zYUUUCZn=y__L1jO_#>{&yB}yN7ubO)6kH^!5Mw^f(*0r%iqCwlh^&<{!a*&%#O$LR zA6;V2Sn?1lB3x514B7oo9NQ{$1qir~`)UnYNipZ?6W#e(bjYzuMF_YvQLW6P$)D_Z zV1_f+tVTi73Cr=rWttQk>lH*&NPFX_IWfRRXpYrnq_Y%i?OVoyc@)9#avIo{Ah=8xX zpoe!v*VA}%9zd+{h;84SVz3S>jF~&i>FZ0o&ENZ;H>xUSs8ccE~C6 zT*gU7rc{$qp{kVY%!@tcBA1hdZ=x0jIaJ+qUj&ho=p88_TS2x|JUM26v$ka9)8l<{ zoEYOVnKKUEpwN=;T2J})qi21wUe(v^M0|QM2prkY#CqCddp;AO`}`P-{Ax(rL_xh1O01#e+(n)JAZE(e4F7~UNZ)Lg++zR|S_z;aqghb}3cTkn zkB`_Bt|YGH#AeuUEc5Anj?Jr?e}^6h6ty4lv9DIKvj>uu^k)YeO}`-2t-%te`ED7r zc!Jk-DT>cyrOBxMtlV?ZeI6&?D{S{_c_b*FRDLxJN*biiShdBwo{155&1?X>TejkU~h^Qyg`*bL90?eLNT8F%8_!3 zkf78{fWe#cm|*%*?@NdC z$H-G8F4%V6?$D@(be~axN2M6ydH666d#}*!ULuq7-UGPs>(LrX!C;?^lnhqTK@w3i zOW(Ap31TT1qW{K679CXUQePMEf8Mouei2w@u4?|Bg*1aevWWAm>GQoFBHGN{wT&(QL-W?aunpYVQuipDU z2%d?i4KimVMO}!)rx>zA0OPX7$lGljhdZk```d5u5G|axJr^$ai2(N9RKvwQ z(YTiLTvn@T)mwe=e7OHlridgYSzLJ2AWa63Ti|X|a^--OKd@s5%%=vJ!h%+ot6aTL>d2 zvT)Qu?Nfu*gtlp;YFSdO0PM{{$Qye=;}B`gH=s!9c=9U2Fi6eRg6b>c4OT-mxw6-x znT_5Z_G~N#>#4N%$;g(1xQlX8N4~~-7NWp)>FOj#cZ=|$@q2Vkyo!= zuyh@sW35W4aIa5!-(PJYflmw(^gF^qAfBz=t{r9$xD&x|BmOrM9n#b&e#79nU-XXk z3_It2{g~@JxZDuNG6}_>^g6z8V$4t@lrDYXpCHdz)mcuX85z67RmwcXJa$WP3UyYp zGON`)kAcHFk4e}#GN|sH9pKw3*u*#$u}PfJ_^r{{qORAY?dG^iY>NOT954*QH#&^`9GYleee^%`M0g#;P=$^E} z-quHJS(Je7$4KjD4?=m4J5t%j;>*@ESD2~($mOQ;X&^AMYR)m)WH^50eaTZDeb9J! zVBRMX+a)oGf`CKe4YT@-v^p)uQ2S{V=u}ApbPx!*+95oMC#Z_5rHf-w0LKK6_5-mi zNUOWL&I^BMQ#xLBL*n5HzTL!8Y;hTy=9$lp1b;>L;1!&k{v+ z=ig>t;?iI=Mis&H`QpLiPP z&Uu{lXZY~#nVd4iJq!5mY9R1nD{rJ83%Bx2MeS>ZdX*HZ2!(A1g!@wl`-xlLxOA)o z_=r6HO#&Q}@#fD8TDkMJsARE9!#j0F{u1hvqcDVf zFb)U$#pU-)JD)Ei%((xnX11=mX#EKFnP%EI_q1gS$eJoi`D zs*S>Ew~%2dEPp!!12Wb$To*0azI{9U0>8yl$RmQ@JC}YQ5Yg|LjQx9GtohA&U3IzM zt+@#;S1KR9D{CBHkglwI>!39c@0mf9>R~ss&t8Lx)Qu_=nQjPZgo=u2ynEIaNl!h8 zjNB0(nuu3b?-zDNZ8W^(UDxvt;@Rd@77#C>L>#{cA#eUJ8KG*3enAJ>Mp3^Bh}>#1 zk`~LR+l=F6$b86D^s$SsGIo2kfX@wyg+-}HDuyUpfs}h!g8{15LvKryB7tuniziKs z&dr^vCNu!gy4wi=)3n?$#bt85Q*pnpJrL0t;7J`Zqg(?j8JK{N5MI&ClGsTV|*y zsV;sT)jb(Uls?Hh2V!|yR-{C*hRMZLw_C>6{N|H2Z}unUypTBTW$giR;$)L~StHHg z!pf*TAgrittzcT4+sl-0g&6d13AyWLE^G=hu;)a)y$2vO) zt7^_Q^XF$_VezxoRqO^@UbBvWMR#iK%|HxsOJy*^lo&y?l996C)NJ4~F=9%p)3h06 zfbCrSJ?eC9XV|Ucb^HzCPoG8VF2aK@ zn|-_#5VEh()S~4R%un35i!dBPoc=HefG{>Wcn2uZo%egA6A%TOs;}6ygd_cQb-y9x z9A=K&g{oQqF<(BS+6D*ODFt);**3D(%^H-Sje?Sdcy^F2Tn}groa7_<^nRyDnTxUa z>Y0KvM$cxcv6-{!;gof*1-kA4(eE{^;r&p~!UOrjd}7KmPqeK3Wz{HF7`_8e&oc3RY)*oL zGar$TElN1yMU_^AV)`QPO9}8K-JqWiSb7Tfb9g!9qbk=8VQmb^kU`iB>IDG#1%D*^ zomG67#MAIf5&b*+}_W+EM7^33TzBstu&BMJqQWTONf z*riGuJJaPf|q*nXSb;^M+_7ePvz!x{zeP* zWPr<7IFf-=P~dhz+GeC6Z55s2!4msA6NqE2OF#{nQECtOI?X6)!tZlS8=x0f@HZO|AP#hN{504q_&ZmHPJ0QKvs=C{GTfyfpu2M^P~RSWRL zfU1>0dPX)(GIsQpR^!?cs&wN6vUrj#+rdhPj``V`s{B}|(U!c&wqok1@64I6jMCEq zn!vvcxGOOmS@zqEQ7mug`8jA<4OC-d5~S>b%Hpw_x0B_07dnG|Ly7e&# zYUAP04Dn6^^5X!QKBZU_Ugp8V>F3*E(`ob>%POtrg}n~yn8opUE1uL(M$n-QwSa4= zzhS9A{1G3|LK8T@g_C;udQ(;NQ|-?0jB@|3*l(t#4OcpqYh%Vt@G3dEr()zeef8e! z!IjoX;W`#U3{GN>*;pYp0VH)AQ{-?W9%kc`I>3fYKa4WyzNV`##IF6eGpatUn`jiP zuK$xA|D{NN(tU|mGT^{Fx56S34=GW4k7vO%ard}S0*)EK@nad~mZXmsRyfo$K?$CK z4KOa8EtM~3o4=*m-6ch27TQ zisETK?FvgQc>i9*?}#qr9ldIW;r3#wL1zbJ!P=%Q`&eU~lxYGaSPi*Rp)Miea0|a#QuLDG9L$n7P#+DN3ykSrPK|5 z@J#c{a5U_e^>(xbluP5I#a}?4{0hE%$vMZ>8%eh5A9s?6cJ84Zj#~)=t&CN@(m^iuT{Ne)$!9P^T72?De|XiapS#(C^%S zR<_E$a@a~6LhY85dBXPL~)pLF&Bp`g<2eQ+!}(uTfHnz z0zl&wwTh@Q8)C?+6VL+GxqEii=(NKE_=i3gm7%kS2qtEL(QD&!*n&hrV8vh z3yo+aZWwlniV%P0v4n$sBI{hDs2y>SoFcWXWT3c#PoTY7hhtGoGZbnG#$U{anSWD! zAS<2v3JZDgT4fYrL|D}nVVnU?MV!IrFH-Mi+2^S9KjqsN0EBhLsL3p438<1?02q9s zE7qN-W~eNr#|*?ycppbqnOBEpeo;$bM%(Kx97^p(qF`5vArX*1;b>|Yhk<$mqc3<$ zGeA}y(fOzMy8)@`1Mp^^x->yf9OAt#ivYt##6|Wv7J$1xr2J_&`6SG9;N_rwsk6qP zQx*wI~iFE<3ONUXmibjf&{@^Q8?WaZ;Op z7Ps3gns3w^ym$t^2G*5O4(@>!&mcA2CaNi@s_5cuU_`RpD*q0UOVlAMRIx^=oMqMm zSF2Haz!Z`ZU5QL%L{~1e)w_J60rYyoc;^5jwvbJ_61jj+{L&7|rzB>?Wco}4|m?_;|viWjUl3;YA_U{TN*;O;QZ1+F(U*fhlM z7tySKSa*36c~C9mqy3QjxFDVc%WzkrGDS!04)m&h1oC|1n5o0&0idtQPPFP6VmesS z`HR=_PU@~O^_BUILAqla@i&}sKyRP75PHBR<6T6`y9W4YoF{u~h(Mc66o(ST1d3qm=R$ z_o)AC;B!I~ZrO>#Z5*nbIl!lVcSVw3jIAx%A?!Zgms$L^O@Tn|TY4z~&{mZa33T9D3 z;D>j|;XRki`S|+$fGK4Va(BqTG(IqGh5-OWij7h|>9o1Hl)x|1ei~(!R&{%o@M`2> z(Micl&9b^mb4m(bbwJKc+)iWrF-jQ3ftBX5LbPCtZItx`P#sku4yG~Bc(v-1_!90U zci(Z%adb|+GcTmwU3=uPS26L#l#wFk1BptEE#6Xp2az=~QACjOu`b+3{f6KH3gB#G zsG(yBo+_vTU8gH<*YK+B0}Cha-N_j?4}_Fv|JeYWZKq63YYPWLZ&L$$;qk{D z(0>bS!f=X6zQavhRIN;uo6${+eviMTvHIXG7-c0Ge^MM_H-7_8i~He9JzLviH^9H0 zlL0p}x&Bcn7=sh&H4XgLw=&6)TH{j|L@|FoUR4S4e^YeYGO5Zl|4O~UN~Q=G|fxo57^Yc14ae^tar!FX5G=ko5|FF+#MZTUOFMI*R*USzvdn#mJ1?TBlBx&}}% z-2}!%jul#ji_-jsG>FkNdGdGAuRzML6ah-z{_m8Uqy5{{*~s?jk8c=&X2KJF+(

      1ba-?^zaB>=oO1eipJ`?U$pK&dzk@5!N`z)tMl( zt{xtsXS(_Z$mYT5W%PQoUfPY?#*g#}3B_EU41$6&S9O8*MHOAQM61w(N`%L(gndx% z!;{T}l2*(2^T%(woDt=8+J%CFF@utgki_ssFZ@`2FY;#OmX9-Er+urpUM+j5@Wpzf z^>eG5wb*)z8ArcbG`nv8y>71sSrW7N`p^-O*Oo#X4fFt4)*>l=vC{X)vtMKRxjBephy~!*ZdjACUJCqaPy(Wen+wF* zcEK@dMk~YsO^G}{%<+>yI`{k!E>oe?jOi)0h`Ib|u!mje@aaPZ&g@%fK>Mq8#Psf4Nd~As2+Te> z`YTU5F}Cr{T^<=aQgK*e%W&jCz9BlIw{S_qsX;aByTpZC>dHsk^E&jZRMlKriJR5Y zP#?^<`(@gMv(SZW;d^%I^>B(Ke z#IsrUJYTeDdxV-YBdVXoZ^)`Wfqrj&>bcu_do1}zA)Vs)!fSB2+oI9ZA7kXiC=z6B zz7O!3E50deLGEK0kyiZrVEGv()569M!vhTT@}a?EWXRh2q9yE^&QiUR%jO#n`l%GQ zhn<=Zt##cwUrW*H|1{xur z2cgGI<>v*Fdr`?n@@>&6@~EY3Q^+X}Y)6H~NWVsC<1|jP?QqG7QZp<$igmc-V|&r_ zgc}?n)U}IIgLRr}UQ~0eWowLJY}`{w9LlAZno!FE_{qX(-@_t;U7}>Ua}`I~{}T1v z@INUDZlOC+YHb)hHQcLw_;4jw+ilCvd3OKlV}={qV7z^Rlgm1u0g1VBOA!hizHG}8 z^~rS?Xu3XV(^Y5g>Uyp^G~^ipD)Z#xv7jP%CRQqsDVN|agb648hBX~(}Wih68vFt}e zLqHqgw9l?X&7u>~^@b7}D+_Q|xtqM$rt7idA1WG_V-B17I(P4Nr^B2&?2GG9^1R!nX+kyhmE&dj{m&hOZ6Bgeg2QZX-4Oq)P0@lvOQj(GK)H z;!mH5T?()G(e>udt0PpP1dzuj11nIzY)cW1wp3tssGyi648&e=E6%G-0U(YDsTWge z5OUJ>qxYtE_tZy(&TdUJ1vVlLWcmK@vjEr{4ZK(k1Em!y<4ADUINi3Mr+6H9Z%QxX zM7P*_pb(}8*=+z)mV=amy77LyNw;UE(joBw;2-hj{l|dHH^`&)Pp?uu7VRBwKzJLC z8`mwSM~E~_gM*L!t7K^1Fz`v8LbKEPY_N7(U|7oskObb*;Z01Fv@w8yX{&$qRRhY8 z{pp9{P|>FaI7mQLNLazT-AeM5~7j+b& zIF|)rse_d5KMhOFzj{k{M80X{uZU!pG3Fy68;VnXRoHr*b;8&FWBM#Hi%$(esxK|1 zn|7dUX7&N`YH~18!R5m{+|w4u`M5ABxbtN~*9iC!b1sR3eJ2PI)gfsQe__%<-V1BQpm>$Va`^-T*OI<*pED z$pe~Ej`;07HDbgHCnojplK}8~ay`s>LhTWgWkQ)Dhc1ChG7#YmFpj#QzL?Qz3` zC9_xtdGI#v3pOX5?jfgO?%8-ER3h7NYd6({s(xh!VYqso6H@Ben5`-(`UD7(H`teg z_2GG;FhU2jG$}6RPb8L-MN2BfygzRnv{6ISpv~-kKj=SzUr@ie<;If2PFkjEpBuG#CQowc)?-|hpj%I6!EFtNY0 z2RnPS6HceZhBDKU79LUDsez~;FY7z*0|rj~y_UEj9$16zp@jPz$MpdZ<4iC{(1q8SY(anxbxq zq2ecamT0gudfGLeqLIOMCdj=QCmYDH{XBhTzY8BR@+o1Q8-S<3JjY0WlkB{ua3wxh zKXZenK`hnu9c7n@2-QlO-0E-F?H_affBr}cR!Njupp$KhBlSvVgbM>$Yf{pV3p@ge z0-pH0)>?;a;BzGjAyl_KP4@AdX{4xl^&33>X~FqlJ@cWKOxWpxDppOuna;eR zR7}mTo5}!j+`PDfdtg-ow-(UdmY)u+dHs!-UspOL4?K$FMslR~uf_I1zlJ{-xf%S= z!XgL9eW+3nG@Qm24V0Grl^LNsb|Xt$ti*f&&tj|p&(jxPK+%NuT?bKwAp?cbW2ScD zIJPQa(EI*GZ$y^IQe(jXZ()W$>|_%USQ2?hZYKEeAO0`T9qmgqKyC4hs+T|gTD}MP z_q+m7gZ*^#Cv*wl(ZXA4re}Z+86E(%=%HP|Q~CG1>RSsubYz^$=*9o-!&2Jj3P95q_W|9#8B_(x!vxkp?E-m$t8}61 z((lOwpwC9IO7OQEuCI2%St`g1$omE$9VQ+LKLrI*KOl$U6K-ijp&*5JG%Al&KuV|4 z2Gf4dKJ8o^5{>yEYO4O-4!vRYNC+3r4cC`Da{$4;4QM*Ifi^-f!Sig5p)E6Dk@ze? z-1ocepKTlLpR_c)pi=$l`Vf@7Fb{eKZ8nvF@825z*wMMi2f#_b2S^%p2B2v)x2_-6RkJV65?zK+8{)`Imv8z7&kUz45u)#`^`z}tQUAbghEEi0Q_ z;FlX|SV~x8nrJ@(6Y>Q8G~$vL-m+UZq7D;wK|vCjqh_ zX9&4&;hV6;y(6^SNL9C`tn~06sq>`W9x+6fPzN;`|HD^*`+)Ec43aOkQ?A>9R2-sh z*tXo}e}+yAsef%3BOkRN{{-ca8J99p0it(@N`a8%%4o(`(*WKJ@SVFhiL*zLNRg`M zawXM`9n!-TdlDx>Md=8g?x25t2QP$q0;!@OP*(6`QR)KRrkTIt^jlXBpPxKuh-G!(R*rur+ZGqPp+6&D_$vTvxm4k#!gh1@$+v zfRK@@pFldz-1;P2@1&Wa`DAaQ1@u%B1u_1{43NFF0LBaM^l7iNKOp~`OYfYjHJqu8 z0_OJoJw6b8dawSYPQnpYV5zUxKYuc+0f-AS>GaEPwia@?O>7{wi$mzhaf-;>Tg?a$ z3s^0z2VsK|cUw-0@_zk?5EkaDlqeC`9jhQ3pu^$tQ{Wq;1wqflP&YRKa*#uU<@TST zMSMstTfkj1z`1~e-o&0l8Qo2vIr|f2@^^Uen5jb=KdyzY#aGsaEWhGmoCF-y3!tO8 zT^nqVumx2B5Hju%B}z+;Xj2Ap#`@#6*BpWNFyvT^CAK=gfNY}~!q>WI0NXa2O?mq< zpL>ozBy5-i)lld_6UT^Ai?vJpcL*eq!V)yl?3%%xo~gP3w@ZMO_{ee8KzvO!ZS#P4k5dfdT4YQ3i%&;oO+E&WnpbW~Zj-ar8_A3 z^AV2U102yf{OFg$84&nPDQm2(^I?@~7mEx=8h#ijv4C!Zk}mRSM5{zI85Gxx-&sE= z926n_l8C?GH~gPKgi{-pljQDYx>>*1mz^BpC+>s1JU3;6pkuOizEAkvGTDF!&1p|r z4eYniR3_+(hs5tZp#6uwj>nO8y^elr+ilM|M1=MMs;Pf)XWjV6izmdT3_Ho7xMXa< zIgpP{k_`A5^Oi7-Wf35=To~dSdcc!fS@J{A>*4bsrpT)EAxtvQDt#v+vDBW~PONJ! zdZOXM2(gQxieg>9l+K{bN9?zbJh%6y?@mfRzKZ-EbcEO$=+VAbsFHXu{IsM{w{faMq zm_i#tr0^Z}1&<0x^Oy~Qs|S==c_z7Cf-&xnLgJR)w@U8mYj#&V*H;|w7Yh`a7>j2; zroy;)9v=2*E#!mEM=R2<;onRrbcI3rQ4wIcwWFB67opa?=z^HD27qsK3o13^#sE!U z9haxfWNGr4J)mYooWQUvcCN=!2;Yk%nXB?!+W(;zA=-!>4HqxfK`ce%4INyTWdl+Q zoPoD-I9hGAEb_~niA<9R9E4_|Y#FgLmD4biHnbIQQVK)C3vZHd&Q=^TA8pd}d<%-Y zLXo}_R)YQN4r2)FbFhB~pPyongTJA~bUJe`b$;WYA@u~iP`f`v=rAa(^Wx711mB4> z4$-F#W*5`t?&FHG11MmKS<}Q@vlp--qLy$5jfE=YGY#45&HIXfTQF>Yd*Qwv(2l<&m&LfOQw`OI^DCzXdH`w4b)a29 z`P*Jto0sUSPvLHub1h8>g@|zNj>nEgj8SHfZFiYHkRw_hvb^AY`OqDkTVv4)+%>F3 zE&|&K;HQDY7=0~Ay9QNvl1%|5c2SmKc9SBUm4s4hdEjWAof8uWt}jFrZ}*U6mQH^Ggh<{K)800;}Yt*4=Z>bDj>(Qy?v97$QYd@1~7xm9-@e6mmUtmY%GpLK*Ti;dg=)>k zJrHLn^b=RE7L@W^06z#f;ahGBIN=?+MjlN@tiA25h%*d=_IZ*{l&54P52MHY3xCk>rc@?Wu>e+=vxhz#F zcy^L!HVr_PA;Cr>%>1+0xt?d5Mfh>S!;SKp!~@WYTX#e*c2|{~W`T!5@Oj__b5-c- zC5=xn>;-4$lej<;h~?N7jrExlE=m|#GNlTn7!08wAz9)+CsQ4Eg5fo=X}GCji~Zsm z5h9L&lI#;C>d0Z+9D(q)Pa;2y!|&Yzazg6cCE2@1Pl!cGA)GK;KXyMR6Wf0^BU#a3 zK$aX;=A^hqHnlo|5&!GeE;U@g^=Q9`&4Jki#N?Pzte5eaPLQtPWhlV0MGE4TO@<4T>@#WhfLzl1#lJKKKyc8p|tF^!gJND%5rjAriJ+^+*Q>x_s-qcCGSNrX{- z630Jwp|;{iD7DuR^PS+ID98vUhn4z`DFKU@tdOR(%T3dpqUYQb$T!Wt_K40l@UAy; zOn~?wnUntgx1(Hlly$Rvxd`)`?ze~oRoaI+g!F_RC-tuO6^&zff z^4}rWMeohgR3miT#hRgNNhWZMvwyXy<<2b(#okawyOPLPP{Ubs{jczyCx z_hk6@Z8&1{cIy1q}l)iH5{F(KTUU9W;s})#gOriFU|+LQ13Scu>vi0_Wu) z=C?k8tY+_^;k+fYF6pFKc*pi*0mr$>Js1|5ib9eHNqju!S@JWU%tyn6?dT>@i z*c~3`@%WCs2+v!5z$cs@J$47M_?;@?;(#DMN#$dXxF&-42>UrDE7NT{4`Q9KtFl)# zl{``;!XV5l{t%cDCxtn5ZZNDA$ITjgXq+OogwB$O^@xC5g|`_y1HQcO%^q7k$x63kh>;4rs%6Rf}KPi zHuorjl_lh(w3q?$2jiv|O<=F+wpn~X7Q>_};5DZ3{pX8I0nvH3rpDm1Q3fJ z#_)&)eW5GlzA;ox zyCD4XiG8837B_bGt4g3$O~{P*d3KVFYE=vhl-!)Vj2in5`oS+;PnY5`Po7{@$qH-b zvO0gh^N*H;fr$uM?ii@gckf7PzsA6W6e*tQ#Y`pc1{k`jP%!r@SL7_PzhyX+PV*3;&IUM1z;g=(AAH~U2vmW4_)GP z({SA=epb>IwTXJZ8z4f8i}&#**th}bJTPu9+!i?lGa<17O8_@5lj6Qc1FW*{P=%yH zKF#+xO(mjnkqSQY>Wo5}yGga4Kp5k)c+@0b2mjnYQKM9=Y3p(O-RjCo3aTc$%db%R zUq9|_m_WXPT?VB{_dLbkgYsy0h*GnCCc}#)|DCVa*B3aSM7_=U2EU44;i{R0edB2u zXp|F+Qv6=o<<#y9RX~W9J^JCApoID^M=k>cD|nxV8<0O5SD##!(wIwH$}Mm(ojf4o zVw%@(<+^x54txZPd$n!59R_|;WXrKy`mvt3(ksW%$^p79;MZjG_o;!g-L+zoEX$8zsM`a&7s6?vRfg-hyY7@WU7#tcf}!K!>6vrF*__k(rU z$0UCD7qoWyLa(nw`KLz-52KZ2;!*OtH!HQnp9G#@4$C`OV%?M@_ z8{$0gH}ZNy!{y1Zx=lA|Ly&hsoYc%xSc`)~TUu`a4ymgog=&Bo zRcl@zMvrNc3;DT40MAjAs=}K|IrmVDBbr($n>NcvTg{>_(|N5hcmg% z^X92d&_$IE|cL~GaDZ#NJyVbNgEUX{PjBE^#h z42*!+iU8JZ09`1$#A=XBOpm#-5)BC{(R5U#6-JXRnFT`?oe>cYpO%UI5(+n(){EVK zSFz_B+?$5-J3WkDgAkyRfS4R&SN(NiP>v&%$RRh2mp)?~WY6S0P1ODhaj;6)3^p>O z&S!&x8ukO`EKOEj81dH;D~?MvdZ6k|w{dICb1g=!M@#cv4zj5It7RzpCADkCE@n*r zdOz=vIqjL``;=LH0~SOz_kf2#M>F=Lu6s3BeeEpJ?B?l^S)Y{7riUGoy!A+wz4JXM1{U-M=$Dg1F zM~)S{Fy*=$7!et@YyRBJcmR0D{FjWSY4VN9N+|d=7IGgjO#V2n!F3R~V3kQW^{!Q? z%Skt{5NNP-Ll8u2?TdK{vvaiT3sc@xAG7Sbuo#D+L0~YmxwrmsykH1c=|w1$5BP!JaRDLGtOibRs83f{hk_EoxEt* zc(XU%XJ9pEt!=+(99(;Bf>GZ*GYJBXdHcuoNF&Ow7yQqS^eOuR@|NOM^NR-pCWt;W zWxt}WoOWOph8=!LQ>$@V3c#!u;1&X1LtMyfSPq3oX92iKm1hBt^;~g(;0S5`kJzhH zw%v!#=bNQUJuhx$YxiixYY8@4aqN}rF2u{&CNZpcrp*CepGBYsmIrH5BjTQI;a)cw z@*wO=S>0A7<;hYC-wEBboNAPX_{YEPHQtZfnlV)6pVPee=CnP9wiI7&YA2eKgn1BG5Fs(Rc zF~CSVhQ}dHU7R)OMOhe#&~yGH&&h4?uIPH-0XnJ3cjDsJQmLxdN;3sF?BJm^jh(Wq zpD2Vu1?S7G=>=(-qm zk0Dj1slJYYhI}KoPoq2qGl)8xEYS_yJ0@`x^&?QjlJDDYa zHOWNn7ptoIc`b{ms;39F#~psL4q>3bXg7&Dw=cynTXJ^Z{QF`AoVq`BmXB_EP8<14 zHb&9s0)cM864ITw01*t>h&IhJ_BpmX8PY;t&yVTRRc-NkYS2|FTz8sKt5fGCm~nKWM<6FR_~HJ&YnEbB^o|YMG)`r zabQr1%i>v+vXyhvY?V9b#t=m(iw4!k6=CmnFr0Y| zO5u?>%_ja}zwg;0ik43udGf!Vqi}p=Yi1hEf>)y2k_*`=?L-FMm){*u8f|=AF#mz zo8%2ChMVbQ5cW#7m0P_(?sj#aCIUo)58V`EsaExv8qNwv2?soz{)bApgoBvg zYTxv$lqh`=vl}R67>;O#r2ref(57A$lOf^DmbXx>dzf$g+gJq3a_ND=OqGJ2V6V_- zQA>J}ks;gB4^JIhzh;Bx~J5FTfuMV)~yS#%@6>7bmRqo-0k zhduFMnk4;0A0fW480%05^p)pZx{a*H>Cn_AsE1khAcu)G^{mHaT$e>32^M@kN+=I@ z%PK5a_A>v{0HRpHN%Uo>>qkKZTpU@K!+}Re3gBn2+?b<7A@@9)`*dNNqJIJ0h`yRX z0;iiv&|PAiE$*>c0yt{ODAGBw93qGVb{18s*P@*AanVmQq@e0hhj_G>ZMOm~*A@hb zU~$C9h2Q^%R0*M%M(uH`^Xb49fn708%tOYu`^;_TeEPoR0rn$OY#{3ID@YABGyJ+N zcN0HXFx0t^;85b%xtG9<1}(E=GR)qZ(2$Z$4}i{w-4w<00)+JHrMa#xr`u_@Tw){0 zCH%w1!1APF6wpdhlAFKENU10SmF{h98_)dC*g581#7}SE3CzXqHmK{c+& zKqW31ZC_nhWvoo;+BSVw^_tUz<+lhH0-Al^!lG7j4NTuT+RqPM7i6~Hu*9}8DpD^T z0Xva}dw%?h$(NDE9@}$J7!&4Hev!L)vlaD0d*g++ZPIbEE&vW8Rgl@){VM=V2Y~d1 zZ@U`_N@Vy|lC20Edi1N9f5#-NH+=xm!_?ao8kR3>)JCTZIP^up`LiQ8Q&^sRDoVP9 zBzL3lwxo8X1#X7LkLyd|h1lL9QyK|!^1RuKB%3!Tbp1Y!kQE_BWm7i?a3N|3h1Z2Q z&tMEAD!nEeFLLr>dl+w51ZzdeVb2!uO?_e9m5(#hf1i4ZPbvd#4rM+T6d)g<%j6Pk z1qSc~F(%^)x4lRMlvYaE+lm+0v-)EN>nOK}`oa{go+vZy1n1ALUzXT0nO z@?WOpKTJJ)`Nx#(vny#{!kb{%_L()e2C%H&{3nT@k@sRF{T(*}Kk+u0 zh}NuKjgiiE8#+-?v#C%y^{W2 zmqeIJSt@p>rTnSt*oEe%64BgOn5YzL$mWq*|L~JXWOpCQx8J-zZ?PXtXz4nO8clo> zmz<;}d?d?WRR`*p#HECb$_1JBW-vX60ZD}GEsq^HJ%HUxKl3XOj9r^#rk`H+%`0wrsGiBM!~fcF5fM%u)3#x-ruUNt@oI15Orry>7G z3^Rsupl`S+n*hi(0E9duydsbUa&n@ksxLsWoD??|GZeA9*0pkE!q-f0rOW4z$71kS=3z$e0flR^hnWHnO;M@2x2!%LYO z{LHNQJT%VgYrbDOZ&l^#MvBHG*zcSXR0FO+|$rK2CB=maO zv<3M-B1v!R0f;|6kPsWAnKm`v->3vk(CdC07b)I{KsF|^%|B@?o*|CzZ(P`hwR8a# zJV6^5pLoWj`-0tO1t9DcZ+4faSMJfDJk>!Q3~Ah}s9EZKnmbDmTPaEXQc=ZRQMkE_ zNu>wZg`whb!coeC@uLMDeqh3SFNo%Z_FTw6O&nPTIV0l8+nZ&m!hp52#D6K2kl1?i z*w=>F8e$R>9zFzQKf?#aW@ZmXOkbK*EoD^zET?hBd(MqgI~54hTL3tIm&Zv6L_d4# zOjT`al!T#NnLNUzY2U!&B-$lIyE3Ytjk7B8=JXD_bMt=Y!HGOJ{lbEQ*{%wEUY7mq zwUhhtqH4Aop0Gj3NAKFZF8^96H{!`ro_h7@OOR4m@)iYpoUooC8J9^*!Bc!BPmoX8 zG5nef*T8HAF>ukK$mU__Ue({S7fmPxkKJs8MCF0Tmq$OsJz`Yc19c$ZW|aWs&F;%- z$Tc#8lqoGSXX1pI;Hy!j;{tS4;?H=-s;Isd7Dfw^uH8*Nu4QOPUQ6m}`v&g8H0zt~ zjK^_Xy&Cd*w2Myy^~ylJ{FFM7fc;9YT37!jR}r{hd4>;kXCS8p>dctD6;S^PyNqZ( z+a)1P(7UJKQ2XTKP0Z+97ek%2&{zJ{1=7BZQI7^5$%Pzzj8;Ss^peqb08vdFz)ZMK zSz*0gv1lYa(SA7 zJY#kCT7x7C%xyY;SQ$$}m7x)V^2`3JTHwD-d=Av-{y2hW7|~OFZ{5IxWjl5RA-&Yz zoeg!*nG1bt;^kBOCbp%gSwbUn8FMKTCE(s)24)_FwAC78vCz?+vnhZ7NPwzgi9Jgn zH%XDAA>$70Ba`hF)g8a9DBt~S2UCu=xZ~mX&LktiAJle~oi?e|16a)lakZLvDi~ENSeZ+bJu(HxmBL+Tc_kemLOp*eW5fS!!h1y2| z$`kBF(vS>Jt4aRX$7?7B-1BV^iiMXJ<2xaAuI0+U*9y^$enu|)YIQAfSyXI5u%chg zA0&bB6(a4Xfok8ROQ8rLl7-ek3Y!!8XnE{9mUGmEYW>-UaXttD^=_oYvBzm~$EhMl zAY})(btBgjry^ZV zb3dvgQPwC{g|war$y(!F9i+HBRB5^o(h7*|q!WEGeNbs|qKXLX<)0`p;E41%5Xbsz z0nT7AIB%z`khbp@vyC07g0Q5j0dKM-dY~dC@LQYg=87wpcnd54cA{lV$fs|i*dKXq zA(n)DF`UTG*`R!bX1EujKm z3%o`&Op%b0GLLysTp#ThOd1BWA=majfU^42Yv9UZSZZKgP00v|Hl_SOfq9gd#fgag z?MF^mgI}+L8e&X`6keN-0LIX&eay;7|L1EhmcaXw%dLf=e)o+F$Ej7LcgNG|yV z(HmE_JFY(g%6e+NVS4ytTe<&}NtfVrZa7AYGxA3ZsQAEDDw1Y4{kXNV@y9~7y*NxE z;D)EtmFr{w6*0I7H%b+D?YS>}DpDtGD&-mFc@gd|K##ic;9Ef50T%zCHL zp~ZHD>1-~R;Wg^l@>{|SasjFP2slGn$3|JK&!0(4#T5fLDIqH-?UB2aPq9n+IVTwR zltWGk?5d1G*>cczs+D7}W-tF>)9f>OT+ena4lTACDWC}pON?83l8J)kJt6^d0Y}~<@tz14&w0nO^C}ya$ z1QE7ebe3I(veZ<_&78PqIyC^J$&d=(pL$-kl>8xx1t+Z~oJ!Ekn$|xZlYoLv15Dw= z%P>%iR=pW8C>?h18;Ni2kM5gGd{_X!d7sz_9iER{M8I(EJ$j2_1xPFA?88g=*JNgs zMe>Q$UCb|%DfuLa1^a{!copKG#(k?aGv03zryrT4t@l3gL&I%`%zlyexUW?K@_*1A zh@BAlb_Jk8Wi=!FkolG)&93W)*338;3n{gp#Hcndb|1tR-w?q6YXuH0Q`jV`Yge#e z@3Rx)=T}Xf9Oy?=t6{n}dx0Rtw%m>9PJ;WmF4NTt!hviCM z+RmKlObW(vO9S!U&}ILq;o>UdE!M{qdJEbYa6j(ASDgiE1&Qly@iAUNx^Po?2mtN) z%kL}-{QI88IsW4oeNKW01w>2*tD}210UR3{gL*s8_sW2W>$2rJ`EO75Uzvl9g7+w$ zFtc504y`ma@RyiBPUt+k4-sh6W!}a~&ksYIndZO~_ATVz4SLlHD<~Q}ylwwyTLk-1 zE7E}6fQ@tm*Ul+-(`^4tTPq8OigqLn28kbQvAz^7-c+dF?=N7gBGarN0Zc^<1Ro&L zqpJF-@|Ocg>4WS8989DPe!C|8CK_kGLOcslzI?QK^FJRmkOc6lllsFD{y$7IFt4*X z0gX7j2(xtppj-mDk8LLsBkBGkCxils=*<3M`S}|HcD239rx? zt5RNxXr=wjzB-ivX?F1%qxL44T5^aowxCSc;UCI3{;9i^?LTx&aA3c|PnV>MjqpRasxW36 zb2d>pOq-cpe&;rAzvBj$<5_*fsr&SCs#|Yz;)9t7E2*Z>Jr8<*ZcQvLc18n6XT0=s zPolDj50|tz?9YqR7ZyhPfZFYNJ2p?FRJPvzlsbVsni>Iz^6yJp3b70`x_CtW`G5Jp z1{k<1LjWd49EkcKzXX@{-{XB@MI#(|NN&!z@wmx z$S?=B{cq-7ASMF3^+HQZb=3c&TWHaIieQy2ZfVj{-9}t8lwV-ht4R;O5OF&Gr<0_) z5wn%j;;Ikuza}d+M1GzK+f9cqiU!!r8ou4P^lF#sU@i zO$oRsK%D8wZJ0Jn#fst6ZyBd{iGWmhOev4L-AN` z(U2;s_Kh4s^P^a^v!0gsc?fW9aX^wy+r0CqJ0k4R`sw?s9Q#<5Fc7UP9)Jg!JmF_W zf~FBIIv7dZOnUV@IMUjn9e=JPAh&6)`=C)WiUVd!MQtL<-{}T7#3>S7eth81yIaF#)vr=rbIxBS3rGozICkC$m_yrd` znz1}+4Lr1gYsX#JQ3Ca`EeUpryx-r>qI`>XUvS-y3G8lmZ%S5aBYM$nZADVlI5{}x zQ2Q07tC$UZ{vH+Epkq7g(AB*$WGN${){yI%T*jbVpAEQyRO#7h%a0b}9S`2(O}?^0 zwvK>*0;766mT)2ZZ-0JdK(r=1suD)G9#UpI(3Gb1zy@7;mZPMrU?C9Z1LcMnz zH+e{X^eyett$8M`ntn}3A8+V30s~NFz=ME6k26&*y@n$i;DS-JbP$UCFI@>+|I}gf z1mKFX-RaSA0fxq=O9$Pi+FCzo;HYwZ-u&5@eEjG@V+OhYNOA!%-|}zZ_XWiE$w9}i z4==QD+}?FzMl;6xJ#wPfj=Ilzp?kZXBOm>*InXU5Pr^$;$9%o_wImYWP7j(3(YdZY zTLoQ-<jrNAwr%aZi=yn#g}{u(&?gUjxc z4(PpI!Hwrie>ZF_Wkg_>7hWrDl5#tcV zkqT}m(zFXthO!R(*F7FODIL5rlm;u4u=%;_pI(9^+EHPdKYEBR(`2Qc6O;(<111W( zR1|KAhlA>KW6KXqpNskL*5D0hX)-?|nnVCx6PlzM$_(D0uU^wikHmdMu(z zH1lQ8^6eir<3V$QG7%cOp7M^8=wCBduF1-Bn|C>i9r|zf+*kt1Kl79*6|O0;ju7rU zf#G!v8{8Z#baR&9i}YnAz|G;P;0OPWCDEioYly1o!7*hpY7=NtlvUoir3hW<2^4oe zE8>2F12z!GDh08oEsAsgE^iGsI<*R+!HuipsE77pesxTG7iG~Gju-DQcG|NujeSbc zv=s4Kg`lqK2sQn8h|se8lsOGAbPeXtR_N3?z1*D@H5)6*jA2n@H;fIWA1lzQfxQlU z6iy!7{N|S22eCJ_%31Q*-82b)z~>#w6-c=<)e3d@`^7Pl?9mq@;DgYfIjBN(D_I{l z_&UYg*=nM~3JUSLU3T@WL1E@~)&(d*bb^3>5!BEk=@s6=fP`#5lID@|w|Dnmt`9RY zspchsFLV&K9i0O+5H{d*7eOZ%_Z7+&z=Qu{K`Eh^VLL}9*C83yK_qu51ROrauxdQz zvmB)aml$%T3MGAjQz>%P=yS8gY>2*zVUzj-$%3G%V7$sMqaqg_pY>B8_+Tz(hKsvT zetcbl7St?QdHq+j1fgh);Ukp$~@ZJ(22gQ0`o+0({hE#P)8x(f~(EvXMKL)fQ^dGphiMYPVO!obC@SUt+X zuGKkEu$!kXkJa+xW{)|;A~dFMy5RKtstTHR-0JK^;c`6vj*qP{qOf)*GaU?;ebg*FC$r; z@Ne0QVh2h*ddQ8gW_t^}8-N}kx&_>RZhpEGh=SCLjpmy?RpZ!Ca`D(Sc~?JD z(vk|hR|#F6ENC_o9=>I!o<7HFP)xr6WTa4U$KD)dmWx2p7(*rQ4sXA$t`7C{$~?^E4Gxf25lB4`E9c_q&*gi#BkxWPY|^Hld6tPrse=(>HU0sem`>6 z3Kb*OJ~~UJZ&qP~8Zrl#oVfcte4i8Wc%h88UM#YOu~5}dk3aabYE{THG+0gWF+F|{ zAJw31IUxSo*0v`huUZ9`lD3?81=jZ6S_@951wc`72qjoooV1UoSHP(i0R_>_$4W|- zduGwuQ0Unf0sm-q0Qa3x&Q_ES__-ZD-20F}_g%k=G&)|b>UM2u?7LZe9SkN~FVzgG zDGm~Tced|4ZmQc~a>W~Oz2nPIVb$T5v1ZhIM0}5!fYX|rG?}X|x}=zaQR{y0;YNdE ziLuNinonn={XqP}VlamkWA>eTD+SxShUXOD!>n`EO=bM$-pUd&)a}K*gWc1}d1jR{ z-YlLG_2`uxZxjeA$DNC<8`^88If;ZuWkzjd28)dz=@=iH-sRBMw#i6iDVM3+tM47& zUpaYZ?uT=5AE^=>Z!+~6vhyiI6Op*m$GJ60_Uzv5jI1Hr6Nz=Xp{0_8MdMqZj z&rj)aWVmnRNJF7SHX4OeZzF8piUANg`JdLiyV~5=Pe-ry^T(a1s(N!$0Qd*oURM|1 zlI({=zp0 zt{xXIa&`Yr)!m;m=0}Kjo1kEB5QV;Oztk10IlP(tY)Odd=;lD#5QzfqRA&ut1@U_`h5UPRZ} z&*|cz#=&_l4~AitY+5jWqFT?_1Lh@arTQFnEgdA>i+p3XYb0Q$*9_;~9TmS?>{Kx6 z{87k4(h$aLcBc5W^!$9sXs}vY^nvFj&y(%93^R|Tbyv}ZlVu+|Z7R9icMX*owjFwB zgUY7e+NjwFb4+AiGa7wr?E9nn8+TuBj#9avtr3k+Si+((n9Eu@;UsK4e&8y&BFrEL;d!td&os zv(IWxeJkE%WqvPlvIE5N+h;~=|H4-x81>kbaJ&}m$#kDk6R$1XlU;+l&4N0P)Cse@ zn4>0X!X97n{q;csaVk6B#sBz$%bxEn%+Sb1Osq)o>0ub-mG}wVB>yO zD zz&O3N%ZJ{VwJW>dE4cF&5HVKj5Ca9N_RCrT&i%RWgCT{GSC#99--*-4NIqhC!EVeB zMgr`$jF3hNt*Y1hTU>^+Y=aoGX=5sFKgK&w17T!>i=gaq5M)Lr#I9D5+?Of(I8gKf z%!RW3BmJ(==v~AqK-SqXstV97H_xp6)<7*8wCaN8NNrQ;{fhZXy59uV506hGTKz&V z`YAsvXNSQbhZZ?)X*NB5+dh)3n*XjRk*A}>&4zYMu?Qikc-G&D*+-CW48&ZnV0of?%C*^H~eNYD@$+f(>Y;?;SoKY5q z{bb_CHBMVkb?54L6@^-DIEBOn+jbFnY#&HB<=?_959X^DB-p0&(MOf&=EGFAy(Mb3 zH(%)%l;bHz6^2MulBT1nR&XKD-E-sTDzwxb$7Br`?Nm9tvt0-Q!eHc zv(gnM&j65kPMnkzu%`a zU*AtQzXqe;EwoCS)O<1Z<%qR9Yj_GqLn9Z}~r;vmIfM6(X~aSdn2ui=+uyL8?3#<(oY=($>B z^T=z_;gEj4pRe31#~}#9TaJ5co@98FU!WEJH$h#b!deS^rR{p(S1XWeywaxd%?*GN ze=mJWCG2`K7l4cWoc0Z-Iv=sF-dyz-*kEPnn((`+^?>eKGx>EG9>xs@Bap@tS+IG; zCxVQ-#?#d?k|6@ssTo+z9T{WE&wB6PNu8n6ZkM(jka$#aYT9bC8~DYr4ZU2&GZh5bK zOIrESEmDhhyzxVcVJELtdOW3=yhz?+%wi<(a~*cl3YoX(^`$cfwmqXG4#+wfmx5HZ z(XIO;Dv&DA0WJm5@7xzCUajn}_`O~qH$Vip%Be+3M*y-mcO-YD2Q1%Tx^s2)0 zp7N2JtEFm9PZGZui#YO3jx%7ZTRfeM>)33W{3%YEfo`owe&D^1nUaZ=Ztq9$DE04NM%TTWUspU5% zCqJr7EQf@u=k|lRKlW;s9Q0FYmYwf3WSdA&Inxe}B`zM^+v%K4%kDxN+n4S;?^r)b zxt`YAd&fGq`x&ox7v0S3$H8<9gHlS&v1&+sY=akFZiNTKgHl~ax`P?Y?**S(?gl+O zYQJULfMf#f(Za)Z52!@9mCNa$I`+hqHn4+LCeGCNShyG63E;slo7 zRWExjw(1SKJvVCGE8}IIk?PXkUW>Ss?JmS%1!Z$2BB=`hU=1(Cw7%=7BY9dB1HOxO zjNz=O&#N6Qr=Fn`u#-L;e@=M;$UlRrJ+nu* zl%QOj_W3Oe=lyd~8#2RG#6mG3S^?=+7jU`A6cBv)vt9u5S1NA36Zblm)4-RKTtJ;t7z8$D4y*m5Zf{G6)@K?TSoP|)d75w}XOBQx9X(Fp z-`OB$2UIbKg(zS0iLHR3a*fWt_z)K+p5S@`B6$lAqutpz7myPPUiSr`^`tswnCL?) z{m+!U;@$zmD=$UQZd^ygF(3d0IU-T=3pKQe0ZHN0O#H5T(9%jzjmO$x=5*%jC*`=tV3N;^m+-T(txO#7S|Qa zLL(dGElTDR`i5;Ez`z?z7zPWCd^Lb8{V3U%j>h*g;oS$g-;dr65thuGyMGu?MQe8-RUr^fA zE!jQxaq-zyOhyrO8c3HMukVgwivD>Pe2y^fk>ZqX--uJe0js}-&l&+92oBdjPER!m zuR#jbp*rzb$2NI`q83Ba2U9h-^@p1{w>x@1(rJo&G$tY0UtoK(x|HY3v0&=$ z7`x6Wy779XTX_ZErqg9Sl!hIp!8iQdgV`;$g_3q_VVK!aP>SEcZ#F0~qa;n@_}U3= z+m*D#-WeF1td;eMOm?_TN6dI5+&r{46|TY`J;pMmp=1+^KS?PTf4_3qtU1;HAtq)X z>TV;(IoWaKo_?q)?vK|q@E8&+B>7eGMw>D4ywMonmW$H^lb@So<0BpGBv7sy7VgzF zjdI`X;$*L&L8ILK``~n3-P@c{5Ynpe3Wispdj@pHFlFqRa<*TZp)mBpm&*HiCcs{V z{bRDlnkDposFCOKt`?e7)yY)L^z*B9-g?XB^J0A2?CvC@WOf)*>{N}G`N$^A_ni&)?BRstRaUa_H?<(h&fO4C`>S|p2gL^?6?d+z(vEo#GpCdC)KmnbFM z@o!$94U3q+9AT5~pOE%Ym5wBL+MGD9VLjVd(YW5A9;-1eE!ks_3g%!cn66Z+3VLIA zXFvJ)l=F0}a_Qx4qpAswZq6BRw@hXiTMS#upcMK&;eFd%kvNm&4_?AuxyWcNet1yT zI2FWOj`ksG#e_&^p~}e71_6^+ zJC9j0+$ZX#$J)Cbw$o3!_wOEWrE_$wov-lI(e}kXtkm{&)i6mLcB~7CwEJ`{{%KE# zLvf3gZErN*k#xNdjZjO zp3RfKZ)4YM>OBvBUOsMUA~dm499%j%`ce4I?OxhDM(5XOw^x^G-luX`Cz1-+s+HS| z40dYUEq#mP3CJ!aq@HEf=skA*sa(@Ht8>0ls24ACbs{=*aC#6Q(TyIfdh8yJcg(^4 zF+fY%t;tJD%$7v)oEQ%{8=Sqo5n&lh4A}(_t5SD-^jhA&C zgDH?I-yzFs_+XX%(9Nli%#y_JVENmZhkh#B`0U!B`Xu!b&$#;)?`_dm?lF;_ zHh7tt2_jG6R~{@lt%E}=^z|(McSM5?BV6Wn;&nB*^k)sdJkiS^ao)vIL@4hRs+@5p zp1w9EQrWC3wxuJQcu|lyU7<~^up1~J|L{CM*{!#F|1z$yJdj{-+T&FwUZ)yP(zJJX zt&IfN*wKornRam!Z{enf>g}1D9v2DE>9bJ&g1Ws?HnNY7u~!I!En6qORy0*_7-r07 z>R7cfEuEwywSuSFZjvX{J}7Y!h)7L!4|hMF5c}-z$OdpMGp2cQ?ManbA_Lt=CWodq zjFP0=fw!Rmqb0E#6mWjOB*NjjcT(FOcweHb+FIPgt*{(Rud5b|@x3wUr$OJrP7|lo z{DHDDJuPhi^U8Hg6r!Att+HF-KVMo2mpX1J0yf*fY0<=Eg#1d&S{rR&ysd0hu( zL7O)xa@-W6U(4=@1&l1vNNCb|}5RsP4L#YO@69n^O$Nl^E|)&wS?<3otz zH56^LOMXnyb5E=X$%hPadZ&W(?h?!t<7*WX{|KS2D`0D0q~82M-WnE(x_gL;z}XCr zvbv*yoho{5lFepek2C#v9OvXg@(4Rc%BFE(Y>+P5cE7_RvW1=d2rH1K*X|aUzZfjU zyHf@$8yUT7g;N@-xVYF0dnRq_Z55U(yH-WdJq=U^D%}c{&P@clQQzmB-x6>5RV83N zM~NvkmYMN%I(Gr-WBKEW>6OAwCsMD8qNd2KJ;TtI8)6PF+oB%TNHkr}g2*-a&Cf8X z$9=UX+9i{2xZc0Heg6F0yR{0xq{~~qM;kwmQ~ez{_ij6SH|fFzDK2y$Ob{#^uXt?j zxJo{tTt8I1zRRLI+^iqiO?Bf<;3%8^dz^{}9pS)o2F2vn&^rbquo~14lPFcas`;9( zL&f|8j_b4l;jEp0gXR%vx?2^E%CZ+H_s?q&-C%t|8NR?P(M(_%N>S#_{4~lBx zY*BeN#8x?TNn2jmBjZfYr}&@uu+0*|Ylc{>*YOz=j|b?LmdB087Gx;jRk&&*RWc}& zM)LK!v{xtbdOT8~{FL#8NK}7~yIe(Na;(C)G+KM;4PM;o)seDiW zA>gRDOYWR{VS5?5UN-Tb@Tk1A8)E z()ilrD0Qm(M$*D5Hid3_jWNIZ#BWSE<7dXta5A;GUc2YK{7T)Y46#QNsLmjVqouzD zwJsY}c~`$lK(h{TzpAiYOP1cbjeeOYSz;}_%AH3+gaqe*loi@o6yltQeqTy^9fj6A zy0;@7l=jEOF<1w<&fr+iE~nj`p=`Gqcm|jnDLdv3VSky9-fr-e8>OyhWw)@fs`Hz) z=YI+oT<{q|{F%KVtTw&cw%l5Z@NG2lwP~V48_}NlS?;stDShLQV`ix4x+m+1%16!- zDkqw-vo({I`rUWDxVORfXZLX4Bh-&ViUmjWxqwF~m`fyCz1eb zlDA6iT6HW;51>cqc7PyiJ;!&i(H1fkBPd=EN4~|UmZVg$;aJ)`9h{S^_Y_!T>~ioW zzL;L}AT8#NzoZQYAf(D|4bt3O@IBr9x20Bql`%mU+IlWZAtSO{Poc7LTv|Vsl`$DxqFX3K27Uyx}f)H zRP|IoX89Ej)8+88Ii0(zb=%nTZXIsxDOP8*NX(Ufbl@wjENgUCg}6~z`TEH!N*Hg) z+bZ!U7CEQnWZ<5NQS~`F=n*=;cp>CD`_`|_EUa;=DszA~<9HfAb=<>!dL5SI$-`E4 zpl%5c-Qt<7lzUb+7?U@73yYo52^0Pg6Zk_FX=&wG6Knv@?(5_vh+O+hqH!0R6|#UY zY$fQ7B2{*_!zeP|VI#MsQhaKjMnCqMKhKnammr4{c$92H9Gt1{KrVtqL2xWNH3<48 zEaCz6Wfb9r7cPY*7;Oj|f0NEbmf!{nV3kjdp_}7c7*;Ech2TGv50!pHf?l?OndV>W zMbqL<(aMJtN>0wq)CekqPilLG<98~WQq9(TvfJDdaJB!v_F9L7z_ zY8sMAwk{F5jF#l2EIN;Hf&MacYZZ`hVDY!!X2 z5(uSEwggy@eEe9bXBGr-B(EcY7`5%`#CX)RzM{>`r?_umzy`7~Zf|H<*B9#c4`?v8 z7epXqEBbNO#C-V43Zk{<9`bN1FOb66nB?B0BEpQ$yN&my>&@js-`MUd2gU_GqXAto zF1!*aWY#iM>`Loy0k5e)n&N(c)93&%;U?`04{5{m8C`IXOcS=!G{S68m+tNcrc>l9 z$H`M|_9(GOCg)HGn|gM~aHp@Io62RLt1RigzzH6g57zFj!;`Kx$H!f+P_oOyw@g#H`UcfcKE=a4|b{^&&F!$Y>}+U#F)B0Q*ZF&jp~pYn6j@W4iPgf?xu=;LH@ zZpU-#l@xa3+T4@K#ox80u8Q`L84u+FPHK4<%7-Z%(hhd zW8%|&BmRSq`FB3~eTVzw{uTE4TB|Fo0W7IFSCb|U#xW8H)r)GxG!Kgr2X+=2k0L0e zJa%9|cbTvY-xa5-Dy@R=N;~RQBaAdIJ9HM26`O?_Z4D}~pcH;)f5=7h+3TpTLTOeF zLpsJ)!HyB+l}{K_?wh7i7fcsCcT5e5@F-ChC@r!vbCYt(w8EN|Q<^3$#D2~>$PFGHAl?;J zdr9sTCbU0lLj0c8H68ewgdNPB&D;J^HgETGg(Ko-i9_!Csao2@@iK68ICrkEqSHp6 zA312{c?_a_ulU2zHFNP%X32(#9i}R!Weul|Y3B-J>zfmm7l0OmS6C7G)qg1Ef2Z$s zNG*(Z<>iE^}lKFE-Y`$dN)^d_TEZ{yT6=C-mg42Ai>UO5IcYyDW+ zERYVfz~;ss9jf@v9=9vA)CDlqgfKgbq$OTI2PPKV3vztYrYrg?q-ct08cyWw+mUqe zUO=o}{z~X~s*^%i)1yNDxS!cu7&@CS2k|SBpmV{A`4llH;}zLw9ke>ZL=AC~vLq+e zW+Q*1xN|3HCs;x}n9omY%t-(R3<|3k~lFC54*f2at96 zO}f8%*^(Ioc=g9mN#nC@8~W<{dwApHOrE~#=X)EnxdYoC?GT$h-74ev9%3-*V4c7F zuyo4s8bL3+kUhCX#7ra z4p-9$72uHd`E*c@sgs*e*NJ6KzmXrA&Il7391#gqgtTwf{w?GvlZj)T^6SdWd2zsO?gaVCS_z zx>sali4ypV0GnR_P?@FXy2agEoUlRAm2OxqD{xnSfD-mGh(n3kQl8Nz7ECZ775|Wc zDpCyKDF<2!(gSKKBb#ypHy7EYgH=fm#MKwXegD>AS5S3( zsMa&uXe?(iZ*!R55NWvl1TlYsN8lX@yCDc%7JTR&6D3xo&ngh&ERcSO;uM`t^qo7j zkc(C;vgTg<6~+L7+Jz^4=7Fn-oj-C2k}ZmhIHna3ZUg1^?}DZGyN~&H@Ee0DOWDYv zDnXTZ4l55|#$I(1kp89}Z!UA?2<(#ulak!$+tVO6)>OYTPb8T)-=Xn{TI?q()8cq5 zN~E48%KKa<>jQ=xcG)9K!ewfK4}Qg_8SY2#=v*hoRvy+CerG%nEnrXRV@egGTP6ka zk+WA{aA+jdTqt`UeRt9Y7y+#B;S{{!SPzq*CkRDY?$U{>ud#zmx!7=?(>1^klhdplaYy}ad<{5 z%5eB?1%sn~Nx){RPzk3}txs1>H%Rve z2ZnK_@KXAYujg$$EzEX^OPQ8-Hx0iLnw4kv@Zt&;bz4p8Paiu@w*4x-br0seZaE8< z;5#n+hT~4|4YsHm(EWr!LPEAB`_-}IG5X+2~xXu9USN=4G-d*s>1v$9hyy(`VlxOeCIFwVhacZ4C0e^8j@)kdS*&rg)4NQIdWQY6{p} zeb}I4Qds!RnPiO@m+!EhvacQscbrvuk@HF8n8s# ztv3P78s77Jq8&pITKMWH2pb$gP1i>Y$MfVZR_Rs~D>U<%j725cYnPYA{Ec~!#~Y1O zBj9^mn~7dbO+#K8LWJ+gm7~c4jH<9F_3MAdq;~)OT*-qc%O)B=Aihydaj{2E&}0!nNr-m_(fk5~ zEV0veRl4fG^+R_AI5N>=zBIy3#WfqG#qw1Ckm_x4_w3z zB(V#gPbnG1n?}@YN{mPX45&%>n^0ub!y`R*#lpxoyWXHic?#-}0aQGE6&amSugY?quql5bUndxaKa)TNA>QzQ zo$#`t!!0NDo`XY4(KXf1^l0irNW6?>4w29AVCS7lDeAYon! zGpaGTW9uF@hBaMT#_ZJ$G^SzN)sgUVbJzq6qDPVJdOt+ILmzUd&=8EKvL}c`!Lmf` zO7g6H{s~$UB`SqspHsir~%ku`jH(*!@`; z*Kd;>bhNj!OV6wNP202VZRHZz^S3=T>pRzY{*wbJNh00lsLuk)r3r6zWF^EvPkWb@h0RS=>5#=b-IL6?VL~ zSUV->rigE~Y%<`h?Di8xEkUbU6VXlzgTSbOwJ5kcxOAiUrMov z#p@k_6vDgWQYC<&a}Fgd1$Az9L#GeEW!D3Ll#b2A?=DNe zD881d42C-|c|LsCjGA}GZ_01{uHL%5$YK#`ULd4Hqa+_NWbqk)E`2fBAUV84Yhgmq z9S`S9-};7Q0r=dx9h&di4_d3+d}sU*s$8@OP1YTYel)+E;iVm-=HkI{)p{mHo0wK3 z3hWto;B{;os`V@(F`T2&gfTt5?t|-&{>xZ;u`Y)!Pv*qF4uAG{YCy2o4y?F(fo8e= z@E7}o{!_5A10(QiM^68ZD+fq{zNvywEMDd2x_(QUsK>u1=N)I^kgvw+DE79MqtT0x zizWO;3w`r1XQ|qSJs@knasw9Y=2}~Wb_t`&LZ4T;E)w?Aygz7r1pWcdb{y&Ir212+ zKQ-wCJ4&qztM9DLEVr&Apnqo>Hs_7x)P{%rHV31PPVx^#`BO?up_UJL_h4$DJ`NUR zJztx{yYDb)5xx(ol z%-BaDN{F-$CU_^7Zc5n7TiP{Ud}APCo*mCOV&ExMQxUD}?>BKc4tC68{<&uj7>8c- zxyb_v_FZRUeO#h|<*7AUsz_0wC0EH3nAUOvt=n)f6o{6x4q{FKt(<0clh+d#C$6l& zK3WQ$c3elmpZn-td0DZ-)&(@ubB;SS0m?$~xEZxrSL%Ng!EXN4+#EU+YNbJq8#S+< zEq`DnhLa~#L;Xj_X=;F*i#mfy8C^?sSSsB4n6uXzjMlS@S;}@f9Px_%^AlY{oE^`T)L3v**9rZw3 z2HegW-1QA%%dY4*>`D@ZsS@1~~exoU48Lt(=2v9Y#9H3Ujo5$5g z9(4{Rj-#?$+($i5iXjAKFl_u)YlKx_F2p7;q05c*O(7HUq-by!(gUE*jkWajX8SHn zmTcC}xc@jbFXB1$xJZ=D7M$?{JfjsbQ+WdEQT=DYf*&w0Jq%!1`I-@gu#;xOdH zqtNEvlUh2Jh7jMK<4s)a*`HdCAX}|SOTff>DcX}vR!%FH@cw2vU)SUfKjFfxhNE~I zZURq-bkO2W-D}C*2^F(~I)fNg#mo)~VG8zKacFq=nZ>woL0Cv567y@2dT3*Z%$UCo z$dCJq34dSor_vTb(BQ4U>-k3}Ti?87qxRbx%(lpnrWnrt9KRi_Qa29~wXQJs3{#+FfFusllj~!D!OYl4W80{Lo7zATW z3$-#YUBIH({HDJ5JdmV=!v$dvo9vTD>pJ=_Y(+o`^Gh>F41$-&4O9ct4<0&J934Sx z$uNwOLBj}S>p!3|8Ly*s3~8*x21;b+f^FvS&tVh2wjJ$R%_Ar;^HXSDCL{D~N0~p? zM}j9|!hJ{jfZl27mu0z}cLC;~<)W`!?KOF?#kwx?6{U*RtP*}s@cbmxao+XFb6BWR z3U7Cg;M1aFKf$?uLXaJZ4C8b^K46iP^LT1D4ry2%) z?GMWTEx?QpbX&a|zryZmj|{P6hJ;HP$Fy3FVxlJW8U{@|Ij!rK*tlr3hz0=&yU9QS zRV}#T;BkR>C80Noe2^B=&b9fK_JulO5&a~RcKk1>b7{Zz`+@eyyKU^t)_PnA-G!YIYZg}XN-EwWUb zE|j->N@rr(pzUFu^S}H6eE*G0O{uHPl(xx>ufbOIPsg5~$%x(($7EK&0juMG+{h3a z+{wLfS{lwi$W9#8)jeIp{E&{v|k9vN59K=vrtFmaYEE^8J80tIQ&j!2KP>D z3JfEIIHVbuaB{9`pF9g37*FFh*g=^hk{eZliG*G&BM6a-P9r|F0yqetFW`f>Vy{#A znoq~UqGliDPb?IGMm381PungRvQ7rKhq^4e?#29d{rGn*kVkcC3UfY}V!1FQQ~-lr zxM5KWzasDOKiSIO(9eCEc;D=zy@qhkjs5Fo2opG|dKzBbF&(S>!6yu#`hJK>ql)ET zgeomoAlL!kvY6AgTBjo}oIvA|yQE2w<)z_I z3bZ-gTFiO&>aBM|!u2+By4vsKEq-+jo|~~>z9k;n81n6GnH{fECl@9G@r%m}8a-X8 zl5qF&$G6|~UQZ~0iXH>hgXfP~j!3s|OP34#nAm9?-l=p4hKXI;sRzljd zKTFhK?N$`;SK^nDQ54)ZKXUN=GoKNNT9^{up8nM4pM?9C7h;3I)()m6UU!tH#P45SEP7;{D?@3fcfQT->V<}r`;2%aykBLMEK_sz8n&p{7vn+)wiNnG9vj~ zHT4dz`Lc-OT`G~qtJpTDn6qUiPx0+>IZw4M&D_~4Nssqsy~WG}25O(x-!T7O+J3O> zzRq`J-^EMLB3`2*n<4y)hL`>`JLU?DO?#PY0Hi9Gep~C+N-Apr-W!L5{5i9{(ZS>_ z+jjIvyU>J4G%F-2j-o&R!TP0yZ3UEpQtK7M$jgPEVCYj%vQ7Axo^6ntf$4J+cv^0)39x0mXpwiUXJQ@N23V0gl_6OB+KF3oM zb)iaR?27jvGrRk*zOQ}}w=2UxP*3c5BkBL@k<38`j!5Ad#hbqc6~BPt`r~|_fyF}4 z!62${ylkH(4;pa^J7qwbVXN$RKrnA`!12~2PVQOta(5|d1>+`aKFJ&N!GNFvAh4UE z%OQcj`X`>4^qNO>`lp5N4@$nklCq_C^-6G7oasE?u!INQA60_?Cl<%8R$W}&;FRUv_0BZiIBwN1C^<7t`I z0k+9O^0V_Y)HS5E6_8o(Xe&_0Dk(T$d~JAIUN;gR=Q@}Vlq4(qOHJJGtbp-J@0BI< zc9cA94+Lj;X)EnO5rz3O2KeVV4MY>fIHky-CL(H`aDWMI4n>k4cr4I4t|h53Pv#l` zr?oq4kjWD&jh6po0Xz6n9OnnvD-QW8$;T@&zp~`lMUsubVEL*>p@&b`P2d|lz&5i2 z8H>#NOTXZX!?LMXPp5|1t%mD@oh#aGmx_o$?iR-Swz2ds7A0ZxA$fOP!S9F5HYA)z zwJ*L`0Irmm(n8OD>fNF(w3T$E1kS+bstb8&wn!dK9+Vs+LOvA$)9a<3{l~4S-z_!xm0yX(sP&y=c6*#ScL^KK&u9$r7;4kw)bz;iCpR|#(5WOjlb9z2HAEGeSRqqS77#shUR1= z!mUO`?BqV1%m);6VMmXmb=M^7KM(b6qeN%^@(8_^QjUjd%>j$a7ro*Ddjxm$^TT~% zgz8nFOgZdtmHu%C-;HhRZ$w)bY)j!GQP;01YL%i<;roBCL~Kt|aPeh=HJp?Nl)t{g zJ|qM$vahdstcNNakGI6zzws3bc8HA1vq2q3F8|jaz_b1X1zkIn`nb{mpxkfzxvkv9 zD(}l^Kjll(XReE%+_f2-JmvppNqMsQd=B-N3#DJ>7Cyz#%{FK{TIi;bd8$;t;@OXuqAa9 zjh-ufMjbll{^Kuc{yXyW{yXxPC;{-IHubW3YVTCB+OGX_|GQuZpsY#2;O3|O@;J$v zB=?T4DxLciijbm}S0a|UYd}cRNpp_=vw@Z&&1Q#QXHe6mz0@1$T^NJn4G=Jp4Qd*P z8L71+&|j;*FFN?As(tcW9x4U8UXYJJx@hF=%)v&#rTXo|HyZTq9x)%~_#=ELZL$El zn-`+BXnch0=rBS1*S_5~Hy%so-U`bg8Ao%a=Lgqq--DXFFY^9wHNR!>&R{&d;NLcK z&7OI(@{_^p7-3R0Hax$3Kq7VU4^G|tTXsry_tDknp@Ee5h6{)PZCAzO^IQFYT@~Gb zyDB?+G}<1t7HAM?eMikk^0TW*umNeUqT3qRFKa-zO3ET@$cyi(oMK1f$Trg_XjLP# zv1HC9widF26T0a>*{RNJkAUgt1|aIx?}tA6Y`C5w@JE^=BvIFJO`mE!lGm9J#>hrX zS#=BpWZX6hPI|KQP`?;J0c5d1^EFvms_le-fmNLFOI#T|F@5f|6k9 z*OW{UbdktoOC~Lm|5c|a&)dKVXTV_#NHy;`H9`EBk}WU2>_WGwz!MOAz|7SB(kUI8w+s2#+(W`IsX_9f9A(#lu@g~ET_OH2zTn` zb?G{gWUuAVRXXPtT4-=wGLJTw-@<~@Sd{3PYsgi67bCPf?DP8owT2$*C$#Jf)CH`# zITEfVG{FkUJsSHp<~lVaBtZ2@%+eFfv>2`KgPl zivoHPKe{-dItz3Oh>Ege7!F#3V8QfR<9yZMb(8u5Erekn_eRdW3eCNx29npsfWAw} z{}Re;yHaZrL$kPpcXL&tUsq!K#tiH$2h86wBiK7*U~n`<8%Kr?9U(!EV7atrnx++usl+*)Y^%s%R?2Iky#S2e-_JlQD4V?ab2I<1}9_{~&U7aC(b5$PgYq zxy%vu@~$#6Hh4+|@Hz>h$T^Jix!W<_%Z0bYF(0p?W(v?JWJ3RjP8X{9MRJjLiGwR_>!4L0`E2(F!p|S$g-sX# z8`@08teC)ZqsCl*49mPbJ0_cL&VYdHR-P*vGiw{LwEmZz@ov=~2wsAtImk?OMBSX@ zA$yW8)OsZk13wVa(b-`PxKlJ9Pr5*{gv138nYTSa2@ zk4wpui?WY8m-W2NHPyhU{$P=Io-9h54Zsi_R#}DnmfCY?Mzq%ajI`z3E1QPkKKnMf z;j#PtY$6S>oWN^8*?*-C{zgyUl{db=I#xXWKC>TTP2`B(TYM)!pS_1#33LE{FF3@@LkJ(pCRxH}NIN@q_%UUD7(Mag3y! z3-z+(#)aK&Jv@gbTD@1~#BX{SW78BmZ6a*e4LZG;*Tc4%N^b!x<)*ImAL~}72w6yv zJxx;i|JB8qC3OS9R@EO2-{4N*8L#x)94+o~A8jaGR>>`gmI#Yc1;dLOwq8^;+5SxR zQd2FiupR2{Q~Z^5G_HElDjl-)J1ygSr9$X$vgrBl$ei8g6p2j8;_tuliUz-qXN6C6 zp~%r3nLLTRC#96j>!B?uQ8fhPnctXSKp%)sptTr*)k(IvwX(|&FtmAOeM7Vx{#X@z zPcY_KoG|MB`#uZ*4_R)snmQ26z@WW668pbI4PsEiqCShNvmJ$yWZV4GXB(fcl_sY= zOj+25(4Db#TDM@?CAO8VT3?}iuVUT?5>0`t` zckbcl?N(#e|8X^7{{w7D4IU#SC0FEp(`c{X<^H7(H(x7H7I(7JphoI*Y$7=Lek6ea zWRI&+UKZl`g&GvHpo-TO$$uF|2_a+-oje3JD&KLSuvHAi>8jRVw&y=1d#!kVX|*J+ z{8!j=gw|%V0Ke9ZHK>^ipjiwLg^xKoA^cKZ;1v6V22EecV}-~V&jS7Si{2>e^DBy= z3OJIGAeXJE+lQ(P@U+nic0VrobR10VgO95i3QT;FBra)(Z|z{ArU1(@V_h-{7zm6anq`scl!V_pCUGZE>#)+z7aAF{)=2=`Ie2KW0N$h{TM}$ zmeF$dx6KFU0o;Vdnl>O(J>u^6nlBs?=x2UZ-*%(OY9+l`)bjlJ|FQrwrCstmhXsay z-DL-q)^B3Ot~Tv_6vH)a)3U{EE-s$3n+k-fX!w{8$r4icn3l53gB@XB>#bQUHv2e? zDvKl0q<`a0=LL7}8izsbv!=E)2nG(9_5DUZE}XqvdhyldYlEuR)p)U2u$Te7rL z9^Yt`HzdTJk%6AKWDdN2<@tHGq`Prq`Rr1;r@Zwc z>SVd`Gk<`tF~h<4#m-F(JgfP6@?zb2MU30lj>&0Qk{sjC2b5*r>*z(fWJ1wPp zLLdzJ=^NF9n=ieCw}OH9jhSD^>Ex=~Yl|(dlbos%a!~wIt_?DVv@*}dH-kml>3|@x z0pT$J0^lNw)wl+WUc|Y-Zv;>MvXPCuZwTE8(=`sA=a%IIwh^b%yrE#OeeRd*RIod4 zGrcqzd{+3*hbs>z;Fg8Jo~}pPrV=NZHrX{5<0jO5{Po`?Ebo{TCOQTzwzH2oo^K9^ zeMp6lxwc)M-xSzSJw|DN1dJ55zGrT2)xKvcvz+a|Y^xMW?Eyf*1SfynpF>WvXM2hi zG6#>A5U?`?I-$QhMwnacEs-O$!`Nq&_D2UW)OVJPlPi6RFm$B;XxN5VpKA;na8JH9 zs0c!6qWr4YWY z-9JbdT0egeXNJ6JOL$VSL6$!h;G34(_@4J-Jle?crDl%o0|w9PG|lPV?N5c-2Mw3{LOH06 zdz;Csk8UMfn_kg_iIPrglfK2j@}{{P(wnv-w07=3GIH;L>5YFVT71#ov@TLTL382s z#PCJGXr`UYng`?UWufwSB=dil1^fS97N9!Xz|*Z+@O^6%E0liAZ(lqdTpF-)?Z?3a z8L8Q76BCMG>*A6U$Tl*d)~-tth!c`CmbKZk@kc5k{4X3B{{b9s>ehKu7TU%cPi=y9yNvrL^9)zR>gKK0oIL05?uEXwtyYG^6axjf>DLZ@E zrf()Wlh#EMQZRoTrl|IZIGQ>$;2@TnebLX_n25S~se-M(zewiV#_@kr8Qo^R1CnEIP2j+k&F{-P7ir$W0pu%(me)t$`9tFV9 z?L(Dv)lR?<<{u5E`zCqkwNS8(YVbR-05Wt?={7(DL$*f`THvW!eM8cSeNRfBf6ZDR zTI#PZ8VnwTJ`EelY(jVsbHDho^##HDMwr=hZImYWp`d95@-AjHM{0go%O@E`6c>(^PbNzI%3a0(eeJA6W$B*N8X_6o9Y1{Qst2eHk% zy=#2_!6DFM6CLmi4D=xn{x}nr%;9e^p)B7?%z_MCWezn3eFI>O^djpec63VU(PFSQ z2S!C=LbJ0jp%LPrjAkH7lE$@f8s^7>zX$VF%MOlr0O%F%9^bq26wF8RMznRVNQKoN zaRb(c(zwT!s9J3_(@RNaYzt>T7?aG~{G8spBhwYFUZ4@VJHRUDukCa4 zC&=1cA(V1_mudSKi^GxInF}yOed~Ja?XQy)t|{@Lj&w9p+Q04mqW)O?4UVR-lQ#*l+YFcf$o+ zBC-+i1z8NlitSO^M8bS3>NA_gWBZM0h6NN-x3<3Q~2jop2hKDHV95u zp!9$Yrp3@@@}1>p>@jlE?~R4^vjePu1NY0*UFo_Am{bd;7@#xgCzBEWU;1by+<|hmobC$1cw#dG9Z;C~#V^kY#(C5Y1a*|R z$(jq`GfS*hPV&m1d_-sfLT8t?FwlWs)1Ao&AU|65pg>}#qb`D9A#QQgNf8_*(`(E9B*H^imc=P%zxofbT5)?yt# zj)^e)j(V!|1(OlJ{z`N!U8CvCJm~WE$1GYceW-Mx2&Po(#K(~o)k?O7Mcl~-A=}MV>x_1|}-j44|4Ov~TTTu3f>`3B=Uk^D> zeU~$nV{mDiE-YiBfHxA_MN+y@up<$DGJ72ic0b-*YV+}=dup9n zp{wT;^_J9<2t^t$?^=^&SbTXqI=J>sIv-rMg#Ad`BXn z4Bj%szgtgDiS&Z2BRf6S-FijRkx%%SK3O|08E0M*ISOXnLGi;{)t#^7*F8y+<+T}# z#J0Gnxq+C^a^5tNr2nddv*;ace3K8Yw9#VnBco#3l;87tz!@{mlvu~ zJnGtIdVj}S^9gj@y;j4kO(g#Z)yeF)S=|6Kk@goH6I+1LAm#p~fo~NVqt>GVGt8+1 zglMgrQZ4goT;hbUXBvybvv9<3d2dfNSxj`_#L#f5;buAOvk`Yb z@h$ek31BZzAzC8-+KY+pxuF`le{UUyZae8FCQYM$U6+F8m2-0pvtImPV5Z5u@C?jQ zIGM??_2%h<Jw0u) zimY9zlWnFp+)v3!!1&MY{qj}b`yY`Mf@cf5%u~kpqi16m`Pn}Pa=mS%wcz8@+-Q(t z)BY>hM{;-&u!=K76y~-t8%EdpIhinX9nh;hRtB6;KuO*kY*oeclPJ*$KLA_bH*Lt7 z0d)Ktyj3f?wQ!rCaL16M;tqm}tc3!Tt?2NFg*jsFg+_PPO>oxD8&q36@cjg0?(_Gv z%^&jYCFsB>EC0`@=n#9$u%-PpQI7uAs_e+?ose?OVM?a#-0E@h(&lew>9q4=UBF<= zR(4iFzt}^HhSPp;(r}O2aMd1Shc~@~QvUE(V}fxn<@O7Q{KaCqiZowUAkwWIhA`f( zlS|>BjkrI{?8YtoU7nl?&R@+-&sovrWBHXW2OhohSjILs2_|vrDeLLml>0;`V+xZj(L-6n_gK(8{(a_MqAc;tK z!1%}9g`B+CZ3IOK;e?FSo`^EfjrhB{y{$6T59s?Mqg113KI<0w#T8V5Lt5KYk;#O7 za9@F{6exMDxdJwe?8IP7RK>J{z~DC^FFlQ!3duev>*jCVbA*>`Lf z3JB=h@kMokT}OQB^Es3<-j%-%r6yumhlVsfFBd0pg4M*tdg@TK zo44guxF;?k9hqB=`KW< zAW$FrL-?jV=16*7Y4?N+94}y|je-JUK7*C&w28qoB(2jL>i2){hoT~mJ6FjeL<-RN zHAuQGGI2*8mB5E|>oTMY-R+|DBuOm2(@@!LoJN+TTKv6c!XyfNbJAaH&Ad>uw;opK zjViW26Vr6#z5~(3Wm+k8A&y*~$wIKuOdmquL-j7l=Tf-eSbsYKD72ZcDQw<61QLH`I?>jAEG6i+2!a)l= z0P=XUg#OFh60KE``Du2TN3>F3BntLEYu=*Rr&VY$OA?Dx9Tou>3A?{Cn$?kPqn-Eq zD#EINJ?3u9bHHR~=>ONOWaPDiHjo+yVWQOGTi*4bb zhkA}BSYnR6i9Gt-E^^0S-kCM>iorrf>k||Mn@z8+MWQzF`8ixKt6HVXUqmt06B^Ww z`&PXd(M4oU_Nmy%et>Wy{5-81UjC#rxSl^X`HG#*IiGoj-vsQ*Q{SA{2O!(A)2^HA z{}c4a1QL=V_GC^fj?|^DR>+OD`hLsLmOE@RyYpuU_%qiHU$g|=&}5uzGMpkXM$d7~ zf$W3}8;T!@pEnMB%V#kdds3H1CM54EVrM0VY3J~veSFxzJm)X!Kh(xhxeK?lOsH7z zJ5%3QZ@z=})@0jhqy0=$rAcJ_`xR=BKxCV7+gdrFFZ}-36^iCOse0_P+!f(BEG3df z%0pGgN%5r3v3KIOE&Wkq@2rfIu$1@J2SF3vbAfJ~Z7sjIlq>MMEzgNZYtDoxVGe+R zl8Sy%0(uN8RBL^`$(kRH!vh~7{-t<5L0oDP4THr+3?SIRKWMN%$eJ}LeN{g^fejgK z=n8!WYO!4+c9~%6z}NZlFT9(0t7HSfbg5T*tC}QZnCdc8uwQ@x3Y6y9Bn>f%@DSTdTBuYSjDg$=*o)A;Y`P3*MOG{?mk)tM4~*BF<#uZ+T4)U(5fOjYWCOYht;Z zUOx>Jwce6MLtvK$ zm|NgacSqyP z@n-jkmhs9iRA-Ey3^6(~TjPDv6tWuob}&1$?>ZwvkakFCFV&;p=zM^8sf@&ucRarK z-$l1Z{^{xqV9D})a?}87o8!L zlkxW8z!0{<_FE~V)@r;E(RvnAD+cUvD%*Q~21NQ8EQa5I+@Eo2kp#I|!}lD|CA0lU zjn6%G@oCluE!$SL;&egAgicj}n zjmuN^JvzO%$tKZ+)Br=2P2cv>mwlG(`6MZ+K@!Y2GLp|Dkv$hua@gQ?AY)riz(wHqyO?R%P<9 zA_n8~8*l!pME&XKZQBFV6gxE8!c*I{LZJkO5o*YaQ`aKY4B_c^a^CwV^LI~j99SHG zNb?Kb9v4!TlK&^Jl)F7H2@Ob5+Gs#t-<6$3x$&2J*;0uH_WR^E(0#j*+3VhSj>K;s z3VUEd?*GLqyaE#BDQ=e}1V-E{j`hHf0p~XVA6IW37iHId57Q`!2qGn=l9D3bpp!=$Wd|aUg1_-&3hZ_?(c+_ALnP5np9qM%MLpw8~xxrsq@M*%LB_=o>LJ2dPX&iZsP8Vl}m zS5_R`Hfp|TE;Qs4`rUH+1R0xpm7hK$l+ghtHqh^nCvEmQKWa(QHPXiJ&(y^0G=S! zU>X&u4?FW|05daa;V^PB(M03)PZ4HYyhhuia$kF)@pl zGN7;L-ZvN1M(Tkum!@~vHr$>jRyKKam!X63pElCTBe5g|HQ5$JU=zky>m+G42V5{D zH`25}{kGQu52J;>)b4$beAvS=oF1?t{&qU!An6<6?eao_gALeRupnVLaZG}= z*F)gMAv{W79Q1cx6TSi77~gZT;~t(Oi)LUtaJq#Z_Zj)qud?7}S`C{|A`KuwU4q`c z8TiQCY(BLzdJ$2e%IL1rm2lW{;CM`X`Z8JQ5PEQ44YL(Jsda(5R}$TtXM z{?(9{<%hV!t5iq&1|7zjGDLLu?0fehUXGYuM@@W(J}7aS z7qULoz)SI*a_Y;pIV9L+k|A7v0ak$~Rp`HclYaAgd3ow<-DxxMMLtLcygC1%@rXs~ zE7JUBh5P&7U(*D!J+PHieO%iK8L*J@7(fhPin5#t`Q;-SF@U@evWZ7%zxOGp|CP__ zdU2x<+a|C)h;4p@-Qzm0zg#Z*$oKSc+z_0l&YeZOZ%?y&0=YGr_yHRQYz#DT%Kq)8 zes?U)z|b5j@}^D`UajKG>kN7gKTwIN!}&Yy zot?-k7Ays+hH{Th+Q`qyo&Wi;MU{>Xc&2>Nc(~UgV;ESD)0I6J zzdbNYZ-DC_=b&dx29Rt%Z>#v77IsdIa$nbc_31PI_A z5TRP*V$J>$s08B*O(LTuaDHS1?W$3VDFR*D3P~=>2~RCw0B4E%UDNtq5ME`#-OPpd z`}Q%wSeM6Q0&MxGKYAHoAmeq(tXp@qF{h6KufBf0P57t8tovEHHU5g%kFG7ZhuT+_I$fpDEsJk<0Fx2UXEgAiNSQ#}tJ3KJ`13Wmr&<%y&mTBH=dQ9f5L@xv zI6s9R%*YK6+yD7hBbBaT6+R4V$ zO_f*UkUAuZ&$^A)+;eKVJTyNv%wH&(((R6PHvFJ1(pY>YsWYwClhT;Im@@pUBp)XT zvzwCF^0Uvul>Dj5Dg_f%+jGKs`Aw$dX2!!i_8pzaPC+e7hC3m3dtEZts>fRVZUZBT zN{=D^h9yn@uUEUn7HQ6zzxvO6+WmRD^PQ!;yhF1)leaB8`(M72oDY#gAJ%L+6b|BC zGvrlVws_U7cv)7S9GLQ`U=BGjyQ|P9E==oDq2{#^?Jb2sJ@qEyW9L$J76n*AK;K;_ zmVv^hp>&1~acI9k$VoQPB@hnQdpGDUUoGQwm=#+E zO_9B}^}wCoY3>6<&AvxmTWf)Rn%`L-vb$8|>cmvL#3+#K)eo85e6uJ(m^Ty{SW@{Z zL;cS;p*=vhml2rfR&G>`DDEAMDD?pKcP79R#sO0R>3)HAmQ|oWNVKtd>*6 z5w(zI-2oN6Iq*BV0hD3WJr&{5awkvO4_BC$B*N+ewZG^{mU)Y1Mn=bk=XJJdmJbG1 ze~?gg>Kn*ZbeNFal^H)H+S7czM32Icr$)JctQCbir8PoB)`=TBuE#68hXmDbgWtFI zhNYFBN1O_x{Jd16W{QPQ_KPMTpJO4Gd%aGbjSW>@#zw;TUtzv3$kcDjjP0TWWUfx+AhLE3x#>fC5*3THp z=HLws!n^u-XEtU>sr^pGzp3XDK2^HU3yE=@Z-?!J*{}YQtMZ84tuyk$aG@@A<#@LL zxAnZqAwor(k`6@BDuma1VauUM7~Z5Li9RjB7S6%Jw<#ZM>N!esyg#2Vw^V`wFBL>X zI~;hika53K|FYwMeF;Sw^E;k$A1=}tOyIWB__BY7x#D)PGE}zTf6WQOLVOdb>eIx$ zRozG9aNfO$0@aH|}zR+mhzp#jXU*l*uP} zN>Q}~UToy`Xiy52qRr`7ksAhfN(q%#--IrwFN2IGs<2(-?mkN2P-6CXFmRkXeH9(L z9QTPj{?n1@z~*^VVY}zc9@OF7cJbHl)0Q*Tb9G}*TQy_HT@%52OGWd~0(FmM(0l z5IH$n9g%;tUzY!O_9qH8xE90EfZ)*R%F%{D;F#J3A*zbfh|rH z5W>6>@R);r+Nu=T-E?}^xf(vC#%bRJXkyK2yZ*Qvv`sL}#k0i%hb1Xvt@NK@lXrs4 z6#B_P7B>;xa7LbCZLyo>+Yfm*$+k;-e?XVEEGTSVW0N{J1?Vz_`Yx3I2?f3$XN8=$QvMUAP6`PQhnm(e zL!l%MY?`9piM2;XPt#&ek6C_>clzYIYjxx~H9@4S)kGZ5J3a3%&IyMHjt} zeXsSCx_1=qr3MPmy$dNs(wo*Fr&}G*;{;68I0zo?!Bj1Sg};v5omjp(@VT;0*j==_ z{VnCkrS8Nx2}$>9Y=~jqg<4+yvo|ZQ8w)R}WaUU5&OI`3QGbY`E7^&m673{j#I2hp zyqYSe?^#a^i*ibe{gkBSr_K{9R*BNdx}Dc%4f}d(H@x~j6=Em~(nsow}E#uKybw8JYv_vxQtuMjv{X|t>o%_0nTGjjTqS;^%- z|C|1CSp@Zg5sF$m!nV);YK& zmAtGY^z)nW#ZIf!>0&(Y@%ii<`~wG<^$tORxhG5`{9#YfP)Ace=031pfV{Ez@oE2i zgPz-B_Bo0vh*FRUI+1DX2(Q|e^QSZwvr&^BRv=ur-91ioNrY8Ampk^%aeRHe)47~F z?wuetO$M9axG>(VVdHLEnA6!{z4`8*{X)wlFWK>>ON2Eh#2wzy@NxYt!T-ZW*`752 z)z#EgDO}N4VsgV<@yq^r#3qf}Qdq2pcM9F*0O@M~X_FnxKmo4*mHeczR|&4@#cN*k zYaNBD1~h06wMP`fV{TC5cuuZpA*$jnDm23qFV35u5BU?0Bmw*619Irmnv2$qCQ)P5(0)>&j#8p#J535_HHu?0{wSzib}B6o5?qmsDYpr%?(> zG|~y!h@uBoaKbb;|2kOVAdd;a~x1$xft&C!%?N2|$IG zdbRMi9jnY7ez6R$^DGzQ-)GB%=~I%;Y=#bUe7NmK>H50&>D2EgDDR4UgVp6QozK}EXtez6p;mg37?**(Fk{vGwWDbyG33Y>E( zwWes$<5Xdd@ac@%4{s$%q#77Y*51_NAPlBV0+PoM5@+e6nLTNZ6R$e@(^#-a*&KSV zF3XA+DsKEJs8Z^qAFlhwR5nu-ESo_d7K&1-)K5YCYs!@f-L`^YQX-!r;qtQ}W7#gSkNK61 zR79uI6#GL>Z*u+bPb!F-=C$hhQE;KwEc)58#I>D7og`qk@e(@U^z}Xc^0nl3EqE*UfCcGuw=G<63src%(>NO$j;{Kni}w9tw#N+~P|BmQZ@Yp2Z2| zY3Yb_K@vlsQY2>V7uuKiygFT;V%m3DXEr-O%@wOVT_ww@h-$~)SS}kqk3${W(D(84 zo~Vb|otiE_CiB>iT-lxNkMusn#$QAnUz3~;oi(bf-NUV>yxvuFT4&bRbJ?Cb$cdRL z@cE|F!}R9ZW!k2e+8wBnuf%>C7d;x=+_PE`HE>8!YtFP2&OW*v%bex2P67_aI2$scjvY_bIv&MiL>F?Q(PKXq#f zfcr2%kt_Z$z8c|R-0P&5F>SI_wmXLaNCis=D;%bb6Zg(Xg(hhqL-)r(ypGZ8zuD!? z7jvWu@6G;h@)UDVI?zMx8NHLS^S*qpmE-T)PFaA6v0rcVVt*hWblvEHjYD^rK~Y{i z@`-7?47fBuRL-S0!3#THg$vEj?X?^e7?9xP^KTSY z-l2mP6?Hjr`v|Z3o6i;x-mp0t6M}aUElqeIw|cY}ZMq)-_1;s+ySn{RT49!sEzd-R z>r(mFdF#koR|yom69ONPFY2=odv_C_r((`KQQjVCoU^z085QcOZ5wCxJKy~VK|4gh z-+3WJ#b)Af5DSt-KT!}JEk04_l29}8;eI-r7UAzmii9~VjLH=6AK`YDGAabtDbr95 zMt-;j;^f`OIuw86kGT*eCw>UFB7 zz1AO&UxN||AXLHH`ErZCXn=OAFQd^Q_<|c84=4d(BG{w0SkpfSoJ9Q1yY$sGScrE_ z<{f*ofgby6=n&HwGnUz-h{{H}eQ|EYOMn|?xA@P4NT0m71t7zP!Y}i8np&Tg%W}pj zX@ii>Xd5J)SG@K7Hrh#K)rQVyU{-322Gy)wVPEFmEP_Tr{0%QdQ4l8huAgZX)_B~{ z6C1RsAkN4IPT;T(Zc7U?`ZmakFF?!CVrUgtI{F_G6@wD%WJ$A#Q`+yz1?0r^Yq zC+Lu#7qYq{|6bfM0Gi_D0DjunmnJ8mofd$#eX8dbccf4##GOQW7pJoeJQU(%&J4H zki_Gm~xPJ8m{&V1+$Go<02tJB42=aoh8i z70aL0eeAOQPJibeh4Q)s^tvTDqO0kqX3b@3{6MUL;D*Y|*?|9razC}-TS2#TYo+ep zbE4|I1N08Ml_sv9r`@Mzqf0?)sibEXhMp!%DQv8Fi%+G#y?pEu@{qtG31pUE#!Z_) zJm<|$6K66F4(q=z&T*2Rp6ul)WnG$LriMxzaH$iUN;8|x^@#L~{Q806 zSxBv4s{k3`NiOPl+4-y8p6)y7%21x0{P(JnwOiNYNQKDu0C+U3Zfz|HNN5@`Z3nA>+c2gaK+pq2~mtTb-LvIcii>wrt_76MFyS(059LAWOHPCc0h6&-NY z%L&!<2HZloO>sRvx6N1#s3aeF8GO+Q&}bSrW^ggoXUx-9&2lfgoPFt|$ni4Doar8vP z!k7O-*Put!=GtNY!pZqs_gbR{ET7$GOjA*~FFfvR-mmhA zaL&*a0BYMZ=tZ4V>4p|88!>T|aN~z($;Gz+^{0qNe`&AApW-_#y3ongJ=^#RRloAR zts1c55CJaJPTd?6m9O-*&yUH;?xVihPIIcSb+3KK7N1&(n<_CY_HdR*b5BO6H2{9U zL!ajEwcxuEP9%P8)W>&T+=r)$c0D8L^tfP9x_M`>x+o18Y~@!w@YZ=W$e&$!E-xO9 zjig3q+)rL9I$e#RHbX{Q-)3eu#0kVurf+kt`f_;3m zNJ4{sLuMZx&bT5y^}pGtjS$N9Zw*XnrdQvQK2o!C2h5_<@9d*$^Z&~}TY8&dd&Yws zF+V=2fLQ1WW;OF=zQ%2<#n}#Oe-@-6WZl)-I-5MOAzT>K#Z4A)GCJA$g*;8Dbr$wM zib;ah$UfFAVreSjML4`c=`=z5C?tC>B|y?5o*UVM_y_J$MUNq8+apa<9x*sX5R%mVGAX4EPU2$EY!1~k)a2BaK%7Xs#-<#USG-WLGR{a*Dc2j_cI z+GB_F<+S|8@LKAROFMJ>@SZJKn;v{owy0n#|HocJ)lU~vubQ9nA75TelAm6yD!de$ zjjLW_zkKc$X2%{H?|(O}#w6%PS=*8>zm^6*S|1u*W8&L4Dku1Hqn{cZ^=S6slWSZ@ zJdtB_?AL3%U@5SYr#w(wz9*#JTz`*#X}T$+RZt-mt&Kts13^envL_?Z5};f6(?DqM zrD!~QSVrQ0(9+2m#VP?qCtF;L()*%ifo%wi_F_b1gkmwsne_`Aik#g6VVvVD)b zB$}j@4@9W_PIW)P7XQDgj`NA;{ihZmE9?z-s+?YCfhxYtZBu8tULyh+je7ROH!PCu zvV)W3;lNXD)U$N-O+c+j{mWLtEpR-U5l+dU%I0tm{Ivv>HRdhgKz3qvrV-^tj)?si zsNayO(v0_q%r&^yh`c#Hv=5XtVzBVYtG7{LK=&&&wVYCohMMR-ujrIXD2^)AT&342 zC@jwo{UyuQO6SJPM&oq5?R)$psBqy-_K886XxIaQ_Xqn|3EC~^UL=OVhr#(zA>jGMCG7~?`E8;Si%b#AfNu;xmD^E*rJDNn< z>|G+0tHJ9yzyIbQlz~WOSvblL{!gbQk_T&3E#+GL255XB8s}FOSCiHAkL4>uO9#~L3g?etzw2++9~;1y5^cVAxaI(JaVKC0*7cY18)=0I zdhVH#aTo>ErlNa{(Xqra8jvvV?Sk{Po_m^l1c!+H4kf`&E;1pHl8rJs<90h>ai&^q zAWX6WZh^*cR>2k7OADDINdQsdr;{D1%X%4hZ5u=VXlKK{ry-_~hna!9s*ttz`IRQ) zbulgk?|#+dnV|+-od3gc5BKS+INPJ^E8nsQEI!%cn1OI9?%Pf(?1q>57o~16z_GeB zk#s517i8{zmY*EItk>|8r#NQWO|D4&q@-n|FS^mc(-PwY zOxq$2i59q>LZA>5hyc{PU%+|N#XUQw*?MHk1R@xV`9}5sN~ndhtl{%=Hxm$U5^Tc?Pg|wkm!-Chb=7@ls%Svxa58 z^5p!F2Ke7w03}YqdsL_fu6*DEa{4?ASu+3k1!!}?IJ#ENzR05*2HK+GAvywd4ej8+ zhXJyOk#l94{#Bf}8jbd!Vem|-mN;aKr6LnaDseL1@3;2n1nMi`Cho_!xPdQ_{*e*< zoQ%n;$3hCZwjXio(EhiY1DIx+jP3+8yaUCTEWn`YfwX|rFca6}_`N~81JHOhnbCu6 zwYe}k(?Oj8YD|mt02UlInt0^!vRsm;=-GOJ(m{2QI2nUMPIq50K~&)KWF z7USR5zz2J*{p43mFG0&9sMasH2-EXD9NhyEt_QUIn0HXRvm~$b%^3LXN_qmdR%Dh$ z+RBsc6*pc12fzj`tw?eKm)wo=0TD+NMxR%M>EfKPelWsLmy(cFDWeZ(a3ipQHQfV! z3$n;VY=rYb->;Y@&Ec!##_KKswKmoW4=aFWm}%U|Fi%a zFWs~&tfKTheg!!#L`hpLQniI~eL9>=v?+=L_F6LIMfzFb(5Ouzv9^KsLAdP#!=tYY zTC_kAArk0SslFO3V1iD$>4s;q9WD@AHpHDxl{riD1Y)TsDM{q8;=-H{QXe5jDgAZ4cICYPRPR@_b)PadyGb!q_%j$1VXK8|9 zp#)A<>kr$VEO7Y10;&x8KXZOsB*umYWfz`Nn@)KmPtMCP-7jKqWgt@rnR@KG9@flx zcqm>bQnsyoNO`|g))MjHoXTO19@UU%a2|7vtSXxh1Lk9sjY|hNFtr!R)zEzhivNy{2Ovu$W{NwL`OZ#AW#n#f=ZCY zW&Ln}c_2O`T%cRLcs1m@hrRLngWpH%^Zg8;A&O7Du$p_dY2Nhw>Zor|%dTtZuwEh_96vC^SpLn{q8Ly{zkMejy8;$ckist}#k4yb*Gg0>vvIGDKll##` zAMN+3HHruKPrKeTYKJULxzEIo73wnF6ZECSzh?{%ksRh-GNi&NZltMW@KZ2Oo$9ce zGa=*tM{LAiIyrtkt*MaA7`R@AKG30{UBW49JSpp6l9G#%_Rn&ReLd;BE1&`en&HccWRyA+ju5I#vQl zm_dWLKRuzE8`(8o=!_yua;JB;$NRLtpEg(F+Lr;coc!a+zSBHZXaWmUXb&*aX98p#erR)t&Z|G_~u^H;cx@8ac&kLJh>xN_tZ9_reb zO4b?Cxv|Bs?>*_Dcr=ouq?Fq?+x#X7^Ow5qWQFx`ou~8i#8Kn*W%0gDa`$1vjU?R3 z95@4uR*4wOS5Y9XQLTChiv|i}gJY}Rw@-NzDibo}*%XGHcysB}fLBdV&Fd#9i%K&} zbXq;vwXdfG=Z$iYW$)62P8(1Z_5#HmVOZ2^dF9>87euq=ucYqCMU|YRS#=~36HT~!jg9N+eGC6b9Jic0Jq(O!>6PF0bN>0wWL~ZBPyI-EZGS2^T$CBH zqOzY~wEz4O2Nscsov)gW`SDXs7R|~QK8w^ z@)H}+v5@&6{hrJv+^a1;1nhB5Id5(l~8{&pClSG&UIMUdK2CdtCKt_c_zCpCR;A&BIP^fhK!i;trT?IM1sw`5xjHu5b&85Dg0H^_YVatqa7Se& z{F~9W;E>wQ>_|q-t*Bgirw3n<xW@fEbkS%4vtyeF#8-hYfPs+t(UnFe$}s~z9y`M>1WZiK{AxP1>oqMMNC zxm1SyLkm0MPLP~mk}V5of$9NpX=)*Dk!zRNdVYQD!w$u9Ps)jLtGN|SUsy13W`ZS2 zMmYSH=`PL!nnNvQN&q{vNT(9nNU&PxgZ8#0V1U|9jeC}j_}&u(XWe3h`pk@KP&{IE zqEvsB%y=G$k8Ay5?~a=YWp#hVGE#kEYpPaopsDflC<%Ql)%Qpn$vILN$Zvp7rPVF& z%{mAfdzv_YmH*{oJQ5)FkKp4Di(X$iCk)bkN>HCYs#!1kB)DByF7pEzlh3U*-!4cShbt{sG!hNNqp)E8Pp} zmO|rQJc+ixgDo6_?s(#r{ZzVB%I|_}ak2rwesIPPfEZc2C)5F-jHC#~-J5q#kAy)& z(xJsg%tb{9zm0yfG}-IOu`~-P54oi>LcDUOb4}5Vyl~dlD!c2{Ec3<+=;d6T+V99Q zgbgu0Bte>AQvfk0HXC<@V=%&@6|b$&!azR_Iqy&Z&O8536M9ha>f8kQUhC6VUyP#z zUAS%Op{IP;U1nFTY-%(w|6=^n;gTJI@sXug>b=i&YZm+sQt zmedgdQy8r5l{<$?m5uu`ycl`J?qs0Pe=-v7xz}Btgg7l1xE1>tzO`|586k;l*`4%h z%Qd)v`@#jofpO>C(Rtan8Hgr}`It}5ChQI6+U(pS*93VYTf^&0-n&mCbK9Zj*6f^> zcR#w5`hL+B>(_H?-<`UP>XVVqb&Gu2@;FV&h;nqJv#pOEi}~!9oyRl87rP&XHocpe zoOX$~nR3pxK#oyYcSgdhv9aN9lyNTfX;uE*r-zTTR#T zl}i-M82||b-VM2gvNFrQdDl_Bf4<>gM&b1xbEstFqS7zyU`1#4$@110=ByUtQbQ7O zXvwXBYojA$bRJEBO!x0U63ddQ(2xYcuP>HGohGewV476}KxN-;s?sRg3$)2B3_imT z(yHwJK(p)Z6}rAUsVKe@HAQ|poVY3H0pYzPxV_*Y*DW63#aPX^7ydxi z3ys#f2^CvrzC8@n-cOue45d@p>%hU&6g48~VUxH}8_Fvx(CgW+YgVXJ8Db?h3659H z$@rZzeE^SJ28^pftA=nUs80IV&F+NDU>EJ%e-mp4*mAv&0*{B1+auQR5b>G!Z=LUOcjMHasr{RWx2HWIf7ZrA;_!(e-_E1r_8VpDl<%mN`XC#tvB z`5xk?L+{n~3IMjFyU-YR3$hl|gZULf3~I zoEBd|0~97fXwxJamt{yh|i97qbu5EO5I zV!3{Ba}TE=;*>lMw9_bV13{rK(5J%&dM;x@Tfq0A`8PH3uk^oeXR~A8cud8} ze(|)>rFh>O!H~lLI*q#fU5(;-_7tVtPh+;rcmpr%D8F|+UDe3hm+l}HW!2#cBj%6VN{ENrVcc))BB?t3U z`(pXh{P? zxZlL;n&yX!iw@zJI(;IVu1FBKn=10wPc}?MJ5cB>ImMmrj8|mIX67e`!N5J0bgh*U_V^Q#j08NJ6}wl&z)xMDWQ*U{mDr+{XP*hAq}TZtaj?lAL{4=8uJH2( zKXxfZ{wVU!b!jxt7Q7xAX3z9bdmWVUkmUJo3fGN$!&R4;Luz%m*T3~A)ou$) z(oC$|pMJmG*A%XQ6;rLn5XXcSjmfq>>0|lQ&o&=7DwEge6e1g7f=w8+?J-c$n zUXpIb{%-|&=KF%pHddH3mM>FGbq^!e`YBeZLs05IEkvCwMbg8L$xbz^N_v3IQIV0v3JJ;}N9i7-ber73-2kOs8M=YidwkuG<`hVRDG0NK1Kq-8 z=#DADQ1Ezwg7!~zF&y#$yb|`%_9pX&VBM>xkEJ)z-%Ho{@Qp;^Mua!{k{+83g=xMj z`}qxv7F;_0YTPct;gHt2(_OF4GDm^?)3{ibo-N=j4Z^vLE}l<}Z^HoPJqk{PVqS}@ zUmc6s+%K$iaJzt#!W%4x+HEnJGaM85*=rFLbFFkavl!v_Ihx{c9eyA{47PC?r9l-x&)*npq4i<9M4hqmg{e*>Kh_VKf z$=xza5(scN#*_;zyg15Db;ygyaUw{S^!msHBuEX%$CZm#sJMi#P@~U7ciy7nd~FOh z2P_3)fMX@c=4FM_XO8CP)E~#`Lvc*^`xur{hXOZut0^oh45?&h#jz^Y&oTT7QZGG< z>6fXRB0;m3^W_~e^lWl;_hEN6hEbHI+>X^Tx*$Go5&s@vRNsKo*EA^Bv(2{yvN+Jo zsQ4U=h*Ifpc`i5O&Mj8<1W<~jzr~zv4-srgzb9tJvJQIl&#n`QN4KW_p3FJwXRw{L#)D+ZCw_pai$2I!F!M-Q=%++l$P=Dbbm@<} zXGXDrz@k2g{WvNV*?~Ya?fv0-eT~UnvAZ2*dtH;)5hro;s3CKtDgk!~1^<%D_a1)i zN~^^Bc(MDwCRK%TQJat!T>i10!KY4&XaCXN6CGTM-ed* zBK=OmnNUS-QzRwSJ0N3PAkg`_vz1VwaXwML%6BO_z@M}c>Jr}Sp3d)U^z#MI`NJ^YM!98ZnJDj4 zptx^9&j5bo_KI#e-`sm;JW_0*9j#@DkJl(Q#;z%zPw{Ak9y~zAjoohxSq**z@|;bdmUv z{{&55m#xv=h#=g`h8%(T8&$3f&mTMQ+g99E2)65q`%@0;R;@)ZR^38U{$wmJJ!Stm z^=_h0hFP~CcS*Xjx5HiN9HcP33MqFxYrGDfmVddnCt*(GD~e<^R`6X3kSt9Q#CLi> zO^ZD9reK}&YEa2t;JK(b@G>m_RA2~wu|otu$PG<#AFGAfQS2t4XCe8h3VvAek6f7h z_wscTPVX_sgk$Z%aqjf#n!`k?`TM&+Vg0%+*a7Y^|JL^;6CTt0hjYQ(HjfN_L?(Rg zT<5~dmZu9B23|IH`7bvR27!*`13mujxg0%G>gq+5RokJOVB5xLDV@|^%rf;d26s`R zY+pM&8nBZeOLMJ1)YU}vd%`Grvug!k<~g~p3eGae`w8L9PZ1ZlJe?+;6S{P(GgB9@ zelcne{}%KmGCpC2tcmy(uA21;#e-ON~ZA`}zbZ4iOKjQVTAEh^edFyzk&PvbdRexSEtE zv{@35U$lLB-ozT( z9>2_gk)L2OhGUuruFm+dGqmC)sV0Z=Hx(yR@D7BE(#$LxY*Nnw( zb+xX9P*|ucB?WCPFpJQvs133y@xu6?7vb{wQ-y=UZbMg z%_O5|V{Bj#&;LSkX<^I&EoCrYkpuE>xq2#TrFR=Am*H!age+TM(%X@3Nc-|39fEb1 zL+^(3(h7*Dp2(Gy55iM$@*C!j#o6sY&})jRGrM#xw|%B+SSE~g|rey);8 z`5}^0Q)GSzSD7E27g3%BOI6_3klv zIW(y?>mtPVrH3~{)=Jw3avIYh@FO_Kd|lPO%S-XJ@2zAwH_m>kt$wE5s3JcgwV*_m%hDY!LRkvBt$@9KKw#f zxBhgXnr<%*PMeR|sPYAb48zaCk#PrWRf7PtJH=Ay%Uk%^ZW{J%w^1z!#+1Yr6PvpT* zw$sE;pq2FvT`otydL+nx`djTrg)^#HQ{aCzO@E5hQi_vpzQ6IEx*yZHdjeJd z!iYH)Xh&FiNI-oT3e=;+Zf3VM7m5Sf+x)8Sv>osWaj7V56UimIMGhV4=v|HI+|MYw zBeZo?o!6u$bC3xgDRxKKK3X4la=ykadv-Wg|5VcbHzlo7zag`Pq@A|I zRF@)Dw@FdV!T;(sN0&(QlBOEtNAp7(Tt*aD59prZME`5@&{LMr#v%?qU%yExH{{Te zaO|N5ILcwPw4w0Nc~-jyKBQj5!|CihcFS3A72_YyEoQj&2FG{%ZNvCW>P)j=LMyJ3 zC2NxLlB_}EfrhBJJnG*=-KZPYm=YMB4@72|QyXu5AV#_G=ijnvB2IBN$26Ur zm)~HW=!25ViJ42QxP@JvYcNwCCvvAL;pmMf+aw!tc72*#%b-2u=Vtdc%1g>rYHgqF z8PsV8Jh2zHfpqtZ7RYZ!7&d+OtKm<5l_ut``I+?dW6FK*+g_J+4KC}1mx*YESES;} zD;x8+}&3*zgo!;^qWLqiQK~2z$N_}*MHLT zh6V>8&5M~sDH-MF8n?iW*Uazd(V>${%Kn3s#~!zoBXW4#ZG~E18E|jfhJxrR1kQX8 z1p4r2R__Kb`=S>-gxorL_T_2NrRuIje$!1yq`GjQ!q1LDu@3XuS5zXhP`sLo^wBHA~$_4(E-;s(2I?i$*esa#~;xDvULxgr42!uF=HJ5VMr6D&7_Vyfb$`R zsXCy6ryNCgEP6gmo~vz-QXH>y&c}ISEmG_=8r+QdMUZmBsGH7v#&D+WD-*`yp@CV^ zeh`RtOt(i+>_7FxG&GyZc6~kS1)QF3G|l(yp^)^NP;**qHhk%FkCflZjDWqhcN?XL zqmX1318o^QK4;Nk6qJxB*EGHtScy+96}hI2eJL2`N3HwUt7W_~mPUh#_>STBjgoLyU+2%3 zS}mt>w;V#Hb$vZ<1w=Wb?H}SL&19YHPNd!67bBVv=vUhL9Ex?u`x^9$KEin)O;3IB z`oOh?%$R{l2ED{sd02&(%wP{AS<2|EXn0s!7wR zPQ-9R?a85VEbO_K?l?@N?00}=2=R^KM^fXgl}(#dk9gu>Atq!zm@Pyrj^ePAR=3{& z@#FG=bt*K-Gr!jj`(vhih>>_f`~u#oCj*$+HLxsAee9N0-|1GTlcAK1q1whZ5qrD#XExtD|%fawpDFiEMcC$`wnmhbnZ}cL^7rFqJkJ##YmX4-7pD zpE%MZhy@t)%?RQfZpkI%`#&K1sq`yE{g*&}P~%DXaW17BqsQkDZS0thJ9Ba{22SEt z?E*{joAzlUneB7wuR$QWxlaRRIOKN( zab3l%e<&Optp%e#w`kT7=5=P9s-W$DnV1LE-Fn^#?{6!Dd;)iL$ba0Rg4f*63{I@HoC4~}79#v{TBON@nTFxm$v)5p_ z+d5**pBrzG`2-c<-Z_1b>9{h-v^jqKHfwx!-7JuOxBuO#ISvhm2LV?)PLokO3i1DA z?5(4s?EWuMy1S)QKtMoghEQ5STDk-T1cvVJE=5GT1f)S?$e}?*y1ToZfr0zr`@Y}b zz5iX-Vl8FKa-Q>?v(G2?-k+PQ$D}_z@YY}pdDS$4%`^xtMy>&UjkTE9+^G*bb0+%g%U$8-W6H)r;k4AHCpC>goYtk+Gh>dI?3q=W9l1lS za6}jbsE0y1OAZS3p9CTG1P%tb*_trVa*nvi7N;T5;*30%yq)xX;;eq&>7$Cf9Vv{T z$yCdI0!(^f^|k*MBL@=7FF5!tatyGNc2-jKSCO8Xi???Yh#0Q~dBFDyX!YNJpm$JYV|0fSvH*FJ7M9{kp>(^CWlH2{7b8 zfZmD6IiKwEZMhnt+->9(WuG9B;rE_+14Csn!%m>LZCuV)8Tx1XK_cDr_}gjXfj(#Y zs{WS6t?j%DYbsZdxjbH-=jx_Al8B?RA3Dr+lFt2ZNme90T6+lb-7i*r3IzXuVQlW7 zAkpV!x5QUu4RNE)^~>E(y4Kbr$d>XieAQ;We8{CijfF-ZCopaNNl$axxeKoZrToCZ z*sZ+-k3+Su@jvVU`_VZ3ZmC;uNh3qC$j?t-#TA?xD?pg+F8U5enl0{jaBu&R{EHg! z@lfD@?D?TT(u>fsyFZ!#SM*FlVrK`sd|dt{4;Ne97AN@578Cth77Mcy<_D<~>$mn> zeYv6b7 z_$Wp`ht0p?YZq8^8o#p%jtJw>q#%Mjl9WX>CIUQ9ZJ3?Stx5E&wY3Y#L6#A z3cKGmlCmi*PZ}p-yk^}+MZJJeS)CT!hYlb2bgtSB-=PxGDNRga-exidPwl=pBZ$G$ zKVF`d#5oYWnjeG>v0@ViDdL-1q1NOJ0>J5(o$1-}&O zHoKI1+J`TVoU-Vqs;h z3Eu-sAdg}-iyh-m@x_L@Iy?RCi5e^e2l00g-3{5H)<=bgE$HYKYfYDi&4b^xPm52| zunD5V@e#sKlw_ciG}&2P&m9!$l-C$&g)913N^m^NHQmbYp6nbe3r=w z!tWzm=g{l<#M)$b9mmi$Ys*ky;k4kHq>3y7LQ-^u?Gu+C@)k0cFa%YEt$;1P)^lUY zP~eghmzHbx2uIUI$Sugi*rU6+e~jN8d_|m5$~#Fov07W3mTlX&{B94nB>9Z=m3_NO zwy}3L972UKFpnVjojj6uoKE5S+I zyz_OOMCc@NZZ%(JuW`w}mr7e+4rmp16e7=moO?7uS?J{IBIe`ro)yR@EAUl)2KV7v z)P!0B5XS{TT!7+<5r>L#_QgPW87X9A<;ek)2LxqW*vg{?b-dF`j`W$P!)c%*j&3=Rnuy=Sz3e{P(R%55o~J|58a?$l6=vb-k!!Tm&ojeW4rJvI;NHx+KPq&Y zYpyHtfR>!MHcl)FwhM=4UeS@Px??%Z)B?03+w#q+_D7=Mu#_Do>zpCr)(;oRJwoa0 zs=@nEd~oZGe-Sd+98-lP`4gB`f!BCpYDLo+)F*B*479R zxu((?La+DB4B84>3brp*^ELZ(Gzu@%-TYxuD=wC4%Ky>Orgq@X2RF(vDX z^}aY%0!n#GI!{LeSRfjItCO%REEA^-b8)*_KJAKMlxJ^g-8#=>sZ9ZXIn2m?tu1`e z|2_PzZne3>`2l(iN2*`!(=QFtlUJIzpDXJ!cjrM=cCYy>?Pk>fVLAPNXIMR-{K%B! z3JwM9{!cIc22dHI%=-WUwK;!;b+pT}1(}rNY?8UvP%CBk53cL&Tl0ZNuPbpi^k^I0$Y}{bD zm~jFTt?`C4Z4?`g&HF(YajDz9Kcdvx(FTG)^U^^M9LG3+Xf+jC)=IY>EZ%0YeRa82 z**@6xJEwbcuiDNy=Nn%h?eUK7r~{~9iJ!JbzBu|BnaHZgDg#=lrJ{uT^XM*5Lc`$I z`PMu~mtrr0;$hko8m{E(97zSF`umc%q^BAax;mC4q-Vy87}T?^zTWO2G9?OZkXA)l z708b8N03T;cTXiMeg~`GJPz{4_!yWX=}mgd1Em33#qsbLjC_;?a|W8TKz*{9W1U|m z8*AV2%L|a_VbQkvQes&L;+7Km4s}O2!5$pZnqvu_-J$l*E zq~iNRp5~^L{;nm-?v2(8nksxW0U^!BljvnG3^0IY?2u{2&pGGe`lRCBZubE6sjcyz z|8&E0m3a$BFEaRt{i9;D!h1qnanJWorjP!-!nA`PZ*XVTy3{QO9Zb)(l$K~*PzB>| zses~+iGQmh4sR`=4#x_N4nzt7zt<%QQ>ayGQ>40T>!2lwa5aALV2mC6q1gKMT*u-q z<+y$_{`@Y*Y9a4rD}D`I2!+jl4ty<#srWJ>NVB` zcBAv)Fu_-nPffcX?B^!aFQ)l+1&J7ka7~U!{>3Z+jF;-zB zu9}a(pqwtG7H~!}=6iG<6ABvMgtBzTYhP&~f(0+8bFFda3g+tIkh`g}v!+n-q54ON z;8>>YO-UKcw`R_FL`_-BF~5 z@B;j;dR4%g#XzrU4XeVLzBGQ#BX=oZ;G)A+3Q zIt-yEKg0G8lRRHN#ZFl+CWM2*>WxXQ^ulTD&qo}qE6KTy{>vkSW429abcqFWhMYrj z5b4FV8)+1$gXe{ruG%$xmVe{B1X%@9TAkLT_`l2<1PNY}Zz~jiQ42TSv=(YyvGTZ6GHbu=&WFY=rs- z3(~ze{Jd#@wOQw>`qULlw6>~IQ)C&SHb0&u;{z2U#G8nFM17?qGtfOZU11t+&*0-Q65nU|Bfg2!K zv(jsDQ)bb4ymxQ#XZV^Pw~u$M#c!Zow1!@(d>A9OlWH(rE{ zfK$ae!pJU z$7t7W(bMvW`u8Ygj=<3iBl<$uc4BS&{b6 z10jWHS64R?@LR*g$82%z{mtLc&XJF+fx^J3}pc>-10ghUhFa@P5ygqm9OfDOFs$EbXY`xxo&GrA z^&D{W7mWc;iod&pLncYZLHM7EzNSIMwb(0Iz@O|_!TECWw1XPJyVqg65Lh zAC~vEuF94#{#JZip#OiGpKO@Rmsx;~VD(a~;~Q|3;UA1r)oXk^sY5Wk@nF_dbZVah zmtFPa-XeU<*yO}ctblk9?^cG3OQA+p1*J46X!E&2yz260OMO;?B~zv&6(30Uc?*nx z$M+%*Z@%Slb4LB=B;triPYlpxi*!o~R=!=hP+rG}&B+c`olP%mY(SljxlrZ@AAF*g zN!>~?&b?2cz_CNGpaXtKPdvRmLgXVxq;8}2$o0w8 z0zDCnoEzEmF)tVnLmUsS-rv z@P8zsl_H=#df~C$b?o*#=p+ago0_7psxp)>4tm^yjn`+ggbsG)%P_4p7l3|yfl>$FHLvlFfc}U?SG@T#$E_!ZZ9wRTRAkOHf6c~kh z(&Gh-lcv+Zm6S!Ly7NXD9I4asvCNSr7iz$-@R{tEen{240=!iY8}}X+u}ZL0>F5M$ z5;R8#gE_0xduH2{B$(tv4@s$;adZ5mum)grtw}mddUGmyOB{Gy?#=uxBv)*IUU7+5 z*+wFOc)C5D6D+!kY<(!Xj;vCGkPS3o1MknjOcbU&MP`r&gDsb zY?Pp0QP9Qv-3y_G)`fUcNX0OAZ#4EinV|2l7>=DmKn#e73>YCAwZ~^a9IGc9iSBUs!%wb!@#}whbUlre zh86rRVu!;s0AJLy2cEDB@Y&+!~R7hi3uGJ~;L!8S}pJw>ja)K?c|26301BE^&AnmO@LIi;t={ ziK=EB7l)RBg4`pg?Fx5p3lX2TZ8aA02jvEzi>z9BY>0xq2A^l_t(9O;!SmzUEN^D%nucj1>lR_ zrSDf-s1>4MUv)Zb=Qqaghp`G*eb?k(4e)IA31B-5Ih+AHl29OHfe#+=863wnYQ)Mq zb(W!4EBH3nD_?e{xEIEX^1AgVQ)O`x$)D#RV(A;@Uxe*OWbmF-l5oebpGWqWiX^*`HOsS zO|#xx(Oa+>%gaKEXG8J3yQBVF!B82p8*H*`{)n-aR|t*l#I_J$+H0(bOY)d&o-tiE zJXv^*$S3ZcO*isZreV=?9wh1ks-4@fxt4&mLl=ZbB<=01^}XkZz6l~3j;Gi&BagKw zo+w1^;7E^P)JEKwhUaVP9UD6UiB9a~sKV%vj%^q5Q|vr(+x2kVlHZR4MzO2;F;r~t z@0Iu|yFtaq52TW3N5~lH=~7RSXY*HA1g3x_m2l#xJH@q3rfxvN!!BU|qK_k+2Gq(0 z+871&ZWj?7@P<{yB&!J&p?@95Rty5#%IaWOWu*D|_C=B>07^DUEQTR^^DLEo5nc90 zU{OD+1n9~70asPh*y8|2ZWjiO@?Kb#P*pt6K?lvNW$~8P@1Id_mm4-!?==sxgAVYd z#Uu6r$%L~pyF@>#Mglk4GS%-+JCQX-!1&l8D_pym-ba>ZIfn>VPai>vwz_PZ?idg2@r92D;vL9d(-Gld>Za<9m+}y+l1&% z`zYtIb{vzT%m&)u2a|&2JLd2zrF~U7<$K~qC;qaPEi{novE*K6@>FOHzu{kLC!WQ3 zz^Tjv{<+3^r{vfx9;}ErOF?ZO!RT+6QXWQF-|JbP`!wIXYQ%G;7F60b+ND8!Dq!bh zN3%tP*Fm~WWLBV+)BC_cyUSya1VkPxc-QU_d7E(P- z^68n$rp8@40`t@o%DONPdqD|joF!tMvrxg>ylGyXC8z3K3;D@TB{&$8RX?3dBPEihi!hKS@O3^(o9 zApfP4id@CL^EV|wyMX0DavMM|DBNP$j>NTSgMPlC;&*eSSlEe5Xy4j2CBeA5VVZGv z4_jwCFlZL1PG?_EuBj1yAQZl?#7mSAuxFRx`o_vcyGO4`MlRXsalKH!3(br;UKPE| zsWW)GWpE7P13SefE!`Q%dkbEba&aVcC#RwNu#0MP91qA$3lsjyin5C5mnd)Ivv)1C zHFRvkn7#vaFy|KKcOS>+wacO3CG|VL6%?5yE29GBQW!qca@lRNC^YW*uEk6EcLp%6 z&$aoWkg&igYmNAi<5f%RK4a^CDd2wN%s$<9QbJ79Ni7x>CX+{aee$M*AJ(rT$wDt{ zG&azI!9#+b^0Be)w|g@M;xSTd<#80Nfe|S_L9iSPnT=353-)|iop1KqB2M0Nh1hw}5bWkBS;&o^GJgbLXZ5RX9h z3EfidN8>^~B-uXBNl#dp!KVR~UxQ6-=n>fVS)2vLtkEV(5=I@B%elrPk0rYK*!!bS zbV+tmzD`jUign78=Oy7UbInbkqy)QRb;;h2H||eWTprB*26O||MQ`sB7j(NGWh(jl z^ z4qz48gfLpYTm)xM6~A5%MscjGpw#=8R=5siRrkp;9b2`!>k5I*YU z;bhFij&7{c+U4PSh98dbnU@Ss+&^)>|v#kLnc{1YU#}JDqGm zKOx4FGs5hpEyl8>J+PI8ntbb1@Fi6ddSCTv9(cY`dQ$c0PC0LgjAZiZb)!6&MxtuSwqxiut@tp%UEA1pQjR*O(R-DNi* zMNre>=ak)a+MQVR-^QYG&6I=6H+3Gb|DuixPuNyG0pv5CRuTi4!JAh{F-)dLZ@yIw zSE!*Ohz#KJ(iR_YU9>k?nUA+13IVHOdUqA^6qO=5-&T%<-{KZs z28>n!mBf^2!kUI0vo~1ol?EH{HI)#>Td2l87LVm@C)btyU&{0#nuDTPA$LyZ*%dO3 zw+Fv$YoPWH-IeG|_@jU zc->~Z&b)Lv+AZO&K`7pqMtd-6a< zgYo@O(%Sv|(#5AA(!TY4*9*^u;m}T<_L6Y*@ABJ*3V<%E&zk4Ty>_FR7?VKd#jr zHD2Hiy-8Kn&j+ajZ{_e%mJa?UOQfl}?H?^qMW2E1z9!nM^0b zDX;a%O{yb~JPQ6xtPLwjB^S0EkQc>$EH_0UKtLSt6U&_!+=a2pntPjXx7a^D-fLBu`5Bnr0xhmlqwQb>goz+K zy1szRLipR1%X_3}^q+gkW3aD3*L_dmh+eJ{%SPab`q^X=lw$ul$E4)e56G;uo0I*W zYL-tp)EFT7u?8K1hK^)hX3C?@uF*A8<_d6I-#fsz+mQ&c4}<_qDhYVUx+EkRwLw<4 zg4b$Zp~9~L`!)biJ5uCke%$E&#Am}wA`6M`kfd&tsu_0sbrGPBQ1?;f`JTIf+Vd{8 zd0`~$;k(N1iVY?V_xsCcMCizN!3rnbz(mO|M1(2|4POq9 zOj?Hr91ZXXwb|wVjda_a_pV&#>b#<4@cYBjiFpy;9-O6^@lJIB)DlokAh{{j-j&dc zF3ShtUHze@epfk$O|&2eR26dZy-)(@fbJ`qgJRc!)sWxs=B{oT zb}f&&xbM^CJmil6apc0csC3MF{lgEQV1rDA&wa}~kwos9ehnQw(%c*bo&UKL!YN__IXm2!cP)AP zFo73~rTngy6{*{y;X4M*Bgk;S=DMtAr14%`F@g_mcBdOA41oXbqw`TSr-0%=mY;t; zojkCTNE{T2Hk&16d&H&|5X+1{rB7*rhTqM9@P4Sgt9l=Kw-suXxR)7A+ndL=NXVhJ zs0MUUo{_+qk9%UN7~8D4+yQN}9g|_Xk1%C8^lU+pt`B?2KnsHaHQUB}5dPvS@8reK z#9TB&y+J(r{FHI)#4D(u&pvWWolt8b^}-$2j8jRFg!!$hpYdf&42|#iJNLtqd(#=q zhtD*_QQ`Wv<^gj@&S?c&g%Lkuln z!QK!!Y_Qo_n|TOArtWPznb{H}I`gy8)i~$C-mX6Q(jbboTd7nR<6m-@p{CN z(bdc9lE^6Py}+`7Kh{s?0R7Nj1W%7zE6^JL4kr%swaelBj3*rn$UnbVksz9-u@75E zmLjgi{afYK7o@Bzoz+er4_&0uZYFx{bdO~OBF!;We6nOj8=p0;PtA*Q-FgGY^jeUl zsm9yrmJqWQ1pAOSnN;++pA>;t0(7ut$OGl%G7|EZZv{siDojta29TL(3l~=*JW5_0 z`F>cwCPO9lXj>y*EdPWE_Ki1^Bo630i9scAHZtWrtttvCT+uuuvgKaW*?5U1_3#Xzfg8Es?G!Du7m^S zmEvSI=KLxbkqM<)qRMYWV=+2xGz+!NRy+uXRh!@}_W^do>m0K|4d}5*G`S8mGu)ca zK=M1yYVEIZ2Hj~a3r3Jo%x907QS_I5 z2Q?Z!NtJbFrlX-kFL>pK?|2ru_3H*UW~Mr?uFH2OxDJBDU`H;A%S${eMO0ypDW;*|8w~wk0xoTQ4@%L|jigc6h zRAP%LRoU92aXEstQ@(5&Yv=3V5ABU0&_yP!D-+$pfZ1C*mQcU#JIk~ z2a|!3FCpYUkvMEV8{9VCeB%K|Nf~nkc)Xa@B?rB!B|Eqj6+i6n?Im_;@P%^FeVgoo z2y)=-#7h^zRhD{sZ|UpOCzu1vqK1Br)k>Dz?FkIx@rbs|LKT9l1R}}3*0_aps~!;L z{E9`UiAP~a)!-7pIB4oDEyFS1uT$`_8$@7+qhUXDF9mqAo%^1%e;lYdcEQJ?_;AwC z%z0NJo_uH!>+W7rKH+-!QO)2hB%E%Nl`@6vxm%$e%yX{EsQ zMb|HOJGSouYd91`Y>iVK_dt*lMC<}yDfeXaSoZu8dh5nHo{tD8YK0DzX+ zYW(n8f53C>Ebw;vv%3M9Im9Pw&rW>7(znfU;p2F?*7bWhNW&Pfo(`^=6=k^-I^8or02`O3SnjT75 zIeO=0qW18fTQw#6XCeB|Z@>9jv3`qXjP0*3$~hQ|YGM`lb@RAwA6CjdmW`LQ}ca8mVtzOF0ZGK5sEBV=cec7?Qfri9V znLViy&Fy!6r@y#0VA;H%j-^-+t@5@9&tcflrK5sHXa|JJX#S+JMC&BpDOYSTD|`x> zDY&C8n37N+b0VqZ;gJ1|d zowKiG9d5LyC?bRnYowOA)C>6bkF30uhf&GSY4fK-^bUt7!qY8xvJMD^#WkR5!#3fQ zNtw8CLCsC&EE(pM--NI~@RnDHy-Ai{#?qQ7yp$?d9cAom`~`R|h1)MbGkzQErU{#8 zX&b)Wag|&`-C5FvJ-1StGxcp%pF6J)t6I`fg4cHs3-58r9kF}Gjuq@JX{X}*hG)m# zZw_A^WwIZ6?tT`3X`OdeZweQaTFdumwTd}EiprsiT^hdtgkxkmn zQf|>a@#olE%_ReGL>H_dp`XK_K}yR?aQlCb^HqSAA3GPs&=6 zlYM$Q8h@iij=J=6_;vuzajtGufyU?en0EU(3C_0eZ-Ho;O zmxxc>P*M%lHgFIL|&hr5>&s!1@W z$aV=eDBB^ekb>DqYt9g;eBeY8aSMXECM&WIwAbO&NAu3uSmZVZ3oHKK;KHxbeWN1y zZ@$qqmPu8q+tuKusmsNQluaajEL1N1!lqUJ`5C%8ii0oDYPUSkpULY=@aO$oOi@hJTKvGkoXADJ4HPpnaS5x^a_xH(p;(!O9 zgphGI@%d~2+`p(Q7~uzo()74N8f9$R_qg>2GejHG;%EmY8L3O8n2wRT zSMRFM|0F+$4y-AIeW1wph`oKptJ`_ec+atC5qAByI~yLNDWl z1m1UOv8@vY_w+fn>pOsXzt7Qk9&$Bq}Uy+MmS!<^q^b znF|=h=`=X8G`bx;JCz~^PnGHh4`zs(0kc!ACY9W?alSjgrI4X#gl1Jc*o>*2%q@kILu3Gq<+wwdiw`EkodXkt~CDAB^jG1hM)9d<}z~Uq5-AZok;ykIq}FB>r@ls`><7CO=d7M@WLV z^JY0tA%ol(GvH`(Xu7`sIeC_J$>wPOU`{ImUQgN>jqsH8tgc(77Tb#KR>@OzHe#Nf7Y-J=&=8-!ORsix}HF zxPX^*G5fR5Z|7DK80+P@Iq;-KYKnC}Q^KDXnAP6>L!(f&>b;EG!_C=NUkWeNn=j8$ z1qB6nt~PZTCHPj7ceTq6o&eKV+X2Vhi@0EX3gBq{UGF-0U zqtc-S`3>J6*!c)umUyd-0Xr;T4=tu(EH=rScTB$B_VR596F>_(MjJ%7?Mi99S_t+* z-HSRO%97yuApaDl^-AV*@=vuNUj7#IM@U8yW=SKpS9m0xxsh=tBnd?EbVeO%Q}_vd zx+3O7x`+i6p3g7LSW~~VHIdi}Uc2pdkd+#ayfq&(Ajyt^0xR6BbVF`EW-+yUIP=*i zMLegdFO6pnQN5r)pW1Te-7C`*OfoQ+U!+HXQUI`K1Ss3@>42|96;>u!@9%V_mz013OPV+guW#3nJ`zR= z%JPHF%z^mEjuvBqwA>6(9c}}YJU??+Q#!ahyx{y}H=2Ej?1SS*T`~73buZg@G zh-y!pI}YY8j0r^DsLSpbq27@r!FDo64h&yI^|>_3S~@$*WVrG1<1qh%bV`60kx69d zv#+t}G~FnS>Q>o5svM}gu?H6Z9#YN-1OSk;yDLv~RLymxc&JE7nBi`Bw}+Oy);q*t zz!y2ncBa}CP(ZvnY4$u@1sVtat>w}Ov$c-L%da+u0ozC(mu=N_kSEcXXIko~!i0YR z-hsyz`1NfloTA`aUc*>a*Kz6G6+Y==N1cC<)~|B&)K4_3d?8;F*P0PgOneUKK)ZOu*{CJgj$7eS zVq-*y1m|%w@fsn=u7|ywJw4O?|K16e0su1V%tf7ea0Nc@B0dRV-K&Ih6vAt~!k_?AxwoaXuv^%OSr|7*B86vFo35V{4lu zO}+{U)!)-$rDXx)fxrLz)9fr@kzg~&guoi*vLb4P&S`Vscdzr_-~_4HZW8d>iYq5w zwE7~I|KyiA{iCzay)Y?konn`wxi#qs8T`RMo4Em_Jy~VN8i^O#-Oo-0R}Sf^Ct)f= z40mR6jI`bI{spq}hCN?OY|D3~)?{F*>^OlZob$42-`6Am*(eCal@yPQG@yPgSsL-U zNFjlt`W#-o$Ev_lGeII$0^Fozc$O)~?||dMYdg(DxKa0B<`2zskc#nFhbG`00WNHa z@pKZh1xnw7v@xrUYd>nG3ppYIW3#Xv2NKwt7@j$Xz4~`G(70Z$lbs6HBE=ti(}zoG zk+3g3HON3m_3ezCSU9=7VB!Nq5q9j(!b@6;iuc!i(K5Ft89m?VkAHm8zHB-i*(fC{ z8+nR5Hy{%f@=F?aQQ|$_P)AOrQ2)zz(K9rO?(&y(uxM>%5a+z!bkMQG-|*}2a_3=I zI@s{ND1W>-zYz0iLBt@INO(tSA^E>XbG(-ph(aGi=~s5D2rc8dU;8K&X9x_DSFLq* zQ$f*FmeZw@Xn0m}sy}cO=Pm-6dAzr!a>xCSvnz^pE?=a=_sDFu&mi}JA&L@r}l2tK_GAYZ*NVJ+_@nN^ZWfI-~7DmxcjjNk zeK5Vfy-)ms70;FE1HgQwYkpxt4e)TTu`6j z_xXpIKBoToH13Qd#R6e9cb^AM>P2DM_4>UQRMcp}mk?zej=qkv+A<1Yw%C8WALA`> znJ-IwWC75<{kDx{B{^i8SLy}BaSQkOh)wWMb-DI~8Gi}t(voZIaQeqJ_3lCS_y(`(wQO5i+mcAmiiy2-P>#6pH`%ktEMqO`b=t z?a%yVe4iX1E{9?D_U&5=F)uz_Tie&v(dogIA1mlFt0lbf^H ziu`-4<%R?_w3f*HT5iyYW|AcL8@amhzB&wS9SW%(>2?7E7+HW<&Fgu(UKthcmCif| z_^V?&PPMl)j92>%dm!cbO7OSxA5ikDLugh~RMUboTl!tYa^9Y?d&S8b)Cq^q#nUaC zOcvc;(`PvBjoXu-l9gBB+^x<`OgC8*ys+fJ>}3f5a#u;j%th6akh|gXq!L}%Sqr1& z7f*cJvw3yqxg92_=*x+YgO<6%N?Tce!V$~L-~9PXcI2BBrL_RAPBuD$!2i2^B%ii* zlqm&eJq8c#C`yFji9}QMcqh3{&hCrVPkHTR>?1@OjrJrPpasGA@ZvZ|!-60tO1_LB z=|~N%Zx`bus1BknO4NI^-lAA!*0xSGS3mvVpXn)w=n)0mOj5BQ%AW1yNnFDD^>)IU zwLckd*iB6`2zk0>P9IEKvYwKba{D3p!mhCd$`8Y~RQSoaQWYU^o8KnsA_B(ef_*pC zFD$vNhw;l#J#K_gfmn{pv$TQrzfaE_D(S(37nLtz)`KG?Dr&=^n99eFgp6E!%GO~6 zu=i_D8NCagw+5#hoLR&0Xrg${_}V`*n&AL2kG9db#{|6E(78T+^ux%<9YR2i5pva} zr)1LQ%$JU^5XtC%IDZZBEr%gho9;)$ADbE)asY#HA?HmTfQL?}H=-Jkii(9s9Uar`CkpcbTPniw!*%UuL0Q6pJ_WW{nhx zSgHI`pTMIQr87p&it z$0r=aNMW1@>#bqLJC`Ji*u9I%SfweZezW=vv$RGz?TFQno1Wd|;8Xx|I)sNRXeh5Z zVzp7`vE!!hGB@#Nu3$W;X|vSDjxl$-{{ZbMTzWY!jw;EoDE(oMl|qm++CXOS+wPp= z>(Z+-GoG&wd#)B06orj>wD3ztAamU1e5;Ru2t*ksgdQ0GeYo5wfyZyC%gf8NG3sh& zW@mwN6Y1+>^8$c-?3-lfc|gEVuU}`YCYuO0ZSuW!W57`PM&ub7p#zDn zW{FRTlOm=B{z$Ms&-NHZ(Dx8w9J$w0V8^kRe{BPdLr-?bSYs&p-`GF70Wt^lO3NWy zPQ4n8lhy9eKV$t`-3};$sF?M+$M01Bl97vs*V8DkZ~Z9U4u%!GtXArN2ekBQ44=MD zO3{Z*ToLhvJCwvTDAbp0@Fm*W@MnY+U({5rP6$5ry(z$|_p3O3-xC4K)pZTg_k~OM z`jCP1){0Nl|GRIyIDu%dr}ScT21rs6C^+UvL#vRzKOSys6s`!37t?uZKC5k>&6yJ+ z;h2y$dAQgkAI#DXGz+&}iOq_yCQoB`?JagU0C99|OQ3*V)^Ule;)IjEn{ zfJFw#7Nq*`&R4iD!L%V+68_n$zmgr;G*$8ixsL*lmc;XP3%_5V-iVcZ*!Ec}w>BVivC=%Nf`nQ!%24UM*Zw>Gm@a_qf>n}*|=e~Fc+$s(7pn8hLOy=S1m zTuAb&;KOH3dHXcF`U;w^&@qlzXI?BB`ML5uGiRD)7pG+4fYlArP%Ej7oH&OP70CBf z4$G;)t5|3vREOAQ`=>IWSuvUH($5Uqnk9nu40``y9Ip<^IU# z<&J|3#irwmDTev4vx@XGL$yOjl;5AZ_tHH%`&g^soG#8--=~3Hk7%E1GE@+FeX++n zt7sNYBO3QkOmED&muw|+NCxEV@sOqqj9>_YxT6?(U{luaY&#W*;F&_HE6-b^K{8;7b;o_!!vbnaB zZ7=hczlwDn=}Eojg%?Pc&rk3k!T^8|^CiVCpwN3oeKZ3lj>y9}&w{e5mCj#iA)&CTsiEl`h%dU1Goczkhz zDl^%iB>@!@cUqTEVpBtMDVh85hi^+p0ZZI*6@{&MYRUg0Hj0$v{hYv`8;Rm`*oBR1 zT4rV@#AWAG#GxWw9Zt#rkqzFD8Rx+9If8a52NM^#AL98pb^iuJoWLE^TB6%e?LiHI zmNe)Q-oxtM$-uY-V9e7nmNLhKRkwEU^K`jY=>#1A-qg(3Cd!O5K2KIxL%T*Ji?Xxr z9o&?dqg-ep#^c&cVQS_2r3P|*2bC0#tM~UzB77^82PqtG_WRu0_$TwZzxxR~_J;>4 zztwCVuk|H2G0w+v_Z;HFUypx}c~cvn4UV=JiU0L246D9L5HBE&xoq~IFfSLjaYj|; zDI=E;XJQRghSMa`qtq4U~m&yr@ly7y!lG&bUgBfme)=aAi3jY|I<;%Qic{E z`oAcVClr8$0@XDUV0Cm}A}SJq%f8XYi+unJL;@em1c#FU3%<+=Fygz^8k{WBMO?9f z+_>Y{XI3ei!xHU^5CTQkARyGPz^DgKblB(5#P@e+Dj64cc6L=}y?9BSy6VDjebtv- zN&#@8Khd6Y1BNTD|0%&Vl49HkN^q{E$iG?vGw{xO`=umD*PT%r8zrq`O~Q`n{F3l` z+ZpwUrbbF&9t}4z&6>-Q=jzsn8oRzxUf15p>NPSD5H*#9oF4HkfQ1NS$ekZBnTZDi zg1`s{g4wIF<4Yhg4(vGS#kc3N(ez_5-Q*a>pt(IH*!OK7GWo^#=KynJ#Au>}i!`6D z`apdS9wR-)gpYQDSmLmBuOpHZ!-GX%8#mHW3{$PLmOC_)GtZ!DVMn~I{ zko798zp$zo5iIJ<52q`1S#@kS9HKwHPR@DC_2+0vuvD9dc^M_c5cR37PVm6J-X_Ke z(!u`#^K$QzL7WPH9*PQJ5wt^S=5?5qK#AoCAf8B}`bD0?^hwG=W+*TnYkSo%n|j@2RZIqN7m(q(pZc6QtW9Dk&+c z%&43rMuK}7icZ>{4FIThFt~-p8%*45_Plxx<{tZnguqFCA!knF2zQZHcAD-iOBV#i zw&|}p@z8p3vn($YePgx2UeB>?0aY00xErB@Y2W!wm^!w|jS)IWBmkSzr{z=bKJ{^P1Z8#ynp2U0)=J$_Dm6$IypO!eI zj5iPFjUfS(E*lI=c#ip&KYSREvz#^wEhjqE8A{%)Cb5JlH268~I@0#}-owY`6mfKw zmEHx-al0(3c1Kj)?nl1*H09Ln}>3Rp0Rk z6R1bM#If6av8^cOyHW0nad?5Z&tMU9^D)%^?)10(5TU+Oje6}P6)60L^M;8Rw+1v{ zWZWH(hs)gc&ccCd#aP}672`xGI-}TDCP51Uyb`M$e!DqGW7M4a?1SVJ=R!7hZr0>{ zt;c@n-w;2Hbq@|O%PN47@vF4U5+@h^XBtT2JQm!MfH<&M#ySqNO}VhuhIw?>cm zH#*M1e2M}G2N%1&w&t&#D-l+sQ%`Q?(&7J7=c4EU=#0e-l$6kn`=ZM5KaJ0W zW~oCuJuaViP$BE(BHi?QCF~=Q{6xRwnZ{iA_?D2TqoK7Zsdtu@73?H^*yOZlJ&L_T0-5QR@%Ik+f`&j81C_*PGX1< ztar&Ia}yH2Y;difesHdf_SY56Byo)5VdS6L-DQTOUu>b--9|-}^fp#9uW#6wxJ*|k*5|Yx6Nw@Td)JCqfcEqV*#eH3zBFH7 zd8ZBTi8K0SZkq(ma?|QJtf@Tzc=M!GZC`32tnfc_VnzxuRSV)o1G=Obgsjl_p3%-S z+|$}v&|p7}s{cE^57wB@FBHq}NmJpfEX9QGVPZ^b?snLNbjJBl_2>W05f zf9m}L9QU()wCSs*QYk3wpCMlqsNWCnQKboA$HcxRQI1n{z#KSRm_=oFF4{tM z4{w!G*0PGf+u^?F0!;;Kgm1P&?PU)G>y*hptWkXe@7SXJbzIt{N2|LT(G1<#IlJv9 z&hFkK7ZXKi8IQv!OPhk};u=TG?YDY-)iiE(Rm-+x&rOH)w0=h)zyc0SKK<^0$94!% zFuIPIo0ni~|8xU)xXwMs$us&8aDbDlvH39mz2L{gzEF4Cf*U!GT$Y0A<5KfGFs_3I z_t#XhDl^EWu&9)tk^S16=lD4H1!(^xLMxA#+i=9EIuEaom(eK|@XJaV4O_)-&v&6n z`|KDzgpiPsO1mmgqX~dv6x*2OVF30Az4Pi zen+e#waz3_j{;O+@gbJwKMy%)^mVG&bPo3yVsi=id6!&=+~>^bvybfqx2x^(Rzn+J z{JX+(@BIO?ir4X_!5w^yE*km5NPQOttw3O`U-n>FOSGL&b#nqK$I2Lslww<&1^2OPiYR+aV&7y~g zM~)Wr;aP@aCZAtM#@6eM#;Cz{M$K~k#l=NfOk+_H-dQqsPKG*d&$T2oUqTOUJ1z+7 zHYlatCZ;e+Pz;`QmKdCVdRm^u{@-E6HK%Zk+ zy#Sqhu@1nE4QI0|y=b!GG0ZsV*IpxP)~-DEUZ>I+nOSskJe_dG$nBOufPi|cvnVr_Ho8eh*~)Qy_V3K^Z!~9R z%P%T}OX$dN+O#V3cIw2@Wj&%wA^|H&GWzg8T5t>0LuCz84!qE;6~*r@)gqxFA5tb^ zno{YbB^J#*nM_i+kLK^IS*mf@Ne##RWiqxlbg}LaJFdCIHcjh?`;wMRF3(x!wxUDr zjK$JGMIUOmCH?RJAL;}HkO0umsr`4gg>sXNEk2*y*v{u@0$%KR3V9KLOsyOpl~+H4 z+;#kiHtXlFBtyMX1iS-*3yR+bh(8<4Gi3o3IR{L_;ps~ULzDr60SDYD-M~a5_71%H zoT_;_fbzKPx~)L(-sh#H;Ay7m-=U@;h`oc>Wnx6i|CE+L?UWsvQ$dtp>A_?)jm>Ge z#P^YlqcNe)RYQU}>&l7d&!-9!Cc>!ri|Jz6S?vpKz&mV|(M&W3F3h%GF?+i)d~SZK zNBUViD^(1QVV)30qu^L8-s*BRtIGmEbPiSFXJydJb@_|9?-*Gfbu!aFky8uNi}f7bAk9K!ng@vv*|p zDv}s92fh_JLX0DaAjBg)_%OT633$Pu2MiN6Fq_sK#oronU`4?g3bgh8Y%LZ;DxNg& zsV{cz98cX<_cr_!G+4x!<3|l%wtAekk0x`A_yhY>i#t}twlxDTgJDB5*&l`}!<6Vi z8Gwr`o%|L4zk}W`27TXPAW|0?PcB}O%%Cq4OCo+A^#Q11cEDUquA{?4dXi}{Qu8$d zuZtLPDF`cDt%D(mIRdqc4_sVaP*QfyO$}TEBb!C70I}==V^&1IUUh|_8Vfjm0Mkz` zr;1{!x;ky))ig3XI?L1tvKaKE>wzo&e&CG9??dJxF@CI^)irrW|3M zxYW>1IGadcD{uE_kg^UB@~&0gNpu9xkoowN={y|#=0e+!qMwTMs72ITc@0XHdMZA$ z|1Cci2y?hW5lGNdg#bQ2m(y7F_mBVPk<%eSE#@vc6Yd@3G6MR>rL* zcBCG?wjRQn!ond4lOIt@kl{k?n|-_2mCoT0ja2PxIscqS=->6F16J;h-NVB}EVrXM z?5kHfUN@(6V0364r6OUDA^1vQ(8m=J5GYc~M~os8WEgOBchCON;ZM>6#x*$|&a0Om zf$b41;O#Nqnwv|S#AwJ66(U)0`@4!9I5mR7c8RcX4gpMqYM!B@q9T;9_twe-l2*UN z1xVM-3^s_;$qdiF7OI<%q;tOogVFnQZ_Gi(l&4)k-D!Hk3-W>ojMM+5@EW4v_Ak|@ zA*8|#b$~8q18gunByxdK>SMY&BiW3q;Hna(mze}lEh?-WQTXFIn>_c zV+B&w0WM<+YKFs$-3c3op`svN9?S2!bUH3~m{t>JU66|JD?Sd?m!AkI_7cms0wrv> z!`S$DFzl$G*1ic=dON$ygoie$??+=nIPZZ-Bg8c-X>71jM1xj&!XV?!WLAuWFO&{~e=0BrM%$Z8AG-+n-^a3P4 zOkhBLKO)$6JG>@e@c$o5i~8~|Z~=?jmf7d_fr+tPUA9q~dT|0b&P&E5v}Aa(^KdV} z%zpDbL6Lz4>>lT51ZMhM@6G*LRH+0mvrv-C5Udjag;i-|R`*G=Z zdccic0q-u{q@pBqU!gbEzr4q6pZecy0o19u(Cdb69t0PYezf5XMxclZtF@WU0aQdN z9w&p(<9%2F94g}TixGn141y?pZht7mg=xFo$`A6n_m{I3hNu`i(#9Fn4Up?mK{b^78Q!EWmG;ras7bnpKg!ka^Fc*a}6aGJiLJA-i zbtiv+mWPrNU~Mn^l8BeVB$P@R(43NUi>U5lYZoW?XT5`!SlqH5k9ENGYF>*ve z>lb5uN;??7dPj`}1c9eh_E%ElAr@gK=PQ(dUdQENOmf(@I`Q_KrY;BzxUYo0#FUM= z2L%_YOL{$tJSw=T;(D*|k~ll=r0ygYi1jGt5=4qkenEvj?#^x>|93|a11yC-5F^)s}sBpW+n%)aQAeTo~`ZA$QnSPPxMOaQ?#W|k;Al2|Ecu+jxCE4SN zPkwdzvxjL1;z&rIbliKT#-Nkgisb}%N`-WI1WdB_ea=sbeBR*KUc|0?{d-xCe;0BK zTmZSe3BYAj1iTxui=1{R{74o`AYjgR7O?d0(eb&T!UBK}WBk+R3o!ZZjk4{g_kXkZ zB@`fR0PG1H5Gz_mVBB3DOa5teHUj0$W}$rAD+>z?nQ;1RHv)Y8?zfW#)9Hn|B6N$^ zTH?ulV?c=P#c8q1(b%lwMhIO5zrRpb;yrT1OA0jAfA)e*nrMBQp2gcew(tI~kE7(w z(+Xd+M27u}maPkBERUW%ab*iN-?*dXOVw`Xh1LR=Y*`C6X2tzzM}&B5AW@nD$gVni zh6!vuRy%j!sK9F4x+m<7CsrI$Car8_e{;LKEMCNtS}appen&pws&TpzNVj-N=#HzM zC)Kn!eAla-&c}qp1~*SLP3Yf9Ur-zoC>5ev|L}Oo8g=w7Fdoi=%9c{mjF#j;rN;1E ztxkQ5mk%jN#ZIW+jdhmyciXvYtE`xmHXj5mTcw9R6p36@@k1hVgS(}^^VJ5iZwL|h z2}R6`KrnWXKrZfM4*(-?vTWDmf)2OKohm9)!LeJ-VosQ__`IZQy2o!px)FvXgzx`b zUxUc@3S@R&&$>gPRILx}5ZNN2+fo1A9nB0{{FhU8&;tk)&eKwT9V*UfMPDh-)7shg zv%KnGL3F=mb7dm^vYK8Lb29FZ2;nTwyiXQo$D;j>dt{-xT7E^%7yH;+;K6;SCNZ5V zn#YSsuALv(Ee9qE*mU;+zJ>x@}&*7=v;>}gw`JEIR zkbneWnDK;KIGY^jH%)!iUzRnk-EGDQ!z@%G!rrZ=otJfee;dk!(no4S5$S}l5x5X? z#lPZW9>kVRtHQRFoJH07?&Dc*RX4F{ua^u_VKifB#scNvu|83;!~Ers8|&$1#f^WUyIbU{J^vZK(Q_ zEHfCk>P-PSGiru;sZszY8v(MFf`SCu%IdfMhmOdB1G^x%kLQ#wMaUGYt&$iLJA5mT#4N=RNuQ>1Ywn$CD^dI5Kq1AtMfam48Bv}2ei*?-IC!` z-+YLen8XF&HYX{xl1s%POUEy~)f%ift|`xn4*W$v^3JKefVs6($%T@x$SN5p7Lfvj^J#!aIo{hSSV$ ztOGvVnYv2#TCA0dB!{)KzSMnFVMpFq?+rT|NlFbNT&dgHeX;r&R-1>1X_8viKg!Tt zHu)}Cr6C0PoKj~p6{cwe`d01Xm>?-TSvwi~M_mTCs20<6M|jBTISdR8&=<+0|KR{= z_)iD~_}%VX&+_#Ymd`-5oRgDvNz;*Z?c3J`iiVZ;+mr4Pko*N?s^&30Fhm=+dUb$W zQVfrS1KshFVKIL5)etlUSCekO`p@qXLIpeO;>+qs5F$jtj^cog8)F@!UJPD}KgtDr z>rXy+GJ+UB_z-CnJ!I(r-ly1W=(j>xuR1}x`w|_#(0-xn!T5f?Qd>;2O#4#}mawx| z=r4VH-H6E2Cd6NLKzILsmA&4cHaUCXP3fihV=RQ@GEV|WhIjj5Wj8KIi zT;iqKiRy^u*hdPJBd6B#aEM-A(X#rbYG z_t;VbF5fQ1JQPUu>pcy_Veelra9(0geEd~KKu%mAU8Fc}heNYs#djZ zg|5&2he`y3z7H{h8=_nuN{*U2FhO|Py59+M+2uR(MDlMj-~eku+=u&lUMvcVxx%@Q^h5-;HszsZT8LzOmqR ztToh%!b2#@iZ3@K7D)VUFL=6Y_lV|s(SgOtG1*)AU@q0N%=)BSw!)T5ttL!^KU_;T z)`sA8R%Gu%Xkm!z_=KLsL6gQ*w1((_YPE5$Z{6f13RG*lQ)YVm`1r|l;VB&B4 zKT!U76j-uxJ85?jx%ZvW{DBN;2_s>9dvfWacjV#3Y4?91|1SvLK*+h+o07j32A1vJd}b9HD?jNuu&GdpcNE9<$t0X9~8ItJbU2>_|1cxnQdHy}^>C z820$OLCq3cL+A4>;ow?D zac9|aX_NiCL`gP&vm+!j=~Rs)iQ_XMlw@u;w9ZJEN4InRxEIYzsTTyxZ+iZ6Oxot+ z@@yMb4y2I1qj2ndT)77E(rZ797pHA?ZBl{KTc4Yd^WU6c5Gvj>t3Zt&fl8xn+-*8Z zjiG3&m?m`h%qDKSGe18AN!E;10mvdBZ!cui@3V|36~8Hq2{St&>ZK#3K)0QFM}Oo$ z!R4RjQkDYn236pwKD3%LxSYfDrI8BM}tX%qwPnr@wl?_ z@z4B^E$(b;s~o_2Kq%N8`0T0h`kwolp#WUx)1ir8YrT3+v26YDrV@(xD*}z%1WZlF zhakb^8hCVh&L8j))$JCMHL~JO^Mq{+#bzdN5%fwys0w9c7)CWn_rJxsr7U1nc2&QG zBHruJTxrYrKHeMfedn!Jn?hjVNF!Nn94UTztlOuQ-}|1;npyN)ArEl{k@VCQr7dt{ z(78G{&7_*I&gf`H^$q{`25YZ^?yKMXUAfhK(0#R(`Zx4H`zjH-ubj=?4dmMIp(%P? zF~h2h6y@+CO614z2-fG-XeqT6{d9+K7vPZ~y%_7K|E3cuU-F^8hzX6rzAo4lp+HQg zc>BA{VbZTenexc9|M3#x5DB&hIX*d&R6PBR?@y|3HdwvXZ+8Ug5*}yyA*%BLz}|oX z0V=#D-gDRg9gtWqABk;;^JD6P(|N_y@GEX!SownQHMKMYgN4f~2h|SV>jT1&^$?5T zlxUtV{LVwz?esO6BM{ND9WI{lZ6%&(w_plCSq$jGiuUPY-Tbp2`O36V#;+%$Pt@XH z{JjG_Ywb$UYPL2RI6w3b+HOkF2lKO(1{=b%;Rhcz1=>F)3kEGfJ7Ct=(4hiRc*!Ax z|81V}1nAm18M*6#AKjt+K(U&{qg7diP;U4qLT36lSGx2!mt*G}UXBZ(alseDV93Cl z2F&TvBCD?l`SqeB=6X#vV-$FP66aJpP$cK0xpMy4Ba0Fbw&$I^AOLp@-L0zNzsk@b zv6wC0&B$T)3l(WwIR}|9Ubhn)$}1Zh2I_LFFujq9oxsM@<_NI$A(KnM2*V)n^Z%wU z?hRt9V?jcfC=u$^4^CWXyhxnGSH5$V?$3ZQ3O3}vcC5NhBG`PDgNyv^;HhE}>x`|t z?0-+FAqfRbbXf@Pv7qHkIL?=*e^#*jJ@ksn>e(u0@w3N(p1ChG09EFJ{Yr>3RSGAU z@?j&ep}q%t8rPCT;r^EwX;DE}+tEk>&bucUwbku*m0g8gDx6N*HipGVB_n|UY>h|5 zlPJh`jV(p3IbeikYryM9I(*6fbEKu6&$mn|Y{por{XtI6w#C<&OtjBg5g}D_vg>J; zf9cH|68w)#c`bkYFb`-PFa*;lOQ+HiP>i}WoKB5@-e<#)*15V()u%NCF|e?|5}e?AmkIFY^-;6I3IUaMdMmw^yAxc!Loi9 zv3dgDDZ=NEim{}c;^zb&dVjEd?%_Mz2@%9HxdRtK@L%&^(2=&AAs|lSNfm5iIa=nY zC0S7+)0-!esrSCzNbP20o+ub(xMkk*U^cX3J)P> z&UkQq-|B-bX4C+U2n5dw?AeCNqXKHSw0Hmj(l9Efp^B zoo)lbMWDV1z=c80E>fUl>nAkxgSa#n|1abSP?1V6$f^FG@2cj>BqD;@1j4{17MUVH z^(KSckpfDY0o_Ut7;*m!)pUC#W3J6t5PaYT&^iR{Ys(1Z;NUE_`4Rz@oG>s!MG|TV z2|Xj^b9*KzC^$Di-?_A8&?uyFmXA;MX?g>Ys}5S-ZZIEK}v z)NAx}g7sT#yNtIQ@wOg6LPUvw`9$W~X3KH|K>)D_9{+ab`Sa`sa$_>*(LZ9UFrqv? zQ3b5)R{yi~0M)G;0z_EQ_x*bB<@-vu>m()xFD$vlmpv0(?JF?yF+6^o1IQhHgi8-0 zeibVY?noN$LSUEPAYV#eKCXa{R^uECTy?eQ;xj z2;eYT$Y?9q0ef42X0`v!`Q;IQm`R9vXmdZB-5HMcGs(iXnqDDgw`~P_Mv_jIZi8@p zSzVuGI}IEzBWR<#{;?npc7OfdLUR2uL4zO49RE|hSkmL%tezx|qjQ9^Oys@49)LA^&C- z3;)%0<^g=(`|+HoAd>N`owrMl&}#50S~u(Po&N%^m6y9x;VM^|$>~UC7i*g};LdiqI3 zX&~aHb^Giy`8&RwQd?FXnQ^fm8Dj2wo0US>z`&OhG#o#UerL-#l= zsALSCa=9VPhCFjfunFQiVZ(VFNcB-9nA(IrJIzvgbNWxj9Di%-NJDorNm=2r2G%!3 zHPIzpel*^wt!285AbKv<2w#2&dj6*72?faU5fm;L*#p>HN*^`zBfKxV{bov?Lx4NmbGux9li zWZoeLd?AO2kbQ`)mlkpPTV_6-nl-Bgs2P8vs+0#%C6T&23?FNOaVKwJO0olTuMWY_ z2_3Hk_Y$7Yu<^j=a2gK8?hl4ZA@|$H3_)K5F9sl9qY+D7YVnLPQ9g0UHD<~-g+lp+ zgt(F$0FQm;`*?SIOA~kar^z*zzv=S0GTZ4_NXnOKOeTnZ)2BftJ+2mv&-rZuA&O^7 zKCGJ&9$(#K@fY^}RYT12R9`x$DvE!j;g2j44U(?=Q&&R!F>l#FL~iCD`=b-79=>$04gq=(@lLs z{FmLu?p>%X4o8HM({3$FQ265`ip9Vj475~Jks5#PalR1o^&4WSWev!a;!PJAM9%ZV zjSwJe=399fPt_}=LbyNv+qXrDuD}&J zRj#i~JDNZcCn}pbu^6-o%)L@^WMS09fkmpN8ua+w4zPge#8H+N#Ttu8#|&Cvx0%Uu zv>5KGVM$uCQMdzig(NuUnfK?)RqpdD_>9hMg51w*Up}{eoBGK2d>Yphj)TcG29(+&VS`1W z3@9xy5}HR_trJe;?oU;HqDN3Eh_z#XpV1vQblBx7NT!e~u@5U}dO7MXE(k5H+SoVW z{TmQNtzhYd>-E*@aA+PWryk?5S9%H|_MYxYn2et=24fkF5ZxeJQCKI#XX}mR<;>#l zLoH>zM^fmfR%!Yrc-C{+!b=I?PVOi1@O@oS6zn42++1oeT=d6iVX{XB>B{OU6UK{U zGF98lI_&lP`BJG;D96L9xq~JQ6U^Z?GU%F{k+5T+;xdK^txCk%mxQ&ydDmIi*mjK& zM%-HE_|PiXb} zj5k9!D;AgUjqypEFMsF9yN^gKfUY9(x3^!_h? z`mTdB)wkj~TnxMCyUmz}poKovrw+Pg70XGhmokZy>FvmWeJRAx%A&UwTaqs}BsfMf${wUd#Dr7qZA zWW+Q0HRLtK;X7HC#(l4AzjC93a^|gkt-WsRAfKuISky+D9l6n|6E-FD#C4nR%@Y5=$R|zvDcmZ8--B$bm-6x{EE=kJ;h`Rb^AufI zqkct#TWBmeiOSf~hIp_tX_K0~nI@#X?%#&nPaBml;os zo{6)!0?GT=fsO4@Jx7ph=1H5RlXiBN{gVClCinSsM?{Fh(|yoIIXxB)_nAh(ddyG8 z6crkK7$U)D;r6sX9Wp4B5!_QIW>DzU6hkt795G16YIQ0YLnrQ0#uI!1>PdKVhFmBn zksAEm3NU~SFD^+Gg@>hIzewF6k!z=c7Tk%0y#eO`Ejim^)u3l5AHL4{P(h>;7m>4H{}XTN>QK;csB6WnmLL;!rEe+|q5vmMJ-=5e%9VGlTQX$d*Cg{<#e%Bcd0LN&t7L+4i zMff_cKhf><7NR{=U>9(mB|`6;mI^EF3$`3hMvnb0zdG zr0Y0(F=bqd? zc9z?UCbSkStr`!HTnhd1-jmE>p>!*pTAaP#FnKWO)PB*oRwIm~3VpF57v&Tb;!rz4Jh9RF|(_gmT#M-b&W3~k0 ziPogO6^ivOK<04YkoQueVKH!+2)AIWKblB5g}0WEQ1HAv@Et0XofdWm_$?;{>{Ktp zlkGw-^=CsLFZjiPm;{|%cLee2m#+62EBW^z-L9hIpaqZI%dXaAv}?CXo)vLyzBq_MUlvNmL%kJ&EPEB`WVa-rvO+Cj_t%KQ$U+7OrZb;CzFOgnvj{U9;76>#|;d+#f&_L7V;X}IE*hoY+ztrF^ z_a2vf5RO{ak?i4bvw;C$OBA;WVg$v1^mD6s$Vq+RkO7M&3RIqxo%cv#C>i`kwlkRX*mcOTf|rx>G8Su51Lo)yv}r&S-gWJlxYtEfzJo`uvZ6OHHLI zX_I*U(kNgIwim2~<(Mc#u;I+e!{@DYWyut14m@SQl}&0xVaQkx1!AqW3@mjD?_Mt| zr5x_?#KSCBnj=Z-@ZoQyXMcBEc@6m6=p!M>RlI7#Ck`3*x;(#}d%Q8LHj4vKr|+mA zK9hJrO&lI&l%v7_)gB1Rk$w2pNna*e7GPq(u}jW2tb)y3VzUg>w?F*i$EkonZH4#B z!x1&U%3QX6>c^efLJo)gYj5%63kWJR==rwR6BQw^9!wl1gMWu{j$*4Y)IMq`xT;tG zQl?CH_9N=)|AW2^fyDyv8?&UDtQJX6c^pn5yBf{;I9FTz{`g_6P_W_w?XB_p{Q=MS`f1td*o< zNiUB+*K#wdU`uYQKiv{=ARGLWV^y6C5#^_kQcKy2GqK^6Z@Em1<;dQ`Ub;OM7xwu8 zlO)kDw#t!HAlw#q-R4gAaD)a`n}rqGiPV%r!8~M@sJ0W&FLM*yW`FzPWuB}13nT;c zl^>%D+kDNggQa+f`Wsd%YRJXS8Sl8p!Q5x$@~h1=&-=JX*#xQ}Vdo7ILElHTSU2B? zd+LX=@7#Lp$qQ^7?jRG6BlE&x#kryFS(d5r16ZT1n@LaDzg!A0>YpE)*v596t`Lfr@1dht(>jJNqawa=Bg%=03SrMSX)Sc23_ z=MQDEf#7-ERxL8)vD?ai-?O=`Qskyi_WYgV;m@D<-LCoT!(nPOVv0Yom-$F1w78oV zubk|SyzEwtL)@*x5sj*%H_|K$*7!Z<0(4u`XXQIPG;aK@9Kg{TMikIL+sj4@Hn<>rQdqXyU|aFwo6Rdu;-VgU zd2Az9yg+qm|8sgxmX=OS-*)A|J0=WK%lH&XBwSeWkHU&p?VEvO(b+LY#N z@xkDXqC@|leeNz?L61w+Qinl->TcJYa+-Z1TS0v*mp96Od!IkL>GV5X`uIYoUo~I0 z=)fWAQ-E%tM);`V@?CPbXFG@Q8!S6E3qvIxjeYYa7!&F1B zT$c9!^yo>OuG2dpqyUboC>gZS66p*?a8~#*n#m7UQO+>y1IDTWj05V~ohzudIYOUBuC|X4Jzl7 z&W@mI)a^SK)6kKfDy-FbvR+X4(<)0)H(Ea2UW}LNa-t_{98pqH!4Ice<>Uj!JU%Fp z=4x$lq6j9X7+xY_i#v0T&gsITkF1g@J^p!{Au)}?&EKm za64(;Og{Iq5_Q@dt4Rr)A+n`$KG3#6Xkw|#Y|wrq^n77Bk+w*$q3W$}z^hc>LC`ew z6Eh``!b2i(&xw(a#FB2bZRSkAy+=#zJOmbKr3wRn;iuEhK`K2h((9sR(R*`tZ=Ri6 zokl0ClX*2F&U5}tV62H*lo?M_%-|tUEz*UQyLpe@*#JEuN%WE{XnQ3JAQ;dV2Gv=U zMBaqr-Bd@%bJYSlit3?$ISY0NWii4^$qgh7CYS`3EL zI8o09fFq=~QKx7Z%!M=h6-U0-a!}88rlye zj>=#Eae+3rJuNpn%bq(w-n+xX!e*)D%M_`XVyAL`V#q1>jCMCm%h71E--@(oso|r^&n2t+6K8Pbc3fAtpPigPXgK z-T=Hc&WIzEh6!(${qBB#GhYAMMEN7Ijg#Oq9*%7zA5L0qZTyOdQdhv=X0$(3X7B2X z^W6-9#+XAp7ZTr1YIbj3MXkPIf+PV0c;fH=k;P|mD^7m;!CO~xjnJb`Eq)e}Qzi5S0zbXu;G;Xo&M&OA4B_n>)5fu`{vsb&!)>q^rI!7=WWSLQdAGvHzBqH2|sqI^43;-HQ(wQ z98vzT5Dn5@Tl;LyO}NNSt2ME#$JY0;fi}nOW`x+EE|6kTg()atA*1IL`IJQMtG3bE z@#Uf5syyaj%F$`gIy5a5&-}H;q~D+nYMSM~Mu(zMtW({aGl~xv7cgk3N6l zG84!3`2%iv;(ln7eyy)5va%oRk0bzwYcx6W+5anhlUoslNn%*Mbkq$G;=Jl4&L^be+fPClu_! znUqM1>}}C>jnjCFfByKZ?8T1vh&pwlf~ov1oXhmv0GMK5Sx2%~jU_>m{tB`!LXXpE zm7aVpxUV!5h~R!zaNjpE`VFQl{KNp_wM;B(x87O;;u5mRG&Idr29Y|`c?demE@XH7 zmvIy^jr6;P67F30nbQGcZ{xC7uY3|p;88{Y$+XH*GPZ+hmut<(oNssw2@=z~`;pIN zxxw8sIYYS^_l(&*ls-JkGLoXqoc7{jSpXf~mOAxQn-OJC&^k~Q0rm?sHekEry8Mj9 zvBAg&!w!IrEK->6rJ-bciMvetnZZe3S|x{AST-d$kf*LR3oe!>a)bN*f&_KS2{Xnh z2}}h`X`d>4-GT=vwA%?xS|; zo#mB@K?!NH7`}{$_w$d(@|mr?kJC?--C7S(=E8gB34>5Q}{LF zJRN8HjH50pfpb{9)wJrZzBi!+BW8cMVw2+v6=IMVoWk+ey6?R24#efzPW9KN3uBlo zws=2iVU#w?bK4dHA>)-|IUI1BlDHJUQQV;DK0903wzrf}^-9Xq)z|$yt7vJ$ZkEvo z+xn&=vT#;0a3>S?@5EujTA+<4ae%A-gABC^o#!_o1)<4KGK$>Hwx$r9KwC|sv9%v~ z8CQ!mO%&>o!CoO7XER#97m_Ba8EBcza)3B37Ac%oo3mxG$bpUn`HC4=_%yk2{deo? zCWwN;BBmp|nJo6v=P7O9`+c=~TY=SA3yq6pv7?s>$d%*s6P}_EJ}h<3tv<_l0&xO` zI=c_e#JhF9?ebFTr&r62EWC|BSG&?E{Z;=87xu?smYExhr(d^i4ni=t54&Xd?wbp4 zJD!H&mne=Uk^TN6LQwEHupF=u^vV3|Y)fy_1g|ZnIY_^OOFdJhD1W`9hq}?32f+$B zzB)=H9*nwzjpl1&o*rYRWDfTh{G%htIOEI-2nbG&+nx}28Qt_7*?FZ6!L6zK+WY<* z-E1HMeeFkFv5XP{1}rAo*gY>Wm~o1?ldsk)5*qvA; zVzK_S_;`D}5b=xsbyd(!0$;#OtMOW%v?-oU+PJK&j9#b4G8;b5q3v95jR7HL?{T^> zpd$8GOHN)g-@Y`;et% zVc$P;YCSAv!*^IKYyElktDP*mgfs5M?6+EmqE#ww%l22$RtMbmP6vv{mB8`4*&FR}MV(c)@$N#HSJ0NPrtmftqq z7e#;sxI=Qqj4aEMQ;UQ~e&=@ztbRK(?RucC9<%1b(wre8Q_LHzpo@d$Gja=?P%JNI z&o^aHOvaLbLG%qe#(#)uVvlF4}X>rAJu{te;s?88Ha%3*fg zTR!pqD^$eJdV7_3n|6i+&mLu!GJqhK=67$BCJk;3lUV(Q?*lwuQr$GKWSrf?`P>&% zYM-a!e9$)Y_l&cH`|4yYnygI>m$Wsrii!3sX<_?x0`_G*&)yZ(r7rH7J_uZB`OOvdlHtb z(u8`aA-^vAZ3+`73%Sds#b?O8QEiM9!p#5hH?MTf8iwX=lD({1oD@X%$Feo{gvCJg zl}bWbo2#OdfYwl5T^%q}X#kYw+!?p|i zc>V`yu3BvdS^xD{0->^2qy56hC!7NhH$rFfSSR1I6Jza>)_On0yWlVhEs}v6FVmNe04UCIZfS*i&4b)8>Z1@sT#`J_=|b z5&Xq!fH>py8PqLMkxXU!x+9rgy+(Iuw~gp*P(sQ}V!+4?g?KMwlm5N4z>-RQnVd!^ zbnry7JJ4BHM8>bwa>-p1y7TiLM!ra^+GUnh6BhU7Zr^OqTY}@*!q+m=<5rt48@CWkR9srcrE1l0zS9 zRMbb~*5dtsK)|Z{b)ED?XpKN6=nXva?w@!Bto1)$0rL4Q#|!7L2!=Upw(0LE%LVPH zm-DxQ3x&}YA9}mjcDPrb;h#>cQB+RUzH2T&2tEt6nIK3z6~XrWFFTvy;9v}O+pN@K z1I?wd!!+vt>E|0zf$HM2iZ}4L`P9GliTL&uN)_L2JbG>YUO6VmY~pZbbEnReat20R zF+Vb=$DBb0@B8vym{cMp`ic6~QT-#O_>3Oo#QA$9NP>cSyt)`kz7&M$!LZ#spgPn* zwohlI@oSAX`*_SMPn&mvh{XG|!>;HWf)-OaffiGThojff+mBmNyQJ;9b z2{L&R*`Rj}Rn_aB=B{xRSDA+;4S6u_0XC-HDPcP|8SzfuS9GWLP14z2k~!u`neSE% z5EirP1CjG}5c>X5z>q`;m1|z&5`Kzi*2LX;XrX>zmv0;IK+x{+GL@^^^QaFpx-)@o zK`JziRX@G|9B1@;7c?}i_`Wj`RqUiF)C|Ar@hJ<-z0`4We(*aCr0Ni#{T2zbO7nwu zkvcmO`5C6;?7M;OrorNi&TQ2?1rFOv3bm?9W9_e(ik}9K>ZGU^jd6RVGeTP3+?f_V zY`2ja;9|H!?2{5Z@X0Juj1w>9AeYY|_OeTy;&;r&!zIzLk`=h380<1qjD*u2Q&hR; zVW#*h^OB#F+3}3Zr)wg(!_V~Y_45&FkA>xF?8>kevIXH)MVwcs_05H86LOAl^V{20 zTt3@g6=gPvxPI2u1sTSm4{o<;eXcDk!7`sVv=<%aK-A9-aG8WQZaUw0jq+t+fmJU*=P zFu5vp6}z0ptnnq(^rW8hU=myFd3-)bCPkJ96mZ&&>yI5lL&aExvn{@~t5e8!Nk>PUNc;v&Gbos)|R5>)q zyocf7OU~DHbb3zFCp@|}7j)stTc#jUhIE_brD>nSZqkYT{ajePaY8-P=abL#UM?bXq1ofW z;1fSbAIPeJ<3eSKvQLL)3q2uu27fdu=}9#C0@B~b^*j+6@1ym3n_LbD(C~YqY8FDI z0c{w&=ljAIfxvvP3dAWlEzm-53bZOyfE#N4;71njPD~24UEDcbgxA#8 z^CT9vK8`l0ePkTZv^m%w{f_(r=7;Ufk9Uw~A)1twlrB}l)hzyoFpy{5&$rg_#oM{H z3*_G2-d@m_={3X&>yDr?))U%3x2p_pM|f-VJY6LO1y2IR=e0AUSsp!g^k;)61VT(L zF3+~tb)F5qPS&U&A$j&}sbTW&> ziPcI5-g{8mrQ%JqzAK%z8k06MPFVQfB%@ z#qb-xFlw(4Tz9*fvS`OYuEI-&pClwl3i4AVhFt;b{cOu zE3X(SrtrG_rFkrl0>idL2Hf`ov0n}ji%X}$Q6EF+U=~LR48y-4MQt&`6$jZcK7zhX zW;kh*B>X0qB~y8m9%9^5KB)Kxqsp4xhr@$#Y$j^L)j#PGcP=2}vi$ZDx6(oJw!a2m zyu8LsUi`k8RaV;QXgKD+LZ*pG*~+L&{Ff%{i!SeWFZK#{gyGu8|D)e1Ff2=jB}2ftfk8 z&)R$4>yEm=HTXZYxYFTvFHSnzYP>P`xcSvw<`WjseChffBaQYyl(ro(3GY(F{Jf)K zpUoc$H2Immyp6=)Bhl{G;_8(-r{hPaaxgb#ZXN8#q1`f&J?NoaXjG64|wf% zFsh)>U;Zr7e%unEL;7v1*q=j0yN1e+(S?+twX(w)4Rn}DtOiys>>M&xTo%kYG=<)%gC1I*>rCd?J$G!!P{;4a(>-bssHaCwkzDvy;n$Uw{g6p(ad(BJc zE*|_G3=W@;sg~w0$uL`NVRcV7Gcv$(Ux480p153h#tFT3aB><-3mConc=knKs)+(a zDxyW^(0SuUzR8@Gji+^;8QDuQG~>`>XL|Jnf@HVIIT9TrWR0>;^eXx0lVVE8Q^~ql zxt?}Ga=-B-i`Bn~Ax+MI3A0)uSa^GXjG@;qeUNtMUKlMVlJ4iuU!c%&9Ujo0Auy+h zIpIV#SB0i|IgceP4s}vc^7@kr-bWL_@}JR$xBSGjl|0cyv**n1JsH(zB`zRSZRJ!6 zLvun0_I?5G>8Wz7xrbVzs#6Lf9E9zpu!f)s@9FwXN#TKiIXt(17AH}~qPDwLJ(@-S zCPkV7Pii-4U=4mV_onMCDUWHrlS!G!0`Kt%euHBgSSEki0z`qIWtgVv=iuFNxfcK?VR~8_5Q-OPEXSGa?_-DCa!tJe6I($$FXXa z#NnTO2d&p8i}0(=Oo)*6#&e1WVfMscQEJ_ovDy$Be6v~@T654_z*3BQAF_RmQ!uDM zh+YfB^$e$vj%t{VHv0wV4O6e)r!Q;I0!z+9Z!pjOpJ68Uy?8hNP+R!vNU3;h>1EnT z`zJvL!AvhMiR!lyQQDoUrCDDJ6{7$i} zN&;}51P#WFHKkHJF7~g+ai)1P9x`tP8^~45NxRX!vYPxkoM9CA#6T~=YxyI+EWx*J zP!8tEAQH6xBy2=;jH&jDBg{ahXYx}h6)VgHA-9DN+3#?xZn2~u2z*#Zw-aV5{#?Ik z%N5EkIH#qId8i?WE$!kDEyKN!PEO-_6!M|_DU``#FSf}lyP?v>uskVTSdzURLc>Te#al&97C!Z5=;FSgF};V#w_LpR14t!Z_Qg1zNbO%vjFA%OmhrsB(!NLh+DG%vWP zOSi`TEc=G@(y9Kk3Fwd*M@L*N z*1!Dm03o9n$)H*+VaoZ-5Iu`qzp7wp`f)D-B@f)0(y)hJA_1sYXvkN=&E~-CWaswS*pk3BL2M*iB^EJ(mr<&< zE?%yp;57QL$eSP0jO#N?7{^&;_f~PwFkyIu8)-hwvc-unzLQJpCu9EZ;G-g^e z;b=}fsn`Z^1A8T_eyy+6)f0v!CGl=Sz9CNu|F+9WmC1b~HxU|;$S0YtlFUePH&mf= zqYQc--mXG#lp$D7ul@vj@>C^Tc;NyIsgGu!_@?~z1h-S3f9JI7aTlKthyAU6rOCF7smQO z&mAAKc~&g(%d=3@5}RL2?FZ!jwRvV^*BzR-87G~+fbhtYRS@)2XoMU&{dLB7#)7k< zOX2~KZTo{L)_|&C_*KfyHJ@(Shoh2nhXSQ+e7#9I>l(g?F55^+cLqhW-?;X9Y#UY= z#_=U!ZLeP@MmPG(YY`zggN*~ksltl6XuT*R0{bwlL`A&rhm()fM1$?}d$KbxTI>*3 zY5?>RqnPcFI8q^7NqCOlNO;@wYaau(+P`yNc5W{Yc#paSHoe~pv|W$qrmr4)slfjh z%80*DjMA=9t!?AimzE^ zK~ZF^6TjmYRdeCS_{0Vp)&mx^oonb`em1sc)~IcS zTHl2R>)V{k#gn~)zDU3C;?KRcJh`Nb%Cp^!7$g*a8HPb zi5W_W@$cmN2pfw8`lRO}oha0LJjK5cTk2wI%Nm+zC&ElT=zJ#s3{iyPwD9{|!-?rs zs#$|Hq?BmD=@CM^{q;~SWbLm{RMsJ7?};IMM!CMB3=xu_3|@Tmd6xykJUBM{({<|U zks<3B*k760r4V!HxeG=irQ5@cAuTnP%Vu!n6~zBJC3GGCJFrJ{?H3<5Xv5AFfKan4)MUA-yya zTp!B~w%A~OYU3l<$ErqT)+@4FL#i4XFD8nPTJ8B=MO1ER`XRFAjd@I^n4saf!Fd}WnO=pgIvXT zJj*)QXxwqA*s2`9)D}p#xVSghD0-R56ylAqxZ_00Mt+V>?)Ty=V)VLNx@$vC<^(=O za}U$99-9`^hHZ?`9Tqs3nfTBz*28IpAMysAF(C7jCs$_H*+B!|oVnET|gLfgTR-Gp(B5fN9041PmbrXTDh6`dZqEEGp& zULsfpxYj03N7c>r<94*Q8~WCc{T1npLL?{KQ_}DwCG^yGQTIWJP*dP4+yJrF{(%Cz zM*{h%gzl68;fTs`9;iy4*1^S)!@NR6#KSn?J-Z#;)E4dcdnY*UINv;A92&IUUF=%^ z5!%?-+c5YEoo~v!qQN^^*vWl33|JA5^s$Qyv0B!@T_$^mb^V$SUeQwN-5d_CmL4)1bg%&CCT zZ1i4Abc+gyaRozsab`eJ4z`nl`;07KH(ABKnYSM+8T_h7J9?`PIC2azQ_h5@jr(4@ z=!ev>v)HGLNE~XtM5#$ZYd!lvfaa+LQTT^do#Q8GexG52!p8`0hPjpi1r>VZ3@_*J zgA^}rf=Eo>w;aLvCp{EVCksvYpWC~Wl!>@s;2FO<-q8)e#6l(%Kl>7{v%QslvHHMh zKmBZKURL2xSsc_FY)kc*{yY%y)rMVcy;CKxqASy$QPNgv?-;*Yj% zw7ibp-<-eCzI>+NkGJjJrO)UJV^(h|sV=m+`m1TRCRLQyNLP6k7AK@L|O+n|@qAZtg zlFb>T%ty)IiwId4%z3WA)-xZYF?_7R+9Pc3XJmo4mB)7XnCa-~c)z|9YKl)WiD0FtHn`dYWFe@Q)G z-dpwIm=Yqc&xS%SJU%H^Q@_c7+4+3p7tx~C9&|S95tiGIRv~}1LfnSg?_|E}$Fq$! zDNp-uZ2m2UX13lw2ActzeD9^?V2``QWDF_u2O?(RGmUJCCG5BR#1i&Pua`KL_gFGr zQE;@R{X5+L_{+#MQ0)x#rpNp!8)a->;2EwA#jF?OG(t=^3}g^JLQ_;(c4G zbYHeyh)Dh-GN2HMTzz8DDkcs~$$hI69xs;CES&9qC^m)($*&{ae9;k26GRi=(GLi8 z8!Ojtny*^_CSi=05DoL+cS_4^<;)P3DlVrtGJW6W@c(%MDRCj!UTySq{r452Rj`3ywVdA} zEx!i>^VjA_dYch-(C8(A-8GiE|JnwpDus;8fmSg;;nW-@;5RmBRct&foF;+CjBGrX zQ}0hkM?}7tJ?1LOi@yf@0Cw|cn?od2%H^91oxT0xgD6cMX#pheKD^bOb zNcOiF7|cqs-pBM&xtuNyNscE>u${zTJfo(Q*HL!TS_$QVSM^gAs~D z=<%hECev98S|BEJ(@5~xsSwE7*1G39%t!{A=?R?s7qmr+(5i~H6dN{Vf(C(d%?eIz z3%7vwE|ToS5@g`TZzCzEm4s7GS7gv?^U9(t!~G3Kx~>*G@sj=;NYOwhA?T0yt}jow zzxV*2MWA6L6KXuwo|`&ODwV$ZCkC=ix8fbOfP)Ps5o8H4Q7U^afYB@d25(jv*1}(V zYS*>?zTH;%5=3OP1327GMrlB6eYL8*O(9Mz1rTWlQO`(-sq<9jhXJJ|?2n|T1&wpG zbzOrA{AZ-+fjGzn7PWVT^kO#4@=+51pu59D+J3<^fJL)kVb~IwCMG6^Kf%@SA(fK= zQk>^oE@3eqUS8Jw6iZ(qEIl7^vZ1Dw3=p3Y_?GHR`wRQIs?_R$l5Ab{1rEFk=Z&jy z5nYA^PJ^zog;z8pRVPyq>}5{2B_tc#k3Cluc7C#tTL}l+yG5V3i9IsCj-VCh?LOv) z759CSX{b=$4Doks}u1R)+`?Iovn=QUK#EcE9_F^YF41q@2vn! ziRMHSZsLYr>}K`^4fQlD;hx}5)n{IdQ{&oI(Zt*a!IOx?ITc<(%_`#auOjeZzO|Bt zY)eWGdZa|?$nkFZ7Da6?pIoE!)dySi!{;(AdYkVY=xwKCn^u&z3}#LV5d7=vHKJNY z*-0bcYOwdIAXRfb8fdlNb^*Ut%_wW4NW~v{FnA9Ap3<&ix~z}`h@E}E8Kq;)UShg& z-8_?`RN1zPBf2pZ6FDu6T?47@YjDbS*Xy~QKD?|Quvr>DaX+eDr8FyihvCHiT~C^Q z^*QS8ee&xcnn<~N=ho7Vm)tay^+n8dGoqdM5Oh0Yc96N^1i zZFSsF)$!20EBUu~$L8A+?dlRTm}YP*F7hcESILJZ%N#RdYV{tLxralWmvRMjZ7%+Z z1k_l$WQzvkLo#3R9A@pw&9kcAwr9y&KhUccO@gWKQ5ZsU!`P#<4J$N0j|7cPK_{ez zP!cD;uUU0!QGw0XNH)~8YR=w_VAJtF@JKARy`(Un&34LP<$E6?w$3Xg7r^y2*g)ub zu7JP0immDFU&12S#7*dz*3y&-c7?{uPcfAVq{vO~-1j8rY^d=sQf%Tj;M31!@SC*3 zszUsjR6C0c@SQZ&M_qU&WUmTU&+1)(pDMe>8?FS-J6Z)DghYO~I8 z_%tfijabYU9pa>}Vjp(=2rS&lhjmvAV8s#GpvK8{RDIrDa0Y4`PcRdOB*~Xc?mU%I z`KE00K1ah23Z1dKKUiA&0p*Ge|%ipIsI+U>m8#GDV?HsIO@FZ#oI9A0IX8NMEH_bE$+oPE#bxjP3klM6A z(!Q(~WDL|$o)QfXUiaHVO=}+#)uxbN65zM)G%eZN3_R(>tnO3b#-;23B+=-Z%~Z;N z${7(dVfj35O_s#`Y1KU>IB18hR%O!ot$k)XHFtN$ad&^^S7nWZ@X#cxvSmHPLbhXy zei90D!v+Lc_$4WmPxZ2_lhxJDmR=q4ixIyQH41mj*HHD>YzS3yk!;jQK-q=RXwR@-JWz zblVE0Z=sKGrnbun+WGGUXnoILyeWp8Kx-jt8o3IcsOeN;w*sXU0kM5x&o>0vfafIJ z-i^YvY)p^>?EDSrUblume^L|>WYr9!8*VL&Ak0+!3(fYMWZ|Y5OmfL zWB|1gEvqkSWNi%!ue4Ding^Swix@l@SPR);Xg{Wd90E_*LIA%^u7LGl_mrG(`ZrGsLZVYD}O!D^j$4vf`BH(ido+eZXg8BPN!FvF}N_r zLGahsH2NNgPhgKGZhf0892-84K3sk1mm^9F8AGG&n*1*2)2;;h$f;dIxzTN|IK#qi z^s}^2czpiixO(qJpKVCITmG*-P^q@Tz+d868bz9w7q1~Vp{C) zU|D0>wP9=Cg8w%QkRG3$E1YtvR-eVepQYw4d3BQ$9dAXT=NqOa#<{)RrdJiT#d2}c zdA5fuc20{GQ*m<|Ku7(fwlPzK<}tuf=ISZY2QKnX9jTQ41c{gtC{H@ygr84?)VO`aS_#SvRAl> zPV6i_^YBUoj?h>ZJuZds)o3y?Ns;ZMGTAEab>_!cd14|sAne2^c2$X`&z8}usoHL& z@59Y0z|3}1U6_8aoRF~Tmr-aHl+I3N?BN|Sjo1$#N2J7elos-|Ie@j&=J0ZC;ciH9 zQwAWKYooVg!RoC}m}uy*25q691jXfRIgf%{yw?lAW`C}>-!LZ@j4JohZJHlNkv-BB zV(3Il`lvRpBwzMy6n$k;*{(8NZJF^a>>OgPf3uv5up$3)Wv z1s|*6s>toJ0n)M$JQFs1v%)W>yO76PvSQR__FF&VSnVzC#$2-1d<={{)mRJAYMl+s zM~cdl@VnCr{pHw(UF*#lJ`-Hy4Ij-gv&bC>#+5JFWQ*C0Mnh_?wTUv_?8DrC!Y5G= z@tCK6kYuar<`+}}{J;NF19g%QQ%yILyL7N1aE*tg(j$!K1sUq*#rw<^^)jOQaaf{Z zB2i?$A{f-Vcguch=pSiiNU=>8NA4e1eKFi6vJa0sdJULyCb{_eQ(d}YNcC(xMnXL1 zzmHR${_u~h{&|A|pHI>XnM$gOKEmWT`0xK)`7tD-jgEbu%~)>+GA{;V*+ZK%oZGE&k|Jra(ViN zukR9%cr!xrsYbXze}N%4pvhZ?mag;}DISXb)v}L;`&L)0)v(vfQMf-9!q`fK2aNQS z!q{it_ae4(#oNa&Sj3yFQp8NeV)Zl)48K==y>wsTBU2@j)M+h;8{p%|m}8G70LRdJ zmnAIVE$|0bbWf-2>|n_N!-?q|o|l2x;;jB};Gr)0j+QWnNiktL3wH6IrkJyh1V!FT zVXBX_9nY>4&5#@2JtOyt^aH~Y;kUmn!3MMp4@HG=(Tjd9tw2xz@BqvGj%?%u7`xWN zjH4-*lS>XT_s#;Dn9t&jiZofL8@#yjP`~*@!^csI%b-sLbm6bTs)n`J19rqDn_4Bh zpUu?Ziy>G9FG*idSZ*`U8rlqIKpQHjagm#|wH30hk0{{4dtr#xZnVIk4^kE{iRskT z*obdWT&7qjkVKD8YgQ4x{>X2H_hfgz&Mj;>Z>-skj?W4oP_ZU#O6hnl?pgL&T!Z5q z@RxZEn;2iEb?PDA4%2{D*$nyP>$IFGKBW5a7g{SM*&D~&;fM;w7sd+6hAnnp;=ThX zII0Jr<=4TyAww7m*OC~CH1$0734IfwOu}fdqMWEg&25~?9bYUwoOcmDnj}&Au&zGU z%6fvM&fZ`Lo5!Y#vTHubpIn8b-p!F)ywUHC!zs@b4w?<#We%n{c2`~>npP|g#%n+w zJfu|ArkA%YBH*8id;a+idwTm=)}<#`Hn!7(|E2EwzqzGP-?Assdc^lS{^*>9RMyxP z!VP|okXYOYZS>mc`2*lAb8JpM%Z_;(9YIUcAb}7UQvu-*D^GBcz5og}_sw6dBD{`K zAJ#lS))I^hrHS!yVPpLddKg zq2A4r-hn+Er%dHhku=Zlx;lwtTVH~I)A|Y%6Iw30QWEfl-l_mNecI4$BH??CdMrs#N6h*%{?R3dO<~)!$;24;+J82#anR@C8Q8nD zP$!C7g;&PT>8kG{WeTVFrIC65=S=j~LdDuPbJrRu@~Gd{JL?LwF@Og zw&RemalTx|O)G>&6uN$F|06^g5P16~ye3VNO0iZT#~?!YT?nXUO`(0{66U&7ReL+x zY{S`jqLFZe0CB%6xfxK@mW8vhH}!CRQ8g>-M7YdS-UjWZArTv`kyd0P{!i?hu9{-z z?{QQw&^!I@I$EI(^YpJyz zEmB-okKKb&XyNf$UK;2U0te5o*M~aOs?6P)l*b#0w|WZ^x2z~IxIz_EK6|@w8p9x| z%&uLM0ZbG$fUdw6*f4@pzEA_q889e%>OHndX~`UMfK_e|Al$nR-Dg%-y}6PI$_L@} z%xwV_F)l<@>X&K5pq6#N>#k;m^s}qKYQTAa|5q=#z7R{3fk*=7y1|al z&JRCt1YnnddKy~tl}XVGb{l72WqEmaVBXHSvXZ^zSQx@v5avb{yD@(cii1QmZVJ2> zff@r}in`8@c;b@x^J;^i?eULG+7f?Z)>> z;w{oFBz2sv*Ag(BY?s0}-2ftyKia4oU~lm}=*B z!vyL>0BUxBldzYu8@K#9Wn~q`+BFEv95yNh(0YR`4zfK7aXLA(e6vigM4vS)mi$}` zYByrf{ee_4ujk=i`-+KFIDXeXP6{Z!WWlL7UK)M9I^_h|G)%5faA^cMZcG1NM1?(? zea>sXXfu){ReKw>D81^66P7bW`u*h zAv1Xyvz`8}QOpEa(C~W%I#)l{V)T1pM5^A87FDR+dy8lWgd{LkBO$EeN6h+`Ca9iV z5iH006f@MKIYs5*c#484nx{q)p*(8_*}gR<8Ek6+t#~yajgWxB79IvCFCI^a9)N6VLG1P6P>?KUw;cwYP~481&fRu*v+YlBum#9k?rsq0VAJeqk?R;nMpm5Tb>C;Dq#sN z#k}ivD?HfD(Lc0gZx6L&wF1WDB#O zWNcMi;dRfcR&|9=+5^d^1fUo6xGSxFJhWL{Ad>YZNCCa?+eTP|Mux=_6MkXemlSAJDz7=<4Q( zA%i;EPR_hyaYeirNOeh!zMhDGq3(D~DB82A>%40sk8NGO+)>8A%hCBdzE>VCafHTp z!h7ekC6sSZZPc4p*rYx1|C(Xyv9|u94@T>o(YEiq;}W;4KJJfg{iS|{prs#3FCLf5 z7J+?13RH^apM#0AHyJ43Ase-<`tP38cH_|(HwS29hMxZ@$95{;NtTgY^^)S{PhNSc zw)k`n;eWp06Th1_n2`&JgsK>s<<-Qx@EJve)Qw+XjKxN4iY3$vek>4lU~M zo9BY>-3fDbYO7BJ>dL(A$rooQBQx{YEE`XmnES#_cdvh|;KW7;tyV_AFXzq5bZ?pW z*8lh#Lb%B0K=*iUuYvZ`c=A|ZJ81D%M~t({de>atBKCrF9FN9<)CSD&cG>r0`&>cD z$vW$7BhoB+BBt!)Qg2V#lL>jh-t0myzI&rBNh$8R9OgSd1a6QDv<1WI znH|oBR)K2pEc<8A^}$CWj9E-5&+!sHENg8@HffGb00!KZblPz^2M0Y3=8M^g)!Ij! zfh|u^mJa4bPe!4G5vY5xt?lhMO}@5!<}hLchPlfC{3W>gD(KX&2@pVG#~#A~liwK5 zWtGA0d-aJ(zEPe+ZM*k-%B=uQ)ViP64kVBbJU~fOK?syn1fqazkPM8cE66Pq99Osd z!6{RXVG6ha<=yIHO8_~WiJr8ZG_n8aW8Hu^*` ziB)y`V*)@5EJH(-slezmifx6}T3|=?YoK&DC1HW(l5gB&A9dfo^WZM!WHWieC>E49 z$J6ol{1|6j`EFf93_O*nr*4z)s3pZ{X9S}>%SH?fRi)5sKbnZuz0>YJVn4WN*UCxgwy+~UdbqABv1qJk zH`wZM%;Ng(-oKMA?9CugoW8p1uSeqv+uf#Ydsln8r%4~4FZ5tZ58sC_KP5IT!zcaS zDIql~>ap6(F{eObxE=X->f2z@x7f_OJv~9s!PX(?h zuB5}sXKC<%Jn5QCGq=6$3SJf)8R<^ENZ9hjkaT`6lIKRddZ}5nO9A_&3d$mz`GfERGv5o1Z=Atw}yN$r3tl0b!LdIBe!gv$% z)4*mP=#Gebz>aZwP%6r4M?%zBab&eSEloLkb+|wff^ep{m;Ck+&;)PJE|LhQfkRcvLWcbcG5=vbO~#!O(1%p`skaI+pQU~kE zwjGnA4V;?R#l9PkCvrJacRO~(KX?2r`=r3Y*XK6%5nYlmYFuq+sK1Ac>X(n#SEC|D zPdzKh+~>8A^aa+eV4ulq692k6)U;H5uFuZYmBgWAc>_J^uoo1m&$us6HX-zm{_QCM zJ$zc42?z6p_dWKOvD{B56)ZFWdy>^@`bsRYgfU--Fv9@*W=XiS56>(u3rsPF%IX54 zjNE&%;S)55G?sp4_XWk5t#tPQR{6jVUH`t34pspx>(Fyj-SW$|!GZ((9fHrxcg7O={#g%qOcGbTVP%6Y16G7}1z z>ki<55cfHJ4{ZWAZ+y$xy7%{WjyKVI$Oq{&B!nI-tUG{`40PhUcrx&iC6HiuPO`?r zXW2uBh7tb5tOLsl-39Ken85L<>Hd>p%SnU_<5+=ONM;?_v|xu|##QiEW+wp5R`-Uo zv87|+0VLgkj^DUW18ptG*yRuwL}Pi+S4!V3J%y~}pQLkydD}R={1XGZ)0ZAcIl+WH}$(=SovIVJ{p%M@o^FWt5bgNGO zr@__kVM>{k3(D(IRS$it~K ziiED^q%to5Z&T}8r*m0YkKiXK<{qCXq!Zb{h;qGmaZ*KgTts$n4)+QN#%`p+)|2480Pmi)KvyA4oIy?w{BDx)_v15=KwR0*wEN7s*crZ^PUWM z`t0L1==A)G@S$K%5kbC&(7`MkJ|hECxFW|7R|~`}!6M%Eqhaha!A%3?=~=maaI9w%zt2;BG00(+ z#tZirmAWflZ6p*rL#U%(e8&`eJk-4OgKl;Id`iRBxy$@GeFO$$qeE5r+Yd2s`P2Bu zfK=nh-K4Kofbn+Od;h~#sFo3{(gkT8Q^SdQ75^i`-J~bYXSXkydXHht6Tux!4rl)Zd#VK>j3h1}`rwYjb8 zGR%G1Qi>K{{OiEFHu`4+2WYP{cXN8l_-x6gYZ(8VykUG>+X=*BIS4xo#=h>7|B}=k zbnw2}*rw)bI| z+w{_ZC~YESxG_H#P`zF!?3DY5tS51|idSjvu6o$@{#-sTH^-KIFQq115{s<$te8OZ zmGTh(;6hsb9qVqs#Xm>-rvVM>&GkcbrU7ND-l`RUaoAlaW3V^MacNgK8qzKk+0}5e z`Dlix_WC}Ge77(qjBIU-!m%Th@mGaQy zfk?Q>y?E@s%wKwnZa~XYU{Pk0W1cq6TSAs)h2Ev^Gw2k~{Lqxjf25xl7EynhFZe)t zP0@m{ad&g#{n-ZIK_7ARth}j>l+4vDXbYCpGZu&|T$TjYh%2vxrP#`O=(RVew9@0# zatqDCILjr1%SVtM1m1S+#ld7SzA>XCC68Mv9*RS1AWS3x^n(@vyU@f(;!{L$DM*eI{5aPX6TN@V#-!kxh3@yKq(@B6}~fL|{Sb1XLDj#N%85uF@5nO2&OFBzyujT;P%$i4Xp-flT^aIMDFi$ z#X>z4wLl6oUM=yUJ!R6H?i1zQ(qdoLO?;+8t%2Flf5J-&vAvE5-8x3rY=(KokBnrW z6n<}jxfP8$q`z6+5j>EQAlDR{UF>5t8>WpDQ+fo(ourQU1L)=@jexKz9JA$4*wiAd zC3h!mIxD|xB}@XewiKXpWcR|su=;3X&jdqGueHK=@&SAk?%;6;yIZZCJwa*Z-xj&i z8(M^|jndj$n2FOilwYy1CGn*E<#hdpF*y{3f$!`$txZ~miMLyMUuzUTW$_4>_&K{kv2OLyFE z_w0nzzR1d8itlsk$Q1(bQ?(|UxF=s$i60+%)urdBTayp=)t2#os-5N4%5K)PCy7?X zq8M04u`eouZ=F#GZ?3Uv;qSh*V}Uii_0tsnU~3HJnpNT7?+|bS-Ls zq8yJStiKTZ6~ndtQpf8JW77=F@E)yE8*wJR=?4SbApy7d==PYdEq>FJ3nyJ_)6eBE z&GMJJ=55+p{11E;@u=zbei3TRpuppa8Kvn#R)0ehNnC&hs%!e zs9J+PDY#Z;Z$Eo3GhV{9MA)8?Y~RHypt2Jo-s*T_7r+vfU4b0eFp2ha+(T{`>6cvl z_o!Cps@;|)o(_*MSW@~rFiJU4N%)Fo-&gddYRiIXx{cAlA<6n>wmv`#!)WNtgeg)xqhrVhZI9#-wY8xS{1xPT*Pv_lznxTZTon31x|I23((| z12$a8ZVRa~{}_^9d@wKf4p5%{rMr;ezqhQ9jtKuZ$?B%Y<?L&FJ%NX#wzUS}qD14cvdFh_hm>W1W4pdF; zI0!~Fu4Cw$=0d_q6z$*7dnum7T2xZLBj-+`PZzBGWJ-Erw&Ue(EU`^?&OO@I6b-U8 zYz4nf)LJFsGr5Y1>cHIA`^tH~nP2GH;}<~Xg+Tl;FTIgkAjFf>5y|QiL+}yO3JrEI zZGVm#pa92TMntwkqFfGoe~8B0-h{V~L`&DAOtg>H<^;nG;I@!y3%EHmQb(uEko7C2 zHu_&I>_Om0GzG|+ni&51*ehIy2q|H=)n$pCj?!%yaJRrORnSpRA`F0)!2ZTBtPf>l z2~kleVd2PvV361N!e`JDcva!gLnCE_ z0Awf?4&j`goh2}RJ`EX6Wl?(^`k496w^r43VU)IrE82GF`P%nKfPhU)ldA6`-kLl1 z9Mb%u7Y1Zd_{xJ9ymwk6KD$vC36&vjV6nT=6VD!M<>FZ7IFr!LbYBf?0uKeiy1f5L z-*s2ugAx#yRdS{JR}ikp5J8wT6lq1L`LW4*FY*lFlMuUODdr3_cm-r-VY(RGDWJjg zN7?H{lM-Q=*Elw!69f?sLzdBBcJkvU&P-R^^9hx;tR8#xb+-7Qx9>miVuktz2)7n} z`+jxa^nx=$Lh3kO+^;gFMuN`%A=0)&I~i+!m39SmKYd5R{Om8^-)o#}{V?(8&!@$% zs9vQ_s2(CZTcspk*Zd!}dlEP~={I^;Kp%J2A%Sa_G7%N;6N;d-{YPLfqG_Vl8IRVc z50wj^VQgR?I^my=S_IS(OKe^HmyX7BAC&OTdW2w$jM77Z@?d*(*ndZXOXud}wJ3hG zVi##4XqW`@Vn*BUj|y^b$)7sYed*g5a4SpJtW*y|Q!OTfE34eY+8*r3kw77{R(#cl zT*ZI0emVK|a`b0yV>9>sqA$u5KFC!xIA{pz#^Q7~IkH+-C0tDedfo>r87iilN)nF7 zdyhHr{Qvn%e+^qUMOT9PG|A4Rn1>kW={bSyIUm1INrk~A=YKPZX=ejhT00uV-Jv_} z2&m7he^O;H>N?Cd`@DJdE4v`8oA(B8qdEAue@$g?BQ12Fj=Lubhc9SwDUr zf*Zg4GJZ?x${zS;-;{xk9dKrih8TZ+ z6{+;;aThO|Bd4a95EV~lM82pD5slhEsy>rTSMS)OEcI6IyRTtVP%wQ4wk@#ZlK4Qq zzjzaMn(s=7;_hUBGFklmyXAu-&r87K?OXM0_W!-{`R!A3%SI>_!w0%I5ck849k&a% z=H5tZ?)Zgg8-xODs{HFb#R;C~s&#WTtTM(&guReah-3S~5UVd5?t`bP($|=I3a}S9 z`-ddbnG1}5xA(}ub=mal!f4aqIxZ<$DXz3^N=&#ekG!U1fzvi?BAlP4vi`nng{0uI;3`_567$KBWcHUxsQW&(% z^mGgY4!T(C$5IFL^fB*=pk(b+>R7E&Af3X}hQh@jP_6aFvW#za{i-yo?X)~kFpxNc zCQ@I(aWk%yaUJmFWZ<_~d>B|@u!{YWYV86XEU7fH{-r*7O)9|vn>`~3gk2!&vxBep zrMV#lAg|gv`SqXo5zN=R==OG}E{S0e+LcM#d-Sa=7|QqoHUGy8FJQETx%J^dF>FV2 z<32>EFCIDRM%o{->VknAexup&d72CsaJl<+FDSs!rj~0Bl*Biao&wAa{l34U+T5I=-~MePXrSXQrzdzK{ygE$2Uzly&T+p%Cqf(uJ4=mLE@-sGa09tzq8+cKkHBnxy)|;R^4qf z({x7%b(t7bm8GG7alS-j$ugFFIL=@;`nz_(xT;2n&{Ij-s6Zlqx2B!NWamG%JMenO z&_<0Tb+zW3*ye{NHd>)RO#9ZIQiEC+;3Qq;vLsui-FJzV)0ZN6bd&KSWU}HI zOwzT3X8>2SV(F=rW(%CAj}Chn4G(5->(6GyikipOEH_R=y-eja5O}v$!-_u(?D9ON zyOeNXk_o$2H{x7l&FT+@*zV?MsDe_Fr{K4{lSO#;ueSg?!!vV>m?sYR=>-g*^q4f# zG07*VH3yzp=z#3sD!CVJ7mb(uidZy`qL$j7A@Do7BHGuSP#|5$#bCRGmJ9Nv31nGY zaRG#%1{_s$TP5>B;kvD3)xq9IfXh7$8{kFfs|Wo0V@iJ8W}|0?td2unWQ?z^d@q;D z#l>pl)8{4Hq&paAdXMK&<)-pdwiy@4ewZh3isVkC%U453;%$@&BZ_+z{2s=_I@arg`vTxkGL zL7d%ewQSjy3)mirkz|sIr2JfF)X?RW1K=J&dsyloLf;SRs0hNuL|!CT7R_d4wE}j* ze?(Q}VrRt9`~0**&;^ht9t|+SRv+`O$V{Lf#)|JyU(&?IP`JApEcr473arE|cPlGx zyTB*}@o7_DOK`$(V))&hljHkF#!|DJEAdBCrOE7|Q z#;a{8K%3A^B%AXA<%AOM7(l;xXM&Rjfa&DN1WG?go5A~Jknt3QU#PDqi*!fT^l{~(FwIxnWsayaRWFv}3Fd9h2WPZy5Rn%P~0Ra{7`#~MRF0<4K zY}RTm{jOL6O4$(0c$lQeeAE9Z7 zOb1$Ov}u0x~X+#qG7ix597eoJDN6^=NR~bVG5e81CIC z1Bo%~6EV(Y&#WGYr}K#Cl4m#~J`UY@d>TDq2Mf-V1<;8_f2qs#vF*9u@y(JoK!sQRNb}+RtosfvOiGqj-JWT_ zIhv_isE#=X)}QwO?_ne^_}}_7Cq(Q_X}0B#Teurvb?Ddh;AMfwRN$j>Ds>H52*jp$ zuUd0-=-4qi*oYst?jR4zyR-ivTVEL$^%kv7iUQJ|A|fRr9TFnl-6e>Wz|dWSA|Rd8 z(%s0=2-4CGLpMlwzk59Ao_jyMU&L|dhx6Zi#k1;J93P{QY+N2>1*in!6~nD(d6J?t zJ80krooHG{`G{9Y4mkl&7P@co{DAStQ{YgJ;A3^5;kt)375RkRD`LS%< z%v1-1<<+(`ff2W(c}i-4P!)4)tuMh`3I-Z<Bmf<1HUb6@WdM3un~+sFe=*}Jrn;X$dx+IFJ{||y zW5j?p&aHFYND@K<)yq7^R144=wYs;*nr3+At4|CWUTP2Wu14ON0gXl~K;8?0Jwa*Z zarra#*#Rs3(E{*;o;%c#>L&Y!Z@f z$rn=^IgsiIe6-vH4D2#~{^v6ILpj3_c#=+wk_pudeg@65+30+Q@Q2b+96z=L@9r$1 z7o7z}!OgN{OaYd}-v@#lM1N^`c%IqwF!RkNXw~|JP8ecfi%lu;?u-FQCs@j65;O~% zo03cNlwN^d2ZT)OU%+B3Nd)K9B~TF{VAbbi(ki9cg>AJcU4pAIbO-&J|2VOGxZ2$n zlv?RA;xxh^DD~J93n1TMQMH?srOT74HLe_4qmPvvMT09>hb!bIMq^2@3`KIS!g5s_ z1HU2lyRC_0?K|X#=4q+|_8LY<#RY2nr#l5D3vj-gmT|S3T==ExqPVyH*7DV|<0>YBVo$1AzMQv_q691W9U?;oElarqdrUELiE zIy3WpG!g%5s=r7L!@yZQqaM?ttb~jG7r0PANy6lgZH2d%BVS_{9KxF|;ZriIPb|Q< zn9bm~^S2oT8um6%myM0h!NK9^Wh0<2RskcdmVn%r3$iFW&;oWmm~}_`^VrSH1Ag5@ zl`gI&(D0>RZv48cbr-B6%ZDtrp+IUuXIZYstrO^J_hHJjlK=OLiWv^dkZQ|}V0n+_ zW>f;dyv*0Ex+GxrddAFjX%x@@xxdAu!P}X4cb+eC#H>IRbgUkh*{V1E)P{Qo{yIPr zrZs4nU4x+q!R~Lc$pLgk)6>cKL`GE^{HY=pu^_OJjoaaOG(A zy4Mm=UUkZrE@Y{Ey{XSES-d*tdSf7{r`&N1Pv~65MS~tAKh;GLv}-P&U3&78Rn?-U zdOIZw`&=78Q~F6@MiMJeNq;bhW6CvT+^FVk>*C<<9V)4wBBfEqg{~@fwZ0<9BtZ8l z!d2$0|5~xOKA0NTcG0w&uXkf6^;|_#e@NpFb2B*4agl z7(`DBumdXdWNUO3P(tV1&eiigeh-54F~IKZalS_>5scT7D-e%fW4Dm@!)8_z-cSPS zgt|=Y^jjeRhEJ+N`}abDrUfARBEf{~U89NQ3tO8A7>50O$0;n|M2P#z*OqPdo9+D2 zl_#yb_EGz)@OV~bv-Rv{wP*X2(&6%3tKR6MT*{i;(tL0s`?|cgmRH>$SD7%Ga33f- zs+AbO}V3HOk#@PqXmHaI1F2ETyF6drDi|FwZ0a2vRp$Iy*g4q88*4wohB0XrHn z8@-eE39JT5K6f`VV5a7vrnm;l*48$b&)x)3f8ui6%#7)(i1erdB+#8t_7517MIBS>N{LxXo+@-jQy`HN5B2Zs-u})hG{sOnW-}6om7+ zbt`gsopYwEgds$<6$>uLrq=5uJmf`J3}?$*3Q5AMo~m0JJ+{kJPs!r=p{5kOx*~pf zbbS((XlWTZG-4!cML>4#(80iyhr4&S%D^aQfAt6b2-RmwvbIX;!^M|!m|M9~r1;1p zXqUbwhgUWNkcBfFR9k>VBxxJS*~GHe8;LOr2fI8jCh~mO^mL1T?k*IKT0B%x@+|Jg zYsOuas8Ze}$2+fnDmh+Md*6rjFr0+{$MmbX3s)cly9>iQfIkHoFKSdTWZV5ls4O?} z>Pw1)p`)sNp1Rfb*B=3gAGqZz*Sq!R9o`+H#c)_SpPt>^^TJ!{Fjdl zQAG9cP(v4y+u6_5EH2Lv_U)TC1*Qytx}pZt=hgCu-ZDCELVRGAyZt&QQy=VpHmn}g zPg;y*d`Mw8nb1Qg7LImZzc(>VE9+)dm2WeDOc;xF#suc30JSZqLDe_cJx!BsunzVNLYBS`5YSypTm12k(y`B&n zXG8@=zr^S)Z^l6$oPUe&I>vN&k8KTXs9`FfvSP|)xmr!+#hn0%Bl5H3HDoE zUv+rTH0RbrY{K4fClBPJxke11VkB?fmApCG*}#@fViH+!zk7q{GcnepqR`gj4c)JM;d3y!de8FR(>5z*J4vF28 zw8wwX1!m296^GA|J`xRKxvVjc60Y1}PBW>MiYf5>ygPs9;dai~-nWjho}5rSdK#*? z*^`BFvXzBKC!G?9_q_i#s+@D?0d6MQ)f@3LPe78hbrVeIbie+3LIe=7WE#3KsTBD7 z>Ex0>=84<|Xf0CV3t2eaacmNnKY$rJ3CbwMTSbs=>3(=t)4kBXd`Qt$8!Av-GH_Xx zM49#V(2*>z>3W&Wrm-^6w!tVji0Yg{;&*i{k0McFToWB#Xw*#pp9mw7{OiwGDLmOX znDu9WD0W+#zA1{l61QA_mn+8DryN$?&*;=Ww0g8nvYGJ|TnbdS$G6_}FK| z{F9~xA`T|Ksnz9tXNCm)DTmkG0&ZvXaTEH9QX3M}^!rpQ)dw#b3i#5tb&`~q)Yrat zE^aT04WM1AVCGG6<-@pUo_0E}57Vfe^X274B!uY_Z^|8JKI15)cZC#Nvkv4jD=Efo zB)G;h%e-ZZ%p{1D(Fy<+((lJh4YQUzHE|~gr#447S834_N)kGF>p9Qe>y@4Iv@5OW zx4B=Wf5)G-aGs-|CD0fTMmNyx{UfmMA0{F@{P%rQvWCh?*>;4d5l(Ja} z4(+LG)OG$-Fb32QaCrNJDW{hal?y0a(E!T7Z(iu3U(i89U%FCx>Asqty>Qicf06c) zmVB7|J8Z24bkFYYbUA_6KL^~e@m)n|fb-*dM@Vv#1F@~*R%I-2A$FSex5Xx$)(9cj zhUZfS{Z9Mqh>D>J44jT?J*tF@-j_#vVdOSC(_!#w;V^+>Zio>tt8I>B7qMC)CLJRH zO>lNcFjmAX1OUWSi7=_)n2lVq909d4lFpXe`4;Cyzz-s+l1Y~V0B)Zxre4HkgvCzp zUYj}-3b#eAD&Kn0(knSka*m&Ea9n2lkm%2NsHeVgDSNAYLe0}PM%c$W_o&UoZ5kVc z@i(!)O02aJ5dKYqr{WADRLuMur5nF3;TTR0&0H-7g*0D33^yg$*L}|=Zh*=_T*-iK zl=)n+?E`1(;(n#dd}axQOC#4+=4$?)WLSRc6L>CWH-%%PL&UoTvD~S5NMGO9@A%Et z;^oKO$Af*>$n-+%5*^jJ`kR2^D}!MepCh}$OVeQVX`@li5*L$lW)sbRSA^YIS=dhai@q?vOpkIc4wNHBBqe8yqiq2<=2V3z(MTY%c7C&s#kz=3Q;7+47`ChA68yUSw zqsO$olFocrm#?tzjT9SZA>HiefLfBY@T=U8%yP;iiQ#?h(ZHo7J0wcWeHikNm=UgRcN_G)MLp?a&YVYwlRSPvD6iJf16JNt@TMdsYlz}K2CBOcD;Qhd0 zJUewqIKhIl%i85M*Lx+`_GZg>;vIGB+;XOGj?U8;7_PNT$_(kch68WCG2J;-d8Nn; z<4RDui9`>&?1V*3zZTU8_L>jfxxGo{?~)8PC4EiEIYB#F%j$Hxr87-nx3t($Ijy4W z;_{$`n7!0enn`pltYi?QTkCoS{Sq4`Ti2}gYzlkyXsRr|O6ZiCb2!p@?@-06xe@ax zD%4^90oVO6w>N3Rl?A7$vZTyS!ogVc)3OE=$-Ylt2ek!Qp7%Si9$gWI-en-I|-zJJvC;eA#4=~{DJ)bI!XMUS)^-ep-=1I#vFzOH69U3^Sb~NyPtC{#s zEGSsCw5@xH0P21Chln4WokwP@RwLt`RN;(q2#w5O1ftVib#V-h5_Q3>RRz2H2McKj zPd7z&n@cy}KR1H}9O@R~`?DM$&upnWA#CA0U_kn_0LRA@qPZU`m1C%8cruEZ#*qD& zypOjykP@9ojCW|;vHLamfNqQV4=$Baq6sTvsLknN& z7%?$>1T|o!Nq+Y<0p^S1my0P~E|7^D%QC4@G(wq=*maT)HXl%6ehiyj}7SVv*+N4xqZ zZP3qhP*h?#P6Up-AAS~pY0{bsNt6KXyHjlO^?2NUvtfqrLU{^W@gw#LLelF9ZZ%p3 z_5^GWPotU>;?ur$BG@`DJ@w4qG1d8v0DFqaZn>|z!YEPf$D&{q4;y{PxU_S7X&2v&PsE|Ibb za0jzO-4~p)scE&!50GjXUeD?|+6L%T=0k`0iZ23`%B1{Pb1W2_N`0hx7AH5!wuMrp$(SpYnrQfYy|Cb(;MNEflY~FJw2}WZD zpyj%1QfvRC+D1%^fGlcsAlYKiZI^fUEvF$o{*i1Cq}@)OXZ(hU+~}_R>Jf|pdV6*n z!|w6Br%@Yo>9=nEHjd9nz9+Cy`h-!NC9cq+@AoS0F(V3>71?b)M9)7*Wp&b>)AI%% zTf44zx5hnAS+zni@CMV1i=3bt(mk|hX~o^?{#nD=Q>B&iJq#>nB;r%+Ma@bZi^dRy zuS><(TPu3?EMLihyXf(bFXK)MiQ89jlYP|+Ghe=+0ZXmRQWwwK0`2jP9o<|CCBWDV zky2K=P%g7ZMyvFF+<6>eUFYZ9wBoaEu%H;tQ&AMv^)L$ z!+lj>UZxnzL{YBHmZ}nCYdAl^zPHGzgjrso56{I|mG?{1IkxVC={(D&)eu^gVI8d1ldK<>8y+qyGSg_q*7@#4x&<(PVsOUmDs)X1Vl;*+^a-F_ zpX#@n+!7=VwQ7 z-!qE>B&gEq#&4;T)g(EPm)`8IlKSbARJT8-nt{clJoFlJ1+(5kSVRk?qlKH{>W5zf{x2Z;*#*q@2O=NLCl*h{d zt*=>f!UOa~uZ@0gqz?^O5m^MZg?k-Dmk9WiiRp5?O6_Mom6W^5fDm}c-js%NRkQUi!RCxPq`aoa$Td|*tbEQ7 zk-EfdrE!5ewG9XfU<3cd1 z#Lnkp#0`wM6Zv$AY79a8BNNvEKje7(F}+FwlXpi&Jas^_^!(&02g3+z7UyBiKF=8zg9_z9_dl4A5RI%JEXr3}K{X=qv5j11i+4rQivaGlA zvh6dhw^gl|Do!6yMAs58IMT=BHB^%)F*JL*gaH6bJ7QtrWcFUIm1U3H(TT?6?xJ#W zTmajFII{Hj%I!*#LsQ1)Ohf6^(CU8Pww?sqO3?U;Q3$orfJ>8h9 zr>^5=vtty=pYE9R2!EBwH?%(5P<3-C@vhG{nL$d}yBz5-59?lLR_nZ#rjGTF#)qWF z7n&=omOVaW?@H?MRX*COiMm9nLbg^Bg*`*oti=o&c`|nc zT-hUlIROKfgd}Izau>AC#`W@!C^e-8j@S@-SvV+1x&sYwMn)YjmiSxHAqo4Nb zE@~z(9B3CUEm55_s{DEPGU`ckctj z+GMnH6BcwAr(;<;Qfa->=po53&iSOGqi1{3%aNAE{b^WE7S`HjYU+}TMe`YOQUI6w zc93ksk%A6fZGiUpvws&A#gR(Pf1>q~@L>S@!PF~E7j&)QzwbRP6cshC@pF6GLxq@0 z$-AG`>-sac;y#evBcqUuGG)!lVY2?rLDiSk`M zCS`qIwqh1JGIpMw>dy|uR?k>dv7a7b>bB5NS6{|r{~1V{`xffpB2;29q%R(kd@l26ol1M| zao_s!K@I|PEzg;js7MBb>|MTpvEAJ9BvA*H2do5m-PT8~@T=#Eua~{B)tPlnYavkz z<*Q3px{Eo9h}a+&_aCpg-$i*W97$ElToZ!%1Wx;Y!1EBLXIAgH5~&^K7x(A~N^z;% z*(OJmuVVz{W@Xm=(0jexOXaJOpWeAaX|-!;rA=j}Y}R06-}54R-?25{#YpL*hQP#{ zZz7(}nH5b=IN^*>w2~)=!%3me)l?g2l}KRtfbii%s7+-xih-|t6xq6sQhU+w%1ceH zw6yQ>%+AbsN@wnh_NJRDCN-!+_a})=gX4AWwwA7G9M1>7qrpmTyi**WF=zCPaYlT_ z*{dY18p|ngp4>DTt?vUBGr8O{F-LNn@xGO{+fV2Xba?i9Ge*iO+RmX-?=rXc+AX%e z6#$MgyB2CE5F;U8dHCE*8#M}T^C!N>7+H?-Z;U5$)XzI|g|R{xmSEaJ^r zW=(<1TlDieQ;f>SAGYH~a%OTz#i6=R(1(r0(|mZu(R6pCKQ`O9!P#`;CF?1~6Rekr zWE%>N&HAL^YFYFo9D9C7()$OOhW;n~;R?eD30Mw&-e!cxTE}7V{2+s&{7Q!s6jLM5lDYMJ4nfj*JMargdocoV5#>m4 z4H4yL34$&kKu~r3l~w(^*1tb{wGjW;Q=qA}j%c$yF_f>AiUviP(69{qJmo@D^BZ=B zo1@E`wp4c}*tfj4OoPlISH&q*sJGiW!EFKG`qQszx1UWqInwOz5B6{s{*-YhASFMr zsctP{sShPTl!C$^pS*!JgIakP`+YHAFvFc)!KrLl1ObwdG2*yn@N%|cf=Kh1#LC}F zVUtu|w>O_9&&T-Fok_i7^*M+puiJNDE*CG)CmAJ62)U3a#Td36Wb~ePs@84S+wlIr z)t2GYy3X1cc#?HdF)`y;^eLIYHKG?lysgc7KSTphgjz6*1Q`E_A{mEtH23HGX{(JL zQ0)cY?+J$Ba;8y1tYy#3(ifPLc77DTU({qOxCVb3VGEnWJ#cF@++x3R`H|C7T9RX8 z$vkxPT#$v(%*lH{Oo7YTQx4bHX45rm=gYz2ajsX)ag0J|1k$%oLi?TBl}=5>2{M(BqqdAc|+wUkZK{+R1LLglubpmk3{25 zFKp1E+&MHybqn({LcF{q$hIZ!59IwjKc7OX9Us_ImUPuM!R4)$MFhFn?-czYyZKbt zUiSY05=BHgoFL~M2$N>(A;Drr-O4F{ZQ@^}I;8xs5ONsdK_zbKx?+ork*((4Q!Pe> zKYbUtnRII#SfWIuAh2Keo5i5l8Vcub`Zcih^m{P2BUbJD#mk=XX(ZT#UvCXss#7(8 z5ARyADq!tCh6y+O#`Cc3K1t-o$NR$Y2FlBh1 z!wP9_vA=JY%S@UFciavp63geVDYW>*V4*3Nu>p%=e7*gpr~yL5scwH(Th44~A3zF@ zgdz7)V#f(3JYNdOYHdAXx3iL?-&0LHn#z-C%&CD)D}CLiri_04cQQ^$SI~pDXsu z6cueP2~0>VsHj12?afkLWO;<4f63xtp3vtRL!= zL!g@!0X1aH(1TcUq??)t&`-3sMR9AJy;Yoe{C}ADJ$iD25oz~Pr1#?sibwnUo)hl(={;GcT zr^s~V<|hB(R=Af&ASg$%M~RGMt3bjkL5S$5tiP^1{A=+76OrOOtq>1QqAy2~YQYv# z6&JC|T~-0FE47d%igd|yX(oi3_&FYxa4%=^S$V`-S38Q_PquNtoMXQU*|EIsC28mP zXD3Ff4)y$u0wD)Nd-sb2^|KAzSNg90YldxWurESx_asUHpFs|*b}G*6DB}f_QwqP7 zS#LhX9(3Cg!ln((^3Fhq(rm|)X3^!vWjdklpj)#+gPh0t+dKlvl1QprbEUAFrjWw}wn)NSS>WEBuX#@H>i9(0S?vM?Hzd}od; z9T{X#MzG1@v<>pPW_-g#xoL#~X|U8m6Y%w7H2bZYHgi5}?u0FVb8<|07?mYXxBw;@ zX$G+e1GxoY4mC>~N+M)qisu2w*o$Y&1sc_F?X6Qi4~n%2=&ZPQcYhuJq%_@XJsXbY z)6v}Ky`#p>8=o6PM|FX6N2`PxFKWhp#QrBPk@ffU(_>K=C~qUMGAvJ?=1BMP67AQD z#ho;;X2CaRST4LP(2K2V?q}>M;3-qNJB|ofndOd?xT!EyB5)mBXh($zdMIhlc$qOG z{tz0v4M)(Z3EOF|Xof^QW`cxr$n{GrP&dvi-yg-~n|-I6nf+o49gk0rQ>4&ChBY5} ziN&qI!`o_zr+A$zyXit2iMrtC9!$o@!m1d64ionB4YC>-r0eBCRa$AgOV-N=aQ5kA z)_(;)d zZ_4DS=;PEYWzioqKiHCWl3$hXp##b!8?u)xbutLf8}-dj%dPT4j=z}ACr4*c`%joB+NNqu=Y_KrM&A?i@DpZ z&`1tjjN~!*dW5)R<*x!lYwES1G5e&q-Me!fDKJ+Bg0;8f;wf%29ThCCEXI1GwGV|P zQ@+Qt)@zUe*9dj7Bri!B6-~i%YLaN7la)fA*=(Jab(SPY?5@3=mXgcWBHnuJKg-!0 zfm}R(m?Z=}_mVjCet_N0!7>_DHC08nuKia|g3|qWOIjz0O27n0fpHJd%!}2PT?tc< z9GoI5^f)W2)B8lWQfp`PMNK7+PIPOba8n->}SKWwOC^F^h*D}HiX>vg_zf2K~LbZ)#)Dv3zL$ZnGeg*ozL}7H}i(F z6oUMe+xAMoF7HmhHW@#r+e)b6lfG2jTGZ9q zbUJ@qeezq~o=kmlqH8c&R#AzuI{)8jZeG&s`hG`AfdD$WGEQhe&|0EM^}zO&3Samw zu*_)6a45R@&Ng$7U{S`qL8b?_;(tJBajP%7_D4Q#27n0I;r3c#r>){&fO@6@{C__M z+h<+rvu+${oNd`+9RjQ^qrzl2O8xr;q~<8sZ0b&IB7gG_+b(#NuhyvOq!T57^+kZLsSycO z5{YsY7}cy`oQn+w!-%5x!KX}t4xFwF1h1=&Un63p3o-Aq5%Gn_tjp32@(S7=Lyv_` zS(zIuHq^_O5K5uGCHrN0Y`x^uyRJXu)>uZqCOHj_t0b!&Sxv2Z!=Y|;{A^W1dx?|O zM3U9=dq2p%aElC#*K>XbozGKyjCeO-rBsvp+0or$+-K)-DP82jHNd$a#w>_>!Gb>G z6?=DEN!1oyGj+h(U+?u3}`QnNlCdB-3bHp7w=h<>oW zavL@P1|A!DFmWtH8AW_*;;3Jfen7NcG8A-nWA(V+4!_8<1~{yo`TY3yHTGUg_P8$( zk?${E61UF$k00~9eE9^h_@rf`cT&zpf0pTu$!1F#VEXHo#MlM!gfiGI<$8qI9HD`z zKQqM{LvMJE(;6bJFjJP1f=aF&%b0BCgkp?2>B!iZiCN0xXUt^VtBvqdv*|j%Ege$PR~H8P ztnc0+b1xnry;U^SUFgUFvJ@zME;XuDGtb{B`vX6={72qF@Rc;dqoDZ#y3Zlzi?@@L zTt2>bgkzFO4{Sfl|A7?6_=|wtL#sdhg8c=OlgZwpx~YnE<2fMys~_NpafTn=m-Z+8 z>A(R2O*)uLp+@~TT@eXK&v5Ojmw{`~sYZ%K1ug%gHtA;tPkH+l`h>hfjM9lE7f_CI za@r?|dXO9O%|RWHHIJPZR-T<|Tmh-jt}9hubes89!fx5Z|hw`1%$G#}LB(tIf{-kp+F*;dYi zuUKw8rAUz?b4@TRO$r>5E-wtdMpC&)wu#Z>>y$~JD?(K?E+>j@i;oYjQHWP>IHguXuvL+xdAszVe;)?_{a&zeNwIMd&%uL!*pHvGJ;syQ{Tg-)Lc z+itR@nL(}u3H|nJZTBgaNaqZ-A#~x#pC3Ax0U^&yt?wa@MEOeh`a>#fpD&GR=gck+jsoFF}1aN*&(`S$}XKz)p`YPm$0zMrCTWhVJjqMWUX)La2=pfn{wU``D=Y^GJk} z1qiz}(NLHx#YYSX3CM!bgr@h`t+(ZFhe%GK$HJv5s6aI@psZRyhJ^n9HEaB_{sZ#^(Tr361wBbgPj8=2ZOU0>vb8v#_}XOK)tW8SQV&ZB@{k8EE%Fl5_B;d9E}1P zB!&VVKQhRVqzTfB3TLjUQ>Ty7Mmr~AVk{UX;g~VQdF8B6fzE!44=%+XK#DVZ%_CTtWRVcDl3ryT z)FO4X;S#;BF9D(JF9rRRFc-#WcMHTk!PIiU5H(peOEKa~gtc=faqTXGLgUbYUJ)r) zL&N>3nf-EKnskmz+??0ByPFHRe!#UXX|gW>gyBymh}VKTB`$vse~#EsA37Ts>R#Dq zwc$cUDb3_NdajtJ!FG4_ttRBLt4Iwc^vk{9nDr$+AR|%J2K*r;Px^Ov(BkeFp&=Si z__}%#we@MGjY-b~Qfqixu{;NJe>!cQSP8N7<;Wp+G zCJkqIJ2L24o|B+BM#BXK5Q4ur%QzVc02+qFrE5Vh4_D&)6ZMVXrA=~4p!o%C8P@}K zmXMnTE1q5Fd*55j+Z@#DlM{8q?O&$^hx++%D*V;yU72khDv6*a@g=x*6NX@FJ9$ux ziA&;qq1%R%Rpn~I+0+k}-oSF8Vpv_^4R_L9WVStf49`H3LXOf@J&FDihm5S?P3pXq>69&hEYZtI}9cIGT zQ%TAUABY>!Yspz@Rf`bX%e`2xX|)k0dwO`-;90QKS&!m&t{mZMRmazQn@dS0D|n}q z(>Aerf8{=-yz|tXVG_kW%ExF@FZNa19TI)hM~c-zfZnz&Y@Y)?%13916v_TXEB2EB z&S)W1JmtU2k}>KB^;W!JZ%yq}QV1a=sBRzj*bVw0o56MSi8^69mnLUNXb-yFItFAN z>P~G|ebHG8i+Ny1)HOx<$~&IJW0DSnk%4QRg=sweqij!RvGpASS4e7qnbG`fz#~yb z3XKztGo3tWlt>OXNf)XY=aeGG>&m6D1r?!E5~VvCkZ>C|?J&N1IK`tkpH%6w%`2+I zw@Nk5sS}3G5K1{vA$ScHE)Z`df^v72yZd;(Zs5gIr!jbkVyxG^&K^QZ|B}V2=-B|8 z{E71ZrvOj^in%Tg{z%=<-?{`~-by6k$dM78Jk9w!-K%!(b1j~7%R0m7=+t*ym)G~td{G~U7ymh7 z?XQ6x-UORfTUvTn;5YtJ`(~-Xz!lO5A?!$XOZ$SP{3_qTiAkppTSNK8^Yo8^_x+hn zxz8iK+^Ff3<{;;ArAPSY8HQN{I~{^opxnbFjEH#aH=`YE=y16bD$R0nxwQKxgn*x^ zL(Ruc9@WtoY9!L4@uEb80o&U{NOV%2)IYeLnq&Jj&VH>rfy8A15AogYxzW|l7TxW| z9^>6ZTB!-dru7l)mA8z08`lAuU0&ny$(WMK5H$cm z5SS5Ai&1TJbP?#O8yh6pUQw(4u{b2)<9JLL9Mks9g8A5@rRC-z8=fW4oa*W3*Zr`Y z1M$REKI=~)j(ysU(eZ_hb87bRZpZp67ut!`J>CpOS?`2A@!7f*XQYqDT_jIDda?HN zVh2=qmfe4Hw*IU}!h|JFd@=<<>B%yv<=On&)wBI}O9;Y@YwKRRzh4TT>kco42^ht!aP5Z(_Fh1&`U$Z;JmAq=_O5r)Hww-{co#`%NRyO5yv> zP6#&1_J5U^(Tqkf~qUhEW}I+XO{ zX;^w0@1>h(l-h|lPnGFHi~9)iU;+WXp+g82?Ys3^C5jXY!O64lF5c&=xqk!#7#+hT z8rHwE(WH0<4Z7vl?%eJW^Y++SU|EgZaGDKj=@B4?W0hCQb>f{Y_h<;w_B}NdctqRB zppvyUr--x^lW_IGy;;9(5#rMZYMPWJ`XU)%{#R}s>^0Ht?V8l_&wwA0GU4hCxT!@8 z^eJ?hK$0-bQ1b~FfS5d7>KmTmyhJVFpRy<%Jjb$wr!m}iUY5d3%72Y1&KV)dt_9u_ zK_2V)52?UQ23dj&aeog|>Tk&a>Q+%+SjD)=Q#`@_bR46!GY@Mp$G@~TuqU_f$IoEb z{+ryB!B73_H9y6f)M{D`M`D83;dxt&-!NAK+V`*QcR{!U8mSQNG4qyQ)D;fzZ18TL zEQx@bJ~Z`;AC;rFCAc1IAGAl}S=01ix95pyw60`(Oj29|BSr2h0`(CE+0F`DKKFc( zbGFHMMbv^DsJ3rFPCi#*t!xVfg1-rf^Ev`{UQN*~042y?UPKa>XCNqT>*0K1tNJf6 z_3MWRrXN@%Im?l-GU1uT?5w(Pe{ob`B|MY(vm^AALskELn!jGv2+GbUGfwN6u5kk{ zd$5O*(*67cnV8g>eC|z$t||z6;tW=3x5ljx#|l?BHWX4HP-(6#G&U+oo!6@rR-+a` zw$7{?^OiGSl`2`;3tI+980sAHZ@yf9k>k`;wr+od44k+Z(#IXNSn!yFA7g^*;Sc0N z4EbwaQy9Us^6jvfmcD`Kpx!uf@Z1Z z&$TivV)!8Eol z-`;y4x!8$q-P`N^mbM8}Qcw_81e3S50&Mi}P(NmZD}1dIaSTM)j}~6dr#%y>Wanv50x?RDMs12(nytS z))Z|;@`N8*z(tHw3;j@0&m)nvwEZXZCga_ypPS9-SU5?&AR>otOPyC-XRW;aPG`)G z;x~y#WSU5Gv0pPA;n2D3=}ffc_|`;?H<$f)Vu@ffg)rBDB|!ex@9dg3BrFGVbWrR! z>(Fwb@7*w->aX{2QpGO-E&u^eT)dq6aG`*1vzESqAHi$*5j=THyu=O{g?1-y-q?T4 zALtKwiTdI-1&t*+hVQJorE8wA^fL3bf%B2Ce4ZYB^)OjSe4)o+}CJI9B6dj{q4Rlhc2S|`6zfQ z2DP)0vC@4i?mMubWtE332r~Ams+0$c)h+EK;tekd&R7JAfWk$mRO=Wv0}zG~l7Sdb zNYRey1Kak?fZyZhAjyxT<>x<(laON9jjpW@l1rg@_DJAHzZe6FC;urBn~Yx!w_WAE zeV_hQXe@YW&`u+%-Fle(SgLSEudhMEi6IXMyh{fJTG-yu4 zs;fii$@aZJ%?k)AD%}V&A1fXu>ov%aO6vNju$23opGi#*^_;GEpjtybb6hO*VW)YlAv{^D_@Xb~%@gJB(^5 zSI^0+(n63GI&Pp4R~gvUW0ocBC=S(XrGV&_X=?PQ(oUjXE>Eq znxZe$!E~NksF3%dPY9|EZt|fwDhc%Qt?(jQAT_F(qv}22e}(f{fbn(`A-4ljrE0+D zI@%pYTL9?op3_SK+99#3_x+hNG0$?&hER|r_G5HJ%U(=Vrbm-Gq89u54=e zKaG6?bWUn8sC~ySf;94n$JR7@KR&E3EzyXsiQHYZo17}93oF1^K7a)nU(Bbcr`?L$ zfg*(VI4dbB0XA{Y)K~7&DJdy0;`<-{%~Cv!fa8ib(`4vCv8XfyPLio(HMVa90$suj z9g{H_(4OJINB9hO^No^|A8D5Xa|hEqu=&D37Od!jz@Gn(n+B{%NiR(wyu}Ow#`bgh zm}`Dj$%>`*EU9umpd(a{pc49Zowg)s633*00!`&KAMgu#IAOgxO318|W|=F&XbIG+0FL*o5G5 zCq3t-=73nQaJGtM@Su10&=v#eA~{vM_8AlbMA;d^IN#jeITKlPQNa8hye^$ESSI6; zVzitbRzNnqtu6euZ@$)lpk=8?Ek-LE{e-+m#&EQGk8s^W`G=)#z#wfk=|@R1D+ zbUV<6Sx=GzjUzV}@3Plf|C_ZQe$?*C$)} z;56kCqBsV|&cQ#T5@a-K=E{=_c$_dG{y;4zS0)i~%I}WwL=4B2=X2eoAY|3o2K7D? zthZ;F2yfPe3>)2ESD18+FoR@qZ9c`~7+B9a3NEGNSFPcv_SWDMzgGCnx6{^0<~p^o z7rTSsn-+w|&vF#TNASsUFp=3NDp!a8*MFfzAjLlkU#w$J=tU3oMHRFDfVFmaxk23< zCs)gE#1w2FN&|(O4^kmDlEC~yI?#W%e8Sa@=L4k@+NnEy*AutZnDo9o_vy{RH_jkH za8EWii^}9{>^BPxZ|J9(3s0bOXye6}e-=sddm+z*w1Bq^bAK7+D=sFFARFFw;rt4)oxE^sR&t~2hNY7NpGH7ztpHBpYFU-nu zhGPx;CvK%)oyyN_Q457_J3vbTOcaBz z2H@=2o~ob)$|uVgh@@%&_{$*ouaVv`Q~@mx3|2+?z^PYeD1^vqGCK`um@uTz{^-o{ zAOyxzN{#I{1z8 zZC8}|!Hb9p_OE6UXmD7Kn&sV(Rv%dr@{9ZhZ*O%$%~>k3^p#dP;X?_yT!i};1t8yp zRfOU@fQLdBh%mv>Ga@WN#gYh?^W?UD1-35lUC&3?AOV0zkZs#d7M5r#onKMLiZry` z-z9@huq8wlfD8xm6R(O|^R0iukvRDOw=K#FYv{`95G}i5Z zue{o=@=;Yi@OK}GX6JhU|HcCc2hy;&?3GmBQVTs!W2K7aXs)Ol-4rsgJdVq`&#C*K zEkiEP{kYkL1?<6cHD~<>ij1P5lSPjS>&G{T`;P|i6cFcFDfGlrH1kEmWhXJo{6O%m z9^aya*rf@8W!IjsZIcb$3itqK4*16O*q5e~h)*R$b6X6OBO1wJoUJ)^DY)OCVW^@ zQAeb$Ut>kcZ8s0ge`GyTtg@n2to@or?+2Hx>EOfvu8+SQetqV7R^x>zL3%GeK6 z2uB+!e?5R#?s{{$Web~b89(yb!_frrP+ zJT7$ielrXt^bzH78~L^&p1c!4RG-(^Q-sGS-56ux`OsM z18zOq-bjXILxuh3y4SOJhOZ}$^s~FD_tiq&EEyb^^~Va8m1N_dq#Ej;3;GV9wP>l} zCRD03z0p{6qf7OGMDDdT$%H2D=2G;a4~0~5ZjFqpsnb~_7e<%(ci*c``!3E&^H<-Oh9WT zuab7wKDZDu!OVVq+10hRzp=q!(DqxML4mX|DvQzk{4n#Il$2^C$s-F;ot*jL^+yyv z&}@-tuG~vjqu$d-#Ee-vBFSYzTIANta^+@yxk0&3F_tE%LaqAzoDHRR#y74dXIaA| z=KOrnX=xMBDkf&FbRno{ z3w^)%R@MKb>#d`rjJo#W8M?b$q@+O_qy!9FkOoO51cokwp}UoCq(eZuLt2sUZjnYB zNp71cA8#MPEtPRJKqY63E)TI7~nCDq0z zJlGl)CD~u)G{=b_{><{Jv8x+y{NkE+^=EfLYQw=we6ig@XM*`fNxEi@DgMihs$`LE zd=Q*fW`VnVPF0cn(HaMVUcz-UO3?T_KtpK>=rCD=+F+~xa7PD+{@4d399o?I`j)qs z$MT*ceO*>Vnt+%G+2n+>gTnx3f$?I+6|myxdM96=9jTGg6ev9^aoGA!$!^e4Sr&i2 z`1PHt=j~+`>F2|AVl6;fDr zEnYp`3HrRDxj8~&q);tK7Qw3jmD}QQsg;Y;g%ztxy4t*dS*iAy0uX~ylf8461cBvXJadGR z#L7PKp<`F4+d&beyV`9ZJis*SO$yddg2(9=LV{L)@nsVCzo-xmmudzF1E6|+0p$fC zVtUXZ`jDcDi+XBcPAHN_^cC>jZom{aI*}rW~@7xM=cKuUjI{tp^G8}J~kVOU?KXOV^$0S7hn;o@LXv(?k(L8+*)&#l*!-n<$0 zoab?jnt8#)%6RJ$AaNmDkORbJHWPxEPdeNs0PT~hLFjRg5ai>x8QS#)KnxneN7HLY z@smZR?56&#+3oPv^`Bq0vl!UNWSlw-WCA98VSKQ^w^x{EO&}dhrbXT*%@vht=2hvX zFcP~%qLLS%ueEs=jEz!jw#4)zo>db?hgWeddA#HC+Qob#)DWUo0pvhe;|F{N3(Mq%0e@v z{6$wYm}MO)bniXF6aH`st8ynfB2{vwlT|W!9UP>;}FyY_)~~{*1iQO_{7m)*D5P&BS*5@VbXjqoF3EJ> zTA_LQQG(+v-CfyvkZ2m~Pe(Th5KEu_@T3YLpB}c)J#%vQJ^W*S9R0ss08h8t3Ty@w zd3?(S?rzj_t))s9+~e7RRMwSZeV!YS{dnFyYb2e&xz)+5KElF}zD4(f(3Rh(h97-@ zHT?43iB4lc6;wA~{rC&3c=PJ&YNTJNsePJ?Yn$y#8Cm8`ydqnoCo<#dg#W+O1Eym9 z^wXHvaqvL7TX|P8MF08ypI;hK2fcCJ_!-Nz|)U)`4d%HRcxHzJOY`}NI zq{NAACxH48(%*w}2V7E*T%m~{eQ@bEB;lLrW$Sl2Fs9+ST2Auooe(T{!c;vRW$k%jwIX{=$eO2}L)#OoO4OcS|oxlhd-hOUMSf z*NaQ9hCp0nf^AeZLGPyD%Z7BSY0AhUBb? zb~y!I3^q8poQf5kn98IZ>|yqc>QKb3uo4Lcko^GcJiOP6G;*jSOp@*apJCL%g z0){A}L#30{+upCiAM|()52F3uz5)*Du+JjB&0K%{=LMDsl~5szb7Bm*OD>hXBbpQf zma#hK9!D!OrOQD|pSm4P0L;@&aI2@whu#siNMc`sjYj=xi(ZWyb$x?S3wVNu@24HR z5p}d=5-`ycByPJXe>ExY#?7ZGGStNM{c~@Mc*FG`XRVI9f`LjBFE+q0`4a)PBy##J z%?0D6(L8*&p4#$#o|1|NBGXS6LWA>u;h(t_)gOwg*M0W*Rj(7qg;d{<{cNdilZDOW zWEA8^HCtT zfB3^Ko{7c5UEB6ovSxFTe|0y)#(PNlvlQ07;|_?m@ynYQ$$Mn^ znBx1G{NGywxuC~WDt&<8vwGhB+spat8y57CMJYax%0>6#pks7GDC8UCbHH2+>ntBJ zmdGDglXJj4%5e(W9-Y(>WBcqGp&M>vtIb5bx-*RF3_FE6q&HhW9@J>bU$dlsBeHm) zF9mP${qSI+aCyROgXD+q=W!tZ^*keo;#2XHNYg&WmtV3LvlneV6Q;L?bLo)ZN#e?5X=RKS%`=}fbj0jolQ5q=t6G@t^=Isu^>%ThTGaqmM|N%DM9Pu&!DOlXdM)^ zVqmnYA6~Yq5G2Id(SrryN1B_gvC@DVBMSr(b0WbF8Y%{kPBs-?9BI!2nkiW7vZQ>u zjmA9>I$gK%iG2*v3q#PWAJ*F zF%rV6&Pi~3eohAGU5Yc8&H$Lbr+J6|{F!u8J}uXO{ZKt&&|W+iSkwM;d%ODuJQEVX znf%7ubXWhJb_pGyM#PvstVcu_jYx0)9_H2S#fD^Ha@^)06a=EVJgNIzjT&S#SIC!> zR#h+h$Vupc>4Th@n3#U#ewxmsy9eNynS(`c3rTcm4aTdsgEt%xvm!6mk9~geP$lPU zT3Q-xvnTfn4f4jP&N;USDVgovNr;}~_lTe`e>di;kvb9e2ceRo|1&L)(C3yE40=mP zo8xwYz_Q3)4{EZQxv{EcQI5Cd^#D5em9!ka@ zWRfQlJnYu*vpPmultt2TQ71luBD!g12;(dEQqt)7jigTWB_>1OR|S;`8SASmVVSN` z>Q4?1$lFrEY8Mgq-WEatdB=?c z#~S0K$S!m4M%{SC`Zf;l&~m1P+`_Dyg1A1J?b%2dI?S%?yePPn1ZD$(C}v%hBb*1w zA~H>tx%N!ixRtUh>_Z>m{^D*^T+!bGTO%SO8c=x2k9hqbwD=9!P2e(c_}3ffvk9FZRNBV=ta4VJO5{0vCJyysu*_(Osg{dVXTw2+6#CA2AfDO!-ezdS z>|dMa{c8j&$i^c*lN3hsuQ=%qm_wP!s;p{zFR|4)duLylYUP8Hw>3}1dIzK)qRL0s zx5gJ~wz^YnD1n|$Z1$WJOLioB7Sd_j5)5J01rwS3LoK)ZTTTdIA&-dZ^6 zaa7$@g`vJzN;o+W_kt~Mr@ZKvtm*BRNlq%xT#(J&u`pTLfE#453zB4H3z5LVAcw*V z1UtCKfI`Nq4~QsiWDL9I9oWbZ+9{+S8p{+Ibg(df|FDulsP-5>jfzc{{K7&~jQ8$- zcamfB2_<*$jP28#r4nxix4oGMO8{sMMiAc79oEb-WC^zXM0%bilZZ<(HL^-(Rrxh| zRfTNC{t}kqfwI)fEP|i0aljBP{)2%w(|3X%al+%0rMfcybHbasH?h7Vbrv8t*~?~+ z;4e|4BBC4we56Iozo!%33BLv{u>UjdUMU>VQn-nqj$|Zeq!fIh7itn+F!xHNe2RNo zSJ)rN81dV_z2$TD*Rk+*%Cl*WMy2)@G2M=+q@-W7g(0A1YC4!z(h!>1VY@an@C$&# z_=}h7nOEv`{VD*)EX{~6eZj*!YL|?s+#KOk4YTUZ#xtA9m+euszMVcR`yLlRnBQi1-_ zw*&3l_2uv*u}Y8R-IF<+c=VpIET#Q?u828|zPYliUA3>7X_J>W+rp#QqESJQ_hK8r zJbF1{xhrVnH!qO#Qtc+^+2n_ll|O%VyF7$sa%(20mABKm4nqV2wp%{ygeR1n%(Rse zgBIp<{6CXO^=ETD`7O+PlyCELxLn$ug4L?jWup;uIcW%RHA|yNRR9M;YQi;K9D1n? zL|zXT8qFq%fv_qGxA@rA%d{1cvNF=AD{jiQoQq{cI)WX$w2Tt6b0zAx#Cbbx+df>O z&|o#ZmMv`{U+97`XDbKWzUUU0ZTGp8s{v07>IbB*Y#r{;x5qnmpI~tpb!_n0-lIDx6GS-Y-@Y{C=Z@rH5ZF} zADq<-L(l;*=#VCl?D%%-`RH)p`VJ1#r1|1fHsB5!4!U5!Ky)u()Lt2Z&I|z|NhMmt zr~Sak`-r*ig}jF~%VrUNLK1X6-D)C{!H&$=wors4-?isqpg0J9?4i(5ZP;q35_sG-~Ji>WAiMS>ci;(*mPWFzkyu!7u*OP85ekjbxqM*&{*E@7ws3+n0vxzs$kijw+HUX0(@bayAnmVfVyNzPykM^gLmEVmV);|WY{ZxFwmU(_Gg7t`?JN9 z?Vn%B%3Z|$AICde%KNXN*;VBiyRK*H6ELB)Kf{XPzsE$$l%+INHX=pFf|0PDWVnO0PaB6FNxPFG-Bz z2TNnHtP%q8xf+Py$}HMm@=LnzH&bwkj#BjxpL zt>uY~xdCB!V{@|x=sJH}lj)Wa3F&4Ns0YD_1*+RJs)a<9;UkF5`W?>C*kXn(R!+{R z`kX=jsMz5bGF&t7AH@{^uKUw2xX^Q9R%faX*|iYsBmGwy^9e%q(KbB&iWkd^pXu_SY2271PYlUG?S4#7-kq!LHa5o5 ziGUGPVK8EfnKBfBm4f6l8Gho|%|-z9G#W5p5v0EznxqA@gevwE^nd?K4b(ovT7`4a z8n^m>$mgSVUa>8Vd&g$cCGTz%%kRm2U8I=PxQhWyFq`4p*ZM4V zygevQpe^@3q#E+rI-tJ39s-7Kc0N!obZ{;BK#{4@l(tv^Y)1~^o5bE?;M$ym*$}|p z%(gHBQwH%RMPfzCoP)ftX0PS3q~ z3tj=_oBqgLb>D-w+%x&Cz&L)r37!(Qxi~;oyeQQwA9GSpm;=IugbXCM5Kg2HD7-@G z^Yb{_27M4)Mt16#^ZpwGk$DAzO2W@wqK`QU{75k(%$)kYe~mHoRUo^E^LqZV1Q4P? zkwp0C2eItj?DTqlN|29`M}WXsRXKGBhx7YYa0(KddV#Yxu4P%+b>}__cSBKgKD>6F36%R%W0_0;E-*93L11v6Wr> z9U#q65>N?5Rh`qsT&&ew;Y-Kwy~+8fjiT}A|5cD-)O9y8HhoxupAlV`A|VhC{ulfN zfzFDS);1V#&~$3E8%i~@=zRs6<~w`c4<~%e?KrN#-YvyC)y(jFz?Z>f4!OWpM0mku zBP!)m*+k^TpU&U7QAPYAR2#OXMtF}_T>plJ30z!K4E|4hU9YwM+<3poL%_k8{)w8l zS4Ir&Q@={cg3v)-CjVAhE*9ORS0v%PB!*9f-C&kO&&8_EXe@qchoqh@aHiX?!qRwO zDC`OjbX)$eU4htH(7r0*QOZ!*Y2F&}eA8YTH1)%dO{I_fLfv4L5lk!ftlDcakRZw} zBy!vO!TP9OyPqXdf`~PN<$~&9SfJuqG%5Bl%Q+sY8l%Xtu1Uf7`b%SiKKXEx2atG*XC^rr#SDG%6uzAUkFz0_L>Qj)zEIOIjEO(6D$9s$@^edr~hRwj#|XYQgmb z0k@6@Xf0c(f&!hJ;TzQew;c$|1s(p*#mtLIv3}%VD`_2~gtWiUbQDhO0|3YoKA-6A z`l?`|;GU2t`@sEXjqC@-M`b2TP{Xu+GZj~nF)#OtO67C>Bszr!F5b%d;K1t|k5zgS zF37!f8#=A%oT~%6tt&i{Tq$!+-m{MJ*3Obv=}l z^TKbKuVo%cV9wd*F;Z_opvB0}GjRu+cgmR(x^iZYnoXrt1>GpIAXyJxs&3DkV@T9I`wP>Igci6@}HN#S?xv-r{^7=uBhPDbLlU%j%bOzA1F^;^$gmMMg9j^kwKIS2q#VeeuY4t6eFriv?d*t z#!Vuz;A+tt%2o>%hT?kF=3x+%&0$R76dsD)nkk`WPx0<8wd!-$$+n=_fec0&bUesj z{1COZ`-jPy;If-Ws&_Ool;$pWl&~Itp{d^o?h-Yi2q{lO#)QD>cA%t@BtmLd8<9 zzcXM3WdB$o@IyP@ERPK@DR}ib#7omV)2_=yXESAj?G5_L=|!I7*D*}t*)htJ(Y@g7 z3URo58V`>$-Iofr^7J2822t|4I^e88USGJhzTnI4ohaQc%X?@w`iPdv7^C^+imT-& z<%CGqU%9I@a`NJVYNFh-p#VvZiGKC+lG2;~j0q>FhffOUrr%@|ub2mdNwSe6_OGZg zPR5Th#24opNw~E=kC5wMk@nr<{p&t4~L$yuMoTvf~0oo_zlbZWPOVmpTO zrP~YSBg319C^X{l|9Y(ol(x2cnAkKqIx>@%E<}_F3I2W7^PhmJUsQ#Wihn!5{~Dkc z1iX^*{uGV75^nP3Bb%EyN-h~~%smnHxWAM|v=GH?$wC!z7G4HjrjcTJAd)nXA6L<< z`cN;`J$)p*)!s+6Ksgj;XG$}cm$BjnFDYIQ*d!za`1F!W0H!SX>9vyD7o93ur7a}* zH#t^W7;?QM(d0<0mi_=Jl4B8&GaLc*-fNi76z=>iw^55uT2PIe{{tAdh^%ZgjG()< zR%X}IZj5UF)5{&o5th0pdB_T61gcV;obKxAI7X%j(E`x}#~Kg=%kCN_g7Ko)Fb0T* z=X@XG=*A*;Sjsf6c;%RC0-Fq#=52A(c(M+G(81N;{P_=@rzCEC(4;;kV& z(QqxC>L{Ir$H+h-!oK`B4a*F44)%|{grNulKJwR-+MdGqGG&ZW=|GkqZs^L?Jq_B3B zPGEldks!JW1TmnsTFh*qxYxIE(g>vSdkVLA1G$ewp*2|U zuc?pRVgWvjFyA{X_Aq=)`UogE5xHh`EYmNIn#W>e*Gh{-kJ_QYTZ5ryzE^H#cQ-PI zRoO(){f=m6{*|kc-&}(VBU6TQN6!LZA<%Dr^B9wh3lv%m&;KPcAO3q1gTPS5kJ|~X z_ro0C!N203)Z{Nbicm}6IhI>U2{{0S;=(L#5z^EU)MT@<{DQ&Y7)dX# zv_u$Nue~nl7M9j;xHTpE1K>bN7*i@fU3_H5d~?p5gQQ4Ba7=5Irz>PD+y(^%5PIXZ zDHKeiP^S-|opyF~r1k*vo;vcyG0sALUym&Xq`e`dXr zrm;j{XyQbL=YvR%+*mM^vUnEMBZ~o?6sb&}5)!=mxqhk^lYyHhew1732-#n{eaLv9 z$q67s2f@XZ;vRjxfP?~nnC={p3o@-cH5H&cwOM>Av{}tu&!T`NF(e;BM*5SiZbaS- zi1V;#$~P1bywmxj_K&rxGxSDU=xb7hxU5t%Kc$>*sdgw+I zQ0zfoqizc7KDaC49(2JpJ(!l4mt|s#7S6Xjnk$ce_5|S#1g^Q+)~#yPt;3JS$*xvu z39^OfILV7w+aDHdP^WPv?{qGct4pn3J))WRBEJ|> z>hALa|4#=VGwh(}E826KpI_gjFP&{vu$n*{CjYj|(o3AW*B#SEUA(;-4s+GL;SQ{! z>B>S>@xgFjyW}PnsN(xgV zk7Da4Y~-MM%#T`biXqo~j)^RUiLMCg39yEjmu=kV-kN=>ua7B-`0At-PWVKu)$3j+ z>aiOEQOABg50=RIS<+WD`1C?gYD!uBcF49sqc(f1O};fwZa8jlL_-Hseb$mxJ~Q#q zScowGM0K8g43~kegLLtACbO3+ko32Y9-=s?cG~(sH&P-$bNUDS0v7um4y*DN++J zE>jK(^MM5Lcl;uS<)mB6e}DnFEpK9USq!}t89`xL#OehohrDK0|K*PLoMff27%pT? zL>XHRXdwPHI&O}o(M-yAf&5;*0z}ab^wETB_?Y7BGka z0g(@8uV_@vFh)Q#Eq#i>oX(bZRgXEtU7m3>?^z6;XKZC;pYR~shll}3P!t5fV>WW) zTi|qha&{CqpaujpLZSX2@kK6PUI=R(^glW@bi7JK%;ouIvmxMp zFK5$}{&me9-{UFQs${(~gu0*d#nWRxk257$AI%H8``Z-jui?1L&)C$a|yu2hGg zKvRig|2xBP{~mX69Aqe0lp^KJF+m7iq+#4Q?!GP4K6ETTDC;}mz&>1cq|!vOzK{y} zf#c=@&)j)qI}7nS_91!nib?&w@eTcoH8AR*B}3fbRy%9dWN`fnLSHGD-&2$0@>8@O z5@ZEy84HNEcG7>^+TghS|J&OC=W$s}T=J2!9GbMKS^3Q2eRO?>?@}#>;J89m><&np zNC)`omUZ&mt_F#E8eLL%{Uh8vJ_FX{9M4955U;9)5FE)5lh`;GFDXLL!?-XCr+VI?F_-Fnz`hyaWQVScor|dt~7Ck1h z2RoDKGixsYkj%lXanFba~?A#^bW6lSI^~q7ve{ zFutThL*G&x#r;H7zTU_%pCp{v{;wu;kwHPK^T8 zwPoJ8R0GmAxBqH&c%nd=x;0E69uG6>31m$Ni2V9``(?7>Hn$+M(_vvKYxNz2<@o&b9Lgx$lelu1T+yP(?;fhZZo2S&F22 zuBo;Yk!n7HF0ZGjCswvAP*wFz=tadM$u{W@#+=sIu;2!->xY9k>d&c+Ia+98m$}B@o6{Hul>1B=Q;VlrN75+%rMn55xHxRLE^X9Bee^xQ1p> zE>nq|MH!?Kc7t>1TNc$!1Cl&cJ3_#Xv?l?DypoM;!0+t~jiC{(?!P!%eflziB}ycb z9wNkt7GIIiPY37h{eF_kFPVKv&SMm6C=5E_r7XzC;-=p)suECEjGnGcjU{UzSejs| z^&-ha^7S(K$dHXAB|GpK3QmeYJ$4`%^A2H0ah1RgrM@;U)^Hs9+dNQS#H zN{GY6gm8AGB-#O3S38R%g@yMnrUl-6jQ7=ifT-1V#Sq8Lr~6pY6+;(<*zV8x&+u@z zcRbH_F)z&E1N_F*#3-CBJzXzRT8I&eHqH9t81G7k+<~WmJ88GuE(oSD2Xr zZ1!XW#Nxdr7ToCo-sqM|9b+_tbj^a5N6dL=1mHrXxi3*H_BL+H1a z*^{%g{Ev?`h%!m>K#=lpdj6JfwY?94;bPdq3j8y(u)LfFSvOe-L3O0KFo}$E2zX#= zGb0A3efj9Z$hcCU+q*9=G}0jF+?o%RrP0S)+}&PjaAwQ4s;mAoVE;0If(s{Vf1_iN z$eZK6O`|l4yz;2mf+A$jY>$r0I|QioN#M?qnmPQ*cp@O}eYE5Vu%IAYbMtF+_u-04 z2pGG!L|s?N`6-S5Qz%!nH(}c9UK>ux+GUO*e) z-+xsGTrGFdd{wNyq>-kR5BJI0MLrr}!l{4t@a*ON*6AlIu1D^|we#U!ahFYe7)Gbf1!fYbkiH3c=s!Yv*9}vP#P>~XmyLnQFabav=FnUty$OY5qyUS|*3Xib9TD$zI z!byUSEv`n0vv<&OaPTh2v|h5Aw7GeGHe-e{91AU%jSMS1IrKU!a2CoZl1QsY!FIyVwygTv2;54!Ww5~ex z6_ezsf4*;i_cK$+7b*17-i!C;eAPd#nHr+XGjcq_;Kzgvo#mNcvi|x{{Ng-Xn5F&a z-J5G`c){1@hCwjx@-WL1O#<4`bC;tFV5hCQql~X#J&r7ICcrJ9w|-yva-4xc8@2v4 zguM4gIOZFR#gHLZMlcOrx2de4%Btoi_?W-p;A8Hw=v`QltWj{TOtVnxtucQ2W5|j6 z`5~j59n2^nw76#Vt`mLwgcF}|?@6Yqwlq11aKJv?<+ zgrn3SyV_Wp0PD*U`&}|L+?{UYe~^+S4dnb@{XlnZV^ogAI(YN1k+&-ud296Q>lLTl zThd5QE6zA!vj+lfQ)E^epJP(PEI*1UBGxwld!3ei$%71!VUeLM8dfAZhAqt46``$^ z@yO#ec-x!3gcTv5c6v*fDpmNqhE3g~z5RW4Fr6_dL3*PvOGf}@BnSrY7tOon`~oEu zP6rmVk*>1;BL)F93guFR9}JxYf~M2m2*U<5q)QUMk+y zWDEj75moR<4nEjcP=)8xSv==2U^ao&&$$VqV7-9tLuHWS!bD6*NK?Zxz9}O8nUyfI zk6Ane>I&(ttUOp(&3j|4VWy}ly$Ltv3q3}BJejmSjipEuhEhVYvt0e ziE(Lyn&er*Hz}|hQl)`czI=|@0}k3&$_^Re@7AyJ;_tz3*gwU~BK0k)`~ zPuH2MTt0)((!e%UrLMr*`TSaeb8!keQ5VbXZ>YGKNpfug>cJDq($T3d31LTzS_O;d zb2jy&L*ZVw?2{rofy5Gka8ia_WYzhazX9nR{ zmI0eh9dYEni^wqW6Nb<|je7)sjw8taxfKV=eT!Hc z2qDHZ2H-phG3~tRje4Ug&$^-pIEYx4{UT>081&n!*$jONUOmpSnK8RaFF0!SMI%j( zmTBzmmj61G`KZCwQblJR<4b96n%}G1>p>x@Hq_OvD)|OaV={kTT@UkqJ;>{Mm8X7V z%6W3`UY-fWc3HYXxukP>b}{*b#W?IdK*Hz^^4-XX9iy$h02wniRz?Ctl;^Ng)>-i8 zwi(XEeIgSS!RNSzyP{4-R}sQ=6koIBi*)z~&>zL;C-g8rse6t(Sl~iW;;C&p@*#FWOF@#JI(a_>G`db{h&Lo~F6=3gwF7|jI z(}Uz5L+;N%doTNphyOo&KSkJE(kzY(VQ*rDy&p4T|Ht0U1hemI!Q1_OGHfk?ANNU_;(?T0y&IJH=c4c z<4YzaC3SoT-7L61@6V*b3>MARerk5mxMcC%%41ABT!m+}W{4ef7FZUsQWw!}Kr&ED z^v#+|Qh8U2S2f8{BSFPQ^2EItk_j$dKHYs#b!G1(}tSk!- zyaXe`xc|K4SFR&w5saa^+mLXN*QQJEff`@(39wsXDIfVT?Ub#Xt*XFM@Pf0GUk@b= zr9_%T99G-!M}@loYe@&=|NEEHN78M@zZIP-+QdiTe>Zbzhr?#lTCR(hp%&@?s-sKj=Qk>kk$s9UXly!H4CLj zNsGh4a# zrSinC?K49Iw|jgy`V2ys#%ldMpG_#+$HJDmnOpyhR*!pz;pG|sBzyXmq57Eqx9Sko z)0sSz*Uvs%==y%@TQ+Z)WNFx3&uXut9M*3RE1pt4eOf~D>*M%Z>W$CV_5=4P?S7zx z#%m;0$*qPwIpk`QPFy^DAj%h2)f$BM8m-b{>}!?qYGR-IXQeo_I(h1Bg+{yQSu7m> zZI|ocYtI@kF3V=nhd6`OE94$eR3C3}?+DXGPTu) z6SuH45&v=RskO74z9aATFp`1qYMkxt%HF?BqmsSf)gGVeX6Ze{CI7gpg-lYyh&Uy3 z(j5ey`=@Z$WG7FO?;5(s2Ced!hr=ueUan-qSm8m^1)&je|k3s)- zSW=9wDLRb&{d0KTe_GwZ$CJucl*82SE7xU@pHIMn!Fc)^z3C{nUz4-cNQ%{SRRrQAC7sgt~sm{e!>_10PnRa{~{-pF9ps+Gd| z{XXAfejNYa?6>&$+qN+J_uRud1_!&ATCeUd%->hXX5{;;6C>_IdwkJnh{%Hg1Wy9e z`47URQBb;ks#N{wF^tuT|L0mHfD$u+SfCq)V1y`4x{MI`>8jvN7M6eBg%T;wTkA%@ z)3)PxpAMf+{-m|kDvcvq1?Sf=>(2cP9(ulZFEl=%@`?y!?ZS46r0Nw15A@s2=7+CS zl~#0N_gkS#u;1J3(c*Y+O^U$*;%BCb>?JL;K;u8grIv%$fz&`x6cq}n{y>zv-{klK7oEIy} zJ_=l=4;;oea-)qx;W_{A&Bh{xu;ajDb4ek0(-pjyoqXSV^fSR;5T zh~LM-#oe1*JZur>n?rjsN-l(f?EH!nx$y1x-v~8vD zK6m++WPG+9)1r~EM$6Z>WXhzRu0&^c)nldOXo5w&Fa^K3L3gMA^U6+t`IzLrlNQ0+ z93^Y8X?@z3I46hBWS3G1?g^DyLeQQBX=Ez6B%(aM`bB}`&-DX8j6(oeq-$TLM-LF%K(eBMagnJqbF@t!KY=7?UE;MuX@Sy*UkhH-#`OCvxoOd1geqRw=!_zmoK%yBlFTueA6 zs>_38m5+GrL?|;Vkv>9U`JL?gZSMCsEL`Oe`BzUIOPki!bB(!f|DGzE4==h|vwR6Y z@jf}bVQulaN7=5hH=m76!jM99nPb{>pE9=c#nsKCVDbl|hzgL9)PKvGEQ!&}Q%txpa-h zVY*v?RF|c4&)1M-acok!@zbqUo*m$z2KKug{2F!ND7-F%Id+(tzsS2T%O)8=>2zn#CYf*m|G;j72#nmR(JG9Tuo^8rIJonfC z)#OraR9RmV&4igy{Wsq@Q|$4SL1y=qgi5kA=VJ(Nc&!2w6G@6|qfQe2zT!o9|D2PY zsE{rO`cBUdNad$?>O*OmK+YMC$m_%X#$a;N&ydE*Z$R8aNRjgYGUY-PMq-C=;}+x9 zh{Ot93JSHf8#oBB(NTm5srKzr>g_X^y4tSF11)RhY7dHJr@2P{mkVIo>(ks^o*rxn z{oY<(+}&V_dut%Eon|jB(pcBTMm}vsGi~KOXj}e$rl$O59JA^pO-ms%E3T83ZfYKb z1wrVc_Y*n&>0cH7@qG#(uOgTlKCze7X9dx4a=?x*7#gw+LvE7l!VCCuLvj^DMp(O= z_fo$1X0Xkb)MkaXF#rB~LhrsP7U(pu5OGaKyPc~P(3z{mBiBKIh|UsHx&7xsysm>b zHX=^grPBE|wLtJ|Z0VtdNSLp-0Kv41p<71*>xJ@HK$-fHaGT1Wp0pRbO7N%QRsy=1F@RfJ}{Qn1T>4@!-) zyWq#axck+#n=b{3&&DFY1-^00aanC4&1Yd*GxVEmMu)dw6yUdUPM`Yc{MMkB>jv44 zpmYv9@VucQl=!O!n;$-)XL*%TD%6dYLzdZqNKiz{6eyzVqcAi8&OMmHik{U zr)3zcXdtGQ=6|r6@tMV8$-{=Ufad?B>@B0JY`dsYC8ZmrrMm^CRl20Rq>=8B?gnXT z>F(H@?k?%>?vk$W-abC>c;9ozcg8qB{h`BaU+Y?HuDRx1xAGFcYfT0X7R*kcWZs zfl9A^g8wvPwTx;nC1Q)yNk|?ZIiObV-}J4hmbBM>_Oih+jmg=UWdttPQm#$P;cWte`z=7x-+3F?5 zCcOsnQBPV-zAB>CLX==ws)!N~L;vc{{1ezwzYu)b`Wtreb;-A^rmm_FdwHe;4pD~8 zBQt2Dy(uPEeTM2vuf9(a04(M1M+m*vww~AU%8G)}ZV%ks7x$6sb+pCIp=}o%9(9+D zrB7&`rOnL)d30KwiE})Aw`5&3f)%_B19eveU$I$dkzbD0`RzYABN#!fbalu->p>3D zDlzif|Ry}WcXIM4R%Hh%sp!?WQQ2DEGt!jiKBQt%--j4D04>5c+S0JdmxSf2dIU~ z<#E2y`ulr%%z7481fk3EzbVoac|%+enjlT6PNou!IX?Jh|ek;l1oQ z&cv2vJqO)gGqs1xbD_D{-toC8#>n-dfTX7&qMw5ZEm=jWBwKwr+H~Pd)gnps>h!P6 zem`@%@2e_EuZ#ZNvnkmr$akUBk#+>Pta4SWJEaor<{pv{(C}UB?=D|`DsZ#ylcGepxK9pq1-|h_E!;Mvi(zfDx#>&8y;9t|Dm$1GOO8(O(Gy_sl~onAzij|#J?a%e9drFAPplO;7tcF zBV!cxHSOQt`A^x)lUM~71-^IMXN)8gL+II6+k%2H{zeL-9-R#*%UCgrAC)eq1 z-E~}*ss+y2_QhovX!Rn+h}URstQAaK1!|<6cl_<3l`j8u(8XTPB{f@HC%OXbcWbU- zTL&`VR@eYb+z!q3BhGB2XdBBr6;sSbIM^oN3&A3oV5T5a;TDA=!?=OU6W#eh=rHBG zqRa!qetjbeo0QQy3=PzK**TFoK`)nxZVzSh1!`zembj}jd%kvcO55P&n{jnD1RrYx z`>BUDxSxpRr+6^Z+)k<9bbHUcgP-x*E&b@BqiGr?g^RvEuy+&x04qAa^P3#u808tR zixyNNK zvL$T@N9aUEU{h3ff0^>I=Z%uh{ELTt7pSL#1}+CW#=@j9ZsyP|_hmm_Xk-h=Qi6{r zU8o6^6=gY(w_S-QRJbq=tWwv?fek%kLrh54y6+(WiG-P;`%XnuB}Y~s&LsRYv~sn& z=654nn(+5A!)!ShTyxaq?WLIqvG6krKyQf4s`StOep_aJ zbP?Q8;j3jyuE;E1n`A|OH%U7S6Hx8{TypyR5t^u_RcLmR0Kc!RR3a05!fMZsq`SIU zxLPtOjw?*#_){$uO8l_h+_$3rvf;gmnXF7lO?egsD~9b-KO@Vl!8!%K;Vo`88>dwC zMWPQ(6UzGiv$Gc5Ah+p%C`QCxP*+G{e@p9fnLshazSVW043-sFvuvc#rzoF zQev=vgUTa%%Xv3U1|Ra5+eL@4K*8QVFyL9I;lNTCQuH_J0v~-fp+73T`%|p=sJ@s! zDA9o(Z5GMGM7i^>>_c)?<^KS{hZ}KG1jq}K8Q=?a7>$WAq`TYI%uo<5McAk zWG)y{_=7BPGTun8_M^V^dp*sZmUPXRU{?|Y^5LE=-P;%@R`7*Ngn=+6*yDK(_U?1! z4JzE$&p{fOFzJQ?WDtl*~_&zB?gBG$}6$ zrf;|G|5PiVj$od!bftwWAqfWIN-C2HH>@iwUwwLBf zckm!tX)=E-J?HOsd3WwZUU1T~47aA$q z|Jv8t^3eiuMx-i-?sCMYxOg>z27{y(OhCfd%$PTlIDrZfa&6>7Bsr2vs2Q!E-W;0m z1hXV<7IGS}2K9Mm!uxeyxRzRC&({~C-e9w+VQt(IMK8GM-A9Ma+S?IS8PR*!p->ms z1~m7@k-aahpjq^ zEcnq{D=Sh&&?DJ}NY`u}aAzA89(Pc)x0hbrN~o=|L)UX`_O_YDzKvv1HkL{WL-18@ zEq6`hYPWQ#`tF`tZ405sY){Z!A=KC;7VFzDM3?Emf`!{|5PsPGn!Iri;sg4lzs&NV z>Uf7C7i#G$3(Vtsqe}jyoV-s!RV-xo)g1Zt`0$NLXIf^Js6imus6&QofQ<=^6I+!i zG?dslMB|CP@&FxzNrPb|qyx~*8O!_uM~dcQYpGlnG!-<8{FU0=Pdic86<}E|`6<@{ z9K%6fl{l()%Vr%0`KoVdMtJp2dRnec-`sI-x0c@jRCv{w{>qr_z}(t!YI^uM)DBWjMKSNPdP%aCu$YvYk!GO#5S$i(jW6yhb)fhlp!!sjq*C~BFu zU*44xLfPFZj4u^YlamkgCOZD7#;jBMROoBAhy#<}!O}dDKkf2UvUld0qBbmOAiUg9 zrA1`mZIb_}JQMiRNzg}Z=9)r%pauX)4Jypn%vL?^RB6JE3Opo=l z`PC1*!&y@p5YPy=|NJT<0yoW!YA;u1L;U_T2$!(GoKOkBpssLKccu52I#-s}2&<}% zPuckoP$pB^;xYw$-3akoU{}cG$%oZBW8mND*pIEMgbywoqXK&z+7oBvDPh}7?|Tu5 zoU14_gfa#7e0lyFZ}S$wr4X`nwTArkd6xk^L}*J0dFCF~hxG+}UtcOMDoueCHjTnWwA#yNXUYr7BAXPzJaL zv)JhxFKf+l;$c#FKCn!dL`%vC2Bgs@#|hwH;SWeYvzUvKg^e#PE!>J-IUTIsQco8d zs=AMlwn8cO1Q@{0VBdunRS}OM_D2!j+#f25$RKRwNg`rsgy7faHW+&)0uVbp4<% zC5hybK1v9nRoC3f)-4`|%%#QZYPi`BHf;dl1>Jkk|KXgnsJF(Sa1n+cz(-Ii(o#UW z`Virr`O={FVm|4L;Y>&Bdfh*~MEdq4EDvB@eoFh1Rn37$UzW&R`cH)p_hu^$hGa#UB&Chs z*~nXrNfQ48uZY%1Da~?MM}N^bwhDQYN|&0FmQI08!n-cLjaZ_2n)i8)`rD3vOA={L ziD@~d9fvZyTA-g_1oh3{?~Gb+(&-THaTE(GFJInZrmE$S_eab>X%d8v2!F8t3!^Ln za{h~APTBOZcq~0u42@zg?2c&lbWK}?8~hieuYO-66aCR0u0slEZI$AWc}i~BS^LoV zdo)AO4wQENrZ1^G7?t5%1#;iav>4j|Hf?$RRl%eyYSr4t%OP}lMr(H3aL(GTni2dE z%-nvoQ%?HJQQDYItdRV&+Z})0xO4P7>3cgpHZD>kruiEw2Slse8$4~0-q`j?(`)AY z6W<78n|{lD^b%ClR#c~Mf{-EC6Tzmo`DVZFr&G@n1JXCu^*Ah_2DldL`z_v<@Q4Eh zkyUyxo23y2+j0;7lR~XK2^)y9$z$nP@fPMJ{fgowgGl@K9wP+pZw{&xc+GmDHEFYY z3Ashr&$3JD4cXeo!*(`Za9%$$3ROwcE`o+7$$DgB-Y4;8kR8PG{y!RBV0x_?gp+%^ z*-R5^!r}*Dd2*A$UxKtG_e)~c%1#{<^8qP(7E1x*8SE4-&kunNva$xN%<(^J0eh}= z!3pExZ=A*R&s+&tKjvLH2eZrqtOZ;3^AG5UxcL>rX8__Tyof_J?pDeWs74&_x->+W zvs6`!pUtb_rq17Cx0bKCpLf@62-#eXeY6Uscy=i;vWh^#?Z9ASNw>Djo+5CoMQ&Y; z3k!9#G7o-{0Q;j_D(NjJvug%+_HSB2WWORA)OX}~+fFMAcqxskSeDSvg)8qV9ajy` z4P>JZXaU03XGP%WdXt3(+ID7|wr>B><_IO2vz{p*7VBj!%@@MK`w&8{UehB0kPWEtKJz|o8v^GSK7CfwGE8IWm!|-$Epf$tS&Xb z3o;+21QLpEBauqZI13MdzA*Hv!AU?F>aAM*hSYAu(W~93Q^5zd!rxizXTRoTR=+!K zck>b$%gd3hkIZqtulkf5wti6d%K>??DMj>^%cwOe#kIZ7qEE-xCoE<!l&s!;~st)ZsB@(DK5(T+y2wG-LomIrwDJqp(OdFS&MG?C4*_d8i@vT_;d z8iLF_9rd^4NEp9jz3F-*vt?`u=STn+6Y7XS8pHT6E)aI@`Ce>yrNrDq#I=B0zRa(m zCB^%|d+M9q7Gq+#l_Zs$Eth`&gZ(ts0U`HGqN?3Xn$cr=;yHGlHh)i=w(fGs!(t+J zn>v2^-u5djOQ_JE6wr`swKnQbih)+I@b24r^sVsQnMBw*7&C6L>0{|fZacevd&p@{p^zkz}gG^m}X;D9l^-U_qV;y21UktRBC6&b(_f>>-2l>Eq`! zsyk@~FUp#8597YON$OuVKnsZ?SMZNO?4{2S+{JU`yp%E)m5V;3K875bXq`!>*7w9x z*mH6mDMq~uKNG7wj*)LG^E%noeiRBY0L5DZH&3o8u-*_tVm-$BxqHWE7<~06k&wWX#r|%cg#EKH|l2^0saSG)Wxitin zI);hIvHwCTCuq~$}0ph+}JD(Hle+T&^W~*0Da84fhaN0s(UwNN~b1ip8=#ZZq z8qdlKqMuMV0Dw__8r~vbl-`C91|UKxR9UGQcw<94o~+(?Ng~Uv?`w}@+idPxp;gZK zfQ%ptOp4ih!rN89zsoPJQjg0WDutde7c**f%8CpNy3R-PX&E2Xa4^4&4670rA*_^p^P=N7sD-^MI2VNHb~CCn2bd$I3n zrp`FP~($wtK5`m2qJc6UrtoTxw@5%KtB}dI`YY#K0EOC=qA+L~ zx7|KaDh;o^2m>tDMV)E44K4|b8zgR%{&n3|^O>sM7zHYCen(0a+FMk7-$r%2LOA`@ zX*6xB+dwKholfy?#nlyscv|&8oIyI?qOMNR^?eY~PEw?<){RxI(=iITcV8AYG*N?_h5_ zOxCTRg>=X7N|XL7E&tFAZ=TSDr7Z?kfnsq}y;6hur&uUq0>y$LX*D5CV7MAj6u|9r z6%LA&;y>hukL22!?#rsR3r56-gSBt?Tf;azrGoc8rP2rIG&|=dW;_Ls!C*H`k|jAK z@A&=OBqZ5EP7>5c9%$hnbt6sTEnqsfHrdl&<*i)Bq*9pO7n9O4q*W9%>gD+yc+j8w zN1FH`6f0uKyp<9u8e+C&s9CtW$dX@i^u9m9sM84F_4+AnM%GGvm|V)TIi2Axq6z5= z--|^4SP?GGdT0i0eS8N7F48Dz?oj&TLTQ-a)L#ZFH)wGd_hr%@S4pqD9-rtMsP*xC zF#~UX1_(U^AJC5gH;>AoH#Pn93S>q`DVsnbfmvJ?FJU=;D+UP6Tu&k<=_V-B)QxMU z>tkf3Q@tu1ahE+#^_(dwg^lemElSwfTFdMo^yrpWyxe_A+jZ68RuAoPwY2ZW;)zH5 z2-~VKpPw!Wlg4+(Z=Qa=#appvw)>n!UfOdltyCHXs2+9||EeA!g3@`nM-M4LtK+VR zzu>Ae0SHRJ5}huLmIFD{_PW-%Z{Y%|tveSF`P3a8PjT7o_bRN9h zlj?UF?q^3kcx0bs(xl^S1+rf1#{_T*GV=+9dh-5(MW&VuQe2vDMkL!A_?_&}={QjH z0M)c5sqmVEnCqwKn98}@0MyDt!w|KFlcv?iU>tp zBRX=Kfb!h1;Q)}NlS=af0Q&0G3n~yU9N`THtH>WJwEHm+$lZ{r`par{p+S+6k*R^c z@*Xc<1lxQB)XV5-oPUTf>4XpN5gDGhH@LuuPrGTJ@x+rCk-u_m=|As?#^lf;&mUw6 zwsbsCLA$#jL~IsLbnRvDayt30Zt|- zxbF}8`w{~~>uL56WAKM?0d$;~o{e(wz_~*v-;R#&)-xv4(z=aq-topi)0%ynqeg zEByfDKm!4;OLWmxz=8j(gtMYT-343L_X6P*=|REr=hQu--s|~2brhRu7_6TmcSQ|Q zWGyuP#qU1>C$crn?vnwcD?AV)y)kCcpNa-h31kop=4Ahl@I{DJbG-%x9qD%b5w=)E zZF*af68MD9RrO`^`KilBUINawSfBIkuymAXd~ddFu6$K#RmJgu`w%Y&0gz7pg+d|+ zsOuMv3}nD9V1Ixr?sv>n0ysLlBd*eTAdP@Ah&)N9>?|lt788**acpC zbk{8!0EpzNB^v(EQ4J_RoGBVC;+%)PdQJLLF_JiTb^2yGYEzzw9B_iXuTkHm2YwaN zk8Rj6AmFzidy znQApPYmFlPo$UQH>f@EG(f0U;%MY6FO<>-U=X1m7bn`sB?WLL2ibLB|H16^daDHnH z+H!(0+nw*cQca$ItV05F(NTi~gVhoWo0aS6F@NentS!zj?=G6${J&l^5Rm9@Fvu7S zcGeJSteYsupT{1a^rBlf!qvI&9r+hN2qi4-tGVGy8bf3I9k{2B)x79I;J4_af2oMR z*h9bip8fVbY@%|rW7Fo-+>(_!+n%^!croZzspO@SCd#P$Ajc~G0&q+};{l0B`S&!77D3iVR5p{AXAsFYJC0W}$Q?NW^z@V|Zi67luK z0-&@13^_uBBDvK6`v^D-c2STc-2eYQ0&utVp4mwceUE9cD_c2?c`QCWW|bPYLbZB) zAl~uqi|N7SZO~1qh7Ni_{Ron&UE6kp)oj%9cB~uElFc^i)=O)Co5!g`5k-cRQ|aQg z;ODW#iD*}Ulp@;EJ0P<>i~OM#q- z_g=L6PkIecgItP7P@f?A7ovYJ#RV+}&o&NnDZ4$<3y@18fOtg+zGWxhj0~FZRUz1xHSE$(h{JA*z)I$^`6%|6(@ByVE)d3 z%?wV%jPUaG_qx3TUW1|?8*Pphx@9uLb{p!s0+liX%dY%#&0=|g_|K_J!Ic6s6UB#@ z2HyzLUoJuTZY5_)L%^x?_bL5JefsHbE1`c9M8vH}HvS(H$<_xr)O$E8y=P zzSn>S3Hr9KJ;IX$b57y?IQ%csWbb(MqaKN)y8LENnkwv61%KoYc(;_Ql8e|?i+_`= zE(A|QrGRhcr4VFLBWHJ3ymFnfB4;8&wmGTF~fBr&2Dm+El+gu(zMv+L$< zH}{EAH@nx^x_--KGH_Bk!*PTXF}ZK&)4m#d_u4QPOP3Sz%%hAcKWi zaWg@Ff&V;@H>l{rhyXRWy#kqjwD`52cu;;$#@wsk7CWEpDSsIZttrJ!K<1NgC1(5e z{=HhfS@3x&&Hmw9BAWGTm19js`Ml#xK>VL=zcR~}GizgU^5GCT*hYS(Yyuz9v4#EV z&_!$x@J^B4K1=r|nICjCD@x)PMbx3>wGE6@Yo$~wLHe78$Z))4>wK(GEf%zQH_ z8e*x5wtQ7D1WZ@QAcK=JYx!_)+7L5YR2PVgtaF&~oEK*Ffpl%B{LALR_b3EQ#o{^S z**T~a!Pf3NE4-=w%lcLFzB{R~Ea5BmA8Qpl8D(b!Ty-!YEtiHY6P5O=y@Jj@9k9N? z);pf~E*fge;&~&1P~{WcOiROvnXAv8xt0b2>YZe~a%}?c37dUAzj7b1%XM8GjPhUg z!L?kf9CV1ZY-vP_h0J?&BCJO;?IA|l6Ur5>eNj5%Q!Uk1(zU5PI?G-9VxR;Rors zBMjjC{<>t|{4Lu*KffvJs&iNJfCcfT_Zpa?Y1OTp|IA1>*sI3*u!UOv#R%`oTAx!0 ztMTTM0fxa%liZ(*9?9+WHLw7k>N|Hiu>~OtM*qu>`CpEQShHMtP2!Pl{Cl+>c!iGP zmF_N&uMgmGv5|JG@0b+wlx2ysP6o=3(|uFmw|A#X74GqA<@3vRJiu(-ftRAVCp-XS z9O3-N^dpeQgvHz940`36!I!R%c%Q2+r@ZsUjRUO(eJA%tuX$dibU04!hi|PfZ`l8+ zso?^z*o%S56z@`d)(LL)3?b8fL&8tTz(W9rv%nvIYhoLq+L2jqY*ERVeh@+~=aedU zbq!n`uV(-9R~n$>5#M7%Lelngsnqu8DDfs6%TEjTLOTmYD?Dd8gu;{v{=h{lGqFAo z*C8sz+2d%Ps98)#lfDGu;(^avzetCA5>P#t3=((;T~efq*mny+p*Ml%{pV9CHg1G_qX!Fm;V8PX>0J1&Xr5&A1l$aS6)ZZKBOYVT$H4gzP2!Zm~;pk8wm0K3iP|Pws8Qnoj4FVQF^w& zL~-_cf6@?F61yaTNImq;n^PRX;ups02G_s7fPD?4MI zYi)BL{egZBb*ww@`^HOGex+bV6uWrxW8D}a1Bp1%S%iK*mvK#<9W95&w%}^<`t`(G!tXg4jDRv+2 zYdvmmdZZ#hzQb=JHO99usLhv74CoF~l1)-H58ebEUC}SteT)J51hscy0^oY~_We_V zlx*$~b9n=YE3r)BYjmRqoQj5M5U0Vr4Jct;&bZ2t3#B6QGjI}2+le|s3hY)QhA(zIsbPzqdGS-_wK!q*ALfg`r}PSc43OyzkU8?2{;5`5 zwsr`yn?(m4wOfDM5xb^Z7B`R9jEgv;B9Asyx(CJz=g4&`btoM&XZveL7NnZ;ld7io zECXDMOMHYQ-|536KM0@XqLq_YBZFWAM&+Z|R3_F}ZWp_$^D(mu7uI{FVXR#i#kc`q zZ2Vj4YRDsg`*o}+#Cz}GN36{s`K5;*{_Jxy=Wm{KwFKnrvUO+kBSC&m!+NIg#f*oc zoJ!RQx0hHnEam<|Ga`JRp2UTUd1A{%b+o!wz((vpi}l9d7?%3Y}!36>{RMafeHA%HIX^r;i6 zWZ_-hlKK^)P@{!dmT*YCcH2EsGZ;o^)VeKYIE`7x*bqb;tg+>msrFQ4RyQv4VYELjh03iCYoiUE1VT87`a9#p(rx0k$5V&nC&`XtX$EPCn8ycgwf_f;O?xvOyH zlNGoVAa3r2wuu@DELR7@ETURdEV9=C%2wTG5c(E=rw+SOvG^LX$snrcqM?O!^dueA zG0868TjtTHPp80l9u=p=Bf27ND=R=jd);15mswN6-0*rBVVn72nuDHE;nmL3-L z5UuMhTOPMCPr}MAKe__-xEe<-V1lbdq-vxU1Tcw6pl>C0|PPvMRrUr%n5R+QTE4ASM_VRsG2_d@%?#EH?>(kRa9YD@BP<5Yb|FNSp!X9!>2>Rkh6o4Tu?PuEyS@D~ke%!Y>cQH&gUK==cxkg5C*phZZ4# zVGI~>070p~R_;v{t~hI~g9?BeCL$F#yHXR4FV zXIu}vix+$&)}Pv>WUrKpqsToIO24?yauIb{IgC=GL|_emTi5*M#;5mmN@4C}SHfRS zJ409@5jlK@*n$hn9wBe(F|gdL+Qw^%D_FwAuPPRf%QB#30W^BI=x+Jboz)Ay(XCqc zr!G{2zt^t(*)|Tobv}_iKXJdnb+zzs<>Mld@6ocJ=_D7p4eZ8f^>l}}$9-49s1VYv z1poEOq>sc^XEr=2(Rr1B!QK-9uHn8o8rgE)PHXz9?y{Gac+i2a^)()R%Yv<89r5$o z-X2J`Dx+bVKUm%0VfpWToMOJ1oEK-Gboa|l*01Myz^1;PJj8X&SleH#-NpY zD(zRxno_OO;|88;P(BEWexa@tcBa(qv2OG>6fkqNHTRk%eF4G3IjdOj^z2w$`CQ;m zX}cWcwctSM{?(JPP1kYj{`mebgzwldKatJEk^#o^D)t~QfCuO9r&yTC0R8p~)sXg# zhIt0r5R2P(#yQx|?cKJeX?}?U1KLRoJYa=VD9#T1K?5*LKTJMz06YLX2;#1>Iw5r> z6-4MV0>*rpjTPEC0_p9tO+T0NuCD&%GZC9X_UEFNdZukP^+`8=hxg&TZI z;9M|IBXy^Iy^!gZq>)XHeq-S$A_la)+&4zxtzrH|!Jwr2T-?FashHL224mSPk#^`N zL!Vz2K>^BiHILWqn80^`r@Q=G^Hr}Ei({F`s}2(*f{sM;w7PTY&tQ8Y-Ovb(HP8)( z)%@Ga0)Xd$9K6I=8H%1dKfM<a#%80uOLgR~*{W0_Fl^COU)uW*+f)&m|X$y`Fn}9sb@-{<|t)DdGuH z=h}r+izr_xq}5fI`7Usn!>?V9b(^vAXoDXg&QMHdP}`b0GG*uF?_!d>DeJx8nR_ZT zDw%CGjat5jy2cvJrLW~MnK9lsGE`cGG4CUR^+M`M_c{RF8^dS5hZZOG!MqYxar&Mf zM^mXPTB(|Xz&w)W!}7SyFT)!F5u^$OcO35JdFLay9M-`%pcVdRIGV(3n5b+g=PS(1 zGWZeLIudhAK2-#VqW$IwBf zspvAmTNTzT4!yy6z!76+#7#1H^;4W7rq$&89fm6bi1ZXFIfP;fKKG?H!+2Io*8?x8 zM`XrQttl7Dx+f2x^gCbDx4fb~Mv4=rgd~uDA=m3k+w6)7po*#6L+p)J7w7dnTuBJU zhg_$w9;!DxPjc}R#j*!D1@fP%)|IdNEvy0}BTU|;h`fZU2(L{+jr1QaZqy&y!fH~7 z)0|2?)op>z8Z@0+a^gd>sh-dN&QQ#$(^MaIBu3q~Fe6jqINVzP9cWI*GIaEV0NTzV zh<8{LP>U`?)(C+coi|+{sL*v`K<+_RmC|)v8sS1k4(jTG;co9io)xd2&R*D-;9z;>O6CtFXR@NG#=(G^eC~BJkCaYJh+2hwZBr1;_*pD4J&GJPVN$+j zk{fJo?A#=x=MsyCdee+{*c!`tMThvqf8woRA;>9#{R0O&xutM~-=G3R$1g;{lAW7- z6D>hLG(2Y+Y~gRCUctzW_Yn@lL9189_uQawY6adc`e6vP`YXvsA#{{7gtO6%&D6O8JWES@Je?GpBIP@wTc0t_f7Rx3`kZcUDQU>Hs? zW8r;$yZpoA`Vn+Ob6j@=FhtV#d^d$xGIyRR6p&}|CA#`O;OFiPAl^9L-eWqew*Mt5 zNcs5_8&*hprU{_JBp3+4``4HF4<+KW`vzUpSCdY(Yi1M7ua*y1o4u6kkS|O(2^sFM zS~{nZF*2TGacw%hYr(gfn0{r zELG~y$xwV0g$M2RYgOmxgvVaht;!%kp?l`nJMA(QLHYo9>3>)VNIYA#9MtPKEDXQM zrXuRgs?=9}eZO2yV{s-lLwM+j1ALz0WQT6*g^U<6w*79$(R_L#xW*&3f<>zyT8iga zh*6$Q6lnQfK&w{UfI;k1T1El?*g?-z5~I`}?O0S;&~3!C`y=1raoUCyEN{ybz*Mla zSs>~G^`3483h!gtwT^U45*8;}6!FIp^TrNtAU3IrMSEbaU($x-NU9{&;O0fV%Yv1Zg)D=zOWeHQ?Us{Zqyy8dQ`{i8nJNiRzob=3tRnT9L_2w1A? z+^D>sM9u-MaJLjodI|Kup%<@7byweaYP^awPdo`oXG#;vxYxmBwUv;O-`+Sq%jslU z#djh~qGi?uzMWN)q~yFQapVyBr>#(5eoKh)2Ff-AG6#4f8An_v^|>JjDkOe0p7+#%R!644?QW;=0X~n3B;MF&Y7u-Ze5YAu`n#b`h~U*n5W z-1hD|AUH*RpPz@j?wbvC;VkUv=>iK*z&HW)H5f)R?TX7kOLZKw02-th0kBU1&spo0 zwfYB~>YI!EcP%h20W0>-AE_t?akU!{^f&2?2A(J~Ls0>l);&8`b>J{^%18&ItL1(e za(Vra;CL@RT$~`T_R^Ws&RI^WOPKULKj%!jxoxuvx`0|@>Qph*s{kayxJwnP{h!?x z(BvE7$y?}qa+BLP%0t->9%7S+Z)M-osXJx365@uIECDm?&VaOy0Byk68tr4Gl(lgJ zD0+VVKIxN(Y>@e{)*HPRMqkRt&9xUsYl$D0PtlC!3Y$g4E&`qJ7#f%Xr1YG_u^6H|(i_9BN6^pZGm$&pT&+p44tQ!S@#}7H@m2c$Cio5S=(XIS=iS9UUWq*;Bl~aM@+EjqH)iF7 z;=NCJ?ML@`*Oj)xl4x>uw`xusPljwthKmA#p)J0-3TdH2-%w|7bk^dvmQu}y;R~ab z;&jG~txm#{-FTTvyy9hIpnX&dlmFI8(({C0)OwMEyfRwV#f3{QC3I!F)3txv?1ica zo91peBXrS@1$)Za091rmUcYPc(%v?~c-$Y@*25-!X^GS|945&)M+A=ZD@-IU*_0ah zX4*D-?nnSjXuMk?U2GXP^!A11T%N0XQ6db;$5T3+y`{?K)*j5_3y$whtN_bI&4jiw4Ht;&3Znnivi(ZTrV!s*N!HAFs z_#?J|C<-L2Te#NWZhiiR)wahC^ad8QGCS+zbttp&7jZ@5luaJPBw|GN>WGb5C~R51 z%N5$EfA}W(CCfUC2P{MB453+Z-vwZG#;?ZsZM0gcx=ZvHrHZexy`NLIDp`O9-Bl}g zY=@yCqu+O*bw7Q@T0~7&K?Y=tp8)INShrpzU!;=D^%{4Rds$fHkqhoJ;CJ}2Kk-+c z%N{@4tCdh$i-!40f2R^n_%Rj_#A>I*Ex(O#OQ=Lbdr$40<0}uWVkwokfaV4kmi?W% zJ;3_RB2GUWI)hk_ziYTGTO6|4ns^8ge)mlSx`k{*Vr6e_{J7$aQ4Q?UX{tr^@r~v< zaz!9JEGG%#njgK0FPH{6N-)q~L7j4{y=aC($~mxqc)ASZAF)J1A{p%rQjO|xl*uUd z?u&_@`Ha(+fJ_NABv8MS`BhjBZ4XXAMK`P7nsOLr`v;vA$lP<8&9{7ab*(^2av3R{oFr;x~g#dq4p#u1M& zpS0(+^WR+nNCa0?58~pvj}wjgHb-q1e9dkO>P!P#L|V1OZ)Yd>JFT=nW0z@XAOiUq z>j19f63kJxNf*F8VO8Ma+SR+GuBh@Jw@XaWI?nlZ1ij@G&IG`WH0i1^EZ7{UE^kt@ z!`oxnu80(gakpGKb>EE@v19_f0$`bYls(C?tk8>Y7$6#%M+Te8|IuUt(+f7A+0Zp& z-Eoxb(NerQngv#}G_oK{qABWm4+kTV3pW2VVcp66wb?s^^V^$EZ)-BDR*1MRj%b_qxsQz-vG^74+2Bo)`rA|TIG9C zXYg~JVleyYtER6%B51F*wxO%TxxbiN2rjNFVKBjvhh_+nT=Hvd=X?Y>-(WYGb6HuE z>(of{sB94%hTAJ(kq59Br>*mV+-jMZwyQ{ia8!xcZB`~nJnt^XW8nPG#>++0(7u)> zGaV)18sX_y+c0!%tN(HIr_FL`Q(x793ZA`X9sgh6> zu7HSj)8g?WQFB3LYI-gs+Ml0i!=w-G{cu&hYf^r-Fis;Xt)Vgrtors!T)(oj0bOsV z-63Qp)1ghi`hP4MJ_Qu$n(cQ5xQk{D_UVc-zMGOCtpKCeGO$*S^L>324WNED3^&4O z>42lmz3Lm`bJ;&Rc&Qt8aawPWDXT^eyVYJTt~RqvrYhm9naiqTWf&l)s?_fA1ZE?V z-svq4N>mTjoLUhFx)rgGt`L#t^8i8WaFe!S`4S%B)~S-?+9yUXPWrd!_l=D0?9@79(S50zB{|#e-Ls)=7av^4Xmh5uHTpV_423 zWgj!`n8qe;gDT_^t;8&!ODk74Qs67xBK=GWD@87M$I*M-hEFkHxs*0U`*^9FXcuBJ zs$XFbLg9R8r0SM_+wry{1_lJ@n{5SfxInx5FAe~9oOG!mj~X4kKAUyjidea0mcfiX zXUrJ>;Q}N+U|vFB6h`M!`GY7nAXkKh#yy@SV+(OjF?fr zJ!^S}d#K45akp+z4xTPfr*zI=xfEu%zcAdfYw{| z%?{%k=(H{4n@)~+L>c8+2;~1=i?*QaI?S<~zQT$Pd#IVUhOW%0ZKFuI%se}b%ciF*}ZWQ?;oRvou z;AM*0ovj;_Q`*bnHn!JSmyLe=sb3-#<>JQvQ=aacz9#dJllS*^8pfLax?f4s3+n(D zu~0)G2*wL9Dcdz5PC}IqJVjH-f+iVYN`)@}0Q9M2q3LimP_~fOxR;A%OGuvkb3#TV z93ZRN6H1t>raa}PGgEbw64S$HYqF-xYZZLa^Zi*{4*EDVsuDogU58w?xQjQKH}3X{ z8DQZ6(jbjibMYnMOZ_mzmel>)KCm7!vmE?|1!!OZugr&)e%FBh-|dOfEG9SM@(Nyi zC5IGKA`UtN?SxudgJ=NZUwOUhkP2>M*TNeq)yefV!}smPmlp|#JiqWSc@qB?VRRo; z%735V;C_Ri4I7!$l$gyRY}JBjA~fFidG^J_Ju8Tj$f&W6RMqMFw;9H1JlxjDWnfqq zA|+v?`B!fMEDwk(Kk9DhW)g;j1J*6Bjyn;l|N2}PQtH!#GK)V}hc4TZSY;)ZqN~AF_Qd3Ld`r1`$8f)tZ`XW8?x-RB7wzHEEM`-k} z7VI^#M%(=8;(~8nI7S(L1HjN~5N;c5&fMG~HH;kv&YWm_{aC_A@A-letewAt%>}HJ z5SoVC<=4IJ%BV=w<*)ZaF&GGih>0nNpE=fSY|nC=6#)l{>nwA@q#e1%0dg>Fm<{-| zQf54Gi?vyqaQ}Hw|4{MSF!~IE&L=|}scLx*@{6{O`=a6=cu#^?BT&qtWk?%QOQo|* z`V3bl`p(YIVN0duOH05~X>zzweR!uZpU}{y%i;Qi@ajRhFvg0;ofbjo?W^Wzw?yad zp=uMuwF0t}M3S(^wqE|z$FvsDNkO@1^i}w%?z8}SWe=mRnxBYPE3NMS-Dwj8Q_>_T zA+%FCG6+@@T|emEB(N=6F%e=+6jVjz>haelBlw%#U!{oghB+DCXAh+`9Zi$eNEOQp zVbn)vx;r*}i=a(Qg(q5JW&B0hwtJ-0O%VCXtap5W-#Brm2>4>->1F$Vi)+9v_#kxV z)oEi$JaeQt)#c2WO|sN^9vv4v<|Q+NbJZi*xfJ_CTt&H`ce-NMWMtr@n$3E{L76Oq zwC%}p--X;Ic7&7KKt8Ss+9qwWcDD)IwdT4x;fP_;I+O!c@R^G>6AvgS#(NwN~v^rcQ+zki%#iA`khO?@4esm`1U@I=g0Tc>1540 z#<=1<&+8gvjvg5)k@}EbShc;77%S^Os4Wfr0r0!MuL^cD8#e5M=g&Otf^`RyTeF(N zmd_dW1+s2BU`flpdp}6V^PZH~Oktgyl;^muBu+lS5U$2;-drzaWOKSYqw@QBF;+>Y z@K|?YaUeH@{OPR+mTkLa4q?4Ua zgIdo>q}N%*-4?2W4B3mrJiJLZHhTJr~e{+GPu&&ibCm2L{coN z7&GU{z_=l4>!wnmKksvF@SC3A*X)uVDV@Lc;pzh|P5X`Cl=C=$`eq!UXbNOzlqY~05?wqd%d3JD8b; zZ_s?b9JRt)0FP+*xe1vc-3Z|p+mA-mQ@D&2k|&F9RU+p}tNdDL8J9fm;(%+E!nRY2T%pvV!nE`7mZUcj zXNC0g6QX@JFV*GgkE+auU3R>Wz{iJ1Q-)%9wA;0pyN2mOE!ONmc@3##zu7=L2)t*v zWRBe6Erl+UoQRMQNh3%0w_H?b>&?d|HyH6A^4CW4-^u&zn}`l^8zfUnyXG-VenP(1 z7Z^QB^xz?b;&TqCo^L9{v2Qh9WQpvg64IL62%^&Ug4S=|d{qx;d%nMC3ae^&*YiZ_ z{*Wy5UjN-GvT4c3Pu1$K*>V{_yR=K1biMqwhmKj_25f?^m{Z>qgfD!5m{#rK(ye*8 zzl1^0c_Nj<8F;mTEJMM&?_$n`x)olBY0>#WJbp|#rm4~H+F&kx_>-f-+M(5ltiylN zXQRLN^IwNy@~faiQ|oh2y-9_FTk|>Qb!sKtRR%F6YSJd=3W^)BJXb*|Q~I8=nzW!J zP?Lg-^Sb!UGB?d_5zh#Lg`;JQPzWp;k?oh2{?8flVxd`=pUBkwjooG1FMWJ-b>D@w zym_c2RUsL*oD3jq@Orp7rXA9fZ}t~0blg2u;ZS1FtXc&&L-$*M_GJ#Rmqf5Ji7vlM z=lQ1G41zY1M6&UbvOVK!C_)83j`6%7LoS9}8!T-p+SW{A7*e{nESp9Y%d&Ji zIEUS+NB-4-$U&&}##*C&!O6>P?17`qmFLNP>clF3dj%`D!OK^(5p+Qk98p4i&o%92 zu$o3aA~?BGEvX+aGA%e8n#xahmmJsLNweS%INpA4eb<9qs5nZvACs*?7O=%dW)7=i zhsP?f6ZYR+4e&dSR6&jT6aIG8j(hgd-U}A)Y0=Tg#h3DlqH+5<_2T3EJ5qvDqyjJU z0<){U!n|YVowx8rL(n=6h#dNwaoRK{C|X0}lHWHnay`v2Rcmlm#DqLowUY@l8P9bL zh8xgr3jpg>M1SnGF7<0BSF)QXt~Uu=WE)eBD`-e;P&lrcB8trxMVhJue_FV5eb{}| zFls|Guuj6ao$lfQW z3&B#r&ejnn)HRN@WB$%MhwbNE*eSlHXb|_IwE*1bWB;=QZWaROtlrK8l38@dD3Py8 zQmhMR%HF&_&I)eThf5Bv)YU7NP)SxlNxtvAZ1u|tWkt>0dal>v9fFCYBUV$R;+T5~ z#H+%r1F?F?Y_XJfAxFO!^C=PXkm84D;FwjHt5h{kcbklql`f^W3FbOpUVELkQjROa zi~zSvf(qjiqgZxp6C*c$FmOU#mBF4bQb@^$#a`b7W&>zNTRJ+dD7Pt``<2h?PQV;9 z##gt;=UQI(aSZob$nvDTOLYZYh|@CH6GJXZ*`4QP1P**B*N8l=U>vU`R-y}AQnPG9 zvB==07;Nwa2HoKooJUlzn3+ntH^|FWg#JGnj zGnWLSBW{YaI-ecRN)LewtFR@`mHHFhffH%^A9GVdE-CKFp~|KzXS+SeN3Topvp`D* zmo~+*)uJk~<=9~Cq8a$DRJoa=>y110k;5c4x2(bS_jt~CR_Hf9b5Cm&KacJG1^u;d zefnzZQiDylQWb>075V5x6;5+X_{;jj)eDLD!u=cGekVm=F~q=Jci;i6*w3BCQ+ZG{Ajhmp7DgMLh)XZ zRqlILSNGxMVt$3Uosv>XX91aHVs=i`i>Ok9z;}yOVXPwli&cl)#J0T*T9+;gmLb~9 zWnGIl;f2ZQG*wsHIhm4#&JQ_v6Oysnq(0M`TF#eZbTkdBj`_(M9?@@HtNo6oYd;ibZHfv%GkTGeXZ;Z*<@`?C}nGpJxjm*WZs`kQX?ASs_$M zp%>dGbrxFoolf6$2_S8lu1}sq!QiF`FFa z<7#mx?ObDynle5))*HpMUyEjO+q3*)=QCo>P1WceE`~omy=*`R6BA8Y>D8MLb=jM6 z$^OCD%5>ly5W-B|k*p#iqO*X{gKxIk40YG$X=_UiSLt>#D2vo5kQ)jc{E6G)DCXZB zgYW_RgGGrCBdA&9=Q?#n+h%8%Cd;iUgN{10F+49xrzInALxcW^*6cHU0Ou~m%sD=& z=eFn9E69AhCCy@--#FNDWeoEB99R;StNqPz)&IO^++kHnuZ zno1;<`N18EwJq35A$FpJmHEEFgs)Z>U}j{wWix;EE^G&)`$nAc1#g?s zhH6j3X~N$AyCP+7cuE5#*ofB=fGLftUMS-|1(Bk!cg*MpE@Xqa&Ba)^0 z`>7bXr%;Sb2EnG)RkkDcGC=HZQl4_2dq7M93B-!EI;L#lp! zynjtTrYM-M&)a}&6V4Onh{3j#xGje&*zR@XJ1n8z>GgRVN@19JSu$3W>;fz3hD-y3 z2;_ZOAM&aFCV>%6yDW9h^bfA~tui1>%_Pxcq#E8UI8K@K!@%ztn zbu2?=_ffu3cHn~^p+=U^-&%g9ZP5K0r{boTTd%FUSN8(KO^4b%-QbFEH?dFY#P+jw znj1sVIhfmg9wLI{N^SeeBkM?#9pMWVMjxt`HOE3J;OeIcKt&YMwXfdFfU90v6Ce1I zUx5Y6+3v~xn1Wo+kH~D|YSz>Fjla=k#9z-Hp-p@{ME;ie=7alBBBUC6~j$NV2E# zO|r4$RVl=aygW0P?ToShRdCVD-E0&`oqYu@w-UX@R~_bEQ2MrY28pq&Ca;`OxAQxV z^Xb(MUraxECQb!ukE)^0Yn;nR14w&!G)Ok|QD1lrpw&cx>|x4~NYY8qR(*cLTC#j| z4V^S0Nq#4W5#IK&s-T2Egl!Y~J(9IOD{hiOXC?YHyl7ZyjYds3m_^*>5{*=^F$M@M z*F-QsOwCyu-`>_OQzLq_Wo9IZ{_KfaO&V$-NDDX7)=gO798KW0JE6Lva# zK5cq!Kex*+%|Hq}P`+%=yQ)k&{d#O(aS7CVJ=lU%$4wW>B0k z#KoO8SvcF=J>{gbf)OJ72qo58xe{wuU)cOqwOyoouMRsjMf_U%C!4p!*GARjjUqc% zV_vodhWc&^N`ukAp#gaaynnGw*Hh%62?T(jJnhczUSR%W&@T10Sl5heIibY^GR3LY z_b0aaa9rLt(5c{AdYVLWSrgO4=pM^Hp<&NB?^MFMB)Iv54jk8;UCGNgC{FRPoxKUX zns#YAx6Hzu)Z;;%$t;B>x5w=&SU8;ZDMeFvXQz=Tr1#2~^;0BrHfx9K4DVaMD<)Vm zX+@o#5&?5}MYL+K`VV{lGlyvYuw4tEc6^@v(J150|IBq>Ok9Jrbm#8~VL ziC2`5Tc%`tvz#XWf-&28WfEt(^&|*j+`lmmvoA5Wl~ z3ban|ikp{|n(C-)q-yI~%nb|z-1p>SMoKBm^y#pR*o-C$4S76Hcyn^ZF!<56l))t#zhNnl3yxzk)8>CaJZ zseWS+BgSiQ`R<_g5E~r3P?-?&e726UzE@)SkEm2?GVi!A+mQ;)^32FI3uQxY-gmwE zNMswb8rUoc9P&164G?VDR%y9gVdDAjub!v8O`1CRGBAIM{Buw+MJx@X!t{qt@L7X< zKPJ7Uym;+Ip8g_}mkDNiLxZMUqb|!fVwN2UNagCCk)0qm_1eeEVtI_p-ssGKo+wuAlpIt7h3wEQKHQN%ozn#m8-7J7uO=P z_nf6E$%0Sitm+3eI;r^75K5Sm&8V+`mkKn7bJB2t&kuhYPQ6C*xC$k?$ZnG$N+dpk>=5 zm7*LTqh+^W#VU9zT&%jQV7wUdslk2%>o-T|8BMdhNX%wEd+%_1f`Pxn&Hh8=<&Z*r zHmfuneldkpu9HzGfbb9WCti;oeVKhL-ZfX0kwhxB*Dipjh~q}j=S0ESaLv$E7$4hP z$o{q_6Dwpe(a5sG(gw+RKn1;4SI1uP%-nk;q4}${a_1? z%W28y=L)`j4fH_=KTlk&A0x7}Iusn7JlqomOV_8CA&@%v%b*}cl@o>01}A--mPu#l zc$~cu$VtX0-hJ*k8?v{;SB<%xCV_-k+QfH8tdsL-M=pO@AkW_1qGrMutD@aUWBa(* zbcUSO8&RzKapOeU&EWxeV8edHo~q`I+QED5w8|&=f%)2s2G*U{25d{D2|J zd5kV>?})MS@ho#b5C-8AZ*a5aE580OfV{VXM8~hejjOq8YIq1G@3aUc zQ}ptHe@o?9_mh?nZt`i)n#wv4TAl!OKQJEtmN3RZ3%eMv>U>gbawV92VmS^1?j5}N zwUYiO+Tl!XGicy@Ye1qcOQHc1?e+dFV~giG8Y48}`sm#bzz?J`sU!n>PF41?7WPoq z@-OyN%*u~Qm3s!_c4iaYgDRVxg?WIpJ=A$U>~WZldc^!2XwZ}-o_)3D)o=Ies!qN} z<1vK}l~RtU3+Ya~9y?i^v|NKy|B|AvFOZJS4S{Uj>5Vx5hWic&*sg#|y-b4F)GNHr z0reC6W7+-kAplKABKubMLydtbPJ+ez>G46vT~$|pz#Yw8KS&TlXGsh~5Lp+QF9+B*^B&BQzhk>q+p zVlS{}rL&ukDaIBqIN0>oYy75H~V+D%W=O06xQSgntoN52W z3jEnsGBAA!|2l zJ7hBb^SWtd9ewU;+RB+|z!gdaAeB_F&cO11uj2v!vbLFG2l3s1e_Wsnv{g4!K2mr0 z@4CetF_h7j3O0CQ)&D#pMUV+H_p)}tBQbGt>NO$1FrT{>`p*kj;6YoJ)TiZchXSv9 z5)7zT%t$t%G$tr(;LhpoPUe56`!9@BgRGg_W}`mjy6*$}Z_Tmv;SfHP8IuVThCU78 zN}6?+LNTRVxkCKIRpvXU>EC*afg|jkhOMK_5GL@Z9k5VF&yBFbslNU5E)u|By3}v- ze)#W?^RtuowRT%``rxMV`{{Up3j}yNc9|HM2$TS~PeqIZA|Ld|I=c+;3+&A`y#Kzi ziwIyJF4a@KO2BVEqA{5=nF7tMn3P}TfIAm>Is5)^uk8wZws_JN#(Vv{_*EeQF~&OJ z$nMj%*Lm(JI7qxxpcjS`;g(m1EAIAKX^f>k55C%2N4`~0Br59%ruE%etg!5NB|Y;J z{o}+6c$*5UftB|pOvk@qc|9FbFCFSdJEwZPk#T@`ZhZCs<7%)`He8Z~%hy00`7tR*W_N%4LgHtp_BT8mV1mI`}(QG!8 zn!OT>^(bMB$Na>;*sqw>^~CUmt&Pzz1m(om{t>&4tu#@~JZJ@efy|g>X(BepQgJY# zIG%4#c|(3fbIQVr6gT!eTh6itO$g2oY^WS6Mu1Prboy(*^Ru^4qX29@O;;-u_a9qt zCIM`{S@UBiHE_k}kF6)wBVzub1n#sZ#5elCOK~5>0E_q_mU(9axjsh(F?Az<;HzrU z-{zZMQ2O~nY%guAtjRGQ&#px79i<)vw-O>2f( zIbk>)n|oncU>GBuRt7l-0K?wLLI4XO*}%M8dqs(644DX)w+sXSdJ-fQm7x9&MIDBJ z;-n?>0k|R&5>gWx@KMwL%@{y3=-5W6KpxvpN}%e2{02fjBq#^GZQz?6Mm^1XIJTZt>XID|BE2!sEnxMI)&xe(g&!xKwPv}Eap`|F}{xOBIB5 zJ}JNWwoDCYmomt8Ik?|WGnFT3B-F8kOU8L>X#Q0!nRrt8+x~C``40i_ zcNWgW-A>oI;(Db*OHjDR^Ar_~rPd1)cpUnX(-`Rc17=O+xLRNEB-Ym!i=al9yIFY@S~$47_8D4bj^>f5Dv9 z^J)hW{u~}Y_lp}Hoj!?9#XL&|KB8n+dlGWDI|{>G2A+6R|8@@9KC3@IZGwA(P|M4P z(DVMgw8tKFT#tO%OT_B0N^Muvadio5nq0z`m1|uX>4{eirErz`t=iObQlUaJ0WU)i zxh=-@-8?al+uDRa6y86vBuH#oIe(C~!vi0O@h+59-B0xAX0?gL-f87hohmahO%$Ty; z@a9iwNs)uZ26EVX)~_b{W*@q~K^a;FbFT;%xmhII^Lt$5^3`$lib**i76^_$_!nP4Du}c9P(ng`pJ(aqQ@EZiM*Fm{aFt`ngP{k zWlUcn)=SySxo+mhFG@XzT}b?(p^EUqrC#VZ@N;E*K(yNHFz`ux#G7GOBd+81=(+Lr z5Ei1gHi@*z>6hPI4ffVG77X%9C3B_6Rs@8~2}bRYD(lTft^-6zi{CU$3D380B=zTO zt3{2K)QThU(X?%Yp*z*Ss}L<>xd=V6Y=~imTK41bl7%`Z7lu>sJjv)2PJS$#+Q0d= z%ja6N_#U%~@FNf^9!@R^h8RbJ)W6&->0?|)6|?C7OqMr3ZqW+$A%%o;FgIT8C`qy! z`zg6STWujD>*xx4li?nfEm4=47LtfZvS^KpWr?rI!KRiRVM8sZZaw>ybUYc~69>LW zS@Vm^^T48TMJjbiE~L(zGU`N;)j$Ao2!nYynm@BOaAH=-K_Jzr^OoknkctWdsq&|{ z8-ai!_!ldB{3lq^LK3Lbq-dCWt3kPnWw*w`PqDn%t;4fioqK>G?dYW}S@yFWaTev@82CF@J~o^u%CIjzdWn9{<1z znK`=;V{6J^Tl(w0p9vMQW8A@s$DO2`Y%36AshhtZnI??tsHU%Y+as@ddy5@n^@@7B z-B=7HSA}qnC2%&M2+|^HjbeenpT3FK)H4#*CO4)}{6^|6^F)x;G9rJ8PdNdfm=-c4 z&)37{RRD6PVMn9L<%asAxB4T4FYMXp6xp&e^sZ$9Lro`Pzq*uyT_pE`Cy!2hu|qLd zw9i1N+%o6x+)O3fL~cr1rovCAj++Q>5hsDKi*K{3|L z>H?Cdf8o-rxI>fGa=XzU@KAX_Vii%ui4;k3TJbBnT*SyN9+@-VnJKTj&tA)4028Lob>7In{6%z_S99>B_!q7XzI z5xz(VB$kB(fTR5r2LnJX9QXZ zC7?Y6GeROp$0Gu6^_Ncxz{%C+L<7uH8`I8Cz4PV?H~(F-5i8a(DLpE#n|nsyz)CMn<>=?|uCEmAnMVY@iFXT_wm#lwWfRsO!P81SfamJGG363KNp$>_3R_Ke1x-UsCkn&Gj9c!*!yU()G6s6y?{RZ3_5p`lmIYU=ysdq2-;XNkv+`UHFwyZA zqCY>j^g(=$VWQNO-MVNj$2CrQ7@lFxnwb)689eGN%5|2f!)$4ti;`j0+VTeG+6m2K zKh+(9giEZ?~I1fJ9R?CmJ|w{adyr!2q;=?J7Ix3RdG%40jd4-{O|)KWqAh zzk|Y~VA8%j&W`*Zm*4v@?3!bNl6kYg}MskmL4Wu-bPXb|P2C%!Qx~V5%9u6xME@);7n@;XA)&jUSW-2U_$w zu=P_$gN>h04jwRL)MxZ4BtnED_yrCsnyW=B4Ne`Vf0Gzg2fK zvPX$%=OHbu^J00)E0#JbfK%P)<>D+d02_j|=!&qxaq8o0aq4PIb|+UhPRm*79|#j~ z<69e*A+<~%>oO|d$+)j>)|jrPk52vK_MdS;GfPWXB}pj>XYHO(5#6rW6EtBt^pUX4 z7@>|LMD66ZC2)CEn8NFyYiGVX)HO*f0mQ(Iqb{reDo+@YS9UN(Ltlv%N>Gt2JEz79 z*A!#dDKEFG*DG4s6Yicrw~AVIxvrJlZLOwY3k`48e?d~I715fTn_TkJKNjK6UH#|@zJ}f4=5v{lZqtuWxEzCk!oY(#jCFhP4G`4^Lv{q+Nw&$mSBU2EN#ELiq#+b zL;`$Y*8hJYiAk(8z%4d)=zt!ffdfITv+k$n)}Nk*S|^w31Sdm5xvgKzBG^RobyR*1 zJs15aj4(mbL!%P%KGTOWCs{+lM8JTOSvZlj8(tYEria1#BOmZWsmy*Pp=hA^U{)7e z2|E^xWtt`BJ&IbbZCgOu0*c%DA+5=_EIj?A{r*=3-0~ZxtOE)sziVUJb9{!DA4ALH z)6Tm(SDeLH-oP5$*d9jWOP%kjb?=XrE4rD!jcqIYDKtoH!JHdG0b9>gZX>v&Tbjr} zFljybaw}HAL}{?v8ihiaKNeK$vPTliMm01j#N7r&AoWb$j_z64)1!UumV6)mWy7T) zv8*=AXnB38CC~A`93=Y4*!|vSv=J^&V;b)8Me|pm&!<|dqv&7; z9zG;Y6yzUgb{>zXQmk4k;x+T7zYIj93g}_;A^@5gSig`JM+`DC;_!UBA&83K2;)BA zZ_3iy{Q=)pB#6DJ*W`dqqe2eQXStHM z3jTj-li&$L3WhywxoTN2tkoBYw*u(n;i3E8Z>|BG=v!!68-oGnPv%{GR5-Jf`5>0f zN1aqw!kOIa6&4bTI+r#~*&&qe<3UcqXX7D>pTb_&K-NzSRk;_OOa!mX0v_5Fv3EK4I1K&z};0w~= z1W3u;RF?{CqK>#e zcOcP@vabW`*FGsg;PXCMt?)PQ8zDE?`yD4CtVXe(!O)42pqy0B|K)m1XOVK(A~on)Xr8XC=d zZr_MeHuLo_A4Md3XWFCoM&zY>HuS;SJ0HQEkk}g7dYeN=QlqSrrsKuD zNB5oYN*n_0^QX*nBP!!H`}+*O+ecE(8`~?tur1c4i0-n_?!^(_G~It2vbT+3BSp-6 z+yk4Vkn*}!CX!`_Pq|Mf91u>zSw6P$dqJb|g^7ddIMCjA9s+z*(ffluZ+svaPUuFI9oo{ z@{B9 z@vQ6mx|I9h8M`E}GY2R@o=c=4Z&i4$cUnAJ0p|>3=p@3h&UKxRW6gKt%eC0)@6`KS zn$n;Xk&0Gb1`B_tIJs362;^V6zaP+&NiUvFnaP+DpcXQn%AdlO8Ub@CCa$#m1Za%& zl1WU3xNWs+|D(1LNSjy9XoeJM^Emf^b%+=JoK-!sK27CAQ?~N%==|C{j$=0>t3=C= z_Sy`{gsd3;M35v%iDWYh+t+KI1jI*c7YmT#A1xYyE1!HRA};|yO|$O7G=ZLhR4Zp{ z^?0?4DZVQFS?6g68dM0+{>`I9(13MDh?Q?Zr!)xoyUxfqxPX`pS?3hUIzIqk+Up4* zf5rQ_`W1JrDUXmkrKy2sp>_wyFu{WnU108KDq8Z}&l905ixP7lB4nl|8Pzlxy$&77 zPs0V3B{9_Oe+h!Fm|Gz|KUFK*FZO}S=SH++ST`S;^Nc1u=O%`b(8)xniuS9r;jVOC zr$ay<{NhuRN{OBTV0nky`ol>Vq;#dYgC|J=a#n@cq?59!TD@9~E*G}C-@j%|kUTDN zdq~_b<*I*{joJ{hTk7|vcl>hV#Y_8ry6+q^q;udnTr~o)t&K#zb)?t?guGLFKR3?6 zRq63~u!U`UMO46mqWMfF6p)TCaj=bg9tr(>=k*k@Vp$Va%b`GVrK#Ec6tsT4KWrK* zU{`#+Bw}lFU!m3;@!c9u&o|<#SfISwwk}RcR`4fnNbGHUpKrb}p)o%vSB8Rthm-nQ zxx{P3^N_h{osL3*pTwROF=kR)FKO7UkS6X!+L^jGa2OE^oUCZW@?)<|ru`RJJ=I0Y zNPalar|ak@h=m5Huzu&x-?P00Uh}K|*)GH@j9E`cqFG z>uUfwZN;5^{YUBx#D!8JjY8WG!83$r7yldL=Sb}h_(Vd8Xdt9JMZ>vr#vFoCUxYg#LXm^WC{9h)g42K9>{HpaHoOg$ zz*`$nyAuv+21Jx~-S^m%%0}_U^dega&Ow|>qO~yBHT{kK%UNH#Gi*ssT3FY0=o@lj zF|?yfm|&y~sk(#9kC}FUxryy^=75cBoc1X928sG$>lyiZVM0A=5{4AfF^lQNyHcc1 zGz}}yM(|~MxP@)R(ZLh=G9!b;Eg5-0Sf|B16su||6m4uSx5@gWuR=?kl|+bL)&sI{ zf||CL;JSx40=wCiR-}JnSO9F984;1h*x@LwZLQhL!f<$~i{xsfG)BIue4I$lmc1p; z?V(L^Np#uj6(HR0HmQ&h<| z^EG*r ztAns_-&I7t4E2CyRp}ZJsF9krGo-FBsD8Lv(7RjPGR!2+7@DO`4lP59C+@}4VeFDj z_xg!qlIV=JXkqcVnyu;pHd^&o7nLBnfEb<7e{OW#(0zZ6ZYl1}_g|x<{%v%J5qL(> z?4o~-?uYnV;UA-m{cCh`$VMsW?^y>|l!j%BbasAgU^%C((iY?|y)Fm!zhn2a$$^!q zN1qZ{F`U`8)rCUrw|X>`HmKK?r13~XEz+dDhJ@>PZCLhQ~&*HJdIa?HY?t`9-5K zM9SVq0S5G5@XEhP^`}B0Y)*5Tb@0tl+&^alykeg3rWdRGRnqmf)u%s&+uNO_C1FRw zXmR$D6i|{+^C?yjvN6q%wPY;Iq_@As6O<~Dcuasv>vnEU8xG9NUXirvdwXJER&#B} zMG?VD=yo1D4k8^qZJR3ZjsI300bl}jARmg-L1=D4o1t|YO)L&o z4&9&+Gx6+x znZIinhJn+`3{@;qP#EY{G1E9JDnbD`UWX4nygB0M!UrWRv+Mv%Yn=-oWT4Au`nu`Z zFK9X5es4`_T!&{++X|3<6Z2MlK;ekN&kc_w>HTKD%2Yyi?U(Af0Y$Hg6pw7LwdGxP z)AaNbXIAnCinWjIgXi|_!Qg?kET*C@^RMbH^c>>L0m&JeG>?PpCPQSE_Q6?RKj?hS zAmpE+41bKDJIbE$0lHMoGM{kweTe`@k7Q0lqQU^oxw$Kj+wvkKRVW!qkx-M;I*2wHU<35QG1p2gr&(@W(W#^N1DUAi&97ht0Hp->|Ic+! z11TduB%4E1yi?K7zRr-{ZO)}Q(K8X*=g-{yA^7AsGPP#H2`c{0IjmxU*uZAwuPw7me4K--zk-=5F<5L_GcX=7H431q zU-u7~$~`gxKtbnuVU!N=C8E0An=s<{{75gr)0pCuT-8+q$m{fdJcZKDPcL5R z7FwTi-{0IxtVMFT)HL{|S~XXGI^k}vs>BP+qbHzVQAR8mX!n1*%a_F9DI`yk!_Q%R zyxO20AalUCAVitqkH96#8eALKiosdZZ}%a|tw9Y?4u0cxbJ{r9ynWOTL|s|=9!Wsv zc;lDN7!Fr|TVR*U2Pr7>m2r=KhWHAk8NnL8BBwGFuD-5T-3=gUrjQm%)1){m3~z*( zIhW1})du_hs6ipX#mGq+fIs-XW3M9*;(~J*n;-|-RU!Z`eCh`_^l9Lh4MA?GV1~{s zn-|aIAYy#)ZsnwUr0Z<(T@eK`8sE4(fkQMAkBWxeT>aUjntEhq$w6 z|KtLV1Ya8TU@@MZzR$i`m=!t5(Qx%@EzEAa5Mu!PBLR*X30F_@5-gtvsh|}_#%Cy3JX!#n&}-LhmmnjrJjG!rg?SB98E`#U(X>j11M>Yw@S zh0KhG=QA)AW`*+K;3Ulf_osqu00o&D08T;ey3B0?qN&|QCXaLuWAuGt*c=JeVhRgn zVj$7-f6}x6zon10Btg4BN%GSo#g^YcH5CLb2>JfTf^Zaws6hfzt$;@d;rR!T{9YzB zh-L-w05mrn;MhtMz*15h&HrQltee7bHS9O>M^2U*3izk0i}n##Hk4D?ni!0ZS;6vm zB8J#uP?I4uWgzr-B7}Z{St0)qJl3%jBIYwO*i=IRXSK{Q=09x=1{{DBmjL}SOIBn+ z%R>bNq0aN?EjQ5E!c^z>i7PJ!=H*NwmSd#6HtzK{ypjZ#K86$4aC2b zPLbvtJP4U|1h_u~$9oapq00nCO9IFz?{J3H;Obpl>Q_7Gmn1Vwaq)-iIpSa7)Js6d z*{{08^-t$g1wAw%Vrnbf?O*+X5gCgTsb$4tE?N~V)_8?;OyYKaN#Dd>C)P=RQ(`!h z_nhly!m6aP6|wvLT4d=Zn=ICjCnXv`V8HC2B{0!ldkBGnb4irerT&ZA648b?XIqkq zZ?XC!UK=^@OTau{9pWw2TEe@#vAZ7WYz`&T>Wq@LL^JAivM}Ll&*eYQ>l+08YYs3X zQWU(@w+casfz*)EmI&E3n~#&ad3baK-=vaDV@Fo1o0*wQq*Z5f-g^&xEa}-~o?La^ z+PT|jUm@swK8_H|_wOKDK@C9H#%yu-W?o0H+!~7BydKz#Q5m`J4K_>JUa!h8HYILT<`bn`&Xl)N_*4Fyo?EQv$Uz!i&E!1)ExqSJltEOL*F$Xs>?ZSmC0 ztTB`M4zQ^0J>W?H$NN(P87)eTQdOcVcp8WMG4o*_3H7eYG%Cf4BZF53m{+KS(e#d; zxl8Y2N@Zy|UG;684$=o4N~`I zpn`uK*ik8MyTjP#L?l9s)vI?%Jynw)N=+6^qSH2xvv-M@PE2dAJ>9_7scJ-O{VYnw zp9nR}R~jsBTXtY3m5_+~rKvRc?V0=5UZ62^{2sm8V2|s{GRbn7Q&#v(`-wH1jq{{~ zs6|s~5=aXeNq?Mn6&^GRMID6!uvzL6$U8wuIDL_L9Ew%OQU}YeJX7=K8kNwc+V$d5 z_*{0Ed((=?0_5CIuC5ZjVOU}+x=l{#S&K2|961XJ#~axocJm+4?ye3ec}yfEBsNFW zaCDnp#J;De!Uwt|X)%psUlqcg+D!thABYLD^)=%Z-j|eUM-WFdleN2hxN{|!&H+7s z;c>Nb1A*W|Bcr2Hr4y)u4Z%m?*O*lDFO~U3g0yNs1_4IV)!W;9B$l^WXDyP!?Yz3W z>bo=c1y49HQLk8y9-rF@K_nPO4Cs5UJ>%?xjX*C@6sqd}!fR0?`IT2eL1A;)tgRdI zF%w?+H6(czUQ@XP^u*k!y5DB3!PytMpT_&UYSEk;dS{jOCcK~kw^ z;()nowTB!+4Q0JdOW6w2OUw8SnYhe=$SInm+mW*B;vGiJq}*t%qsE3-tIzcA zS8}iK`(ga?-s~gMOU&}dMDn$Z$Npd@Vg&_R>Jn!DlsB|H@BEm6X3s??eP}`eQXxoH z(vR{2$4;o^%YT!MC4JH0aeYMMb$cPrODRIbHbkpw65a>}K0>b@ zlc9vpSTczV6N}u@Og_A&Cg(|Mq{xukgUKHTonC-%p?UvC_A9aH11W-Y7(gZ;OIT(9 z_Lv|b{(v4{=JL=$+EsXVD>|^mE?5~>Zj)`u_u}u z=u9pvI1@&1-xr{LPv}d%P9h0&zUP99 zQW?K-xuafC#VMfYb=H61R7RcLm|CDfC_ccSRCXW7H7Yl^lRSy(P@Hd{T=J7iwjhG8fc z8Ng>fMk3ZSrFDZp{(H|kkKg~!jzs*m{dqP=G$PuWfPS2w&f+9jG>WW8{gJktTWmzN zkFadj;c}w&>4%B6pwk-)3<(7Qu98w)tlew^XZJ3%U6bj(AEk}w_k0SGfl{wrbQN&< zb%doNPXT(kv|h)g>@qrA*hlMb^U)>Dye5d2Lj};lo?n-gte}8j4ECZjBQV2PyW=qA z1_|B2PB)m%W9r~hxELGyhm#otcwLm-u8#=TfqhXVCTX1&u68C4~Ledx3fF{s%SmtDFJ+T8T?@H#{^w(xvtl;FJXh05U{yYh^o3m}cjvy2@8_U!Uu^CRH4-bGx zO`W_KNH*y_6d>Dt{uk%~*pmtN$RAOI0s;&obkinLv!)1b5SPPo7-Kl?4Fm9T81*7h z2)L$`|bjT1EsvDb#n2vPr+zTA!PymXL?chcq0L+SZE&G-n%lRHJ@v`GqwGo zkl5_?y4mNvEe%Ba0&PP36y71YG;!2VTiupA3v2`mw)nt_bLug?+V(j^s@PmZwL#Yl zoeeb}&#MwG;C7CNPl2;!@l)ns3ix=6jOT5{GC8A^@+*`Oh5#R(C2mzgF7(DLZMidZ zSzGAL4M}E&k*>+i+iX3*?oE6+Uvr(t1P(S4iD(E#7Z6k1w6h6!f-8EvwYxbw$-~)J z#c0^4@V1tjKz#{kZJfgOm+m#j#-Q%jvE`s1xY>6M_<^W0Ke_)MZ0UAJcmVrZ7DAf%tU#I(k5KF6AJI^Lk)kl8HH%%z zhcd7I)pLkNYdt-eL(M1|*jMN9(adRNT)LPb>;SYI)jO+BBH>?xt1o$1J96CC+C8L= zSMkuP2adb_wwgkmhHLqM==#d2DBJGeM?yrTQ<`CjA(ieP8cFGplizjI=1fC+Gm_9mG5;0u?mN5T)$22X!;Z^T5fmnwS?|mVJ_Bwo6~ZghHm#$vMZb(a zZqgEyoPqWDK-#00@T3hn{(*~-rX@bAvZdORW$Tn$9CFL@qA`??Bw_f7! zot-FPRx5AQTxy(19>^jv#MM;HNsS%f%+A(Ah*0 zx5NJ6r#0QkR0`336gKT|9(Rx@t%HG2&NivTVsMUroC<}A- zUQskv4$JL6P^uG31kPT7@A=+a50b;>4%U9?I;~@Uaat+qyw(a>tgK8;?LSlAb&draZ%R9K_-<(wsVfs4^gD|7WJcxI+j4 zP?6RX^#`{7VcsVVjOTK5sqO&~jMfXr_;z=8kE3N#mtT@|haJA>lPBG*>HMBNUL)oM zal~^~(>iq)gP(oRZC!AWua3=K*x$ev%;-%x%Wog9PfMD|F8=(%GcVZ}Yi$JKY>(ys zot=9-B-Q%jBC5@2%#{;pgLMhl6sV&&8|3pu1dTgg+Y@e@oDkCTC3G3!ExTth4021;J$a@7b~AlQ7?{GIIA1(@9t9Ul*s3% z%QXAWnT|_tNm}LhW~(TyS9Y<)#KhKwa<=?Vw^Uwl`(K~H1oxMFCYGWw&|6F3tvtB; z;?I3fHt^^Ac!C1xO6S%kJC2fXUqvDenV1IvVQ4o`vJ}eC<&S;;3o!_5AR}bVC+U0|3qco9eEQ)Q?AOIc;a{EaK=lTsjt$K&hDqUyHsbB+!@|Y3+WR3P;P`peBk)l@&*L2= zra+}IPoC_wX4LZg@|gGib!rCb+p%mo9$;2vS;#aDcnM6cu_Z^;=9O|L0JDkp#kL0P zOoVlHN~!Yt%VQMp0mFdBwHn00p<_MU%Rl7Z{A5}7j$I_rSaPRauh>Wyn2F_mP0WH| z_HG9w9x7JJUya($l#RXl{$Z1z50@oEr&G*VE)6UlI87BqnOOATvDofmt#D-|98rnL zLKbh6SNR$lb^(W)eShZdPt`W?wntcDr<`JPtLEc8OcP5TNG%|^_I-sws}sB__QF^# z6`nff6J(@(F!nW`ya>%Ph>yGLJ1e)>aXG|5@Mho|6n|qf*Yk&Fcj;|wkwu%HqOfW; z<+nzpB_4eqs=UO$-?GXeps%t$pQQk;rC*LlZo@eg^KQV^;HxUGcN7FAQ|$z*xdYpe zZ-DvgaV){$KkPGr=DO4VO6-8S{G{6uV1#W4GkJe66h8efv)z z^gXLmy7#78KSa(11&I*J>0gn1!l`HbHBRt97tg&P?>mx;#dh;cFc?Xw%fJn%zk?C{ zbI)Gy{$3+Yb-$LOE=mRqh#DD~(<0jASH$7-af*L1$4R)ppPw*|g|721;TfHmzXXhd zxT1p5u70*K$9$fSXrkJrVd;Nrza#avVEcLQUcW!+^)Xp9v@I{jJ*8d{XVfB{S2tz1 z{Zvs2e!Dm)AC)9WN*QK)&1Ci!F{_JH?PifskJ8}_8x`g zZ-g+0ehbGw@&iK+VF*hz0%Pzj;WGd%rTq1aWU=W=4<->pE$x)kKj}L@q&(B#)6bu1+4mXsNMY}QzXoR7?)RccYcB8*Qs8QH0?b`Lp87=%VRJE9jh1j!%n0GKE3PN zOccF-KStSciFy`FPyR({Jic*p4{yfrR$K)`iFo=zUYA5)52 zg??X<*xTgZQBJW#o?flDSSN(rTuLl~uEXd6P2;eVat9-*@ zWFd!HjE70@&V$yLGFC4DL3XFJsus_5&miqTj#zy?NB+iw?F%b?o4xP!s;da z!a*k&bcUWh1JJIin>uw}f?sc{YEf`%9~YSAmlphupx~tCwG2%HE8peCnrV-JUEtVi zYd3FzWm4PTu>)*1uS-+E!0=#0Abk&tT|%q=xY-gsz!$GT>yM%`o2L1mb(@Fph`JN> zuzCCbqu6T5s2FRi|2Zb6@_QwzX^|w|w?HFUZ^~auaI5RL*(h)&48PK;=A_BqI*N+$ zS%e>Fxn5nV+&(I4S?R~7mZnMHK5|O`YBifeSh^DG4*)9nJ3l+8PbvkqbAz`k7329) zzcYVs@9Iq(l>LkWC@(^kcP%2LU*;~ho?e=qq8PpU{2Q%GNM%+?>32Mq`gN8Y*4b=T zej9QB+ld{l&Cc%IzXES{0s_5>`ilYPQ6mo1L$^j?7M=@HG`Pin@d{o*ruJqlN(jcJ~j8z1_QI0 zh3qqk0>J-Fx_G+C2$DuFBsqIj6n{8VSer94uV6l&RmukeTOUCW277jT*%nuKvoxu< zPSAc(!}0w-ll|{xRquTUe0!v9Q3A6A2i;c3Zi_ztR8oR~58o(fE1>@@VaD>??QSLM zEP!8@=;GcW0p893=>x%^836IJ1M;ovahsGDp9S4Wk{vNIa{PHMS642(rGb)Y}DS1+)tIS2L@Dau&Jrp2N{6i#5LKo-D&YL~^Q$%u0y zn>MJLAA)C-wiht0vm0KfrQF=E zcc_Ys(XFIScAq*%2<*NBL<8jJWfr)b0mm_(XAQZ|dr_#%6)U+>wNcCe5bbW(4y6Rw zyuZE$c}d9`Vm8MWz8}DJ>g_#;#u!9j8Uu9HPwv;ed^{#5NXe_d^z`}NHr!!wFn73B zCdE6CO!T!J@eDwQ`Ma%TZELJD``?BDYDVbH44L)yMB;|Zq;Axfx~%ti`!T~_n)hD$ z1xVBb0hy$2X5VpD6shZAh>uz9K&u;0aRGki6(A{)H38LQ;2P}VPe_p~(O$ToDV3qX* z+_$fBtC}7=uH7q9-snPK?hb|}I=#~DQiRt(oLmq9tl58)@#;zFQ*45tXH>S6pI~@< zfGR*iFZ&U1xA#2&A6*Ik0Vnj=r~j(Dt0_K;%Cs`i!e$y;^qrN&$C5 zh}4w$H_U4XutVqc+_9y^1>iK_CwRGyf)eM`WInYzDJI-%(QH0I*h|gR`U?M(3C)TS@=@3%X;*_#87hR>)IkiSuvpJyp2z+ zp0N4oo~tMhD%$t;C=g*$T~DpKhU8Z(?P60Cxz~K#ZB0QNa95QwHru6^f0!VtWr_!q zPX8jEGkU%S?lZn;3r!ol8HdsveuV(ej`E|@M{UI^zNIEdohkC8`B}l`vx)G8B&>SR ze>RoR7wc%we<|kQ>`GNh-345z^Bq4a%Uz7%X;L3SMkM4MD(?A-9^I{GAk=q-lrqgs zLh|kv1F(Mfrs3*g>hj~3ka_=$+S%SrnOm@DNdaqnTGxBY`@G26dr!RDdF9st6KM)i zjF+3(ilf7zunZuTmmU`TNEgt})~&hosVCH>=dn&VrpU;VUe7SL3fZx7Q2+HsY+g)z zrYD3??c`H7R+F(|-^ZdN=ksgy!3rD7oW0{`029gGlEyx#6VY^puU;(&Gfk44a=n81 zNQt`6VPkdh26X|RLs*LkAG5=tnU)|jXm_}%7@VX+#$AiIWu>sj{C-z7i(qLe^(K{? z$)}Ay^eE}G#}r~S`kkjl=HqyyGbd~jL*!X=Y&K{0yVX1#_yS-D?M8J3?^cEV1alB= zSBq5THvVVVF{xv@KNS~nA~9*uy-e@o`fj{U!Zs7P9&^e9Hh@Ni*i<2Ctr-Dgdh%9y{qp|ay$!e zsM^QHzz#JOPYy#b2CgC5I|qiCx2x99`0G2U) zib5`$r(yLX@rUGZvRyWr_5+;`ZJ7$=VZZgY>RnK-Ock-=EZy)UdCZN|ouj!*6WbbK z-ueev>h+IP-txDWD)M!w&a8mMSE>EFs^Oi1{-J%Ngi$Ab25+8jYN}y5Qn9*AWWK?I zw%$orHp=IH$p0k->Fw#I57|o(s#`mQy+_yC!YOEG! zkQLb^IIq%T7CiZeVfw7J{6ZRwflr$x(TKGK5?__7Q|9vx-!X=X6)qFXduNR-k(uk* z_M*W}VXjLN+O`foh6eHzBz5>Zt;f4*LIaPMa{ow&9L>qqr0SqE=w=yjs4#P(bexjG zN2$Es(GdJPq>Df1#KM+fu2GgZ&9}1@(r;q%_j^t*p~c=Wd+P*|p4pdzl>U5e@Jrwj)CaQLdE8Cy2oFcx<@2?NUlk!JfQU@fn$@3>c z5}&aY1z?l&$jg)>0-Al#SqK=FnTN(Ppo2qc?AgsoHu|ec&jS_PB&*$sPQJu?3H|^` z;$0~*8gmE{)EQLx)zHGwO{zj$>lLXB3~dGI->`=rMwcY8Lf8vQv)526dTKE9u#6cS zW?hQ%<`W-tZCSE3kBz35W1FJ1D!nhVQDb!?0e11&gOdzOvYe9KC2PbO6_5aKlbs0PT|pgO zbw_OjbO;a^(M&qqCub#oMHq$xHW({`tVk3CR@E`!0vH>lI*T8e7cxIG%k8Js^Iz^p zv=BM&E-9q3Wim@ARRe_F@p7RwMxyGSyzMHmQ{jUh!FaNOp<9hlO@_oD%&^%dL)N7v zN_jW;o37oSH}#PV7+dmV2%q9IXVyR+O={*Mr|2w2T#$_>jDSJL-Qb|dGR28yZ6Z`r zD}n$znal5#C&XFY2npdBg(@^6BBwX*a)#_yTqP&Y6>J;QLWHcUUML3L%1fjvu!3!C zIIZ)TXk?4*(9GDkzia6T&v^pBYfc>OHfdAgq`W5JdvdiL77;To*xdI^PoAh>DWvFG)AYdZR7u}?#dj^S z9U*9^X;?M>j()I)+Sa<(j|C4CH9d{CMn)f__q&wfg^|P`>A3oUmNTn*; z^q{WzWfaRdr3j^yeUg~wL5>)P3$Nv5{2X3g=S=jboQQV>MMA4IqM|5d%h0$o)^rn2=EnECEE58UT9G&p$ z4$sz}25+5xabs@otSprPIbIqb#0L7mnoANyHV!8Sf`*(tp(h=>+fg^>uu7Ugg8yW9 zcty?BL4u^!4m1Trt!%>^Da7>h{duVpj z1tV`qdAj4BE#WWb;!>5A_KpsygPO z*G`v@PGM6jmeDV)*nx5NtxO{5rTa|z+fsw3YJJ1yj0U;p)OC8(Ge8U26ZT z5K+FeD=G3(4269>6Ds}-?~`;b(KvuN$P5#cHO<0c>Oy&rok}kHv#ff2gH&xJ2eg$T zGYnX~i0uYhN@7#lM){=`bi5WmQDI&tHnf~P;QG;BMal_2&gknGoRX+Q69qs009MFq zn|Nq)Sk%^<8T&RWN~;jQ!HdT}j4>7>q?58<@?b+*4BHwxxze0|7tN!D>#DEVYiK;I zm-S=HFm-ua0(OzVyi*wKtaNH3v{kHN9P?9Xu7QW9#Iwri5s?hfyf37*UC@rh zC%R&h%|n`iJAW`=E8YGr>?CRtU|9PazASgSv2fmEmhC(2O;IH+8;)utXUQu}iA&a+ z?hd9wTVacBoE>T|#vJOhtUB6R=@ecm&#H*%>Y;_zwiK?&qbavnW;(cZXBua371Q%_ zB&!&n9;bpj_*kd)E|(+if1LUCR_9&ap4o56r{V5r(O}+D^v!XaEnS+dNZy(SOnga^ z+?p9Gy%k=P81lAJ&Tee2W?Isi)^eEE`I#X|o$_9#`In~yd#i&rTh^c7uDCEWhSbrr z73oH={;q8jkWO@n?&9x+dBZupwN$uE zCcU_>Z1nfvRJ-c%{>QERfPXXc=Ulww>d#+p&%E!6Xzl`z)nRD+Zu>;kMuHaV%`>u5 zGoGEMx`MzOby6R@Ga1-ca=qT(Nm?zh%XY7rW;uRoGOqFtU?9^_4OK)E_@ry$F|MOCNT=IIwaKWwjRU6)#Hc7n_VxO$I2 z=!8xM2iCu0S|S*2#Aq{r;Oz-@u3vtLBw^02LsMkrj83UVd6b}{M5dvwP;?p#T;37n zJ-zyRxlVyEd6@#LruJRiRYQ8dy@p0n3Gy8z$#aUeYu$8)x9FsQWm?Ug-?|>gAyTpO z23x#5ED4z0687%P$Sw(}hg%D50jv zYZLV)lgciYx>$bMYXVC4TH3<=xigLL)?SoCpKO_>PcUZKOBA-Hh)n5ksF=5CIfAO= zgpLga@Ld&Ghu$eB)x1)5ZdmD;a06fBaw78vIW<4?+2LWVm)urFD5fdQ5i9%h8DP_C z9`)%(Vpi>_QNRl&Fx%}Rl<{el zH;UU0pFLM?g{j;s4|jHUu4OxZ)o=}SW*v|_>FX6SH01y3)&ekG~2Gnl^o3%HyIhO!fXPL zFKBi_1?1|UsS?#0AMj`@;Qaxfe#A~8QDGXvXzlI+j{eWIM!TY#$*YZ=oD&PU-SgmU)Q?`IbVJk@JWH!?dHc@dIFx5)AI?PsPW(=r{iHh)f|9SUTpRY=KA21gau9Y(U zoG_#kjOWcQ8G1b_lD)OK04{nqbr-u;RjeRJYopNIz!N_MKogLY+IF<-9eC>E@YkYy zRDm6v(EA<3A{n>!VwLP@w`T9-wJ3_YtIIbBB01Cq-29QVLvSwJYVBrG|EpJ}4pZPw zH8-hh(Nh;&ow26Tj-TLCHkAQ8hhJIFO1P7QL2hRs*hHD_I1mcSvW7JYA5?I8G?Kcj z*dNCl?!%_f8(Z$3`y71Tcn!iA+aXx=8olyX_zj%1xCkzC>YM@;pzs2brNZu|9C#;@ zBXC&5$KUJNlG-d5*U&^`Y+QOf;g<6?az3ML9sAbl0aA5(Xy3pO8W|oP0uM;yh#vR0 z6LZ3i+~#9n%1(8E5S9!b77hDDSp>b;Wq~EqamU27@~1{EG44MdXnN9LyjS9 z%V~;x)REaQjq0k+?1$<&F%jtVc6#OpwnLUR? zdp$t_UlSVCRdjJmj;Pj>rlI>Fs~96u7;!9GrJ&g5mio}}+v3q_xl8t2S;VbB@WV=+ zXx7%&xk25>2Ag6TE0O%(XIo;8hDPjJ&#Ij(L?40mOrdp|qv96#QzOb|FZ64HsZ>-c zR!!!&m}~mh5>OM#r{z4)#9 z)@C@Fj}<(@yMZ|Sz0Ifk8Pv>mOD%qkx6Ps#XJCD*-_fi!)fEnz90FY3ReU!!jrsi1 z8wU2~46ozv06D?ED!}$4X`glceCLA%2#(-hMPxiV}>rZ zae;X2hJA%BU2!aM+di_MVr6=1OsMZWgJPH|cL;G0A}VUN8}R!YZ{hGC2>GBp;6lVW^rNFD31=^`2aX@QJdEaKvGVE0qvtmsVx5|RfxsX&dgJ6cEyDDH8 z0{>b_+KJ%8BwG01v$ZEE1x%)2h#I197=DHtyD4dKV}4BmG+Lf_Thh_bt?GIOrE55f zqeeD|Qn^{Ar1+q!i}g0i6P{DVkR@CC>`Y+{<^4eqpS&TDYZWd9;PAbT@*Ap@b!MlJ z2Ex=D)DzE}sD#|V<_Nk?cUG|rfF^SqE(GI&jL|ql0h3GE;ZCy`BcA79zF;ZGnRS~5 z>_3Sr2A(@uYSD}pV%?rf16ZhRHH!sS9k#ZA(m+eL@pyyD;NMxD!IE*R2D6iO2#h`D zVGK)PqHN%Cg120zKr{=89XE3Zmlj1fGMHWM|61hbk+Vx=4#bW&adXwVbQ*|d%AAW} z>d){d9yL%)7WGcjEj!_?U}g;tttPNTm8(Cy~FrRl2CoJe*8E0Kc1 zrivQP#H^2xpU;jA7vme-5ted>P6oD%GmZQI0(w=?pfK+V?8nA4vY#wVVu7dsAgnBB z?cR)v&mS`;4XCisD)i@gxKnE9VY6|2vcE=CdG7hyrhRkE0s~spKxCROlpW|@fAXjf zdVY9AA_skJ{9Xz#2*(vgHrf}LXK21xDOhN8yo-FZzqiP+gtIvD*12w)(PPcWNj$5n zlI=!#=Kl4XY&@>Pg*xj}wS%WFEWs{HmleaY!nqAGV`K3q$wMqSiw($Nv)bV zcsxB+Mqd1?V7h8^BYCT+lHSENxltCSi>X0tTj|{#6i7OD&;Qdb%s@%1ish0egbh}= zH8}?9LiQID2Zt@{;MSP?q}zj{9TvNc%@@Oj0DRj4nx@tXTj&;OvSGpDJPbBd=?7`n zwt{XPQpjA!t$wmH>{TLRvA5e^=Iei+!wrUp)tVVKtT+j~)|e^PzG zh@>1v1=Z$UAD<^eG`lfU3McEmHEqybrU%tTD1Hcpg%dGkGgM@@$0d)?Ew~0zf9EAS zA2~?+UXZ7|iUFB+!&KYY7d%$~tc&ClpH-3Vci?9l;>KBm#WfjNXcqO`6y~nJgjf3h zz40Wf@(s5%G&ta;=;uQNznYfk%YF|856FGqUB>Y+f$SY@w#v;|Hvv_OfP!`X`_wvF zLK8+m5j7}#!wGmVpM7?w@Qg!`2agZ}Rq7kiq7!X*c=O!pwK)^PO6uVjlZ1|&`%2PM zfar3V>)pW|>j3CH-&0xBDT{v|0ZvSMtC5Uv1kkEq-iSA&(B@Qrp;4$Dm#~^8{lSkY z{D>9Z-KWgZG=#Y%e>p(A#sk%>#QFVGu9s@m=oyrF8>&5oHw^fF%~{5f&&9jEKYce7lv`jfxc zZN@s=_Q@#9XqU~4Sq-&;N~X{(;7W%^0*+E*H$k^`__OZ6X3Nv=s{DMKkABIdq|Eb4I_X`{46H=CZB&OlIBE&J_`H8L&G&8EIR z2hY%ktwn=K23Q)GAe0vgQX3f9zpNSea$_Bmat>eop!)Eg8krx411HBnTl%XeSO z!^zK_<=Vv+RPZ+O5R@Hmps9!q5(UJPIb4o`>atk$pC)pLa^;kWkIcZa=Fmg~zXkTC z!>n1NIovz+c&Qn6hp$1h4wKLC>A__e=S393VFp7clZ@DR#v&3Ou#(zxuP1aXiiK&Q z>1XwVEcJcWHYy1XT7+6VjUUUSW$;}fTpWXqquV}MgW6jYms{ettA~Rso|sKF zG=9jVHxVWLam*b~2M%WVuOmI@zolu?P-IFRJ&Z`W=*nB< zSjU*&&l99r!WOZG)IM8? zT%I+1A*SL;tMIYc+V8XQmWjdBB!>9(qKG=DO7hHT$JEM#qA}8o(KUYf3 zmZzNUw0bK{?Kb=k|KFn23EW-{4Mx3SM~Q4Du)bPS&C^u%Hwu-%nw;|0i4Q77spys( zttU{xN%}D-3{LfzfAc)nYR_@xil`<5{yWt8%tr6sW1#%Y%SH1&;*l9Wrm!1mrxco}fE5VP-Zo{+E#ht3P_^6CuaA zQd-3ajlYYE!WSbumzlYRE67MN$H7u|Q+)#^>V7tuwUFj+c3#kruHYdThiXcbsk6f( zniG{bAif`!=bS7SWprtqf`Evs0t;U`2l$@6Ujq1YX&3l1i#2C*8`iJ2T1~qA`&%U$ zjyL*Ww}mgBW|ttxK|Mhu6mL4hWNc#d-J6TPR~r!RrfM{DjjDGJn>Co|3w$oX;&99j z{@7=`p0=%zQ07LA5Hx%wa-AZ5K=*oMFB5(kM8B`vRd$^%`}SK0_hJIedz(8Uv;5Xv zlI0HnurA`CmzrM<+QJq&^TkaizsSIi#}p6LTYuRXdD?9D7p6)P#iff7a*^Egs);#0 zqXw!_=s>*Pe-qd5PzwKBg$Tl3wu=iNVMx$PrRrC15%0@qF-oHnrQ&|eb9T#J-*$H9JG8)!^NjRxwK0I7D^Xw1if`uhAm_>7&98y1WEBl zS_E05A1vNP2SM=PSClWZvs3;@bN&gSiX>&_liwsqx$@-nn0b6H978%kwQ&~@kN8;G z#eFZyergjFtJ?_!lJ;)j08B_OKj-UpdU^t_t^eE7RP&<1HBJT2J!KZ5=b~<2M0&t5 z6+ZVMwIBLR<^h(~rp{~=`19kHvDbS-+ap`XG^bhdaOL9{TrhPyV^fqd@Yn7t?p@bK z4%x4nr)YNFRqcaT{E=@!ySH#<*DE{Idk%GFwHRlAWuI#~-pac{Ch9O63(*t1Xp zdg!UVO*&{xV`TyCq^}XsYU7lZCl(M5*nVP0-9yFA`#+lLEk9#0{cw}eU0$imwFx-9 z@Of>u-1n`nj@~=VOaSNANGn#KIb?mJEK8*z;V^ubH1^BPJY>)SsD^~~nJx+ChZCu=^_(aGHK$0%EmYArQe?DIPaDQvQB+%op z{Jd#_`Nx)wd269+V$csDhCv^Y_%a~ zb14Ui&1CsZ@kn+;4eJDtoovwNM6BxqKLOduAojvZJFvY$;_6?-xgxrr$o*uS;8|5m z3jI2_2G+-6oEaBcKZop zrdIZj9^~qvml)>)_g@L$(@>+L-&$*b|6}!)8#fM_^#h$@%_c-biv8Cu^DBmyDEGy# z-vae)OEY_>#x7RWfh#sw_f`hkZr?M$)A|i5l2YeORJ4lJUBdJzUI#iiY?` z0wO;-`;BgcY}vT(#<*Hf?59VkmaOH8Y?`k=o`vXjh_JsdKT%F}8Wt1MZx*eQp{TBq zp(?I#pWq-;v`et-d%9`9_V6vkYXtAZK$5d?<(k%AT32o*sIy_<*fpPj&xi4ccyv^I z+dZ*Nti|1>!vswHwWpK#M1S6eP9kGxq^=cG`<-)HJWz3$MLW>5<#Y%Wu;yqY+IfBH z$_a>PSLQI}(#|yC(+}(?Yb7Hg{oF73lWlrhzlkF!Ql*(E%(zapkLZT1#l@apnY!$! zNWF>8W#$b$>>wZHBGm>h2BM!UsM{!bBP`xDcevSdH-3D*^t+fV)%PKEgkf(AE{{R# z-WOgqwaKE-<{t(i;L?4$^z)uf?Dan1nc(aMj+GxkUXm+srQ?GrxBlwS18xwfPU;x* z%)zp!Lhzj?-2rTZ4sgCE;z;N6H@YJ9w-t-3n&_9z;>A{n9U7Y4JUB{&^4X zaxu#1Mr>mop}%E%EY1$t75|@|G^U{+xPvO2Fz@_=kY z$C}R8xZf2qFjp0>IpFkOeMiboOv9vixFTX9CSH8R-8;Q-`UzGqCUxN40rsH_Ml&CP zY$MC+!i7VlpC)PedE<1KFGkRWH*~WPR)MoL$h8Y-fc*^2H*}eebG39=x5bi^4 zXm9>Vf+4g%a(W8S(QeKS@_4yG%_Z_lJ~3kPVO;r+dGm4*ci8bR=8fD7Tv_Uh7D8we zumye;vx%sKZ+ma88M)5@UJV*%ml@pX`|~jDN9pVO;@q=|Xn@Wyq_Wv?PP4v;2C#Gj zgC_;Nx#i0rmA~a#srw+C->J940+!RhYXgIS)K=oZme=|;_ubYK09hDj0DljHZv&dH z1pmROFk5nDTCY)boOBtGP?G{9D5|(J310%vqQBw*h!ghgi`A$UP;G#eHLY>F5`Q5? zeOj%x@C`%&&U`=*wS~*zBch2QaK*~{(VTHbDJdYAA6}r$2H|=I!vRZB3%ScL^?u48 zU!Yh6KS_8Yv3Ys;t3vkmVzUc<7LN_cQB5HVN@XBUwH^!#8|&9()#B(~N=~C?-YdF~ z4L)mkZ{NN8{t2Mp40Lckck0hj@<)eJD4Tuv%C#JH%PT6PZ%nEEfU0I z01O&gs=$VfH|_Wz_QvmcOgjDRnYRqjF0d5O)Tp7~7*$m6R3!l=V_Guk(nx#(SqO18G4If0i?r#rA7WU3^{%O1EQvk$qEXXlMo z{@s3p9WDCSSWWzSMzRgz5x0b?UuL>LM^7cZvNCIbB>M1I&gfZaUBgp5Gl&jR+Ffyr zd1cXtT)7>8t|?<-2xuYXyAevmul-Aqo!|G0F%p;%l03x3qyGL^chtmNTfNCmxRR5b z`Ml}$UPDrA{Lz}YaRs*#j35+FXyAR#CZ>x?L{=?SmUk+*6#@=7*sK3hoHp<6gV+g@ zYJisBNjuP`FZ+35-8a=gfsLkI{Ey`(+S1@+Vxqh1=vIfBhZnKa1*H4dGMHkL324NF zzD{a#zcziOO_ZYnB(qfXYvlPI%L&VXztlNYKK<*TKO(6BoYC+pmn&5ym!c1IW|#I6*k?)?uq}WK2O*b$I#m+lLQJnc5`Zo-HWFLuaoHN^p}2Q zQ(D31n(Y>Enw4Z-dg_lOF@a4SyZ0$BRYPVIA=KroMVRPL1zFN)o7LDQV))!KWJ`yo z*^=Gal(4xXWt$3QFqjj)i(;O&)f+M^h<(#%UFv*TjahrV|HvBM%$5x4`gZMWZc!M_ zWe_z0rj2J7_(z&ZPp`NqTGznRAb@Um$f0;;+m=QqPexFM|5S+3S?n)+@gu{}`6bF& z4wEi{qe8dcLVejgZy@74t|F)eGd@;WV?$60dlmrtZb6ic`&1JACPRs6CMrz)ulq#f zOvRxCNG7lULH593DuIfA_ar$hT@#_F^_pbLlQZ~eF(zT|G<*V^YD_MFVr-e<5%s%J zUNS5>Aac>}JV}{V&`qgX|Ky>V&CiPeKs=G0Bv_c*I2EX&rB7hTjsUDJW%!B;Lx9l$ zPSFd-*9?fpQRe>)(MY^t*1S zkhmjYe~gSckzS@Q`nkYlEyBg_u_G!X71#HkRbd*;lL1hlPFe6djR3`Z@s#>o8T<{4 zde+228h`<6rhFm_>)G_o@QT6|h?1}#8MWD&4Kp~%#<9n=##bYxN?Z zu$GoY_HOprc?Z!Q*UZ=vUb?Q%b z32b+>R2Z{_r+A5Bvs{^R`CGeSoZ5=ru_XW$HS!Qa+bN_;bBojY!eF4b$zwKonfMm2wHu;b|8)gw-QF7}o|K7D zgFBP{VI_oi8O=Hi%eQ|z+q$>oxoWFSV71J&S8#)Z++xZHfm~gK07q# zc^vp79Mj@jn>uS>?r zJ=zTCJ=VqD^>t`qW{lzQ=loo`t8Wc~Y80_DJ$Cj-^0#%wzMJ0aaW;l^I~;V_)k)7E ze6jy);HZltQ#PW(l7@v7iWdfUZY)o^YOq2!?snOdU$*2!`i5(yRRZs%cAIgH0 zf6>6?zXL)T3-_EGh>?m+3TT0@bU$y7WQ9MD>5(`xu+LrN5CY~gD|X%Owzm(5oAi`= z3mE)3RcZ>FGK*5@5g@B}i+O=|DO$kN@J&NTR|#-LOUKtxe|zwuiVa(Kzh-4UFJ3(? zQ-QDi-qbI&FF~)1zUctGHFSN9KQxFu`pNABGOu^AiTvRAG7zi}hD~buWT2{(p9v1HkagWuF{yfSzLXcDB%eZ<6GRN{4`fOhHvb z`3p~Nqlz^8;0slTz5V9XsW8KGD`u>KQ+IS|unMJUqUV<=tHlRrPW#p-qhD{}kknXw zh|u0|M@OJl&_#b(+`f8M`RC>V^(kf}5gotYM{w!q1`_4)MV?`|=Mb-ezAm+?o|E|3 zu6P*KRFZ)EcGI@t=!J_2;A3aAPDJ1bs+eHo(~}t=uwmu>5sV#^yFqSn_bl>Q`yE?A zUv*pwK%Xs#B)(^q0N(hAFCVta+#H`r)$lRAy?|Y)$abXq0F)@fQa=%S$dhZ|@1tvr zi$}qeK_>LoDaT5!EM%JAuj-h-TWRI#WJpBe0|w4swg1K0R|QlVE#WHN-QA6Vv~)>J zNJ%Q)-Ko+Y64E6hA)$0BEh#O{CZ)UUu5Fxi9`1d)k09>-|FdRIe)ElsEF}9i_XaXh z2janSnlfu6S(_M!@5R&AX1Lf{a!2X>!v`x*=A-iE6lN^-T%RZ9;f}D{Y>$5gj;o+I z7euC7Mx+XEOvWtq-fOn`Potyqnyq_4Y__?s(dfGQWtxgO*JFR-DZlr}2Qmy>i*0Qz zKSudx_SFl}+K_?ysKI_Nub)`4_@Ob;d?+Ja?EdC?w66@ADIS-X)O$F+#=|n@g@uKj z^mASNL>2xHW)}Q;tcgNEBoR6FDFLw0%FN}3snA`hCo(}TIB4_Y2HYHm);B0@yXtqx zQmRC5q1(8uWPMp5MkeXh#lNG88QwS zRmS7bUFqV6^ZtQSrx6k(mO0fat58z?NG8Z;zOg2LoF;$SIv@MFmjZ`jvpATW4&G7r zGiq{ImL@^na{8bx{%*%-xf2;Xz7{~bsUUA?=107gH*!8YDy|%yp5jZgXOilM2hn*Z zkQa;ohVZ0A!_yg`VV@qjx6giur@A)nyM${LH2}Z;9!&aQ@6#BUyJHqOD!Ncakg(tm zPFZ0v(PoaiZynrcuV)no%Pc{%Y( zz-~s;x+D)`Q3JhRNwTdi{4SKnYv_}{DtyGG|{UXS{QzaPDj z@1=k9p3XuqfeiIj{#ZSA)!oHpJkn8dAiSjjsSYnSk>W$1SN5uk3F96fGoShgIcK7+ zx)v81o0XL4QP@aV5!yvKnz}KaUm5Sz9M;^g3PTr}aE`#_SQJI_hdNF)Fa$BMQnLmC zY-T)q-o0PIEQ9rF&QK2kPO7b(Rcj!ccD%*24@YdtY*){#%l*+%fu9jBBqAV}$7Yai z^IR1aY;WV57bat-G*eF3t!q*0iWz9mP#zHm@a~Neh6Zn@<8l1Z5dterGoMmLNU;tP8PN%^{lQ z#S3a|x6UCje|LQyNUo6qH=K*lz+7E%=zz!Ag1J(MAA%U}aDrJmT7Ag|61p;46Ry)A zj*;!V{uOqXO@+x}-9DA?Qf4l83Hc9>Z-k9+eJcpVu;~la7zvqR4mxiGlX}Zpqoil` znNf^Y8<3w$a!mmE4nP-_T2#c!^CtJ^hB=U^w0=i8^j0h#>&@sq5W<&9$@H)V8`CJt zlZ#e#89knVVVy+0ETY4mRSur5+xO!-{|Uz?#;r0h=JmJ3ZiKd#* zYhe}>$Gv8h@AOh}DCC!+Gf|!_*WLA`sSG{#nx}Y!Q=j0B=4_%)R;2^hI%RfLV?(-$ zEB?y0%Nvx?T=dlYFp7|;xYbfl#g5y*as#fGV(UabB$kW$(#mMBE{T>xJvb<7>_<<+ z@aRiu)4nuBpZiy!`7!ptW*ULHAE|Dj=7xt|XnoyA!`2g(O*WE*)O;lC$}Qvd4i>bB zw;zPf!TlZI1#EOBa2b~-EiLWkv=VU{V2P89@Zq^c-Y?`h8uKG@$r7u8yX;%1jc9)L zZiN`Q5!-9(u&p`2ZFC%UWf{Y<9GLyN z23ndP2D!Me>xG-$2TdOPSVHc$w5cQO2xWL5xJJ;wgW4KOsyIhla#CTL`G|g);kClz z;mRyuMLc@Kd+|9YwV+paiH~1A^?!aHODRUc@4{^{R7Og!G@0*UEJ4Hay>Q*W)~4S& z#mX0t`n~PZwfvNyE4lPkA>D)!YcRmyeeR~znki@#JmCy3FjcOv(dbE?g%!OFT%Eh% z!eL6VdwjYZl6>{ShjREfYw7e_n+C@IEm7?)d*wLA{C&r(jUV2U)k`gibTwj(i>}Zg7uH<-WqYHi=hhH zfbd1icK=!(EYt5+k4}12+et zjn<#NeltK*b#mF@AksolNcdq^diqAYUI)QL#df=&B=oT%fEdgMu07q+#?D9pz??v# z8Dw+MTESNWdg3OqZqMG}?8ni6)_6OTLg)6fg7xYIqdjF)#V=^Sw%c7iF%+IrrC%EG zf8jp5B&L;!-sSL?&R9rWyFe6w& zfe-5wRCgfO7M_(#RB*@#bHZ@1T(l(^z=y|;ILR$WyA3NimEz!MqPkn2~|zynO*t2eI~^rM4kD;*O((Uhocq51pJ3TW&6Kc8ADKIH#- z;)~;$6H@(||C(t?yfEH4h(Hb8E$de}pMkkXPXE`Qp1=G3gw#3w+9r@m84R9%1YE}l zK)H53rQ*opydL`V;V2{yO?W3}^B6ONti zF^rKFI?3s0sMx$u$_wczX4)3#a@<5Y*#PGFjp9;xB%I&Q$ zroCsPb-4G@#dKQEw{zG9GeciKQV=?efUjy?;93*;$NRlx50}9_3M`ks1@1lvE)pYj zyq6I%B9xc_>de3^>Ik$8BmAoeQLFqpn$=k3b0WY^?MNybgBzOwJsPY9WN@#+|K68< z-!lwHCJQjLLN8`$=j=%|;m?O`aYalyrWC^In!XM#v=VxJalBqy7PTePB2Y{0t&J`; zl+2*Bniz5iBN2c;geG86lu5%Q40MHI7FxeXe457232WB8c96bm=Z!k@>hgnHThX4h z^F-)(1I2k=isM))*U?^Hn#J2}q(qeg9XiXP6sPc)`)elRgcIie?Ja*(DfQN&!H=c0g<3FMa!d+zsGfpP`h5s)6STwEU2r>$(EBj}<~E1z(%yDN`p~>0 zp(oi%-=Lwf?aE?}FOY^6^5Mbr2ywKrqVjGpFYs=jZ-GkIuqXXI`JZH2|4NoMi>p~h z=_@?+4`2}EJ*YqYRS`LInZ3~eJRQxSr>l)2jAhsX28nNn43z@;_tPc)eY&;$;p=X= z9a`{oe$6id(lbvFqq#W%o?cg}yGc9N$-M*a!=N5AZ-{-}&y^_-BS)_d{kgVEQc*)j zYz`TQ4}C8X#1gGAvh|9p?0ngw71DA7G4%0nfG2P~?rrmQo_`*$OG<8alqg$h?1s(n zg}`PVuaxK@e9W-SYNzgfeIts&z7yiG*qY~@%?oXJJ+e)Wxh6ah-Sfuf(yAUjCMeC{36OcA zbld7@O#5lipe(8mraI9!h_#7u2~yx^9Dw_wFJio*kH%=QH4KNnP*?U*v;R)8%e^v` z%zWv5`OUA$?)Rn67IX^fQUogwj8O9<|FYr5zniB-)rs_5N%%T3Xg#2SKoOuuHK7D4 zZZ3a3&h|PZ;lAh}YgNw<%5j0f(2MYT_PBuqD}@dF{D-vmEA<}}`UH-fza38h?Qie< z6pUh8)D15$E?mm=53YOBE}cFv+tQOO zKJm^zgLWBPU-HKD=WD?MvY*~txupC=-8)FZEtoZJ4O=g@A7@+rGz#C9u7czDeUMQr z`fGSV2(`^eh6o-XqjK}bAa*H&BtI-Gi`%Z#H1dq zZ`$EG@L^y2Z{inE(e__OFx4leYBqyTk1m)UbZ~Qz%=I_X_oMAgP$vk-YYqeNynoS$BLid z(A%iJ3P130=Zu&uWKuDUdBi{ed*S8mH>g?TRJH%NTLbt&Czv5TE8r3iJHC^H(C{TH z5S3kSr`h}0RDU8&--LhAW=EAj{&LUD@W5~z7;mj?>=afiTt|GU zyY!+v{SQP)QkZ@06@{~gC9SsrsQ!gXD~{-r4%gd{mo7$z>Wnhf{7n9=?vrROgo;f= zl-E1j4H_ZF9hJ^BMy!BX_zM62q%V~4{1Fo5%aD$WbU4BD#Qa!~3W}Bep%+~`mIf+- zs4$VqnN22+{jW*?S$xUEI7eYHiD|(XMOctF)DT!NFEUO-N4B3jf-`l-j!k3xx#1j3 z#2qHS0^dGh?=wPb#Dv!NNc&Z;ne_N9sCnjJEtS*6(yg9KDMYRzyc?#ilC`f=qIB@x zW61~&I|X%9YX1l&YYGm5|2qa8s>svuZCEx*)Cg;JtcBOFUO%yyQYN)XSUcGH?J^TvJG^q%^^84!&1IWM>y()( znfb^r%X%K0OWm|;h!QMT0IVA(gChUb=_Sk%H3-+tLl%dJh3se}35O znl}7T&zRogc%7!V2z_Lnv(MI`G?dl)mapojL3)s_c6@*K=ru5?R1T*U0J2e?=3zZ( zNv6l8BmL1%V6C~)pvlqyn1@Vvd|s~J&vgxJ5}j|3&8Fr=(703n0~l5HOT5!!zEyWl zcDz3Aw-_iPl{rzFocZu(F%pq!!kocbbB`%P4#KCLg>qr`b4YxmS$N9$ zI_SyM>)W+4#4<4EkJPF`4SZCuZX>h$ohl4-HNNcldneeM4pK5`T+_q7M(~fzobyc_ z{qG2OHcljYjuaR|K4{wWR8>C;`2omj;vBb!#QKgd|E=WyYJmK!rSN^Qo`(pxXWJ=~ zfL{GtL&F00lJ6hI!vdFfbFB%HenAoZV(!-AO-Jx7sP9zfSV=mWt94Ea$d3|dngO5Q zUPVIaI{rnf$GD%B%&vBmpsS2-HCOC~)S{@I-* z4ZxA-Ce9n~tLopcfmK{OtfB3_w-LMfX<7yyM{;@l7#~b&z}CiGPsr65?D}(1ERUzD zy(KNTc@9D7h;LFL1VlUHO{pp5N&O<9_k4^Y;V- z`t>c%J`c|Ztxd+NDxNsvjuMtJ^m#v`3>vfPp#p}sn0s=}_V(`-+tcNb=M9+`4$|~$ zt@C{zAa*d%Y2={P?*cJ#m%9aMC5v8|*mvmU#Ttd|N~Q^~!A1x2f&Oo4n1WvOG~DWS zK^+sW21LvKpnKy{SVul^HXGv%z9^oo)l6G<`Bo`{Gv#n=K@OlF`XDL&_k!i$4=TiGG>MkH`+3|7UD z?0 zyC6bDn?^AlVTPu8M;thnCs+*p|CAf-E znP|fLP(_Cl2x8Fu(E-Fa7=eRivtpFz_T*CQJ8N-mI{BOe?Uf>QAUixegpB+)ANs){ zX;$K+d>h`f17c)7>}UR3LtNw{OFvB(@%GrFsB%AmOjuJET@)dUAnXr z@XpCpo};RKb7wXzovlR&K>e=4(7AA%55Bzod79Cn&S`<9~y_FVfeLbKe zoTPx90YdWkqDQh9!mS}_FBJ34&hO`t%_`4N!KBN8n#kD9#Iuw4hn$Y>?9x$0-#>Y4 zTr9$~J8ktoPAvOL&P(#_OH*r;Hn^?x!w(h$pywmr`^ON44lp$kf?r6c{}nfDms*7S ztoL_r8G&f?vkQb~ubAKnu)>>l%KncV!=CN;FbEmw+NL#LWdcx*Je=IxM}}gJ)F8NJ zw-ab`!iizqWj{J%akheZcVO|F>tD3_N5CEnK>+d@U`0TWA(Y@0E8h6yvrI8zFwKoE z9riNL)+!yuXlu8uIwS0eX0*U`GtD|ZT&9zc9Hv}cnYlCjDOQx(+pk%`tx%KoD0x%L zIluVp1OnV07YNSq4FMr^p*b?bw@4xCj_SUAZvj3lXjqy19@eAaT9dL3QXjBh&6fM|IHJCd7p=p zhn%*$k&VgXYpY=p1>hpTBYHbuOzQQG<{^%KsH@UTu0{3kpYZ$G%<86!(*$*&9c{3q zm5D)w78H*9#~F)r{uWtGyF9L6ixi6uzu`xgmJ9R?e3`dj0KJyh_mU@E<|E!d{NZ04VmDrT%iU^`Nm4bNX0Isw=G{>d2DbY^M3CL<9_eWhFQm)R(q% z1Ao8cx9x?C{B1jBkLUR2ZM} z&Qlr_^uXq~dQ!D>zMPBGP=mggIbArZlJ*e`%t_No&+tH^+iy6v@za5JBFtzdG~319V+*0^tsM85g7rGzCh z;e+UKHO#yLofPDwHn4P$+W+Vn^n0y<0}I*g=m>y)SFGGsFjiEqHT7&L90$B-c0~IpesB4dBkjt@j zxnjA-kE83~RFb@@oT`<~w=Y@G7cp4lUH2D7-yoh3Q9Wy3l}n>x1uiO7Ni301uV+6x zR^5VuVooqTbYUa0mYdeC@rFsOwx!tS)97)Lp+LO}O0z?D(0(amSPB*Is5w&*Wxt#B zk%l0QW>uYU4g#BPr6vgA?qQyh>9d{fPruuiOFlxRzp@hzRwVs=ZK+(};_c5GL#adc zRHInhWwqBxihRDq$HM98K;3D;P_&6%pm0!!h@Qn&D(Zdrd0aTM%&%y2eqw9h%<$*3 z$?e;HhI6e>NL4FzGS;y-Oxk`_ICKi7wUmYgAYtW@jp+Ha0B{jnE%CmD`0RU~{0@Vl zAzaW4$mAq!@7n(a2H@ZRsMu>-Xq^UvR2L&4IfnoZ4xmN2j(F$5PrzzG>%<1<%@C3Q zEK7`jy%7BZFiI4RZ7+?cqBCg~W@51ts+5MaZt$)2RFfaryxTMnb+o+~E;E=Jv8AxH z{pn78L}+807_hO9&6ci4NcSU6as8^vWrZ_&u*{DFY=7RL5FkTMTJBOuk@}k`Qg!AFQ&t117 z^p1Ywpk+LnjBL{n)Uk%PedQH2xvFRQ9SFACs6$$y&8tMH3kFX5Bx=cx;UyxtsJpMb zWd56oaLWI&udj~cj&q=96j)Snqq(77Gf?!pT; zt&0?<16n8>G53*cF8;XK4x!3EK}>2UL{3dU$4urim-4oX$&ZCtCP+R>$AK336ef$B zE+J(49Vt!4RIiI%){`O~jDvu3=^^D<%>Bg(_tFWjHf2`=EV95v|F{-CPx@UE3;=KH}}-xmefg(C&HNdV)7 zeDCQ0*=o;3!J_8IoUp$iAS$uSG_v!E<4M(u6eu)UR(-x_qSaL@kltlCGQq-OIQ#07 zt@pFx&O_MGRc6)g{`SKXeG?z!oMBTXIckvxu8fkI-Y!>v+Gm$UprV?xRk)0dNwN!h{R|3fI8yQ2w>LVjB-*6Orrj z!CB64IUWxo#6kmQU@rH6I@0JWUFy8?;sx#nAS! zj9yyJc=0;pUueplfXbp0Jdcc4%}@$QHrICS=s~NSlC;jQ;Br*&Y^{4(Sc!tkHun{dard+0 z$;%4}c{k?3!^ITL@!sadk4e%W$?ZBPQ-=4Adm3NmMWeK#Ni3VD?mVi%_}UE*#-*z= z_?pAwUXOj?2*S8MC;2|;N>+%@!3MVu%$)=XI>!xxF4+)zyo9Wl(6p(3Cnz5CjbRy5 z7vp}Kg6At=Yd3B3Ie}2kF0ym&yVP;y>EaBB>;lbcS9P-4;ZdgAaotC2a^0V|ie92d?!JzBr{nAtCw|ya`1%=14eh)6PW+Ctk9V%!(1ulf6@qzjORM((h z4*K_RDwY1;qs!jopYLCToE|b6jVZd{*aD?S0zWL|e_Q)^?dlO8wvc`XWz6RR9Be_u zqe(vb)-6>m?~{(xAW<96ro(#ZfYVF0uFdO~h}P!=_V(bD3W*^Y-U;D`gQY#IW>0rS zCpWimgSP!e8og#qVRl%P1 ziv~y2VK&=~CRU~^yZghC;>K})`Le{43DQs;g#bEiJ%zL6y78ETT>vLt)Q;sWvCvhk z0a?L;R2IvdG(n#o%Ch&fI<}O&*EKBsHo>!H4J@y|edxr`EZ+Xpg4m-TmOg5~dN20OJ9VlVSfeZ^0H_{=;l6nkfk3Kt+YQ>_( z{%*M}>Hcv6pJW2hp*?m*Xf5L*YF+XW8mJxrxA^uiCB`cJ)6L;iqV%R9!*w(Qp1EbtMfkMz4ov}SKdcn>4hI3F|ip9 zA6NMTOFuyJT!HOg^p@GU>ls~gxu5Ul4f5@5Czi}#+pfp@=m=!=_md-C&OeaMjg{8tX*ef>({i-tHl>Ln}ImxyxDO+%(RB><4gx8xF3e~$tY3-q)&*PqGzh= zn$^rmwaSp|bdx)Zu8Cw0l9ZooEQnp1;*`#WwW!w@AhkldpPZ~mH;rfk_tRpF7an&H zQRl`HZ^(Q6xC+Cc3^YsDw42tnb1?=7qN*+Ytty<=KGs`+9Z5eP`>7akuK9=|p}+HN zN3K7y6Jf`Sq8@-KEn>i^TMBu$PLj*UjH=YkrWi>2dFvwuD7 zt_X>K);~XNgY~0{s}$7c^n{@9iTdRSd81yWzKvl@jrh;zD`INR`m*r>dlzjwq8t2G z!mkc3@}DGY8Mf8Oj;w3N#s1?0Xc>##`6MNhgjCw?ms(m>Zt`f+bv8%d1KTLxhWWD9 zJ4__K`>V^M{+MyGjtfyl%6`=QDx6}kzm685RD$V|zroIQOJhec}Sm4p5a)W0tGH4I)H z+?Dq-a@Cv{qrSzT1`(9lUPZ{~Fgx@QA zcFI4xqZBk=#rl=nRQdGfc&b_b={mNqdHLG}W@kNCYrg%{(7O8LGvut6favk6gs>G7 z?rMlzaUnj2sAz20R9(0;Eo#lfH)E;F$PSo|f_>IntAjhUYvOC!Tj zIUj=1=oqf`BL_3$T^7Fsg|LW-TC1fKzV^p$5U+w&?l1m;q zDA~{1i)Q_d!h$>I4Yu61gW=9NDhU{+Ea7RM^r=9(CBT1TIp4_p3t?;^l{=nQ`x8}d zCjh}*V}l!Hqg+4Hmo?Z_CN&2aB3Garp+ceGT_RK7RhUIPOe3?U?|Hd{arZ0zh3z)a z0hRFM`(jYPZu7r=>tNJIBiR`iM#PoyldmKN(bq^+eCtzxl->~X5tf@f(8bn~Ab3kvwZq@HB6VmwmN-it0d z?Jlts3D^pDy8RsPh7xA$f#<{Kay+?}bB0;9W?ju6St@cjE64aaNO)2o}=@KQ?1 zk7+TBdv>JEmg*L5khxlP(Wi=20pEcj*-rYqloaR^rDCwCQ(}? zL3m0s9(J$*W_xC-u)^7dRT=w6@6N+ThI4gQQmN?+LIbXOC&UOXUM<4z*J~3|ZRyL< zwsM(1o$$d)xAAU@EN;%zWow>cb>c|Ha}SNruc|YpVmWg552sm-cBzCmii5vhrcu2Z z2$~seCVLC#TxK7_TCr#B^zqIzYXS?oH+e5sv>`}>k?`gH%I7x`9s`EBfr%^DSNoRX zG_$n=oCMRjo=eX21#h+londdudygt41dgq$vE_|B2?zCNKFxvLEU9#V zp1t}N(h-{Px;c8W-*&(17}Yve_98Hu9UXI$$7T`@&=KD%YMJw38Xwhjx;;Q;suUnKam zpG7A#c&rc5N641z*2M8xsSEpEjTg26q6daEFwqDGo~Nt9pkJW9pf+2j%f>T}64S5) zuwGe~+O~e#|45YUp#{{>fLoH(UdZQNzDXpXK|W0z9cS3Du^GwY)+0_z%cZ8OD%!$-VWm7wJ-t^j1Z-U3f~^SE&G)t3V~*yMw zE}+%YS&5qO=!V}K(hfss7JAD(>?yv9aHyF1Xe5^X&>U|7c@4#U+iT!>;Bc(vlgVb7 z zGDOZWeT_uKmp`P&eHK@)nkEmPooUmM_~z@?d53v%iy4ksp3W!TjTXUkx6a=EjPJ(0 z&^(PzCp|sj?uHn!Axnyjzm{jGdKyL4`;HM4g@7##EI<6{GAa%~?MSh^`Spmwy@PiVR&8%xoZBN12`aDOLm_oF%VNWD;rn2Dp=*7I}= zzuK%Hp^-1%3PA3N9-AV0#xRB-)Coa*$uIiFoR)(;J%1)r-k#G)g`oAO^K(>N499>C zka{;lkIe^&4n0CC9Hs-~pgWI$rCbIu=y?MZrP^Hq zvE^EoahrQ>nLnhQ!OG8XH8xWRV=7{=j@JhX0oXV$fumT|4j9kW?<+v}4)2tu!DtC-CU26GEy3z}K#e zV^(-=_D%scnmbv35)~OT z38rTnx6C%kX4;gHwW5m0s=^-u1@Qa=HFe1-r>8i&V1t$dl_2^$G{> ze>S0TmPSAF4p4CN@L=7;vvTraH_RZg%9VSwJgT14H9sHG)THNR5Yg2CXy#7vxPIDe zdX<>fA*I3BHlb=DW0n40gT)XYAp~6ELUd9-)$wA!)9nZ0Qm3`So=n%z z8}}s_HOeuTmKDlf(@)q41}@Vp$qr{P6ugs79;u$*m2RXdn0Y>d(9w05Nt#yeS&?BZ z=F_UHkv~EdK_WuY;-;kDNMfkclrs!1BZbkl7cQ9`b-p)i0@IYJy>6sY4t0;0pg_p$A5jRCvksp@re06}vazgbKqfXTL|(ik!x0XPp8+bq0uTy@_H} zvV`TCpBIjINRDA>`8|*zn=DeHlw2e%#qSKq4b`CJ;4zTboXU~>`od^X?FQ_y?_9OA zaO-d}ovU|xlB)5n&2E;jef8OgZxQUw>L23rTg)kk`@mtVg0QFacrq#CuoKx=_U@nq zlLzd)3!UB?|0o5vTNB{2pBPod23Llog|kE#7_*M2bwA77UyIhgQ<9 zMaq-br5ty|pN8HIf6CKpvbAOm`>AUsfUlA;`)F`wYM6OwK!FCBIMEa38658$zcxlZ z4)uWtYg@=LP8-ju=3+!zqGoo9sZ|vTctw@(8d3dHskpl$h%z0?3vH~6{9=^|SM~JA zOn8e_XNcrsvCT9SS&`}$>st<&Dd@Ac_3%KK)p;xH^TVWP$tela;j%@P_fn-5yJPZ` z4J&3jw7d-46X0dYQEKwBkj9YU%*4JuZ)Y#9Zik?1;uSY^10gFJAbOBfKkX4Z0zu_G zHN$Y0NIqCSyk&(4(F&y**!4w&)PjXsl2+3wcvu2C7-w7rV4b1Fl1`mHIhcswGl@Vs zYrfchg}hvOhKAx!HGwQ92t2)cIZ~bM*-$S0yL6;xZ?q<*sukUL9G~u8-akF9V-BhL z^(E%9IlHoIM5a)#Xr{nPN{nEljZxbXWBeNPxa#w|Ond(1N}ppQU9P%7GYY2Z+Wndo z8rkrIqUmO5Dm$G?ZLyHi?J-&Y6O&b|c{lE^s7&dg%S+MRs=(I5raIfwQz|T$);it^ zz1oDNfLv$Zt8gigF&E-b_L3^i~6|E(oH3 zrE3@Cz?Ne8VOW`NUPz{THWnuP+$D;A9|xMPagZd^i@7bm%lE8MUU_=Udy3X)@k@po9 z6{>`{*ZXa!;cZBDG?~Wg=D=-&J0vH!p44rsBTSgvw_PGZPqrz+gz$ZFi}-f+JMOI> zZt0U68;kT`Yg=Bcu6r@u-@Q88MfbS9%-EKO_di$uXpOTD%(sw`n_w0gE=8*Q7GC>A z`@NJnwtdGOy(YRk5)&LA47fpG8AJbGovI)|NRl1=!p7D>VN}%)xmgY0X(9dn&W{S& zSbcOW)z;)IF84`G)2|BKP2rV7=qYOLOne2TP14^Su_lr0h8Hi?M;mzIQwcuwyRC() zzU_S&u6)F6m--P$c~q{U?=9g&59GSX@iRqxz6!V<>pMv{^VS=xX}&|XoudVf$F4MP zjyU!l)+lwvN_h6=?Q2)*d#r$sPe%jT9JDt%JB*%^^|u?@0YNnIWW72OSVJSgFr{mX zXoNOwBgK;+%^h5y?>}$$JiOri>VCBPeY_+|ITa%w*vJQYoVW*EL9<}SdK3h;6d!bg z%)v+mOg@S>QqZfv*I|rjd2M>dhS@EoqFDLd4g(uN6D?!eTSjp`)BV(7@Y@oK!&e(e!3JNP4H+A~PKyo3r_6-Z!xiS4 ztiRN|Lj(joj77=~e@?_mM;=u4x#r;DH=&#wkbQ3PbkDB+M6A@rH^Z8lYhO@uGOp<$ zqC9-5Km8a|`|@y7BmYomjE#y@%FI2zkdEzL_)52m6g`Va(Tx!=dK_j+y=o6Ug67tx zO7+wBQqgOxfv+?)DuuRd#g{6z`#%Ei{Zxb|@8yN~(FlX|AK}&GRs2XoNwH-ee=T@( zbeYNHUuh?K_G5EjKxa{syiTR*V!8f0E)tK?-&$m7*5gygj+t&(nkK92g1(@w-4^MW zAidNZW^MERg%-FY8rvT^65}8T5PYJskB9)7G?-hxYsr{m(MJFzPdz6qv0|e;)1PGy zKw1ziS&`9g9RTv;C%LF_hQ2Pu=!;kv$*&C>UBgEUm2H%kPkWRSt}i#Tt-z*rLn9+i ziC}R@+NH9JbtXfGIZ^KuImW0yI{}Y9GG5CcuVW}`PD=qPx-{VZOL`X+;pd+WEN>TF zNZE_e5q!p7g^$hp-q#WiAA&)d$a;`Fs-be9i@Wqnu&AEZT>*RI^T_S=o&_$q8wmZD%g;g${-z5K zJP}E}TRcai$;BtHZx+A;>UYPC7m}SVW1LwoPPptp`hsRLn48U)MQlMNU|@Or_#F3qfzt)zr+m z>}vLjo5d5y{ivty3-WsQ6uD$hV`{;xM(X_>EF&9`_Oa9+ZOgp^tqFA_)!I7$uDPfiS7ehoHPzTuk_ zkehY5S7y$qAID2}L59~Uz9QM(Iu_!&8$g-KEoiy9sa4e;DrW9pzAJv8mt%0GNaFS7 z`0kKILYOa_;|O<9pe?I*?un$310|vKx-iMd28+G!L`k8d)ZB7`sfDJZU*ES0HQ3~z zv7`u#O-$|?0RuOWq4Z%fb{KbRd!(+EsX3%zgu?PC+SHzdQ+5HX%!`^u6eWhatTJAM z4jU1>7PqKcn|q1gM>+GMA}+jzbZUd&4eOuftFRYHoez&xg%UFRMVTft`XgAsYe<{l zhuMHJ-&97b(}MJ_{J;ZzA;K)`)Ks)siMMdztEu7$nAL+G>DN;s^qud{T5LUddJ755 z;(P`3Z6wfarILp!gMZQYSowi0!g!ALLR{%*fc^5GG;YmIt(>{;>efiWjehg z!4sEmBbng{M^qWe$LB?(RVF<_y2Kj6E^B=<;7balh`AA%Qebnm8bJl7-R&)nGRQ%T z-FIh})2iP60(>5cj|`r~!*77h4?l^+$S`qm?SNnkF2*mzNGrxE1i!Zs6vyzaO&zPj zV43VVllf5hjylvqL)2$Ci{zRMd7%Nqw9m|$U_QC5d}_fh5^HH@zZFMWe=D0 zJp<9q4)!C-=w8is_L-}Bk45MrIaR5S(dO!0%7>C2pbpZtU!YfK4`)_|h)MAy0-se{ zoo#I39O0A17t4_o8u98-67-o6A1=SElVx2=yCF|Xl7O-LP$$X)1RQd(yu_8f z=+4Vabu61oea273L-0jpLuSq9p6*M&un1^ay9xc0v-Lyu2;UQ|{K$9jq$s#USsY(K z<{b+5vFl4@4r-+0m+wFpir`|4pEBm2K_19d)T4Cdne^)&yXhXrEH7b^NIe)g$rfvo^5>vbi~1?A{Jq)P&||FM3)Y5GM>N1&uY>Mm zi1Js5^{-Ec`w1~Or{C$}i9Dro8XUMXc;oiSfvqPUx$Y~f!YLKTMA?gXcURjSimd~X|E`<97NwE4S0{AAC= zaP25uD?b8;=}4H=qH+i zSg%oGNG@*)@*_!Q9kOCEls8z?zq6-i)*w9|^fn3Ky0>u1@J_`}E^S*tU6<3*-}xMf zLM-BM2Fa);;SMvt`5-RZc@7=&i)JN#ib4L)nf=5~Au3?033u3E=}B)YchQCaMiuIZ z9*>1&c0HwR`uC1+9k?t)9Hg*f4hQXPB(d8lS+qZ~brY;Uo+mH;<^{+bn7hL{4dFU2 z9(23EgsuQFu~-(rf;B$rPvHno@H^X?mO*P31OAe&b&*RAcGzAY(YMru?cs1Oi)KmK z7gB!v4^UbMPkmY8WAD=~`qs|{W51f1U_F;ea)uvdT-;JujDE0ie1*8t<3g~{*F1bF z66Eo)o4O2b{~JhD!uM@`Q%u;fSZ`kL!0z&Js~pvjWkXyVg%FnPy+va`m*-o&`P}@9 z+7QI4?V1{PNL+9rlJCsXX4Lu@vA&k1io-%upoyk!XD=CMsikTdVlvl@L4#DQZylzM zG4&*vBNghQr>HM8-IZ`%rqmFaisWDIW-}6~72TSA)LGX5QhtOKPZ-c@IGyD_FDP+) z%$Ltql!9zrNOAe9$g4Yor@&IXY3Xxp1q%Iq|FFY!@Jf#F5lo`6E=-!MdlECmJ?bfw zZJUSbYhN;|chM36)oHCgufsw9-94)FkH_-K=`xnU>@;b&kE;?2>U;bX%HH9Y+qC zBxh4SOFwsDUe=fuKhHL*Ey(_2W6cxCEusIYx;j&JiMM;0btH1jicXEMyXw`|2%{1X?@q*@F@3U2O{mb2L&^m?Xn9HqFHY8Dc~fn z4=2c(UW{Li3rM|y$(ymiXxxyx&!e;eYKO50>67;V-6Dn)?ShwkbWkry*#fsFK zu@IqSgFkf1R)^bG8>Nm7&EQ2~B&JmyLmeaOXCZUluZ0kLAsV0AWaQp#vP2m}FA%asWgME6A*)5T!Uw8qBSUAqv;8l2&)y`(TR!L!BAa#$ zN+rhACE=|;)iZ5p=h#M(t!o~jOnJEBGFxj0%eH0{jNe$L(@`Uh1&}ItlD(jJrGPynR;qS7P#b~X>s#OJT55(qf32`iY5P< zBWFHZ{wpgBwr?bY&ZZ*Phs#}W4=NCe+{O1^S`<+$kh8!^qJfIr^b!bfi5_fqqCCXJ zK5z%`KNW?nuDT!iY7{%B9Bp6va-OxVry;w~YpvDG@dVSfM*9=2LzC;KB&gs*q{hnU zWckmcSJBMtU#!)jr1Y=c1|njjB;dr1Aa1l0^`zUa@#V)p98Cm`Tw-6`+zKJ%p!@f1 zDQ^xywKk%aD)beqIv+#*i_;E?Mz90a@WE(h)1^W(8#9AW-^RKhR`Y?~L+@Dq;x2mzMZVL3`i#8c?fziXoF zSEDQos5kSSivylnuM!GvJw@OC*!)g}))(JqvF7YWxzXXlk2d@i>(?L}ZaAxEi79~@ zVYdkx5?tc*k;Ph{YY-LD%OW!(1 z93m)*TEK8jVd^P0e&yxzcX1*4yg|;|=R)EY$@NI-gV|^W*@i78Zd^R!3cdhhYphcy zry$(E2zN)F*wG8WvGlc5y4a>$;_-=jt_L1t>5y0W>%U&SOk!jUW(Cv0jcFz9-(o-_ zf*`cI1u*jeseZvdhLMo};PkW}UcTn^(<@2zWBdFy@Ba6AFL=$cbq(FI3NnpUo};(O zJoY-8PEWyec?utIq1Xk{ps}(SY2$8Z$B}%4OE<@unYpa_vUl|m4i(nxboi}ZFbi9|6Q*#$wvCqqHEwSX=qKm1 zk=TG{ycFJ%Lzogz*G<9I>dJlh1cl7Ne%f2qFJjPsquXL0e zQ++)qCKrkq#P5;oYSVE44_SX571jIw51=$dcc*lBN;gV30wRqd-~dw6Fmy`@Qqm0) zQX<_A5)uMKNP{3q<9+b``Tp)*>;9>0l;ND`?6dc)_UBRkCv2Rdx7eS5xS+E}vn967 zr(JjfZ?T3zNqFQ&>qdKP8M{#E0j7X>rkM(^;8M=pHyL$zv-$~p$t6+6L1rNW4o?Ti zV=D**8q2qpVV>1M3g`YsmopCfRkz(v8l?@VEj}M z4k3|EB-Ml@GWq-aI{*g9s*?^5jkQ>#W|25|jg|9Dbc4SEOmV(uzV!g^bdWcC1QOac z90l=7e0I-wdH>L{AJ_D`8H}(I!KLANFYI6SZmelT)~PJwbno#7R6zfUDn6&$jLJ^v z9KJQ4ZOWF2KvZfKq&>3NOdltIl7?f0R9e#+qy>2CUUAvhAVv*O!$I7%PL^c=)7jEk z(r3wsVQyN_B+MGgxpew>^=rPN4wco(lSj>44wEz^t^UHeWx?|b5DbqgD7J%%XqcXq ze!->^Q7^p=I>SQZ%>+{7qxn3Ah-fQWeS{%IO@6V*1OwqWBBjJGuDFR+dAbp+9OGg8 zF>fXPF12rSWM8JeKMV`uO7Y1vMn;~Z-0R?5mVl+xi(@~Nu~uCP&x=o--Kf0snB6hux4O$tp-L$v{DCjyu^##kfcDEr!2%FADjdI zCE<Ccg?*ycye95n`F?`@am`|$2q&H``#9KMRhg~m$5Bx?z-COcsHxq^a! zY(KI<+=vXRx`dVKu+a`=E0c$81qetlFj%_saw9QpJMR8u4n~}&@jU1FbCvMrYSLb@ z1LDu;*OWIgK!iQD4Z9W?txT|Y%H{MIPGKg>o_rB{&3r_2i~Er+cE5)ukj^!I5xj?x z{;S_d_%3oE?B8)4GIhPC{22?45xN}jx?m=LdE(UDOc3xTC$?)a`5pfg6wdTDujob# zUEvk$PsyxWmYC%}6q>h+;Vo#lCwEa7%n4+VXszA6|5~&m9QKOxkBXr&zd(*nwZLX^S#FjW zCKKDZq1-?bL+7N33CX(c5~Mq(A#cCp4@S0G1C4N$uWEl<%)1+kPPz?za4(zr^p!iD6>4`dr@MB*?nENgkQ^C9xr{wvp?{% zK|7ZccuqYGGsULgd_MOS-{W`RgrWpTLS4lMRvh*Rdk0Rr8LlKIQRgxnJ#n_We44`+ z-*^4QN3zcK`ea)x7rycsc19#9I*F=sJYQEj10CA?m(VcWwkO2*zO5luDbX4h3BRKu z5I18ip!N4os_WO(klC)}oi@Eg%oEycsADi;ku)t5#kwHI$^gj0%3-RCZu8$TqLN>} z7awF%&}jJ>ci;Y6b@#A3`Krvx7GMKbU9vDx{l0azdgQSpqnTnPW+}4x+#~k;09_XE zaD%`)dGEB0a6S+A#jn?kEf(4J^F_Q?H$(<_+{-Ygsg0ISa_%c>@IBPxmz>J;g_;T zBI)Kv`^I02!zzlcX~Jns-y1p_8SF!@&yeoTfz%+Qodu(0L92t0q9E#d?)B6n4a6VZ zZnX(e5F!uL&(sc~NZ4}={5!3Vf4$xHUkn_o6ymbkmqgPi{udM=$oTo$$l*|I)t(PghrWVN5&W!s}4%`sW^uFrOnv*?(R zSR~gLPfpWwmaXYy1s0HDXl7n4kdN`k;ThR!P=OWz;l5U4c}~6*x5`9q=w#ea1j9D7 zW)bQ^M6F{BcwrpQ4|tI*Gp8|Pcd;(sj$3)K44?vJy@REvyAuO zN~`4Q3xWGP-2k?f*ebBswh|vCO60=df_cY8&f>rJH9E>fJ+0R!iMRbyK7zcLH~@V( z`N`%*v%#vQ*bRCqALmit3+!2ABaNd1Qv#PUsKS+@PgQr-UT?1;8$N*ZCOI;mi&aw$ z>ec0GMGn2B*Uvj2%X1UI66<`%QIhV%7WeJmV>O=n zWPWnL0?TQk@u&-27Bl4-QVm|x)n)HMI2G9hw`9lnEGady>{(JG_gV&wnO7%fNjMW~ zlA^ZE23iA-+SLnUMAeK55#IUG7&rdLuGLzxwAoqL*bD#BbpBdSY$6U>W7N6I@B~lG zb)3Z*ekr!RkqTkUSauNO#2~}cZov>)(cfzu8}TvDJJ3=cYjuOqM_&4Ulov9KYftP2 z#nH322yG+3zzqrNpHFDDt_4qzM^Ybp?3n)MlYy!F&NwT1XWaxyQ(oie@^wr^UKND+ zsPoLGsYM*qm!nuzKAj^KmE|S>uzw^5K3By~K9YR!CvWcm>%7^9w&xfU_wC63hEW#t zD&W14D)O!`hqR>=e>wlD!_iV)K%XV;P^XN4kv?j#kEo<<4~P_UPR%p8R$QEv!$RtF zPsNU7ue&Ei zZ9??#v|V|JM-b%g${QM`Z^T9!w~(UAj;9x7u2}w!x<9z@N<)>;U`QM@db}@TBWHAw z_m#3=TGn&*1RQmZx* zqbcU;dC{Unw0n}(lHEn_1AZX{)>2rpl>A;D zC9u3je_A`#a6{04!8l-fGxoE+Vdqpt1F?~5jCa8_zHWJ2^002^<5XB6@h+&xNn$Z5 z19ay3S!zy#1vL&FHA6C`ZFST2>X)fne!o_paeTU!AlSr(lTyf9L_Fmo^4xOEE50$k zH(WfK07Az%_ z6P_-WA9CO)$2lkZ4(3)!v{s!S-AIc3R`+N+HU=wd8kI05r`}MnjMiSL8$j^-e-91R zZP36>OXX?>`O9PF`q$AB>Je$rODiL?ZxBp!d3-|9Zr6X|2%lsy<6ExE(-rW zWDH+QV^tsK_>~hsyLM~0p?=y_CMoi0e*VChX0;>T20?HnVw?6?_ok_Odm_#}&M{t_ z+D9h5xp>`s1rSo&HU&?0>+hiJK4l?BcR1K9gJu?CbQ55@Vn? z8S1XE%JQ4ur=JQi?_>|_7bB};zXEYn&6SDng&B@`OZ%N%#mLJlo>e-XtCB(w@Uswj)(Q9*L3H5`oLbviK7v!$zVZS`l;GlJy~<8p#fgvh5|i z4cZ#2THrKFh5=$bL!+3d8UYb*#*7Yy_l5%&xj2eV>J6_`{ zDrTICU97V>HapYjMt^)`%HxB`k;TVp8JgC( zo_?n6711SU-p6HHbXE+H1yK5?@^$a<3o|QuUICZ|ky7#H!e(Pmsc?2(-xEd^y(VO$ z-HVOi>KIMUDq4k zv8g`je{(Dm%~w=dIuR|$TT2d*c^FNY;sxsJxHz)(qb&= zF&AA`Cy>5bK9UA7EigiK7T&X=gb+W7Dw-7lYD82{L9Yt9i1o_KH$(KFbkPP2>CGs| zCML9u_^jl!4`w3dQByQVV}}y8WkcM;rau0RD*A0xWc>eE=$J^@brrdOUKb42KH9VU6@aZ;pYHcT|2btx+BF9W<#wZ4reJdnr z#+fKDD}pA6f`1I75%=Q(QUqa^ApLN+&2|dw1vvyA zsxA<`SQ*c#5>KqC&gmBPjMi``q!pW}Vr*J2ESx6TO;VypY*gJLePfi`J2H7T9?C7- z%}1&KTFxT)Yrx$H29OV+GQ+Res%+vJJ_IvcPM~-H6r7HGs7TqyXCfAevT zS&OdNakHe)h^B4g%RFNgYr+V1*`(jHKIlv&SC8|@n*X%*vgafKVGwD@iy5l#9C{FM zMx=4-`e^8WoRP-t5EcF}G_d-MdNgGn$ZeU^;L0*2Fb1yIu>k}uD8Y%=O3lLinIp%G zYddrwzXr=Sdyt8?1peiRndW$hy=JUDgIDL(L?5%T)icPn4}70|og?KdLbvBnp>n62 zBMXzpV%hJy%*04WsFIB5!5#?|_r=V#9(ZcT^hBe`2KRH3ofF1nvNG#qz&K`>sX z{s>?9KRuFH1QaU(o9IGLdOP(csB^ZqZzvc8c$x)Sm=XewU9oV{s@@!?)%_C4t;h-; zu0FU?8nS{D2sS6q8kKfmrYVo0iaihHeG+O zll?=-b|ZKckJy~K^2{{u1c)>G8!S(Z0Y$WKVBn1D0pVNtb6F;sBJ_j-lrj$^Z3APV z3IsWW1TKeb+US^wuT|*TqJ*mPUEaTnt^;%iF-Ot7Fp0Wh%3&UX6}m&OaidA*+i&jz zJtyg2G|omA8?Zf$ro*x1yRpz$MU_|I+WCcUH?1UqI4{~{OO83cloOC2%?)9D&Y#(5 z?&lrRMSEOsuJ5R#g+4bxtVxzH{{7Hp&D!b6x{yfzCwFam{67M6>KOcq8L+H=c@Mw^RVUvD`oY>ZKx~lrt+hNSm3K` z@e+-pae>+=uoB}z*pk95tM1BW#=%psRH$$H9Co(NC}vY^uGz;5*wW(<(?{L9{^ynS zIrpEuQfR~t5^g^|9IY>+M>kS=DD}?KLF&z4@7HOI((M`JGc3Edt}eE7k64G^Et*Oa4B{18(A5zT^$1e7wM;Yw3JNcc*9sFy$^iD*3$FQO$lUpS|z^ zM7kK{&`M9eh?2$AlXyU<+5a&+sn8MRv;Da$qLK9ceC=7J3=MNDTzF-Eu)lr(aGC&o zP7HzfeV2_Y=N1MRw-|U&OLSMUo_C3Z2FmSu?9J(#G?B}*E8=mgL@D^E#P>!hCtzO@ zz^u3Xd`7caAp;-%!S<(5YU)T(W;$w$%5Dycl!YiBA|6FJ-TkN2WLNeVf|YB9J#H!0 z>6NOnXWI6t!KoOrW@u^Hu;j1ljj(D?v@MF1ua2`E5ks~mX`q@k&8nw{X*ns+Y>HKI z6S-9Bn^c{;iVX^>H~0I8TXSw12%^&tCy^w#n5mc=x_fSk;vk)82-+WHePE;7e92Zq zF}o~_8Eo=86bpjP|2|Tw#Pu%g6W#y`e69jN=zvEza;lK#hTbYBAyO+%UnhTzLrDI3_r|nwq~PM;3>mFq`rEz37x> zvrSd7_opa)(dd+sJ_+-0K)q9_E|~QqonBw*Mp0Mq3^Ab_{pL5gAIoHau<RhE`--({LZNpgNW9`n7zW;H1m7>@`RZ8FN+{QH;T5uwLZ<% zDyByh^l|?XHZOfV>nwn<@jDw!8p4)7c^epH%99`oERd2I!Irc=uJmn5fbdZe@XB-8 zBqYW7zf4f(oW85?i@4y-Twh(-4~uhO)E1*rsxYQ^SI@m*nt6VFB~_fAs`AY!s($|} zW7+7jgEo;hIbkBPtbQZWsN3n>ns$TYC>X%w&UFY$VPfH@-AIq}2 z4a1hkL~-?YKW8gG#{yZXC@(;w5vt;tT=c=L?K`@I+wU>PhW&Aj#ll$(XGy{J! zpDWQ_T#%(>Diba8FSjE%(df-2%m%Aw%`U)d1S{p)60CDJc z{yCa~5l!p_6_RBqvMUxc{bV7R=Z(0<$fdJC$oD;mK?zerSX~80Tx&2fX9nFv#2qH) z7<1rl-(6Li(mld(O6UjOkv%82Q*Q1ftb_jPG;jBNq5~GD-JH@b@Q?0U3*^mn&=Egz zeQpVG+$bmk+2dQZ4MKpL3v&} z(Wz~p$Oa!oIw9E9D^2XS`Bx1j5~;a~u!XI;S{#@hqcM$duZ+77!KBc8nq($PJT-G!XyhiJl6gQ=9E-*b@Kky^I^*3;kq@?lT?w1)ID15MEkx7v!v zf@gCQc?Q7zRt}q z^B-L}mqT~H;GK|e)>|PonkBAx9C&(u^2Yc6)(4P2$%8yKR-OO)jw8n5;qcqB%}C-= zn9#ECtNCh@?LYs`R;Z-#Ig)ia(1M+%Qg0qJPN|-&Ji?d%U&pc4zHO%gXpVsd7woE}35+X|E?_*V03d0HnCB%#^1eaP&*4w3G_h$YMQRW0yTmg(yAd5EULrP_CrtD zTj;vs{oMT??^rZA3`GR`DH3dLJ+Cs&UF!K0{0{#08>c?5cgqyWP|>e`JQe;b6G#=3 zmh5Jr=a`<=cgFC5kPkJ!43d%S6P@|2@~_{}hCo0~G5i6+4Azd2wMcfkyAf=}gW3lX zo83ztc6ce{I|NFJM97-?T^@2=OPYC0?c->`1+UPr&>1y)0r2?rE=H0`ihL0rq51WKKJ_1@tZnd*IP&=jS_Wp z3%E(J1k7fb`0Fg}rFg;(drd%C@u(d-s3+mkn0k9Z~f32cKR^jh5pW{om3 zR4eSfnDQ|ngs434rvJ+M6H^>-%UeGDtWa9)eFh^6+>k|L6Hvwt>isA_r16z0?0V4* zn?mZEcYl^%qj~~6?nXgHaK|_$=8nU^9(W9ZCU5#Vn!6L??s)$ql?G5X&2bQimkQ zy+WK_Q;Z@U(vI}!?B-@5Vo_(KwjpBGBrb#_WN09nU1>-#E)Vy~S2Y7ECScmYE`x%H zMZipculeDm!DjYs=3YCKay(BDI=oNh*MgBt+k*X2tlvd{!E9ovhvQKPFe=C5Par7P zzD<6V@mL=MBY&7z;vr2BvhhqqY$lGbye;wn0YHZ5LVC@q9axoVEPsJ)y%flD zO4EK^Btf(TiIE<`g6i8p6nKNz{P^ZnQg9VX`T%%^L^j9%FmY7o}XM#02T}D>yw);CK#G89^s#kNB z8DhvYE#@j#O_R7$NGMvhbcZ;Cy?Zx6l^|=elm3zIJK&xhVYUszSmt)^@eq03Y!^$<+Cl2`p&gmS=%iP8l!%j*?qpKZOIn) zUiHZAvadvxtw%nyyh{D{PYTr3-kr|G&qu;GG9ycKHpfz>azOk6{PI1{$%nwDOX%un z31>es%$bC_|M>syq<)EXbMK)K@Sv^2Q-TFAfbsge^9n3%I?d-nO186~rgB6v+vep&6&+d_zr*V_1w@azH>T9~QD5bUMk^bpu~e!i*##dm>6!XD#OL+Kf1 z$8hG6<{N-|9Yy8+R5}zZcB#R^nrsYLy_95QMTFx==Od87U>=SC2=n&D0O?kX=(x*US_=X`V zi_G8K0kqWa6n>TV zQm{MZ9W=(v6zHt`>VJJXZYP@XYN7o;@EsS5DBc338T~s51Iy;mzRsmXHpuALk=)f! zX(hcssZN*bFm~UdS;sdU`E1dQC)A?1ZEy0EYMuW2GMIfI`>%X%i?p_SoN+-v$4+Kx z61XV*p4Icf`waOQD&_H0@^QePdXUH^kv@VOGanLUpFEgCGhII|}cfxfC0djt*d4w!PF0PX2%ao3_?hwy1wfNQ$`*$E6;)vrsV_4UM|QzB&F+t89~AW-qaufrHsap&g#E@sjwjJl1dtUlSK8)PBa`w|sVV}Y-Sz}%| zpWGi3^hG+YPY%P)Pn{I5r^2TxP~ZPicf_oa zv2QUR1;kT?(<4m*LZ>r?*ISb|1Q9YoRDu3i>U}F+7SpL*U&}d}K`FGmvQ_u^Csjn* zd9@5m6lIi)h_U>W{C=WcDdy$>)6=EsNNDiqtx)soa-9OTh={{>MeCHZMZ`6?KGgDG zznC;MMW@v40gI2;gM5Fq76&uc$49<{uJvG&@o?$OtOW(TQy|Z(4?q885llZ}iBDtm zl~ULdGR>lzt!*7f7PAgwMVEPPmM;80^dl(F@!=*+wwD9X5IivvsXwU}rriIwwJU&!w ztHy(uT~a9LHux--^d1UZSh$VAazY3pidQ!bmV3)~(H(`Xdkn$>!Wbid2XetlxA?9o zZlIA}yAi8BL&>Zdimwu%ThO!G(}oI){UJsjZ!~xq8k+Ph3Vv7n5M?oD?hD!w+OD;4jtaU+PAdgLlA zjPD#Fhl6p`{6~ALuVu0Ev%j^RZ8I=qFl1jB0I>YQp81@4IiI^a(O$HMx-jX@&5ni_ zb3%?-qSr?*D(>*Z8_C2N&z9y+rsbm_kAu_3TvUeiwhQRq9t&25iZ(1XSmp6eQo#T8 z#k?1K`JL^nEjQ(SL4$+t6yWz?E^lVMZC=pa{!_&ULI~`1(i|&_ql#qB^AO~;>-uzO zb^=2uF-YWdV9Xsv&wUcm?f)WpL@-FTGg|C07EA;MlnVmCu$){ojnvzQ9rS!!dP_?N zycERRI@D`MKEDfu8gMIOtnCA3MUXH^(AFugxi43&JgnHz7_hfPhWwu$jYL8Y@vb{} z)T~g^X3+24&3wrti?xwqc?l@C3VuC#f8(Bn0H09uvaGh!Dya>ddS{O!qahLCF2{$M zNU{!kGcVd}>hnnmO&+b|s zPG<{oWm7lryTt5A1>_@yzO~Z zx6JLYQ1T5q63L;BCxQL{>7hG!`38Yj!?K@`unf{1B=ugM&j0K}Qds)fXZ%_*6SV9$2v?Xwq^4ow-vg{}=;5&{52Ezd9<^Za+DH6U*-hqj;wH9!vQxpW! zDkXYdkvq2ketL%aX~y-qN6(>i>KVhrf28Ie#t>w*zM)9-C(2a)JLR+#=j*G_Gfoj2 z;y7^n!*=g&R@G)PWvTJmjH+Z-f}exXxVJPPo_5eRCE<&4FXCC%I3;%+$#V-BybB#9 z`iJ2e1}cRHzuNpofXecHf=q@8_y>iwAx&(5BcvD|&UTBySJkEqxH?L0<~0KrgVq^f zv}D^JMzxEt65ljmuK!{br|1n39kGd^0>QEi%fG9(FPsu^S@4iG!P)E24a_&uuqyIgnrr<@WC<}i%tZ&W>_mawU8a!Hd}?3 zEH@!8)py`xD)YNKeM^e{p+}CBDiWp?LrNl7Eq0zX2}b(U7E`*-S~nQ|_^6G&G}-~2 z&oY^&trH2R_ssPhFb<+)rL{)%gyC#H^=zcaj{ZQ;HjK+GHucd84Lu{H>k%rmMf!nu z|JBEtVNGvq^DHbB6EKiLjpZ_8h7d|6)T?EVC=4l;s0ZJ-WzomWX(PBM9n+;e;^bhA zOO-1lDK~Y3ng=T)gi>NfQt@RJuI);pAt7hUx-C6W1wp+?0xZ=s)QZ*QL@wDysWs@t zL*Bb81?A5`kPNCN33&*l8wD$6!p7suEP+;v5LXj+@;hk5mWu#w9Vu;blbPZ9l}5du z4v;l>A{sFF6L-g$!k8PRq^SXmFaAme4+4HL4-5EIICZ8Sv%ao zT-;3h{erYU(iAH^O5V;P)^aC#zT7}9H>>|-=gXRe{LuvYEPe}bXglP3(oM!}+`iE& zvh7SXS8ruKpvx=OwaiQFH!3Tf^sv(leb8E2;R|1FV#kZEV@7Kek4k)qCQ8=%EOp-q z%+%ha-;1$5J8l>bCTdq{t$vHn)vk18$X};R|KSN9d^i5!ln%rsTp}NS7lurU<0s-T zKsr&M1c9X(8H@IZj1p^M!wq%%#JS36-wyQGZ^$`WEx8y=F`8bIu@G%!W{zDRCSWuf zXN0qwLmzLD9+x~=!!2?kPU<}a5qNZ@cLdZUt2gO0Nb=m7Cjqj5(JH7;V8n&L|9LXJ z1`w7tCJsG3_IIAGIa1__XM<__XGO^#?H)c!AQ`P{K)rW+x-dMyd}8QTjq>o%i&W>E&=^1?%hR5j{s1f&xZBu~ei^5Nk<) zd_<*Cl>DJ#9nfmB z(q8Srx01;|!cmu|$}4=!MuJal((v|bHZ*z36b&-8AxHLMP}UnlV-zPRLm ztTFmbrjp5VD_8Vx>$BSQ-$C^~_g-aVzeSrW?eWiQA89Jv>LRXbvh#@C#c9j){oO?K zxLkGJ6GxVW=l?hqPUy6*mu1yD)!ojBY7t!v?Ua$$wn`?7Jp%W8~*3S%Bc%KB-CS5z;e`Fql~owA>$u&4cfSD=dCeF795rSZke zZJ+dCpkRcaI(?C1+?l*{r!Fk(wJQK(v6-XY><}?-&gG*v|E%chI-I%NdB=#H2(OPp z)b_=3pZr>mke<>o@~cE0_6l+;NnHjY)soG>vB~?RZ}0xX#On@$VyM;=l^oaHVYp6D zNcbnB$x`g50~2?e7#Ys+d| z0Sm7vN%HXd7}myMrec|Ln7!{#`Ft#>Ihde}ox!|R!~$~Cp+xCp1|`x&_+!+)Y%vD> zvRtt86er-hzWTU_=z*80=PGT_BC!JcShgnlDs0?$;MI)T_pC({RGpWYMZ^ny@uD&kn1aY(Gk$PPC2l#5^PeVZue8Ho|_M$ z3(>YVm0LaahI1=`olGd?ZAPK#*+Iz*D@ zN7(VK3mDuFT*93sV?qv0Nw!{*F8bSOjM8A7dS;Q#d z8@-o;!GtO?q7F$15sRXGMknF?yCHn)@o_`8^^i*rsvMcpT=f7YDY#^q-dL#+ItiT_ zFMvx2kD;=ZH5+#~7k#>em6g37oh=`U$I6?is~dqT04$HRo}=k@?p2*Cn;0}b^MMT( zYe@LNVICuQ)+^pbv4br=1Zw>KGxX;79{=0>Gh7g46HCZCp{z9GS*SR4&=E$v{8h1n z%yTxykw`bL-+K2~PR5(vQNvb0OERUHoS=6_!x|6iPv2ejezEs?4qVIZ=3;$ew-0{Z z8;EjWQKc;ysB8W9ra!?^I77DPHfO5#?)Pr@?%3JsmH*Rs4CuDwI#F(9juu9wxQ3&L zstI)FMfqD2I(uh-Cg^)#n@Yf{%@<#LNy8)2 zaq6o_;zSrqeouf-CE>{xEH=tHvgQ?kEaIhMxX|awQ}i^oj;lMlmQux<)tlDJgZQ2n zy@j~^%vcG{8sjBZ&KM*VY`fRX?ZsV=MN4&SyU42^=45rHY||P^pk&QAGiG3lL zMEZB@0`9Mt z#uM|yZR-dBbeGRE4Irwdn)*^7{L`FQ3ci#;2y7%sRZ zn^1A?bNv(b#~**yCk4GFI|TX79}Ww?!P`pR6|35Z3Rs|DR_sW;^ONMYUMW7o7a~%L zQY#Y@uw`)GFApOot)81menUUJGNW(utyfiEr(5N;5YluSG>NHXx*T%=fmR?WSm9^= z^#Pk70;_*)Hyi0Hs+CrZQoci9%&VD0%e8M}i&xIqC{1$eiNKnQ|Y#%inM1=jVrVf`@CuWl#C;r}MchI#wbB*fq&b{R7(GYy~w7TEkdpu1IKo zhsV)Ezrlc)=6Y+q@wUzHN_R#EBq3_XDEi7-^|^IvTMN5aigPQf1--&mN`=C^bwFO( z^Py862ib0*S;J*#ISJ%m>KwG z?7lsHJG4q!zc+xh#PyN-%5irlWo_Xl3t}biqNXSWiDRy z2UwKopPfzN2+Sq?9;G#UuStC!^Hl#pdFvI6yP!d( zpfO6uX9@y(a^7#Jbc@2z$IFkAm-?Mab)y?l&-k=l=dmEj5|6-<#oqbEB(zdRZyM}G zo=$28G{6+w-Ct<#xN;Op)16O>>tx*&a;g7LsVL+=*!9xx-U1lri4)(MmMjBm-pp)( z6vQa~AR@pTFw{z`QzT}RW7|&`#Oso4c!9Z!{kP7T8G; zC{&S$8eH{|x0mw*& zJz4M$T%$w@|J(EJt!3o~m|NF>B)D?KI*2{Q8Z704V$%8JYqb&C)z0aTYrsI(5wcy>Xz+B!BS>X86?eS<=BTM` zx2Xs22TVJ<>TK-z!|*F}IhK{L4k`55jMXNgN&3zDrU#f<>fKde#AKt$_8KEDM)RdI z2efY$DM|zO#q-UlteEi0*E=i6AggtIMkXB%qMpKaZ;*#goB5UEDb?71RGVMc)6*1W z9VzhW!Xg`=kms!PXc8*lKje9lx1f|$;NtT!EzHw+{xdQSX9M8%#tk0%(L&jQc-q zcTR8AKpK389tL2ACH!`Ty)(?WX@JoPj#;=_+=S+=pS#O6v~B6ecCy+KE6}zaNdB5ZgiB=yvB0 zSilueaU`JowX>vrY%+@5Xr7eT3A7Ml@Mix|CW=TQ^;x`FE~uy)?w#lct_;QR1PnNT zLGT_v2;NhnzL!4#TpV(q@m-WLmlC7td4QA>2BH0W{?6Tvm(VM9?#I6`9Oe2CrPjkW zWpTj0U={oL&R1CX6a-_k`Rw_fDIEL1{pvGNIX02AT#QHqh-9UwpG(Sd!rk3!zxwWT z;oLB1et*cNOs#Zc-p@q1qIQO2As{SD6R{0x6Xq z&STzY{G#=~X*GaItvK_2K9FQ}#XOJ%^_Oc^RgW{l*#=5fzr6`0PzK5*w6ZUfWjmkO zam${tma=spvbrXhDs!N8Ga!K>i?pWP@f&M=(3e8fzxT1=La#T)JGRSrN<6?m$89|2 zhUQV=`oG<>)k*z-L3gsHAimjp&Y;`5=Xm>DWv$1~CcH>rRj;^exjQyk~;%kOrGTZ2Ywh3}$r1$^GeGdyuvr%dhDLl0FoX9|`3mmJmd( z!N!;EGIB~lyfS(C@k2iTWdlAq$y)nwE9L?OAeE~PafUUko4US0u>v%Ngccl054WT3 zfy(%`UNufy{&4WM{jc=59{&G-wPr2#!QcV(LSMb#Vrfts8aCAb{T@Lq9<9;$XJ@5F zDDbo?WOU*8#H+LWAFm={rZTInZ#IT?-g+MsTK-Kv7OefzL z;T3zRz13acT-YtSS80jzG;I$cU{opz-k^&S%Yg3V9(kfhoFaoGwME7kYxMUalx}B= zF`AGWlUXxMEVgOx?q{~N{|6xAP?eUJMyUjEYE_4C#YL~%ufnHGw2lLUIU?lgA^&d=OIcGvF!Y z;QQAEQeM-ohN1gA3aswK-h9mwZH)iSzABK06}V(3Fdq%57HLELWFLTos)tb1|0Oia zS}+0=_&zW`?NunW+U7@G@am1d9+-OHXA-p+PiqXTzB(uY5t@2K!%{nA`|pdvbU5l_ zycp3~L$&uQ101EiZ>y+-7wZfDdlv<9PCtQeFJk3JSZTfuaaf`A(~G)qKTPdQ&BhS* z>vX-6SokoSa@K;Lg0#iwk1Mzjmqd~Twks7i0?l|9t!~|S4@5qQ6*fSQWc~yz7se|A z0WZyRoNdHUATP!lGt!!U{;%KxT=u`$Y))GF2M%z_=tBRyWJ?JxzWU~2K^RDM3XMvx z_b4PlmKrm;A0$-ZK=My=6g<2cDZsvX02sf zb}^ny5UHW2pYD%Mj;-6SDq^p(`$kM@t;eLn?bUtEtYijAXVW((DirmLs>SPt)42gM zEO}%TM-GMSCzNH)MUfzFBU`+cH2ZOD*8iHH8MTeNhw5GTvznt@stb`q>e0i`G3xQ7 zF9JctpO0HiYu>lHum95hAk`QTx%S_C<(zRo0VHDz3Ir}&Ulb4j_shs?KYB<#(l=vVz6WgZoB4_N)slhA?Z+!R2(q_%t@phB?fzu1g4aY|`9H~O$!m7DLTgli`0kEHDk}6-_$v%E?m~P3MNdL6a zP6K=@RF0X<5?gV(ljP2CZ-3tT0+zA9x!*d57(@}SXB6uN%OwPrTxd*q+O?vPNZ zY3;ZLhhcmDa~dc@KDTP!C&O$}?Q1R(LcaOuhJQ$+q;DyvL_3tFrS}NoX(Mjv=vn=s z?!u+&9pEX&#QeH%_9XUj!~ROp8ZIP@VbHn-(!<||uhvoA}xd1c)CvvjTS$MVt)l#5; zm|C~DRYr#O^Bv2kKQLq9H=gtxaD16-Y|zadUBD;WmGQmpp}URBQ9gCR?gmN)S*w#X!#5!P`av=F*w?QL0UgBzU)2(Dq_LJ> z&UU|ZQ>s>gYV}H~a7$)ev$CYDhcl{Yjec1DuSJo7K^e{wdDzPQ_2vHFYHtAO zKiQQl|38dFyGcu0wZ7Nh?y)(hZX5&?VAHqjcAyySW?n z``?%Qa9{o5K6|e{gLx%bt}dS?fpqK(?T zl@KHAzv?O4wWfR}2lUKWW!l_jVsyTc?Y4yF2$Cf;Bti-*+0UIDkX~~d&@y@qKB;C41G_Lh3ws7N`xgbWNI^8b3S?dC9Q)|Yld5~nSs!stw4`BIdadLoRFrnzg z{SDJZS`~FRK(bVz0Ahp5j&sQm1eQm%R(n}8_CMHg$Uym+%z*d27W-hW@xbQBze?Bt z3P7of4>yYsl3xgx@vzF^(W`A?6>0RUYDBVUr=y8~(8OtkYsYJ7x0hNzo5Eu47wIGJ z?s2|KzfiS2ScSjR-?6e2&PPf z!1JwzJK(OANOYCBdL}wqCmncGoNd2r>Q+qwVk5ODbbj(O7en2wfN*?#wXMzfXe!udIhuA*&3|J}p>y#8Wd0H?j z66%Eso{C7ys&8=8)(L5a=nL^rJl2GdXaE80Z*&PR(kszmlIitfFqjo<&`LH zNszMxCz4wLf+rQ+q@!M6UgK5%q|`K015kan)8KYeizF5me!s;pMb-1V8~3~lK~?q5 z%j*-4kUk&()&%nEyIp6G?4uBHluPs7g-DC%O_HfhEsM$ezE`l&9i~tH_||yO+4y~G zCCKfkIZ@u&(|nS-pU}#t%|ZFL4a_%IqE}mR<_`nBPcF*(E^tJGDCgu35wG?yx#)_9 z_U#kc{KW-zS}IOX7&^;cqBYP$U%eD>kA6HIqZ%^H?pmy=jstIk{FwiRrq$}Gdmj-e z`3IehzaReyg|dhr^E)tE0B)t|9&sD6AB414n%3zmK(71V?=99)hKjK=vNJV~ zVs-@@;uv40(MZ=#a&Ra(O~jZ*&}oZJH90&k2lmbw;d@M0*vxHpyy&PE*N)_ zi_M+R!t474YxI%O@iarAfCzdzeDU{CR}5%iGa0oN*pdknw3hayp*=oBr^UO}O{6!H{4XPGny=)YqRbhRh%c9B@kDC9ganWQ%|CwMD-NeP!P= z^~vy`2?vVApA-EA%AIa1H*Q{wd@dYj8n%v3{)oG*B`xv)iw8In;M4x%0bqC-4{t?* zxwbF8#GsCAj#ls!w0g&dwnDprp=@;JEGvZ3URQ`}sY;mLh~|YE3go>i6VMNS@3go zaewzu-?7=KL<#M^GAXcscWaJth=H(25(B1FobWF<{t@X9dn|wpLuR{tEXF$-6s2gc zKl;6j%l$saM2+pxbm#wmh4#=`YJaQMtJdbVC2)8+Gm~^}IyI(ebOK9rEA^*8Z~-r# zEzWc6)We%};mGgm%XMuO+w&&OhBr%;pI z^%a!l7Xz+{pKI{fNc3ukv?hLV>q#N+XgyCbDz&Cg)p16#X-3B%W?lT|X(w!^dw#oj zLBM@&Wv%!`HPJi3%BC%pzxbCoP$W}~bz~cIg}eZ-x<@hSXYNoUtxad8$x!Etb5ee| z`)s(xT)OP+B++O&g;H}>WK^0$xphAu#ho{cuTk132`G>Y(ACUUq%X>*qf|B+dVbm3I7H z`ISAVWnpxcX_|R<>CdcDAS77#>=C(MU8zUnGjN(m6QreD_KV}H|3XURU!{qmp7VNO zm3v8phQW5pqbTST$-4lRZaSEwEXu1NNDW?ixMAa&tABsXZMvCPDL+=j=V-N%e?mEb zr`?*s<=|VA&WXXJkQEU%2>}GuwfAquFEpz&K@oUsiQuRzv z)Z#d;P4BQ{r&ztTsS%;_`KQOYIMb*moLZ|<310~|e~#dlvkKLDi%0M&HzQ1Nd5Fqk zu^@d${)UZ7HuAlO&bqB2@^AW<>%vrVC_vfszu!nQh}9K$4H4MyF_Ctf6o z%+tL~lRRpku6vn6>P-|hS$vAri`sS1{ZiPg45vm5?+aM?D#u%WAlsQ)S>ziQQP|pf z9ezZ{P1=I{v$D!{w#|l3O6)~~A0CYP<*=z}?~3QC?0$0ZX74uN_M6Ap-RmG&Mv!PX z;j5{m?-@lE4Kef8sHb}GPn;BPkF@x#2nG^I`xM2yljV)S*{k;Qe&}s$`h`Um>0Qxq zj@cazI+D1n1~gVxw*kbF8U`ye30lGfsN7^>JuRb>bXkT{tA#@!eO_P1U8=5&FOOmiX`KarnX0k`n9ww+XtM5{s#iwuk#%OJxV!{=C!&aVlZ)d~W{1H_*_2hTZO( zo3)$cIIUz?9M(BYrBe9M2V9EwycJ3JCqJnK6del&bJg}?MI(|1?aT^Gn0iitWBr^jY)b!?SFa=fl4@Ve(iruDk3S^+SA=-~Y$>vN zfrf=5*AovY=Q7Q~SHsTIRI9B<4W$oYiBZ_S$s@yctkfhU;Ufe6 z;VH?_;6)MkR$k~GRyhH2+=H(iMAuF}A~q|KRwMSzGAu~#f=RS6RmIE>DN+I8m1 z%vP*w93G0T^4@E_JbumFp8~WR)2H-zIn!c|Gxdfcxeeao#V~1iQ(kul z-%Qw@IWv5zf8*J5Z2q2-TY=b;<9o0$!kx#7ON!j-Xp&o{i=O|TYL#FMQ!HIb7Uo{= zM@U)nz!aHr_;nkb>XhJ2?QoF(tO0)#s^n96IoE-pS*vd~4N(g1S*YKZrm`+bAtIkq zJ&zlDHVpxpP=yrA2AO7o|BcFQpG6?X81$9^!&qpggY+Hi=mhOOj<gyV#i+$Z`(g;|I#tKv<*z&eADb|WDS zF}3+Zj8XUKsYs*}v7W@L%*5C0&J?IYoig*-DK6gJ4!38@-wCC{QthL4skyGobx|;L zVAL`MMe@Q04&A{I=D9X?NdTw(T=+NkTr7S?UIuT9WDv;BU%!@n5hv^DP8LNc z+$jr1^+afJFEZWaviPMovpHkq^%mA0HNrP0w)8~JXa+;z2u{g$!dtb(U|Wan3F~(m zZNv*~v!UED=XwMPxW2sEwY7|JWdSoJ%Eo5&2T3Of-VJiuQbnT(*cnfeH7%Cgp!xQB9thAu-fQCJ|Be$u^GJg*`K3~x5@u0Ibhq8 zLWmaIm13dr*_z*9I)R=JN}DU6gF$t^$05{5DdC9-nGSvG++U3SZXOoG56uA~GdZ!H zk577tkqxEaF55^hKHOAMkD@1tzzEk9yA*0ztyOHiA7V+pgfu>F0wHn%miA0qcy2GTy ziX$zE1@)C{lUomKqvv)cc(;;(g#cU#OoKjjf@g-F9g%z=I-!Bj^xf|W(l?$NpTqml zapGj!N86dv9jF|QB{y087MUKj2IyNN+ley5h&&7vLb$Dad98G-a*OvB%&R z34``KNv`7kXEku_jYN|06dyDyru}Y&(E4=3W65sQ>dT2_l(Xgvm5eKL>>3uo#Lq#! zKexhCqWU$i!U^knQ!2kOjpONnOFNdN{=UZHOE{Tno7gdtDfWslfJ0?bg64lB0`Fbi z6-Tt{h#)L*_)ZxdRlE#Cr&E}}!`+R{eSVRrKA}S?CZ21Vgaxz$CU;S!l4#g1>gSmSU%TUa<12rhI-WOYS3?BomGo?hKbLv>|y;AtRch zZ6RC-uFI4}}X#C8qOJ96_GB zhXdJnV*B8JF$-L-U!87?9aUz6GWiA*G->)A>y+J=IrYxKQmy--yRrX zO`=vU@s=Ez>}ScKdO9!lWiH`mcr%2=VSglfF+P64A>_1^5sJNzLNOEaL={u+5?SWw zQ$_u>(65X?SMk|GZnh7`wqNXLw4mX}%L-U3#?8LJvADQR!o>abT2Tb^{bDhmy*Ysl znH%dBeHQV6Hf!$@dwR)FTs!5pwLh zN+>vdXxTY#m)q?|%cl*hXt-zo^r~xoo%t8APMUXBs+5i%arkf*rR!sPi38`N2}|x@ zL7L~-D{`$8JJFDgkT;A2dBZ=H*gp4Pwek0yMoP5g;Yc za}S(8V5)2m+2#wuI66?_Vmm3u{o@BtLecGVr&+&o0;8YA#G`%mpm2pRR(>5^&LWM@NV?d?@wosll$CuLaqKocKHD6oLFqO@5@;ZOFBc?G@{C^ zKX18j;+U!2;ZIX-pym0QG(Pv-1I>Z$!qcuI86VihLkxIp=^tk?VPK{|Tl#1IbQaZ8 z-zF&#z8dC-FiiiBhNlHtBkW=fO4D_)L{m5ziLo@$$$d^T?eRBrePJy`mFi&i76OVS zOHUUivlDol(Fr#_V;rXO>85Zzxipl@UMlh3y{MBXOAMJ&M&tRsI6-w7$pMF@Z_DBC zHr39!00oU)YV38au$huS_&^Y2H%S`JH7$VsH?d<2-~_gm&BKq=$KS$dQocRVi$R2B z<_w>4!aY#2n@0DkjLfr;2|0&1mAd-)F+<&i)GF8o0gq{qr|KwQiALu9;_M#`E(`%6 zN~-r4l~y#j-m@eDIn)Q&X(g8xSZG0MQeW}@>?3W5>Y)YA{Bds|tzb_*CxK3t$PX>@7AeWH5APoo5(0i@A$b7!gR-vB-=Po#)9sK0+h zPi%dFZmCCQQsCxaM)u<7vb+N`=L4v_G(>Zr}$^Es>WxX;~AN_HDN zN4fqUppJ`?^r+D%P>N~2syBi(i?$cpcJcSwl7o#)_1D#iwL2>ULF)E3%)ifeov)4t z@Wh_5ngBlIvS-`R>?w!LZwe> zDnYX@nER?f#OV6?eRiWmlBf12r*C#=Z1BAB#=qD1o}8}B&ji5221T`?1Oe0rF=rsv zj=l5JP@0g_uoLF&`yFNd^H!02-*K7 zVSo&Tjz6L8fokbZ9)KYqW()6stu(}o<&hB4svKYyGRRgx+hA=Eb?@xebKUrkXEW<2 zy3S&-m~PQ>=vOJ6Kq2o`?VfMQ0bwgQCvvupA4R3Y@Esulr;3lpV#oN%C&9Gd*2+vn~v|GZx+oQBXSD7-hD;EJ|w=b zR+yjn+9~7-|EJdZny4w`RuIL9*~B^`wKG?O@-*`4M5v|*lA9*G^}w>$B7F$NmMs(i zuHg++h*>e3V#w;=oQ>NAV==FnJorX~KkG+|l{3^(uSRsT@6+!&Ucc7@J9_ABXTsN< z2A{^29%3p){L5r!4Z@gUtp(-GW0aK8(0I1=u;tz;6(&DgCxv%kxsO)VbJ}0&(ZqI< zJ>RVZLk+3sOiIy`bwYgX#qtm+v$+0ZGCS0HL#(+ZJ^rYA<0i^^`^CP`T@K?wbd)6s z!UkZ|p6QAtEvOu*wt4jq{P%_b+w-P>hTuNxLiz9C-qXvs18^A;qUt_$@Qt5b0zDxTOH6IAsvnwS0qq9@~CJ@Uh|%0Zh5u_w*5Cfg=LxkTatZAlVoDV;48~ zaeJYcJar)488plN#oR$I+CFN-x#Exj5DjbPWV@EC8f&sKKC99qO0pIL4bEhDDKENh z90^}VHmVHfi|_TDA+U1i--w;AjEVAd2*VAq~~P+L3C9 z_~*X>L2iQ$rXG9SVL!3(&^p#Mfd701(-=P|HKr|_@yt6d?F_)wC)MSl7h;AA4WS?p zpk2=G*#BYTp>O~von7innWd6lqC>ql8wqdW>+k4%a|*xZ(^kK+@88(CuCGw+h}`0I zKaaMJE2#Xoq*d54@X!Al{`r52p#j^Y|4RiTLI9{$PW4%TRr^n+NDXbdTH~O3Fl%1p zeud(2gI{%5U%C%0CQ;%cChqMx6cJY`b1dj;5r0@MW*yx;ofSS6R z3=3_Ho2knVeLnidxoyseR@!p3s2nqkeNqYnuHZQ zP9gamsOw;`<0^HdWaKY#| z=9p&Epj~M+wnt?nEe;&P>(qYrmh3Hs9cti4>5Tl3Gt9L&I3BJ<8jr3%12Z zm*E850^v(w8Y+LImP^9^#s=68c$-Ul09aKoP03&?IwXmK9&vNr5}rW`oBpd(*39_u zrTrOlGd#v5N?gPrku*|n>Y=NaA7W_fMulZRk7ZjNq&hJ!lTnhRr5on+Cd$Vr8KKs| zH1UT=g>1FnU@`aa;de@}?-rwzQbgY7+tJ98(y@y8ABiW~9$vg?h>2}j%yC*T>0Pf3 zK~ZZsV#Nyjk-E*L7U=oq+rtKi4a6i7hl|n-D4FPuX*E$4i-9@Tv@UvT<(j{dd2;^S#Zu zpjUnSX>b!gNWYeCsCMz4&ywh~!gt}Sj-piCHFV zovkeL!BQ0YkT>y7%FGH}^1jX-jj}%>b$W9Aj|i$0HX(dD zw+B7uU_>_E+L5q$~ViX#Fu!8kg{3;Q<$QT&%IPCfx%npTF|E?hf0JCbgWx z;-2`@ zD{16dBtC^PYh~z@9y~TmQr!Ywg7hA?u)Ee*C=o>H6dax3k2Q-m&(m>mU@_l*H=J!UI*aW|AM7wav)un4?tNr-6TQ&v(0w>zqSc07s0-(_t`tZw@GgBLQ3xj-aQ?;HLk{$VWO^H|Hag1ESLwqAYr)SC#Cd^%uUKeyDbXFeIG11k z<;%cgfBCZcMaqgefG;zq2EsJ}f>xaR?2obGGl@N`>7XqDt&3~OE)lusssUOcY4sZ* zM&wwZLK@mC&vTr6m3UaG6sAzSJ4fJR1PjGDOI7ot_&(Y7RYa(0aer^4$n_|gW#-B2 z)y76eddcrp=};g2aQFxIO&OmRr0*}pdwa$huql`8l80s9fYFZ*h?lve0rfyl ztkHGdzyWx#VyT6E9+)~ny$v}bhIEy)B8823*ZgV&WhEK#4^S$K@e-N$%b`o&O$F(P z52m5NZxHnVMgcS1n%`|e5uTXcs~{EI@z`YT04B0dUvX*3L*JA>!Q%4Q_ts(a|M*xO z7KNiYu%XH9xQ^59XsTBRNm+-37-pXV$TT99DkZS;1%OB@_X!;E|BFxu*pHMG-kf*9 zgERX7Od~juDh>(Vp`}VY=YW^5f>`QjmPiheErl?a0T5Jcv8_^~aU(C6LR&b#UdAQr zcN~cK^D_Dv*IJ?Bc)C{UdChRpEc+Y&pnpw=SAUxhnA{Pi?|`NQG63C@5Fw(TI?nO8 zp^wOC7uBHynKi%b;!Z*gg-%I7+i$peqELmS-;QUpne~?GGbK%jlj}_#(*`5CX*y8a zuj8#4>YIduw*6bp;zPgTUo~zrNs5F%!Bn4ynG_b?tg^tYlRaQcok@tRE zQ$XiEuP8MEhR))y(u_~@`^u~yKlEfq^Ll&92tC_&z)oO$lQWUt=~JJsmgb1{I3Z!c z+E=>+%>4dRtCI`g<+b0ED5?~{gco;)PDReNSqo?^C9L06jZMgdHQ^jup5Fgvy~$ZQ z#Naq;r=%%P0`bBqT0ksDpp|aKNtl`h1w!5P`Fe-1qsR|5^9(P&OrsxUEkffRQYI*z ze`A%-Drc#TF|58@7$2Gq6Tll5fzpw9dlLn^Q%0c_K|6S}4xH8@;3z z5jPNVOeA%)i+J1D$8&?Jdx6}rkaM)6qrSW;ar165@hw3`uNzk@)?BBT`{6ENcAI{PvPU6&R=m7lxo6i{Xamaxet`)^37PZ zAjCg>X55n2ax+`VXAoLuLx8fhIf~M&l+c>ex)F`_X++5U3I6BNk4D0UBR&`OQJ~Eq z7~i-Qn@c2pa|erkJQ%E1h#9P&g%haDV>F>0(HU@7#dyM1by=XuM8|;-uUBP&){S~U zZ9Ue&YoE?4fx_xebKEli9YGPw<1B?9e%w2_sftv>~Fj#rH%IRk$zuohJas!e$V;`k~1V%DeV{ zknOu@*8vB)#WOh~wl6FES3>Uj3~z7Oy5;3?URvD>nRS#iSv5SvJ|qMXfj5ST<6|%5 z&szWd7Y(j&_cxLL!U&*HL4lK@!~p&hK}eer5!fGIv|Y)4_{RtWY}a3mfo!-&3;g{O z5>V5aca#%7r>dZAeDR1eYJz4Dt06Q{3`dfMVMl7{nS0Z%`3=>@0ak296NA%R(4Aou zmbt>Gk(}-LSdyFzzOp1Iy0kVKU2NL=H=DS$OP_$mMMAmqOrbsb(KeFLkszV}y|3dR z!W_sbQ>`0Q|B>e5%lArj_<`qJ)5bS6y0}obMB~J`Vj^%mO40eo=T? z82K#PY<;!TDb-`b%U~ivOAAMmo!&K7Z(FY-s;37&3D^yrp7q^3qDu8%p(kl}i?0y#l0159s?NLYsn28Y zU4rv@0k*e_bjk6!NJqn~1u`|d?i{`6d}u*_fO!FFX>`+SGqW)xkj~Ko0}-<7@9ZN6760QM z@(6-%HHOiMkopENGxnkCfQz55Pu;TKa;9GWNY%zyOOa`yHIN>QaTUADjzmm*Um6f3dqt^+C0d} zhr&5oi?@g|kXr=y)Z>#dT6EaE{u-E*dEDB^g013DEKx=WZiO~TWM^l)-d(%NC9{&4 z_a{UE7i2dH!@&uixl_Qj_7|jrV&1239Qc3{z&N0#%Tyjp^R7`zh`ET@F}2&yM8szr zd1*kXHV*-{*++S`KGsRrWTp zqLKYfjTRp;UI*N>9S6j=ivabBi9FeOKGfzlJb2*83o2W$BTKX^l_WkqcazW9uL$`F z=YhR`?Hd=EYs(|E-TI5p*cMw%`KV5$bI&RCZ|?KRFY4k1oYUz`&n$syIC8^-R})sV zAMH{lg0Pnh5K{s~7@_mPOMZ$9nl((WS1-N7NQdWdIih65QyVL8-XBbOm{xFI9p$-h zxo0j(DK`o!A#GXpA*?qKEHg8hx7J{jSw)$|kL$e1TF6ZoD@@XSr;w0RUnhnWwE+e#27n9uQ!Y!=Jvy(6GFZrY?F}J6m|U|= zCk~Izh?sRvAL5WN>UTW?s4R6Qz{c{U6wpyoQ33VG(OenKRCW{i?iiwEcF@Wjh3n&W z`BY#s$l2a(G9V*suS(K?ez2G&dV465ma`b1Q1@#DmWa=0q%u=$jcSSld-7WH{`QIi zIK`%sD~-XZQS`|TuWDSv4Br<6$;YF0eG$%!U`RsmunyN5l zs+?}SJ(d??7(8C;2;K&C8*`7>2gZS0)aKW~P&#@*)!kVDkjZleF5a`R=jbEsx7bXT zF&w0TF>%EFZ&4_U44Zh%b*jXt-Y3%?jpeZ+iX!=1JA(CvWgl^Ni>sRvxWF&q?hHSX z)o>=IOqCT=OgX~2iCfPd<&lGy9x(iwVF8atx73#gRAbV<4`2*n>pdd^fz7wy$wsI|0$l5db$O#?u&wwB=Ozm`$5L*A|1>fbqAF%u8uOzo@YUv(Q@=@ zs_br9Hrn5~aNlTtai$*F+bg)bJJ$unE}A|G{qstNcC*Kz+LZ~MQuz9Mj0f%M`NQqW z$ML%~VJ}W#bk;DX*!PNygGIg`le_l!PZK!Iq+Qa_;6qA)xeT1iX@YKybq@10f@xkP z{zwOH527YF=kN$frCQ}VU%!&O)Q2bVXq(nOF_C!t_N!*u-Xt)YW^~#(fCahFev>`c z5aK|hSz(|X8HY(K{04ly{=b*Pg7cxokTDm?K$WzFUufh-J^_?g)ZfD+G9T(2TT(e) z9j|MYYO%P8-ZkQMP71p1^m2li%&8hv(76(rq3xKtup!dHG6(B9(%Z?-GI70c5!8mYzKecq1Uq zJX(vl*XHpC;IZJ0Kq3UlNoslC68Y-(o8`___TE$81{elLfGp5?t~z@R+HcFqBe6j} zIUE8%3UZKt?vI~JqZg}f?BH2fR4DxBd+%MoEe$GVb!_Of-~k^flCtFwaXZRnw)rH< zDR4*FTJjkxnR98Jy2s}X0%k#E?oQ(o@*i-SeMD0qnh+sh#_)otPz0RU$e#^rmukf< zS@>*?P;4uN@*~KI8$Ao>wx7}1=tkbTx;bbYf=!{jYz$@tPOC31Avsd4PFJFm9fVT_ zTrCdvzuDtUMv|-oy~POAb2c*4yWn_j6eg4O!y>X z{sz2AHL4nwMux**p1fX3<+0rYgtvLy%G{4uq`WX<2d~|V(5FWj z)TM6;ygNfsX}I_s#lLTVe2qWVAOS{4nyxfXuIS}3`*Di)qB%W+;5BH;3f-i^4Lr^9 z){w1|3(lD0G5H!b`Wv+mO7Kq;AVNc#Ho>{V_rxDJB|SHSEmb`ux&#kTaDe9fz9Ryd z6<`S3_IMoFun)1|Gn*R#MDlU>odXgOqnGKHkUI93S@9X1(y5mh>p#dt^})6i29Br> zF*B>^M=}*;d5r2&0|mr)Th-bK)2;0t*!IBV=!%>({#%tCBsgW!3ovBqd^0N`>FFIg zrYZxHLzzTREQvMnd7RgPf_nm>m;+;W2BuS8*S_m}!B87Y#nK7nNemJLB0dM^jAHWB z(3|A_w^7xAmSQfTx+fb4kF;57)Dme$K&hrRX>w;zZ8vf<-|Cmv=mwJpA4pvu^^k3k zD~nCm9CH3mHtcX8LEq@c4ttRr)M!CcD4wtx-^Erx4PY#X?5Neo2S9r_%`&7t%EEr8 zHts5>LOy2Y%y4}lrU|qn&UmHYr65AEvNs#5ftIQW#H}I)^%Ci?W4U#dH-%ibzNWb? z2U9~a0%8n;P%rTS$huO;{Tx^YsN^Hy0gf+NCxa;f)9`)&iW<$~5vZVl9FA+bhw5PV zXRNTG!#@}-$hIBaWkthOOEAr4KgWnWX5~2Yp6B3n_MP3>m|6FPvee$LQO-C!JZ-r= zK*U97kaFC#XK7U&N7}}n!Jcac!fe5Q7X8kw!cE0~cHkGd1Tjq$#*9{Co}V|Q-I3M; zcca}m_(hA2Kes0XDy;x;WPVQ?;E}EW(Q%|-U4GpnDv!azJ)J}!<`GGDX>m5ZQqs4 z4=r+v+}^rfDA%s8;MshtA>bLD95f(BU*1a__SBgi<%W%D%=kLAyo*-=|I8`@`RT1N z$)$~~y|Sp{C{3*K5Vvj*tK7OD_o+SWlups(abfAh&ehoi3)Seds4` zJXynQNvsZ>!`wr6%a(L{p}#gcEAVaQf_tz1pmuqXaK_7;>5Q4{(*oPXZ^{4-Lz51B zjrp26w*N5TV@}*8-N&0d-~Fwwgn^Ds`D_OP0U-nqy!r!!fw_BiB#A|TOy5y=LF{Wg z5UA;asf^Xk1sr=L*}*uYrZc(gKnB#xnFfM4{gLIOfDV-m_&A83aQsI}p!>r$tTF^nkpC&2 zVroJp9*f*T^GU3$s`}L-2E=GxJi5Nzuqg@n2-;Z`k7dB8V86Zo9S!yk4-|qPL44TMw-ImJ9qljwUo-5iRBi`In%034$*Dk~tf76EyZ^W&&nv1+qh_j!eO`H7&O z$A=}n{nj*I`<#uTw1J0fUZ=Zg*Exx|=P|C^W2#3h-Ro{H3(bz1)2sLJ7c^0LET6jp zki$^fP{nCK!+qihKNaT)%y>FBS^DGV=b#fkWPqTpwttLiRz*q{N7!si*G#vU@Pm!N%q;Uis%r_-J4!H38 z8dFpVNO@GZNwcOv`G^6b+c~zkUj*H3wtoS+*0Pf$TinWu-tAx^V~HPCTM1#%DCkD+ zuC;rCBaqY6$z{1S)LHE9>}AVR=0?1-X!iFAmL9sY1M9=%jUYsH6k{P;sDX-m)iYhi7B!N+jAeNcS1lg0?x%)+;vV ztPoVbyuUI#?T0zuKJ4WvNtR&`|ALfD0%d`*8th zawsLA^oR+~NuyBUTfmP3eFH}aARYUCWZD3tqvz{n3Ojv86n zfaQU4pJlar%4vpD?G(?_6`2;;aJP(#M`BSS*^9Krr4AR%Qiy+@XqXYS zkDI~WeHUi|G)BP(#D35+jMoUZObJTbnf?_b5o(BONc(Y{i%btHdtw89yOvG!`M;`6 z)q632@Ci1;4w|XBieQoF^}IBzKPEGz&z!lF2IB8YWc;SwAt?~~(ftX??c0^mjaNY}TnZ_^1`9ik5TS%1neUCq8Mj#?uyj>k64Y7O9bQUQSFr>6)75dcJh{ zEAw|5KYO7)Kgray+_FXogA0niSvVtccMp!le;M#Aa=3i9q1)-p0tVcP)QqK{Yo^>! zD24~+N&ubb|3{ta0dy`u=!c6YzT|2a>3QM^2oWkibP=w?C6ST^$6{l$?s$&jo^ zZ90Mw3>yvufa*+G4Lnl92l6Mu6DW;l1V||yPcUSRp1qSGFNH@szB%2dLT=G_RKe3eENgsrtqz=+x4e68oOAG8r5>> zEQ?+mCKGngmW*$CPih(YIPHVx#66$EafXx{2i(9-s{ zK}ma}EP)TMNg=sl1_i7T8iWD`ko;>fFf1?MQ@eYWXb`xk(bE9S>~mmlDh+XRC#;MJSA3XxGfnq0SYWKxnTEP_>d z0`6}&_?efw#pfIeI3)e#ULjX8Aym}E?{ptL>DYSdd3#xfqYaD%_BMR`J{f1S1%K?+ zhp=`v_oL`o)R*Lk%T-M8i+PVBSaUmqu;Sn1D)%I)g?F(nz*w+Y;*D{c4#!NRTj>?e zPN8yE|Kd3yv$7ub#FICBIJY7lACUf`|5?7%Z3c5Ux$(^AO!=m?am;Hdrm#@Y)-OVOh2`EcXn&W9ebqhR#g zn`vF%I+Yb2OFC#4vN=&Ov^hP%nU%aFkISi#8*WgLlf`UAd5=7L_dX@8{(rG6vd#J2a9 z;pRu0q1}bMFb#>*@-rW4=@Bp&$L z(1t*q%zE-;ET>176bnAYC2~!EwT{8>-6Qf7_B{_&LLWU{CPFU0k&A!g-7#BAZ?x;# zxz76vdY!u9s(C|n#@#nB?!Zdjn|vY*Rl?2A-i~(oX!EEd7Td(r=3Xp>%;7oR!Y?q^E!3? zu8xLjVqV9Rji@Vt9E}0?$_)N+S(T~o@Q#II|5oD!{X%229>lGsWGwyeJYfkhwy3`W zM*)0?{+@PU`P(z?w)kO5jmfb+1G+=8JKB9uh z2G_}e>-JU}C0rg0JYN>Yow$T&O@A?|Z7hpL5(vKUcH`p(Ui|cr!kVy zg)(&(j~cPRn9^O8_dV=D2Cl9hV5Q@7*dh@#V*&F}qz01N_#8VQ+q)UgUfq7OKqWx0 zTm25fQvQ@Iz5RLFBnPUt@mvo>7{Jkg1-P~WACWoZuMa5T_jZe|Epv2G%`JK0wK|(TYJPYA|e(cYMT$9gYH*j{a+zmlC0Y89V&P zUv_WS%J;3)bV^_wHaK{x-eyBjT*3Or#1M@l^|p0J2VJg<7n8lIXnz-+klE}hzD}1G zQr$L@DURX7!?igrl?0k)wXZUYbk+=;{phF~$`HE!BiA;>{dRO~NIx97YE`OS`IQ$v zt#<`GB-kcn7eiC?*k>xc7*Blk#kPW}o_>(NCVS5>4K;E!?FG4%(o(Cdm^~J;hA%7M z(LV3j$_Yn)AKIK6pLMYv@RirM`v!K&sCI-u(;HV5gky7Tklh#+vqN<-1S*BgyCAYL zNTSS6T8`@MhtUiDwm7Fvu@*;Y<(c@O+OxCj~ZHp}_%N#x|>k;^j9a=&a=?xHc2 zhB8s5Ibp^NhAFpAy_SsfQ2JljP_^~kYd*lIuSqxVfyntM*8#i+z-$9`ZIsb-62Sy^ zkt|a7FRD%M_5$q&Ri;uk@{yS`EU;nf#+Mox!)Amk&*1fu6=YD}m+!+z34^6OmN1Y4 z*y}2sO-2V~^2&@pwh|k`1rvgUn5N5gYu;&IlY2c@y1>MiYudHy(I;3T^)Km%&ebXM1yCWoBzXzdN{xLgm@f1LNxF@{>FN*=Bek}NWdKLh`)A8%okC@%}3!0J4 zuSO%Dep{T%itS}?w4)M$huR}|t##L{qp6?hHV4^?Ulzj;d-S8?vq8)Uk`!rF0aMFI z!M*@(Ws#C6gc7klVqbt8mt|djYGm_e+2nYwPc6{vd{>uYS2C3qD&l=wlrBwtk}j!Dmq-do ziXfdL9nx&NyIWw>A>Ac;7W()-zd7^1e>meXfVcZz*IL*0sWo8Qus^w1{}T&A+!1GJ z6P}HpkrhhuhDr;pmJ>ohli*3n5S%Y-wylO(Q&3yXiQ6Ww*qp1ubRtsKC&Ftby0bVS zCYuKhd;EEZLxFfbdR2rk*arIIaHF~=g{Z~-pypyqn1jR$^XD?R5{}3Pvo~3N^Hv8O?DbX7<>!M z`viV0zbxu8;W8KzZjl#18Uyyb4B^n%oEak8^;`N>HtUIyqW$Uh4-DI-?78osEMeL< ziYZq``c6ul*8_;UPkj~`fGXxS)-WG9IYh|?-F~`j zkq^hJQWnJJ*T>oAG|-;5v<_6Rpj9$9-M7)sx6Ew1O4vBMDrxm@ayo3*;Nq{u;UCU9 z+N%>1u}u?6VwL5*CDL8J-@Ut((<DF?}U0-cRFYCVgPCYUm%Sao6xoS0pFOXwKd_N4bIY**Tqws{~~G z-GWo6&J0<4|7$rT%?WG1-|9*4JoqZM{a0dmd{-D;chPL)NYfNkVyj{&_V?dQ3QXtQ zvm_cI)^&gw z4A0J2L>hWhhJz#;6WU_Rom-Go&_b{+HU&!HO%N8@s!x?e_Gq8s6IQkEAWJ=ti45oF zaW9CPAAO5}`1e9*Jx%N%KJZwkkeLoRR%C}qPAx3RhhO`C$i2TYZUY$LHIx<+oMN4ewIA zMrv_M_sNBuqK@P(XJkZIC@>qXQ36t&iZJrwj>Dz$A2TWKPXwnTb%mLePT6K9VpXkOQkw?;b4 zt#TcsY{!4JDkThEW_B&;S#-Aayn(}b%KTCssoFISmT@z6Hku%qvpGK|xO^w{`=KF= zAAo9$&*aSuF=9>I+Pf-)G;$aD#>UmE5NjCIZo$hHH2Vc1uB{PSdz~7oUOk;b_?&G> zkkh}m*n%y^e(7^)diC+Bd1SwP<}3m@lxE3)-TqTxKvI3GkxzlqL#?4LCJBP5U2Ycc zB-Nq%jd5e_K|UXpG)q27y*9pi0IgVo(STB$--QK);MK0>b8XuN%Pd8Niaq12X4S6f zrozZR@^_n350=(yXgokCijh?*HyfZ~8qdP89bwgJk%olUzbnyqg|s#cA;&+W)K!;z zisK_n{L;LlMZjQKwx-1(tuZVG(U~ zSVPZx9W815l5lkf7q&IlY5e$Mhos#?nQ7m59Tr3f=-pT(8);^Ic>DBX$fEi{h0)D& zcB4G)jQ{YHrl*KEshyK@6y2Hau9AMbt4qy@u>WSnn|hz)=u1z7Imvz{K;o)^#prgB z-cdt_@aBc_>)4$E%^ys^kgTPJJTG?2hgSPW4S8&-U*5Qc4~EzFRaG*%xRKdXJKSpc z=|D$Tv|^m&dF@hHZD_hH2Zy%hnx7z~j`xR?@wX>DbK_RTJZv66!&4C)D04-qR0)gz zqkrm&MiB*eO&Ky)*b`utKm|483GI`RA*Fi_t$8>-9@)7^{Iu_30cYY2KC0m7-LUQ> z(9?|$JSJdyZ_Z7isG~gz^pHC5jNWd(6-;k+9WRyE0F_|8TGbM82Wiop_6U`8QG;CV ztUbT{(8qhyXM3e00Qd-SN|16i{@xH+yW-AVUBqg!8Jb8NrnvIX+|qhCwi@VIbl7+L zx7(9f=^)*7_=MZ>y5Dbh>N`-~9DiPt{s+X$i2}wXy%ChuC02Vn60+gaI=rh|03iH& z#azE)Kfon=FXf{oO3^Py+Mb2_AJW=qYA#H9a!zUVGmw)U#iR;Mrs z6vW83uOKWl8;}8`dhA%O(P!kR-~4niQH}F;__~_c9%q1UbkvYYg~TZ26~Xw~L~VoJ z+Rk@u1rmO}>4KpDv=7amh;Csco;&V+xAOO$Rzz;g5&>I*SU@N{WKqae9!nRwW^pC1DHvk=0INkEi^K*uSJ}#<*%s+j#(bJVL2SXH-i|2AXEs~g7|9HZ zopn-nbUJ2_m1`{uV-1E2v;nv@QUCJ!UQZG}*yrz|QP{cU zbC+}%n74Y~8wp$KIcxz(#b{o;w+uWcExSox?XszKe~F_J_opw4_9hDAe%EIYMPzP4 z*6MxAw(QW%o{grBVvF^HE+WN0dBH7^oA!J#xVb_UF=RVk1=fZ@r+uEIxL{eoSCMvWT?= zhd4B;pa-sA_!6NCsdirFK@QR#U+G`ux@__NuPceX?@IP7V|CgQ-v`}q#3@e?04Q*; zY;ba)m^%%-r?PBp`ZhcWoOh zq6Z((1n|NFoFn#VTdAQF`eE&Tu2rPAYC22tpDZ_=10jsXTIJcj%LlUrEi8!Z&>-+{ z(b&vZ4XpFT)Y0G`zO*RREKRP>0q4AYGU=w_|FH378_o|+5VkJa7F0+?-~|`^!QZ`f zJnOBhPrAmyH-9(J7VxCSdq^0Gozc`=kb<(y)0v>czsoVWbrN{OM=~7Lx*V_L*#A--e2w zof7P4HpWZvqkBw(BZaS2c54fG64k<8bYU;aFkG|X37Vo$YZ;*|0>XlN9*`)R941A_ zh1{My>E#Aa>U2SF=;_!60s(ENnPc| z)G>ymOwIQ$ryu{JFff`tbm4UUpPn`pv7S4Z;%&<=n3u8y(Zu6%290n!=yUTl0Ab;4 zfv87{j>3pJs*QrV(YA!X6sP~;DU|4GKw#kL{q?JH;5u1FqMy|S2c!&uN$0d|@k1If zF>FKqT3Pv!fRG&i)$UB?no|uu2u$JU=Vpl|d-#PK8@VBbkateex8Zd09OzwSiIR!I zJ)}<9peM;C9dEK<3G6U<63~r9z-u?3%pSZa2Uz3hF?`tfU{y0O+M=Bi2-109ZVzL8 zw%B$ry@_CG;ppIf`@R(uSuz7Cp}6dq#Y3N9{axG>Hck!in0_=syK!J!vq2ER1}P&} z>mqWi`1cyqKqWl#Rr65Ue&2u|_+&FDEuU(AA7DM*+wa74Ju#RCnV=sR@ep*ZAABp0 zrc>;_BI&<4oYIdq#>$~nAJq|ZA*3G;wm6L)ou|sS7s{v`zkPf zQow*G3sBs>8(^DI{#5YG+d0B8NM~E9eLI!L$I&-xvFbIr1gSy^zUKGa2Z4!6BN_4- zy@|AVa}BO(fj8`v|HpR!4F}$n4%^i!8aQdwyPfX`(}xK2I51m*>WKLStHfu{?tSu3 z%ah6s&Ej{ZZ-H{>Il7*S7PXaL;4;)yIRyD?sPxl@U@ z(%IoQ=WnXM^RJa%4u7mPwz^RWcT5VX_qd+6b!BiV{F#rsMwBFj9vGxbE@6Y=!qt^& zW9iM+Fn4RZ`QgN}Cv}~Rx$vRh>mov~FZPpuvm$3Vl0sAOsU-5GYIVP0{qR`g!AKn5 z8YURcBD8Hlz3;(EpZLxG*WH^WNvU6b)Lyk>iks-l{Dqyj2xb0aS@3>;?BHEChMUx` z>i=&P2sGSnOi&4I3_uKmHJ<~ncN_zMSdirj;N>(z#7GeJxC#WjXB>a1u|hv$5I&Pj z35Ao&1@eWyHTVa}IO5e+evJ<+@FG|qF<4oVFb+O}Z(He#L{m93Vw6CX^DStH({$yM zj(8D)Sl#Q4?B9z+)FviLD3FPTxDy&Fd@0RpjIJq%RDgo&Yd(-jo5}t;oB=20N%G|O zqUql*>3|I3Oq{rJOvV=N-b@NqNI)4iw8l*hQ+n#qS{d&=Ooql`)v`04ZN4Wtl_h!T z(GXFraaupf>?s4O1L7gSHp4G8uU9clJaiW4WBKfj7>LSKTXoTFpIYnzjosU@`43k% ziOLcIpTn!}m8g$jcM>N&UuRQ2thacAUX7VU12 zl-~fZ<*$uHja+=(B~xb7L-VSFV60CE1$CJ{TC&P|dNpQKT7&Iw3EJSaiHn4SqJyvU zO?Z2A;wfua12MuG6O8*5&X5ez1*dxH13LV zD4`y2n`NKk%u#Ke_Mjeec;CK%H~RgPZpSfovI>taOqzgE^|QU((#&NR$0-5_rzVCi zhd=f$`Ia}Ksl;;IhIXm1e<|WsAF4+Ate#TmXWyZrW z)2aTZ?v$rowurT?9eHMTUsR|M3x8JjrA^w%;=e3_YVw72a0rQEL?j|R(v4q5Z<*Lx z*am^RizZae-P!;BecM_ZqD`z}CqN*hr;6^n^lsK&i)5N7*j1yct_^1E={Fmq5;A<4 zB=!AjZzB4tw&_0hYNBr>0CaM1?ghJ>y%81LqdW;! zIiv* ziSB`8)%uZut>LL?$#`y55B|$0)(&T$;_62yZW=!{OeK~s4nS-TfMCZk7t_CLzB4dwE^s3qL|nptYkLDgt_xFHJfxs)y5N0W&9ozCPm8AIJroYndo2 zB(1u5>N#yl=!fP_QbRzt9NEF?Rz3<#&4GH{cZ}`56j5>@w!sDZkj}}IZWyB8F`eME zfLr2v1d+-C>UgY>KZz6blwi^=%5+h*tN6@lTFhGRtUvw9j4Y86DOYD^HwRG+&GfoQ zrz@`>XPL^0bu|1^jfgSMIm)!i`qZ+cr-M_NkKI?RFa#C4pin3hZPXdeFm`ANKC=rz zZN52n&t`a4VoRoUe$pA5t1123@rzK)uFt9d$c2y{c}&JI(Boy%yN#6AoMhk}=EE(4 z@{cr~J*F9w!cG%O2M})?ummnNiAy}Icee;S(hKz#YY6yB1aiL~AKptJNVWWCL(kci z#-_PV7Dj9lx4qu&67A%sWNUxBr2|0Jt?)Ye|A45k_dwLw#YyEljzt9cX9(>n0GG)E zxTqF>n`qCyPU)u#tpQvG(4v4FS;h;shx(OLfgkrPSQ;qqSG70=FD}%}b8`8176y`d`_!mgSoZjzifgdBQI(&b70!jF z)Z9-;GZ^)SY zuKlt(43k#R^}3f8m`%MCXOgmJ33V?8R1cyn1knnp3lt5jD1>sGKAwScaJVlAg@icj zP#>WIQb8E;4w5IGl0Oyc0OB{&zkMTc&iuc9W7Jb<%A^In+Muq#I*TSO}9YNP;7D9Zlag zIgIo2S6zY9JS%#4|I}Q0!1|PVbZ{OmOV~;zv(jA7?x;XK*rTcFL|r9SySk>8#E|%qj~B2b)m!LR@kh*HHS_sxXp97joic;aLNq9;kK;Rr){W!p$|} z)Bw3M@9vOvbp1s=+s@8Ao|C5cyWQY=8Ed-m#A)Dkspio2!Sn;-`aHG)0)=Yq)Hz-{ z0y(_^WOY*8r*4wpGF=jxf|o&XO!%^3d|lUnE+$HZ`w?xwa8ccrOpJHwA^`qF%oNHk z0RpBE5cI?YQ%cdd)e~s^Gr|@RNPF^YosF4Frj{D?2lYg%YVgH$Z9&*^V|Dp_HzW^! z##gDypXcXD+;frIlOG>4DtH+mpg-8gxiR{TCTET0H6sp|7VI4*mt?a6M{<3kzc6jV zDOc^JJI7~a!aM-DY10^9N(AGdZ0dqDttvM_u-cwuzHRnjg z94#pAHiAZ_R{sazE41sW{nO@5^P$u-imE-SMeR=lUrRJ6P+A-TNyz}z1B|`b;a9jY z-en1SL|D+yY_%dQ3E2bb0JxiiAB|tu#)T!`ml}1fmS!vjQO$!Bj5cIapIAZ*ORhQk z|I}mdE$c=(n%MV{g#_{wb8$B;WhlfjVQ0&I2@p$1$-c)mJI;zxjUwWzL`JOhi6rko7q<0_#sFj<)Pl2C~ z#?0mN1ct}&tt@6@d>s62bWBVU&);&LD4pmuauXRqq{gvPQ)f<3X=aW7+Mt#LT_qv< zk;Tv&3gNwEm|m|H69nNXs2dIj-iq;sRCR^g@PEa-bU9rjsAX%fNr*PVv++Kr9Mkn} zX4h@#gE?gMGqy+JYlVa`8^P4FIK zy-@Bxqc^5*U|?YH9nppy!1|N@xM|vtX!$g@t2MA@+tN8wNuC;PX<$+ow3t7!Ja`mU zhOBmJ%9Z?1Aw__;gO~^!f=3sjf96jz@VCOM(7@8QVI}QDBz<)7(drl^Y&;5(0c(M_ zo+}opZ+qi8GVA9jKUPIt;;N0=lVPyp3@!^y#>S7;?$i5U`7}3+hEOaxV2ZAFgnl%L z@I+^K)liBE#xYoekut?*!GEf&TCo(?j_+GePtOq&%)JVF3@KGm1p9KR^@h zaDwH4Q~2gNF0A$qVVog?vM=xf{(luv`b6XBazjw{zn$(qUZaD^Ue#(GHvesC_S75! zM3oGA4xP_niRC(&I&tAim{gFzQv4BLli0%@WTn;}jWe~>sVod5fT04L(jJ?2U9*}iux3J9_Sf8ifH8D&1+qS#Gt zV^EFvKZuqp4K9*HQrL0cXq*!G6P1lcJn9I6p4B|BFm;QuHd*tB> zg_onO#rqSEB~*L7atogQ<$s^36#W1HcMp+(B$=7Ku;cn#-GjJ;3x%yj&7I_a>Gqq= zEu*WU`1hzVMIV&YxuF=V|9#+dp!|)UL=d2N#kh-Bjv77o|K)R|V*m9vx0SOD-dkYr za7%I$fLp%h!x~;LJW)i1`k%=j-tYhRI=~`@>^z@McW+L|Q>{_>_Yy%MIO;)qqsT6c z?foM8^Eh{u&BkH3rD@QwfG+(p@P{t_vtE_|b8jj~p`8P7wr|Pb9h@XKF6^)!?F0Z% z;{_UQT6g#QZZy1STt90~Pk^E)4@|Q$%vzj@eD+kd(x00-{iCgbMF#jqpDBYq#{yX9 z6k@5gOO253{g7LeMY2FL<5Wv(e&UUAra%tVs+kvua<<`9#S84NJpW%1+=hjZ33>xu za~m_6R!(QPS{~QSk4&XMM~%`+E5dU;uvR14U3o@!o#OI#T8v;!_U5nsp1bh-HQkWiM4 zL<~36$o5#lfMg_vVucNf@2Yd4kjnO`7Uk9l%(GYBv8S^Hzz6{x7YmO-b%SJ z^H6vjY-H+iZGaV4v9`8$#&0qQ~cdT2^IP;}wxPIT1${FiIsv8|HYdfK7Tk{;+Q=U1r zH1SvuNU-!y@(*+;qcus0Pbd~?lzjef=zFc!7Jo16*i^F4tA~VBaeWl4+w|hqA_8ix zoX^AOukaqu^2hXMu}GC~4cfmOqjtg0@tsBKuJ;~KmI*K8cF9jxex~u0c%tL*5jCLV zCp|(5_fv8jw>^eqk4ZLK%C8>x+;e{OYmFH%7+M+4MQ#eH2ZUdQ3q0PFdBFIAuFrw77v{=$oM4ZCe!eD5XHv8^p+&0Tf@~DHuwpigcuaZzguI3Q!&20U#8=jXC58I>7o2IP-Y`LcLzH z0q&c&a;?GbE+88{f_v=gr*myxSGXxR7J*J8BADSM{X`pPfQHn8UKY*dL0dxwMaqy2 zB^lmwEXea*8rn!29jr6Z8FQAv_c%V3XFM}kW*AS=GUu7-(e0|${_(@R+KR}l&KQS4 zPWdxWLwQHunRR`M?-p~RJWlYwMUAY$b3wIX%4jC*hxyAJsJOwoi!L@BGF$b9;U9;2 zH2ElXFzo($L`HzBbXI4XSJhtTQSDP$GaYyQEABFnU%Xr^i}+hjx3Y}M*?a@mW$oYQ zBGeNHi(do1oKsBrQ5Lf}laAmyiIZjmwi%?oWbGQc;(zAk!BfXdY?rxAc|h$-9XhQ2 zJ3y`z@6Wo^y_L?tr~=q1UL!~vhY3$>+T!CKJiTvmUJ3dG+Z5PCf?NOg1}MOUekNVs zK9-|6OREN&e!um;=_kXx>g!qU-QXCu90&bM)&ojnyU8a5Fn<(m%Y)z%Ga0g(iu6J) z&XM1taT{@HD*Yf;bVM5>=(3}E?^88FuwPv3i?i&DWjPt(UFe3!FsO`{8h6p#FSk2@ zU^Eu=m4RU3Yrb!H3;Vue1NQsp|VLKH~`DCn<=SO$V zd7fMT#5Nu{ta=PmmV-kG#(cuq8a@+J`w7_H8He*cK5q;$ zw`91fp@n?K;xe_h-?LtbARtu8$x8&7hDKrWk0w53%e0R0$ot`V94(`Xg$Y_1+X;A1 zt?t;cq*u~HB}^|K3gI_pw7u-S`O3a0YE`ju#Y5+!L; z`LVhU@%j^-e$v(0{BqSF@asD6Z*zLDbz_$y6>y^GwwZ|m%m!5kDZfKNAU1`9N_Kp^ z%S66fCU`|EfC1Eh8EW0aLODH}3ltD+*c45+6+#2LN=lTps94!o*yO`wIYa$7VH6_d z9RxFje`sfG7I6T*kXmn#qis`G1BwP1!^2j&-3|=4=IW|-11ntsJGkoLMrv#0>q^T? z1qQgPF4OBY(8@_gBUk2GWFVA9r{ch>bm#qIli$is*`<#9VwwY_CZu1UxwDz5xCym-I(n& zCvm;zuCQ!!Cod~saWs4Wx~I>LNpod^LL$hvk4uWi+)JH zq-+r>$*nPby;!9(pGu_rzM{s+P*{kbIMChRk6jGe)}NAG!xTvqUfqYl0I3ylk_q5vO6DmR&@5KH$&%@muwH&aTp->ed~dFf8h{m=jqhvX`vC4E zW}K_>gFKPf&XyfnYpSaY1vH2sgMv_4^&6StOfPZ1VP}J*-xvrm>DBUM;;ReWx!)mln)*S05h=?yj9>V4y_kobl#0tQETS`6 zIJ-15+*dr#7v{SBLXYit4wYfg@JQ_b#<}GToUE`%H zSMMTmE$Tz@y%dE`@fFHD-VjIuQIqm>W0tT}Qvc)L%c`Mi@~oJe3j%}(FyZ%iI9`z_ zEkEvVT0>-*9x?cNOeNkD%M(*GsO#xvSvV0z3ctXevKR=f9O1Jv*1yVmJDcw^i2N#b zUFacQTC!+B6P1C!8^0{ec)8s-y-cpj zuY`|RB94TcZjVBIK81c)PeV|8`bv$fdtPp#zQ;|}S7(Opa(6o$ir^incOAB&X7O39 z?&QRmLkfANC#b7Cwi{mW=zQ|1=c&s`0zY5D`v~3lAFwvR3bB}vzOYCwNLfy`@<_|+ z&5cggyw18IXdDjfy6#LKnkAzYhp(<$C`ax`?k zA*sS8f>wV0x@=!|zhT|)Ti$QsZ_%T%~bgjm*+ry5A)9oVCM?qvv-JN)x*Wq0dYGLWTPzu0}sKEJgB*AbU&8dcmp~l zj`j9W58d$`!-&Iu7Z(7plpz^T{LSX~%j0BDQ}h=?LSp^ImM?F{u7jOdn$Zy@;br@E z4Q9rs3>POcA+tp~yzs3vv$LTC0pep1sw+M{!nb0?NtaD8#>`Pj!6kuD@xD5H7)34h zSgYdEBbuw*8&9qA#h=x7`f~B?VzT!?GA*CXr`#7E1?;o_!j$)Z*=R%}SrW&dFSPat zi()JdZimZ!4y(aG7tIHg8F+YDj+>+bepG7Eg5Yn05T55fvl{klb2O_Xx!a)uaAHQU zcv#zhc`LxnCIwac>TE(}%Nu5v1>P`XMczIn;EB~}9x;wrHxiiC)%V9!eDPjwAcc>2 zQdKJmzZ4VR5gUomrqCyiO<3eyEeJPOO_$X`-fO*5LnG>3pCDi?r_U`YnT#Xv!o)p< z8vVVty9(`6zbxEVs;6f~eFjochT?o9CCWlT@u9>e@-KOd(t;=R-sd-O?Y>l^Wyf81 zHN$HnRI`w3FJEqNzr-l=zoX*1yK%;%l4+;cR-dz}EZyE?#bjkiyg53Z8ojDL_uc+I zJyRq6aF)NY&&iSplv++@N5YV7=4Z=q zn6&Q#wTKPNrf8yUua~C}@XHt$lY|SK8nIZ;D~9PT4^tHyAZNdyAUO%cO>sJo(CFZ? z4C&IaH?xQ>(M}N%$~SIZAV*Q>UscyjzTU3+^((P{9(6KRZAQs8Z#TcUAOpo#Duw9N zryMn*JgkW|13e@J448r-2Uc`MB(CU|Wk)5C!Z_3nMP~6PB1uR5LnHpj&&=u$k9bjF z+401$R_$`@NIt$P*ncYHRw!DwTg@Ffg{K&0cl|P=4DoKuZZxkZJK0A74O#EK3oEJ; zH`c@Q>gJfEEp8c8WU>uIUGZes-q~07g*RSp5j`(ujKBu=&iwc9kLXSXenoxntVOlz zWVDY-eiTZ^r4+UQUcbEhEMjW-h;E}M9Dyz=5sx5V#~CU4`4p}xXc{T>*{_xKnN`wF zReWI~)jWK`%%8@+Hd=SekHVGNaT z5njgEEBwlRV^UZ=f<*)JX|}TV$hJ0?m2QRqZ8e3>X=*;+<9FpAj&}dPBfud+padZr zxp<}L`rpsMSj4skP>k+41}f9`Pk2%#28bF2bdNm9<{?tmZOSqKcQ)w$D+$>cN7tibv&G{WvT~q|J)o|M@U|i z1|A77(DkUu`x9{^1ktw3e(bIv!Ot|qf`VA56!rkFY2Po>29U~k6aA)+0!#+#@E$)D zToTNAMChMj!V=+attRqmb1xZXZmVo&13EnxV{yA#>j6oytbpLBWZ6bZoW@ft=(xIf{!6m;N?X?_wARgXj<+ID<88U<-(@MmvCO!O7@ zs_;Rm*C((ShwwGT&-R<#sRnk+t!)&4qEk!_mjAk!pDrqe;Lk9ef>GnJhFe_aq+q~e zv$uL6>na1St$kC5iV2gUeYt00d0fH+sk;Em0>SSuRS})BSorY2j%ldt8cqnBGv`qm zN@``tsn~UxR()CKyu`DuhOuwMQm@vxNq(~RFv5+T*pC{^MU}QbI*VG4;M27K z-f(gBEjI_nN5tzc;F}ftN@o&Dy1)YrOx(Rf4Sl_qEvo{qco)0f8~XVA^jx;5Z}^2B zbZK+69YW;EpFi0lAbcwXkzF&AiU=Q(=xpZrgqO<1Ub0=I_0!cm&BDmxkfD`8ql(T~ zM=Mg-5rc*)*sckLzkYNNS=ncdK9z&7UbWUSbu?8@U7TM>Ze+jmp(H~oFNsgiknEer7!lbf6o~%Is8>+?j?aO1P(t|;GkkR!rdWG8{;w&b zD5J&Zn;W7n4snyOiaO+o&-z3o+OYame})&QafG;h-;Rz{6jf-fK;{gffyf%CABHmt zU`-QDDUDhb{<3gmjHt)Q8s`sq-}9l({*8_hMDTKz9tTs-P~B1ksp@q0wJQF493=ye z=AwFQS;tsx%hrs}18(GLNx`mSqPK65it?U1Hrr%|PuOqly&ai~A01N?g;(qm^7K7t zwyw!;bS32b@p4UWqViB0tT9{$g`76oFb!R!@|E9RIq^Fj+WxN9+%K5n2G8{umWr2c z>()onnFY2(Fhi2gc6w#SJy&BAsj3!ulUn(DlVV!Z^impe-mG!g_C&#F=k{3LK*fY?>pvWTuYRte&>Ub)-F{(ZZWUaM zE=rp5YV`|MI+D+%0 zTJy0Hn6R1AcZZr7uF#@oPW7VJJDIpHe$K+Y!$x`59>=uQgsLF~pS zPWH=P!6cysOtC~?5N+2ka>-lDR~cm$Md+k-jb@TlCUUlMkGYN7QNIIgRlKZBg#08g z60EmAf=m$of=4EX-cN;ERDCEf%AS^gOfr&O54xj}`a(;zgDV>hbUkMMobR%Ifbo5S z>g|hDhVMuikMUt71HKhh$Por_M*|i&a+NdRc|igQ4k8gM2-zXq6j@HD{Wj?!Spvld z3*TbwY5FAJXQ8T!&1~L-TxG^paL}Pufk>-5-z4B{xoTg3wHr0y-1wf+#1tJ$o1;_n z1PX8QkmDM7xD?Q6Cf zh^gDnWhEcoxt^CklSZ+4^t1fvRiJM9I93Egxd80!Z#~7p4q-Au9U=VN#(1c@-RwGZ z8>pc#eTU0g!-tlIA>=)lR&QPuqUqc4)lp$z3wu6B;N$X{{zGoDVDgvzy$b3Vffy)i z2$YJvXD<=fqP98TtCC;sR&ZjId$|QnPR|;6^gN;3jzx%~L^k4Q32}@Ti%`tU8eiBsdUTeAg8wo}% zh@{f-Da3y-H+rk_Gh^EJD^|#8h(Iz3__>@BQPn7_Y{QWtdyx&hdalRm(-$ zT`&iZNwQ~gN^o?+{;EScrm*MP-25lAB&*Qtj)|#^mw}AF2(}UrdPDVz6A^6F7>HLB z;>5U~a(~_(Iqd8!pf4R)ra5Ke#PlZIpj!ruLTxXCNY5igI*x5jF|4b7WsCeO{mRoO z^6T#^CzHj=SoP4Z-oNlrGy1g_QsGVJZCc91^Ui-?D?!MR@C9iVA7e8P_%z{@lzp0# zX8Ye9ivHP;O5Bl{y)>S8g^qj&QeiL~u%A}g-G#i|ML~wrc82xiWlDrT<138kQ1d6- zItLk)_n;Dy-#orDHtfsT4$yf#4E()4#Rlkp6o4KQB8QTblPB`i5YV)BfLYB#@h#{@ zzZ~1HbcR2i$&O}F$wqzE3AAUHgUw|)z6}7>AXZ|Ue-HSl31InoI8shN7Eo zCK0D0Wf?ihpL;l0cQ#7K$=UF8el8(NrEAR3Q}x+P*p3WAzpaeWx@u_Y3Jwa25H`R( z(WfSl2UM$dSjObO|1LKB>E`%g=GTT#53TCw*VwSPwjT)cjC0P^bg*GA{nKc8p^8Up z>))2!H7zQ)660x4_#QSF0x`fXQX}es^?vv`_wV$4Tgeq zOPG*D(!MQgae+U$^%|EM9q}=AfS-=+y|9qfkC*=KP0g6kD4TcF9|)CR?2yJ(7lhGr zPhM^9jRMbjweFmhLS;il%w0ne4Mb-lgCSe(z$?7U#mXmzcMh{z^&N~&b9@TU2@MxI zL7NaZSXhBtS;o!YJ?r5`J!7Y0x3Q_?mW%vp&&C4*>y!7Lp_;WlE6l^|mHkeNkBdU% z`R@+%Uq-{e$Q8;2`w)&Y?P^C@2rcP`3!HpV-KG6j^ztImv#@5n4QivqXTCW3Sp8F1_rJ;v z2)jpkyEg_K{x32jizB6(CO8yHfLe$!d2M^EF;ePF_IS$pFD{Jgj}9H@5@A?2>Gz6@ z9;Sm&#(n&i<C^KKYT2FmkR%`w8i^32^-kUxV5SiA_+IL~PQ;ye zlP#YVpu+0Bw6>Ndbm|2ZBOCJ#b;x^{#;Cdh1SPpXv}S`w65b|(R)7rf;<5f|P?E4k zW@|b2O}>k7I0YUAd3J#a;1Q5G9A$$J&BCm`G5}DCHXdSCEVC9a2zDLgp<+?_B)vE} zIEYnkJ2z_niElbYwmY^n@u@$$9+)9${t!h2U%_o|)4tJHwg9h@Scsw9KigPn5&`6K z4qI_Y&sSGqG{S_v3klF|A6-AB^U>jV^c(rnSnHP=8EJHPbAvD$8p|yDC6&I;Gr!oAXx}cy? z;_FG{Tt(iO0M%b{IzGr+#33#;kOJ4`3D=U%bxE$-tQXHj?b93PE+b+=ztix0{n=4r zch=XZ)wK?6%=^Xz$ie4FmOQ|C=^9TI+_2?s((p6@;z7fgPo@BrmydFtJXF z%alV|0-LUB??nAYtKPz7dF0S%`_io!48FPu`O*EaX+mru^8rU8)Ma^}jchrWsJ8Vr zCy24CJr;FDI)(QdIDXYL5u4kD@tgj#)Ow>+D?HT5$23ZZpA@W6BVc99cVv!_$_&x@ zy=0OooCvS>?;+l>f0yOmam9ALU2i@ z>R#X(1B~pvuIae4YirI+9=;})3)RLQ6BbxSuypu`e7VOmGo;|HZgUsvtOUzNh6Biv z+-Uy627sJ_p%2?Jty6|C?uE`8Bej0Huin9C8_n7`ZmfU44N=dx8KD}aO(O7jZ-t|* zS#)10?F%rCtwliz(NFXMox~!vn=GobTuXm@wyR_B1nlLR1aIBC>#MeQ;|v-^gEtFxxWO=*H=7=I;|`v zt0afgqD%q!f@C7FWciE@BAavyVt&})jnfY_>hMVKl>oU7;&C@ubi=EUB(wxqac(;h~N?F9w>%oEg z%Z&ert+$S68XhK|s1oxD<7kOOP&! z@7d~kzdOdgf4yhCjB}K=o;9C2e>GRz4JU?Xvhg#HU4NlY9eqUw2+C;x#u09wS&HiM zBcSB~Op%X`ZtN>X(JgDrIB0o;Z9>KFCo7Wy6vzwb+h#(VmYh)~Gu5F>UP=NV1c>K0 zH-oWLd4(IGbX#7_ppJ@*bE%}S`!;aq@G?RY57y6<`j)q#`XK=EPbT&5c6=M%;#qzgjw$Z=yMBY| zn)J!lS|NEa4^#Qa$BsM7RH}c#F9a#6@6Vm%$L~9C1s8}grWeEeLp>sZF+arNzXQWi z=i?m0VaCxvY7$0;ybrDZ%K~hYfvPbFm`QUXeUJ(JbLQoF%@QyvLk9;{7V&`W`{Sp_ zR$+YD-!SghU!U$$1mC$I5K5x+m?1FAg$Wti9^1oiTAkl5er1fGAxAAsLhf*Nn?yssJJlAm)h>fntWEHPH8u|m-BG1em0 z`dKQ9d1!l}(&#efb#g&UFXf}kkqUG)gye`iqaRQ^<#u;0J~IEB(E7*P|8CWbYv4{+&|s#=nyIyu=>%wXhv0PRrJVD%|JDZCC_iJQnHmc z))s{)-Bm|0`$c1zvo(hNR*`Kul*7c9|M5iom+#75=@{hq0(>rfP&YA1)<{a30RrS! z(xdqS1b|+dT6S0V(?ro?63uQ!j{a#{$ENLN z&EwfIjkFb530vnk%XUCR#g51|&lKx@mhMgMJ(MsLG4Xt&cY47>^|G@S)|XzDJ3=&* z-j(a?H%F@V@}odN$CBIVfkukk3(EAkjh@NikY`bLzas~&n`&cw-wj`j(?0#!3oTd7 z7mEE0(*7aO(?Ipr$nu}tcjG^J{~z*#tb>eUf1&go9i`BZzcuZ#BSk&`lHs4){6Pot zRYu)^i~-atPk~7#XeQeXzXUY>WQ<|LZ`V5;-fnzI2dDywAm-9=+Zf6y($`pf7>q{| z3|N;i7v4ai&#!QFXGq~Q{pPV8x|wjF5T2C1ghR&qQ2^{U_;`0|C zkt;~>DNlS85?$t}?N?FU$9c4BQ$^Lm@7QEFC!k%d*|iv8h+98F00$Mny(CS51;>lx zXc!4rXFG*|wDE&H?FJO+N0RibloIdH{Xmp6R?h->fi6rv;QQz_4?-i zE3-<;-PsvOeF7-Cu-4Kli*fPwqHR<(Z1JLA7_DlNu8#^m7o1XXOchMjnI)|60 zey?EH^ffa1S>Hsb0NpKWe>pr~-SkFNwB`Jm(k*;6{4HeLNQ2eYh6r-kvDCHfN#^_a zw8jB~3)=Hkm3*zi+SNK%ip9A;D#xznyN=4+TAB>gTiMP>49W`{8w6E|PJ9t;YT?FK zygffbJ(ho&hZWoDo+kf`ie@o@J!d3vP?b)Z*7ePoWI;324xhU1I4Vl$ZsT{hgR_dd z7enMCF!^x>4NJXQjrN64B(FL?uba|lJhbQc6l(u(!l*)7(noYGKcIF(Ema=d|GJeW zL*z@lpojJyCk)Vdg1mo?3JrNs>7RN{_!LpDmG`Xy*dN3SCU@D}n{}0HpPQ>tnIN2{ z@nS9OxjK&ZL9MoC;2o#4Gd#hL2Wra?fq|bDhj*qbV`=?69O%Kse^7OQ169!oot7Khimkra@G9>N>E>h9yL&a-~~9c zpkX?eI;3UZlk~oHx$}TefxgnP76n%0~A+$3v##L)8`$A!EHDA$0i7b9KLmkMn>PK(Q%hLDn77UcO?JFh7XQ*e46 zZ}QF*L?;Ol*rGtVBwL>}2HAXYLp>ru5gtm#@d}wE!BcC0WbUT%3Ks=}D;=Rr6Au7Wg*SQb;p^fw+jfI~D>u&|6~q7u4TrO#pB%5W}@G2Sib z51O;BPUx!6T~{^Gro>iqHH^jl)!Irx?3gCxMQr@WO;KojTlC%%4`qBaV`v@)hr^>8 zUv&dV6iAwbeZUVZYB?iJQY8)jMRCq^W2vPHbh+8jjeCxoFrGh84LWj@;yEc7(NlVG z-y-VvH_u^Ki?2+EU2V`2H(8Y&T-OxBm(07PytMp1{C04{=u;`qMJSq2bt(eovypP0 z)a^V7*+Yqfjr2aePjYVh7)40b-T}jzA>T3g``gY4V&zWo0yu?52~Y`&pe^#H$_f-} zLC12k{kZ<0jVj8?3r{E?&}rN`DM$pL@An}NsoU%MPFRJD7rU{xrJ2vee9pfeQ|>iu z#oF!F3CYQn9#Lu%fE0wozS=dcp*!xJ;A!`&lZBU7PW0C;PNErAIy?zJ|KuozY#w>$ z`9q#c==%J_mml&Y&o|R5D?XpciRDC^Gj!)RYYCQ%hi#fK+K{d1w8(0`|9yeC^{SI( z&6t(r$?lu&Tzv~U?B3A^9><;J;6Z_j?iNu|g#O}~SxAb{^P&qqL1+D$xl+T7bxLl~ z$M59MXM^HX_|z@U@+*|(+{J*z>VlSQe~kV=28>Lys`cngFq3Ssg>MY~{l*D1$+8!9 z>5U09UEvL1QIK_@sf&a6>+v>UJ9_?=k<}rdwPNA}{@2feBmsov!nCnd_{gx%e}ZhK zURvu~U?ZYc4GsW{K**f5VB;VjZ1|h!+gL7tBi@@(!bbrL6#TCf9B0UwZkyE`fL1^J zE4VU%i%o91Gc<^W7P%O$U>o(51TpE(?k-0hcwd=fp2X<5C1TiH+TT2!yvI;1mJ zM}<5>gKcv(0e^HDNCFQXOy4uijttAzo#kUx%Zvc2p`ot$cu)>+EK+85DOj6yU=BfY zdyvk@XaVobnAo;fC`Vhhh42E9mJCW{%ucs>in4oRp6X1Y+M&cfjLjU=lJDC(Q z_HA=a2d6=+TDlMs5T_%14}-NthWhF8Z#ipaskQSsG7xyAeukE-XL4wGI4cO&}tO|ii)R!zgPK1DmFb_`sOF}9uwcQ zPp{=!XWroqWU=epY8Wm-Sx#ltzml4lZAnkE^p?QLLIJIGb5^>{gic8ZZ$p(Tha@J$ zSRz>rYvg|W(bp757c_j>JO{=zb%wS?UNp4&Yal@g;}{C<30rwAoYtso8uljiYaq=; zX@BNaclo2e=H|c}r?Hif%NWY|<)omo-21i^JZUu1gj$&3E>~WL_pGtJzhN_)xV}8T zJhtuqi6yft+$mrayLRTm#FwaT@|+xLgefnl!yr!f)*kK6!4OaExS8<|4QjGWq6WxyrGX%&aFS*WbUZamBoh z@(S6lP9l$y@WJq|Q|XFV!=@0Fok`df)BkT)ggzzxTgPU5<)9rF|LI)=3_x=pXrOM- z31faf_-h^1xwP*enf`DaeyyZfIF8Ec>L6UD#s?S%Xy5}MuqPI|u&Evb&%4K^AXyGm zLQ_M7%^HhLMO`wN*;9~$gf{mihUvgmJ4&DBMI1ArpO=pl>`}}@bwnKDe(Mp+`&>>h zzo>$y<8|`$ae$3#X-gG@eG{_jLQeZXXCAxk!34htn%41Cx0?UJgHW9#wwQ)B&~`fka-y8M zoaw%K+&ZbX9Vj3rYu`VDYPL1b)z*MErI{_z3)ct+iRZX*gzBs%LI98*!RdcnmoWc1 zBqT`9fyGc+Bl{>t!X7a|f;rthQ9qF4gI- zEfiAuil?!*WR-lTLBt+LR8&+BmbboK#669>GlY+F`dqe zrY4Iol`9pgO&aw1ug|z1Go?R>9$}L2)5_D9V!6JDWeuwknqiDCM$r*mggwb5Yp6No z%e0QoS?Su?$ga;_zVtd@`b;AXBfe4|Y9cLCaUMwYhyQ4zhTZu-tfUP;J#sdXT~I z{@J?!1??VrI)Gr%N4cIc^=H~SQ{7*-By{o;E<&1%bmtrGuCQc|ZLr*UnR=$}#DPv) zKLL5ksyg)%f)&EsS?n+6k1?h{RIXwpB!wqoe7)Efahd(R z@QE2ye(#GJDKyJi!II|O#jDHn*{Iu_Pk7H_9Z0fMg)Ri}P_9oUY%=ifkWc|?6YtKS;dSvq>Sc`bbs>H4% zIVGQ*8ldYb(*FXGpme%s#;j87frHI4yl$+qg1enU&qQwCWiint`B~iWy>>I1H+dkW zy!As;LQcF(E*Z)2ZQHbgTTdj1_1D_Zeaq;YciRFX?sBbw*ao~Osy%hHZ&5vy9wAcg z&jdgF>l41ZW0#uV@|zJw%X{^SN(cYvEdTYtS^mA{0qox_-~JT^(Fjd!G+@dh+xiFs zK#G~I!}ZTkvEJdJq1Q9;gEd8Tl(r13N;YUefT%zh)r=)l2pD1A9(g(^a((8*0cOG{ zAkb}sBvv*|HWFtljqe21_9L_XY^CHbO~?6 z`U_6udctzUTH>z0{Ww3H(G(#bXLjUbmO_6+iyW|*d}>(Gm~ zQoyWm7K!sXQXs)kfpVcYMI%TZ^e_3sx!dH@C=i6AY^A$|A}u+Y{BV7cEo{r*2t~5* zODcOEHhdxk{MtAnlVBLK>9e?=FVdi!o|{_%M2ul$#PB>ekbaUBx{Tzhl!~PGsbqs3 zjb&NcB&O|5%9lV-QZkeMT})(j9&43!uF=(Y_~FA#DGGtM_RP#o8WU?D3u@DHL;jJw zgWo~7xn>a#n`Uyj?Tl>;`eFl!ePZtmfF(|CN6U^Z=eABu)ey!mw)$XJI%#(_L8 zD0~CR{ktC0uNtPYXfc+vgKDJfOu$HPet)yWZ_k592$9RqJM$`f5+ou1s|FR{e3yk1-Oa=5)J{?r>sQ<_u| z{j&igU*EIcX4=ohG@2PD9(&#@U-4Z8sIH#=>JVQ#fhjZkU#1wp$EjOzLzVsphOd{= zQ8~*6I5}m$l=cKuqB(wPg-c%cb;z5BTyMRfvG7bJr`bRPO{#%>pT~3*DpWr|8_+FE zft_;xI()~_?b^<@dSws)4wn#0^I?fQw+3UwNz@4?+j9c18e;2?}I2&q!e;I>5}Z`R4F}&D|ox`Jh+H?@e$C79^pK zJGM*LFp6KT&04b@5u-Si>5>LMLKVFn$9L@Ey1(k*uLHR$B^T>@j(a^r$jgAxL1CEE zhDBqyRbnQ`_EMD#aoHYt+C1o>5@oF-`~IM zX^xARtJ&0)k?)1s9kF3qHZ`O-#V%`7oDBfPT%O#aXaT~N76v?{Hx+^65O=JPpPs++ zK0n_@?WVjRaS}FGPF2I8;Q6Fau{Sv+Z| zsbZzRn4~(r^ndF!E^;MMA---L4TAqQL^L(bP^g`?0X9`gIm_SHXLfc1y7I>g1Z~7Y zBdgCJi6x>&&R^xWrNsIId^LFKU_=DHe2ukgZflqYC7JV8z1hB@Yrd&`Ca%?Z{CXCMy*Kj{RrlXS=rV$nug;fP6jH?quVL&ACklD$za77xw*}ln z9}EhFK^TT0ohgUU)p@&h+$>GY!1PkmB@N^yH8u4T^Ro>~nP`+ri}m)0juc)=Cua)Q zT6uUM7LF}6RNbFG`AE3rj!Y3w)T<K0!cciWTmB>3F!m zzps-nu!$I33AoKZHKI9>=Zgw~U3KAL&V4P6#tS5`Chy^dSav&YscD!tE98!BC+{lj z#Ss7}@bZu-7QZNbIxA%3?O*Wa8(_o~lG>Tj6B-L^VpTogc)4`>PfGf4!#v$74ssc# zh|yc(q74Q0lHos?sHxe8t-LxvmIXMh_g^O7>~09syF_w@5jpOpJaKiTm!Hy8lDxnC zY9D>+V&awhktEwtTC}8?E>-A_iNC8BOGRwm&hpjKlv-!nLwSWmhkPB!A$5+TL&s~! z0x3r%h~^hA$rgBbX{pEgsRYOe4d?4uL1Q5mocu^c+fUo(c6G3Wx!2Obar)JwT9X+- zECJPVitJ_aC6I zDy(?!!~LxvgDV)h_;oeAjSG-v^Rxn5)QFv8`q_41y)Z8n$dB^j8z`em@$vDF``%}J z8M=`Jlprb|C*bqi*cQ-zc7MCyR=fH}*;eUk(z@RqSj>#OFqrOCC~z<8$_c%!Z-B?~ zcTe(Iov0Yt1M(_dm9t7Gf-->1xSr-`vrW>fpRzllKF-3zLbl3}ICP>*TVzzD8r}O;z;9qrg2@eW2TRlgFA5%5EiD22jaIGPb)woe>2B zvUbv{`s(=w35bC-#!jm1F**#RCNhT80lyw^%V|dG_BQ>KKgjAQV;1EU(0i+e)Xj$> zYvyAqEVBEHW^{4ddc{JI;B&6oB@8PP#6@8z6K+zgLgf7z{)CpTAJ|KZI$b zG$YKSyWYx5l}I?ikF!OEdl%C8kZ9hy zqP*I|M|Q4F)ZNiuzq&YTH=P?r155^iGX$&=;xVkTHvdxOlAHKx_1Rplt={0FaY0jk zy&ro^AHN_VU3d*B`=nETc3W0KAeaV_LdBO@2O1Iv;ab-q5Ug)m;9br7x^xaOJ>HBy zhfjVJxan&+KBUE|V5JFr6_$*R_f;T3w*4nidOUE0%|wx?X@}TaHNDn1*fP61nKHYv zN%~%ek_x)c*P1}sT7?ZBUTvu5vh@E>_@n=r(I-g>qW`mT${2&OR`xx%2a-U^U((4o zmmHlS?GIPQ#sYTFrppz3EYQ(BNm{KTkm~%fGu%*9&xU*Lg!O+E>J9vJm;a zek=GV3ZJP=tAEfh6nxHqx%f%06XC4?JwwF5K_M`eXl3b*UUo5`?r*eHNqzRmLhQ$Z zIB*>0Nhdu@YTQ3k`PmxXf8q1`@R1E5LvEG^fv*4YtK(NkunQUoyVhxTN z9}gz1+d0&xH143@z+XKV8d5`HBKajbB}wodvOtp=dwDx4Gq zssBBNb2^|wkoU&0zwISfE1z+4@KQlC~HBhLg`T8&`Inl>Un4Zu9KeS`1un%r>h_TK1oSP6f7Pa zeQ&Wfx(2A;z>t|D>RzF{3}7Kg7Z=i7VDKa2dGUk;kXNs#8(rDf2R;RYClr1R=24uf zIS?PYT-kav+CN#OfeOMg{L|7X(lat@UAVZoRtM9_K@37Sz*zX?7eK%T4cN>3mw`(w zOoU8)1UJLz2Y(}@W?m0iT{aRbWYUBI!@j(f3qs{Z_8cy7T!9xI@!x~_OMd@Ra5&nw z*Z$`~KsM3?Uzd@YG?lNyzaBJryu`Wn&y)M0iuf!uc8KG0l|Z|FQkg)TRU0@}dwBMg6%RDZD0yjia83^aFXH=J1Usni7{$9XnV$hUT1Bu2Y&+ zPhk#-#pxz@uAe`DI$j>zbVgH~X@8E4r?fXQF|j0Bu6J0JNMO@b^{WM5NjZQtNv9#Y zxPz;Ux4;UJ4X`i6hg#X_w?ME^Y zAC|}z1HHUXgR>>jK9iWWyq5;?>)v=>f1ifnbL@H!U_F06x4E_B^;pr{J1QjNUj_Qa zzh>%+GhS(CRzC)Se`Ju$JMN4ajRErb5=`QT59AP@DZnh)xMLW%yuS}B%k*D`roDQS zDs#r3g2(y(=Op=|y78yLm|4pg7V%fE&<&DF0lSJHC}t#94GNG~3aY)G1{>95@Y{ai zLIq;b8!y?F?l6nRh+<=heNnOdh(3iqSCoW{)d?NiY! z;Bun91|B!sPgK9H92^K*x3}i7LWRtzAAJ@%Lws&a2FRCUAo|wCBgqetS!ha#dQZRs z-HnwK-#=NQSS=gBugJTOm!N7KN>){XBH8NO;Xh-yf74}>U@eM^Jr<0=zI1pa=kfjm zi?Y8~?yxK99}OET2NT5PXp8`79q->bf(y6QEZTM5CUw+p|^fO*(44UVS(r4!1wkyHOLVA2zDvs zU>XNLqYy{D**I_)1>S+30NKQ=ud>ovXr1S~w(!!#qu;B{+2_I^=I zMN>;g0gd537iG06R*jqwU0xVuGMn^##?+7aT>swo{)FH*pCgRT5XD19sKpwD;iq#O zXZkQkOTY2(2XvgNgAL(WV4HFg6`AQYFN;L0cU1qiKwE|1rHKSI@`F^+?uspZDG0S! z&x)JU_7u;b$T8Vh$^W<28PqQC5@Hz@mZ6?AUnV(G+vStwI^gI2!#=mKjH2Gjh3uQ4 z+86x=p|6f(*u5Inxe5y#qbPa=oO1RXRLrx^B~ByHC2tRx_;uX|Sr>kPIY7aar!_Mf zyJe#JzCY54xQ$V!&3oeF^7iO}z~NN|XFiFAa{3%d=|($yRm{F|?fGv~ z*qDlc$M;zZu&+zIyLh0YBRY;J*hh+>(dzk;C0Xrz>vI%z6)US+znb|DEGV<+i|eB1 zm+?i^G`@G>>b>QM(jkbFF~py4NUmy$E>nuYKPMBHoc>q49#tZ`0SFo_j-nexY+RFO zgP=5huz$1d*8LL@KPalL)+o_zft5Sz0JxK!6VQ7O%4+*{qCG2<`dF*KpV2kmHgIn& zce}K1kHzP|0ygk4u)Y^IHCA#}LY?ydEp)dn5EDeN*(|+Lwy(1p%^OKAq&BW|Sd5}q zjQd#o*4df(Ip5%nrg%9roBZajyx^N@KMC*4^MHoHqsyv8zWRTZ^asS>J=Ahl@q-^i zdt#4WpD`t*>Sr})Gw+UGk2mcwIv!dMBnZJt?YZG0aQ$2^9Ko+Qc+SYCgcXD|=%)=e zo#iAH2`4{Sa4)Z}ZWwNMUva^QS+5~9-Z#)&yZhPF2FzFMeJW*}>DW$jv!6fhaCns6 z!>Wv2VISYm(8*q6wyX%0>(0Wk|52~fRn5@+WbtB$K(_y9ehjw?{*&+wsk~+{$NM{% z7`eT6!t%z^ zkN@-%T)O4%^^`=y)1w4r&F{{F0|NtF`Oi;w$iYX#s(cJ^8)06P6v{lP&#wmP@m)|0<$yTyPOz$E4cJUT2>QPs zpl!Kx$UbqTGpvMteBK7)u+2e8L%Y*deHy$`B4Tds?Z4|~5uDc@BNA0}^s8LN@B_rm zHpX1P%sMNn7x98U-q<)SZKiT&J;oWQHjj~K3LV|(2J52M*ybzI0Q;!<@#yvgN)zK$ z$Kc8iT-z22hyVUg>G!Pu-%G!f2|nIsv-UN*d@U4%4a$4>(nUsWlc5@^9S=Ghy03@R zVsZj~A(*df+t#jeW5sNV#;JCGD{^!FGJ%#* z33pA;mcK7Vf>g_;o0XL!I;n{%T_Yx}IwOcZGw5HyK3+?w2hwYUfThE9?#*X{Dc0-nZc04Wv3(f=&`NmuZ+Ph<5Tz1PmM8!}@=38&<(S9DNPM#ly@gIQZXy zJzf9rU6$wO=6bw{uZ}p*I$bSle7m6Boesny0!*nRN60{jN4nrUMHH~7YGuHw=57Y%EhV%aoiB%}wh^y>6 z8wtWUM8c$+t^Qf&MenLt?Bl|1kC*uM7acs?e zv6KzOz#9gn$6%i;SRz1!bP8-D_3tluU-U#p0um(raH3R?JbHZW0Y4FsTYWz5>i8V+ zu#@CZ(0gf;oiGG~t{;R9adL9DpGT8$3w{k@I^Eh5v_F;Bk1ahEOG9#GaCnQSpaGZ1RtSC z?8t>#oO>*Rh~A|v-y5Q+HohBB{2$p)mTeAyMpa5=Wtg349Zqd%XfOxAPd!-axA4s~ z5E$#S9hcfSCrZhQnN-Wjm`uQH=UP`7>RAn=o$`f4{d=<{TbXV5F0%*xwv`QsSMU-0 z0xCWOqb?lY7KlPs=rrm&2GT(~KN87OFv8SNH%4*sOdYk_v zePq=!E_;TUEvNDx2wEV0f)WdnVemR{&+W(M|#x(4i;Watr2fW|E z%fsi0bU~silKy^r44)SAYRT+FjhEdM{Ti!v8+SDXTq~S=jmwBQe;N77lM^goaB%Sy zXbUURsYSMYq@1{2oDjg{$ggq2ic)HBA7r$?&M*`-v^nE*9up!J952O8#^L5wil|qp ztVf+owxcta>x(_^2koGTkEAKHVXW$XoC#?+xk4-=UtjmhXmR;2RdDt5?|J^}j4$nZ zBC7bf^lg;gswpexlcBO?w;ye}-$M?5UMgBX!;YbUX==f$xkz7BOzrzYLF0+<*^j;M zsc45`=eC!YZ;0f^95P{@1`rkxw+<3&Q;8>KABst@kLcv{ITcd6kH_3mo$anJFHl99 zCWyQfw}l9}5_h&w`&2v}eXIB$s0FH-%5l^j{L~^KBTv?@aM=PpzC)W^qHzpN$y*)}bCWg?L%> z(?IPO8f81*tsXF}rD`mg9k-}tlzz)Gad;B;;(VM$xX_46U}=a&(DEkp{9rfSL$aXX z;O?oVA;rM$YRTvQ2KR-$1>r>7kZd?z_&fMqA!PYlZnyAlNkD7D*%M<+yRf=+)~3~5 zG6e90lj9s;CUs8>nmRy<3NiorVri=i#S6Wx!BbuG4s3g39f9vm$AORkpHCj#vn@FP zn@n|~>4@?uSp?k$%weop!)5PxkSvh{hLRT#*8Pkw6y|_T`!j;oU>E*E9HX>fQLJ93 z&jZx^%6_o`)|CPE;2D{0mV`Gq7#HI`d4YG8SV6>Uh!WYCcvuNu;w0pAB@{-g;md75 zQ9=fG{Ge$;IR*>CetVjfacxBYe8IC%0U+zwcINi?;w`t!rg{XGxS{fxd=i&g6tK30 z(Th921Gg@oI&d$f-GlIml{&~z@>dj6e+QF0T8*v!RfdQwicKW}pqokdze=cdV}Ce3 zJ)NX6N3j8263th2mmp?9vbMr zc>fo9MWC{CRo@!L1Z`Onq|qdj{f}QM*k|Y_gG!nO-)YgM-q^$dh*V}Fdpt(`9A z*!y?|>2i5R+gg0bo(0PQ437*9XM?X1tyW4>T9MM6{N6ajm>`)G&e?{RPYX;MK(jGE z^@qw{xG_(dS0u6bsKQ^YZdNndWcc%rq6eh7h#1 z2a&pKTr{V!_8nNUjG#^7S8`idfNpamr~%u|+>C zjDj1tf3OW1&(S{pb*omX?=S!gmS7ZJK;%clbKwuPgFT@u15opEIH4gmZ>wjrm z>wge@X>|L)@mcab9w@KCk}sNNpuA?dr$~mKQf}P9i}iHA&W-}(&OMshc+MKI6QBbC zan)eM!4jh~bQMgmPdBYJn_*g7h&1XRu8<1`pDI0#5qYCUfMz#azUKd*3 z4c!HjZ)s07d=hIBAkjt`!MRMo5la06KY#KSED(CKG1TgtP;enEDjF{4j6nqiTh<|z zK7EgL30jq`lW@{dtcr&a7PVZ?#7FW5&Z+s&9UQpQ->OXHzIQGFOLigwR3Fb2&M)qJ z^UaZx(T+Jr_RY>DtG4td9g8^zq)jQRhVv z0x$F5&qF+5n_AC`wqiv8iYe%*9K+I6i!AGTPnGm7S&tSjrL16cu`Vdln53R4Qyz?L(1t=ErOO>p(QB#vH5$B zN4vaC^viwo0p_f=#u{#hGwx}#_u+?r7MW1D3#(Vst~F}9Cp-{zc+pc2Fev|O{M49a9DH92CwhFwBXg-f1B77tBOI+kK890}g@=L;kGdFyjcTG4Gv(G%)4 zoT{@2(dgXj@=!tb5~nhOkyt@gW&2JmmJNp=2!tUbV;B{(WFmWL4JO-{#bu^;YdgNn z?R3r6(^#!73g&y+Q4&OxZ7+^AWW2+|v{~a+fr&S(NbPB}SS8vsFL(tP-7ah(OSHZ- z*ZegdI?C+T)1%ylJhibW{4=Zg22bC%MwC`AoMk~CTho$ccR$<}aoveDI+vD7=>z<5 zz&HiNzGGAl`qmsoNkJ`=J^jnKt;E4-lkgE2AkI?EV5FQ=Z{!wZ*M&xa`!AI!IR2l& z30!|je{VfIaD_>!mXTrwGr$vMfB^*%9N1?X&OHpt#@;CccBzg^gPG!@fTS$6Y-nr@ zFxCTGr!m#k)HvoVKT_3$TsK;fn9XtXX*8Cu zn?X=>=WYh6#F_^8UsS*@7Y!ud*v!eiVn@c?VG($s_f@QkTt=M`N?dmj1&}m)LgDwkaL1)pux_mO|_cgVF=({Y}BHJ36+eoFjIv7*9vE0c2RtzJXu zj->lD=ZOL18h>kf0wLX>U#afn-uKaq-+yD+qm-j!=XjU)3w}fAU3&p(HWq)KfV*jf zEkT=3B(|P&-P&X{j0`cT_BWRuHDcll&+wbw&|iNPyPp2a0_SPC?*CP-4d1FI(U;7Q zVK&O^B3&(>)av||HIE93C42JiG$mIdQza-tF5vKst&%rPtWMWIXLs0T5>G{5*oSp$ zdW{wI-?XJ4S8|m@s%;b$i5$33(*5K2n>O5?oF@ollPedv!HQ#zt4QJ$TUi2F2~usc z;}lsW8&@=E1KWyv#;ZP8euJa{+MS9iH<(B@Q7o;z)}$pZEn9ZMoz*fWKlUJz6*U@z zS0@;%B1}D|&U>yU{76Bm=Qne0ptgCBq-t`znwSVzbs{}bF*kdbFi}}t>~%QH>n_f@ zlY;y!bN=brj3AMq0meu{aWZgbc!^s!QDEF9^K%y|WGxc0PE)waL;4YJ$Vhe|qteYX zd;g}~&FPGiGIdU4Rq$;y2h#hQOf#>Yo(20gQM{t0lMCyI=vOHAN$+IL?}(SB?$qKLA$LhiF0+A%H1g0e5Q{izXUax%?f8k(*O_W3^7%k1q&-$B%&E zfmW3Z^d)QOC^=jw4E{y|1zFMfh)9eG{zA2m;D8|M4Z+D#HvkD=w!%Wt+C41?6S4i0COAcSjc z-+QLis_JVmy(b51cjMDO95D&|X~y``H9+f3fBtToy~y|qmuL<5 zQ%h^O{MD5DfflGNgh|PViNh$0Bw#{~7)^yGgjGC#=gJpG=00D~X+jp_9?qnaEDcuio^6>et44p_&je<6mxCtVeM}EgVodp361r_Mq@-kIk z^|ST9*B7@5w;f<9*il?J*}F(HqnVi5Znf_s;KL-86O>wK4N;8cwa) zj5B~%tJY$&R#b1_rhVtf8#p2fwg`&0iBbDI^?$G>Slv#%|IozMp zGP0w=?(v6GZsgfRap$9RFLdn+HcF>CcJI)Sv9uK0zfX=roK=_zy(lVU5g)=3wA{Z; zSG*bx=B7hk@N(j&!3iAcDm--dU9vi!Kxp(K*V9NQ|Y6$l_o7m%MuY}nrigB1a5d`kta zuGhqglJ!(g1KEpSc4;qdJI9lADjnC5Sg2ug-uw>lsK zhNBTY|9Z3sz#~lo@F{sz_YY1_gMmUvs1_JM-LJq_U|cL8d<9zJ`!!XK-Hz@2JoHgRZyP()Odt>4Ff48ej={hSmZCYq$*n2d;XGm;Rul9u3qBC zF$iW}cRvD>?<`~CV7$OE97U{e;de#-xjcKXT?{Z!y1APlm!R2W8@_j%Ga6@`eBFrR ze6w4M*Npq7#Y>iKc#LpA7w3$0YNT*V?Viw<5>$gAZ=0fZs~Wk9)OvyvshEpx#RnMz zTDYf~+szhEPT$;Lk=I3)&?9x7hS?T6>5t7RS|grJ@>KBHIFr=9sd%U(0!v^%^Y2~Y zm1#KGgPE#}i|e!Q+?=1@H>J>K(nDd-|Bd)N6%1-ML)a@G`ug04>4-byKwc>2NqkLs z6HGc2Mhn`nkHmCQx=FPD&7dJGX9+QV{Z1~K{RL%#9}FO`esDNM&3<{OQ1JZppj^ll zmM=36QaF?%-|FoIzf{W=Rjya{@NSEPm`-9WWwxKTWUDMyNF2C|aMFUji% zO+Ta37gacS!8rN ziJt)BPmv)j)g3m%931^wHW`=azS(a9N$=MSlbZ(KHD4I7BZXTfMdp1r!bt>oT~^5r zqHws&{XW?J$ZY+Xz!Jv;7!XFlfav?HBe?F*&xt&+1OU2xyGREDG?1$SH1M>^ZI=+R z?Wp3wji%X!z^6gdcsq;kB4OJ%G*tv8okjTuA5bO4l(SXlvdE^yq{>Jf$f;zkMbYno zAnYMP2<K{~`^Q^a^lF*uVNgS8xz804ME53h zWo`bbOa{rrxd4o4|1_;RlZ^toJV1Y9_8=a-umHw;vqCXnx!dN~DIFuf9|`{{#O8kr z@od=P`rf#6a{Tk8OIkcu2X+T{dgR2(e!)Ks@m?23X5`DZFh?q+H2KPD#P`WCO9ix zx6)?xCz-~V@2{_j2Cn+NF5QkVBI{06({UVY)=#%RT^<6fhBXGsgNfqkBmDZoF-LaZ zq}^;TlqUbV^|2sXhqnfkO)Xjl6!I{*#Fw~%#n%&hTS84$mb_bKtaQzuBTdn)@X4av zl2rE}U6G(?U%8sxV(mZ9Ebm6LU_K#`35lj%IexnyUkmd7${X%;*`1M_!kV!Vd74q2 zJAqm|Z#s&Gkn9t?>uN;mULZx4ZxW#Nmqtsl@E_Q#+Lia<1u8F{vbZlHZ!gi%hZ8AZCVQ-SpK1D%K>bNEe0ktrcp)(MqzUG5g9HZZ6O}ZLIfNZ#>G3e zK>XM)E!LHL=&5qpW-qf4!yoz z+^o?J*p|)1bu7<`I#oZJtm{GTK5`Sq(CYDTVJKnG*y2B#Eb+FWI&t0@5V#UmZ_V2#CU&wuFDv^V^@w%o;O#XYulj# zKixd^5o&SHE~e)5alXJ~K!U3;(RP%pA%9xG1J|{Awv#Yfsxd9t#L>H!IQe2`An+Ap45T@M5Ka7$`JvGK~nmV33kui>Y?qY}j5q9_F!oX00&agmqOPQbSLbiiVk zM8`VI-$=9V7Tt*OAu8m?p`~8F%+HMF`A$=N<>hhHtR?)^on>$rO$puDb1Bq+PO8De zL%mEY1|fT;;TZ(G8=!f93~!XNw=KMj(q*4rcm)0t>fGjl(spCXSWk^C{ogT5U?EY> z98dTCIq{tcKKW%2fT6j-yIT+DyEsObFkog$`SJ_|nFE7KTvXZWz-x!|%M&)4;5#f| zL1Rj_>Ztq~OlJ4Ma*wdP9AUu8MW>PT#PskUG9U*dU19Z3){8C8?1jFbKoINFn=cgL z!KPj02V~?lVEHs}8vll_^L4pydFsFlD?Eu+ErtfUcgB6X${djd_D1bi#*d?I*!SuH zGXRqy3g9kuK(5P+D_x!!E&&X6?W+kpM)0I<*C%GIJy4EfsQ;hea|c2Gm{0(M@S7HN zX1H7=WaAn9^dy%;f1I^}QmIyhX#gt1-|}w5?WIYpj5Flm8&f;W<6xLB)NbT7JeJkW z?oF0Dx!x&fl1=_Qd#N~fOKmcblYNo95YcD>SnJCxPplZA|^3wxEt;-(tv3 zw5|AauH1aa&^*qrsFw5D{K8P(cbYy@FSeS$o*?8Mx(_WMod&Tw{CUUYqCFywRDCl^ zl=kr!Y|*3hQ=dRyNzVjyH{ax_`mM7pwwIvMmEjG6)i^<}5QcrE_Q7wVKPSjXQWA!$ z3vFdaoS@d@5uIxQDCqP%H%rSP>zR7IfD0(FKcb>%BVz{D^G} zaa2g~7bp7vN0r*Qg`a{}EJe~+V$-7l2v`syO*1ecghmI|Bi0Gcr-U0|cQtQjGy}@G z%vw4D8C4wjro{*q(Py!IHf1#iQa-|;N}LsdNP9eCg;&qOoOB3oJ2RO!oJ}2cQ0cK>w6H7qzL3e!o8P@BsJE)vAji&rA5y0ke?r_xQ7sEB=p9z^4@Pbz3eG zzp(glN_xaC{9A@is6ltVOx3$L{LWH>FIRIrOYYhDS~mHfhhWWGEMC@dgk>~+dK|XT2KC+$NvKlhC@A1O zVg1H1lv$EoWB5IQEi5WfpX9^PcsT?~1xbH_7zrvMw#9{9BNiLMT>)9gg#BqFM6Oxa zJ3=@eqmUsq4g$`dqUNYR0MAV&Y-uoTKZYGg24Q@E`9Cj!HUost$sik~$6~dFZS0TW zA880RMy>(Y!qOmz9RiN(yFwBHurB|+$UL|LBsQw`Zgv=H3G9ZXAVu;hatL;6QBeMYQl@*}+TK0Fq=#HmjcrxrZP9pJ$(g)Y6| zahNyIdcJr7RuF2qKH|1`AmqNsdI}a;g@IlXwP{Bf)sHIh#v`O*OeHLVvw#_=mBJj1 z|0pp7>LY5fsH&V2h|%Mf+Qwpl@46{ic~8|M2xM604m=!yD*x;(gU6ZezCAHG<{-aV z4Ups`alZxy00y3wTMpZ=*S$f33*~cwlGSSQAMdRPh%i@q81)9#=X*d!=D%T%y}BGF zIK^A_foybvxQ@yuejfcXAB|X}_Xk>euVnzrxCRMaDpBm2MpGDSN(*1!$FLt+*(!(< z2nWw(|DTPT!H)FJ8BT{Nz2HOlbM`ZCNtx-Pb2fFyH+lDUg^;12vGqI;u@)2R)JoSB zzV{iEw7z`b6;V%8=4z`*m}=m^PA(aiE^%@;yAh2b6+)tWF<>6uYhekDjrUBNBb+wM zJSFKGJa;~XmBoG=T4g~$v4rXl34;|uC%RLjiov2sylEes!};1XT3;^qce}&NEx%&? zDdM^cgTe>dw_V=Y2>@Vk#v)|dr4H5wKNqBDelYd!Ek;%DM-K{pj=8vIKOdIMH?=tN z^3UkB9=km%lUx|T#UioDL%Zj%YzX=TYS8IKxcd>Jgex@IQiR*F zTv!;84JmFo=x8a*o@p2cRX7rY(M0Z3a1_@?>LxBlomDHk%j;1#19YH%ZE*$f<+hMr z?RraY0L!rV886tn0VG-?Jl119JdQx`)d?2xJq?kM!Kab@bifu^%Z%3}8&!Vs6X+Vi z9w-gUHS^hr(CxjwC_p0jasdr$2VkJSx))U4hpPnw(SPuacHo7=UKKOK8N9AKwx9@; zQp`sp5P}N5I&&m8KT(2i0eSbER2J}A0whcz)|#a|;;lbdZJ!8&y~LH)d7KoN;_y@m_?#T(^c(f1|TSfkGBZ5IKgI2DNPUAI53(suCn=&5U1{00?B! z5#0Ne>rN1xeWPP-vnu0#`S+piBaM+U-yju?d*f)0W-OiFXmCHjTTC0T^@P%r{LqUW zvJXt`5dlTcW2E0>*HX`2>;y33M#7~pBr=;*-K_=|ntVQQtCW1D1NMjP$EuWle`mrv zlB#aWKL+Ucd7tj!6jG{a7!TN{tmheIu!Y45B{I$9FP^M5_UnxBVWUehNX(=k2nWpa zE89m5TTxfI%KECCaNBJZi|Yj(ro9~{YCyJUS}Di5<<{4BRNHv9_7zRR_2B&x2o*$y z+}&bP0ZuEetNAvM!Kevp&>K;aO6grSp}=~OMLRQ}2jkHzJnE+z zL9GE<6QGwSjGuIiFd&i6JQGK4kyrwRX}LqC@1Ip!(3g0}cevJ15`vEZ!hTe~P^awa zj|SlOM8sa$ipTs*OR%p3$Sf-z7UuiOK3&=aFD868Js!>Y9scK~JeJHqb!4AFqG_eV zpJuTI>W3qC@_^05VL)@=C$h?HkfZRp*3QmX<(u*`xroQJw?lmiY*>2639mu0mxGC2 zjN_X;XCj!Qb^|IV&#f!>XTQSR>$5=THuICuv*_IS z5)3pdG&bK=zVn|u%jsj998#Nuf8wbZJn*n+7a;pGscJE(>F|^bW5WP*b;N6Zfm49( z=I=eG*7zhASLusbyYJii1FS|-C8Qs-`Y&XlH43;T-PScq_K@cdD0_Tg%ooa%FB(TbnK`9g49Ggs7QT( z$yODwA<^|}Y3-V2O1L5(<;(GAud`;niS6Hx$A5qEU6ye9`CJn*Og!kEj$G0F?89(f zp|x$})Hu#?;bJ$13}@!ochXXfZ;r~VWw}h~am_M*!ecbzy7Fm6%}jnV0n;0%9M}!S zL&p-A3twG^v1MYVE*G97)x?LANu=^L-_(3}DxvhmhbzJC88_TWs(1rxOOY@S;6p36a~!g*%5o2G=K944P*NnXk-%=Jc~PF_nw|| z!ctdE6_iqU`hfe-`LzvM>H@|jP7x2Xof-Wwb6PP#>6W@_&?m*AEZ!v4`p14?7$eao zJhRH%^cXKG`UK-kvEUx7of9+$QcWcUSc9iR+WnX)5~#Mm+9)kcXFvJ@DImi>G=TYq zWw8%S8Fcb&2EBp04G#)Bf_#eu#HXK$5Aq-N0e`GGL_^Aq z;cxt06klL7K<33@?A<3MJPd5u9YL!hkKve3r_@9%KT$D-kw4U6@;WDQ{+;_O`CD?2_krpn4sIEj(8!bOKUGf2uokf zAbqK0_VKwSqcjqcnCdCR7czC>J~hy;Iv3s^N3OwqNYB5djay=6hC|s|yr+^h8Er2! zxd2sNq4wzc=@wrR|6%Lu;151PBGem#3L(b)gVW5X!V~weaV56*k3uKI$Qa)B?oMen zGe-9Lo=ZIY>yJ*%UhY0UID&zasMLRZEfMnQ!$D}|t=$0TOxe+X3&F^EZCgMZ0*R8- z`T0K_*_*4VKf5>=ZHwT2$Ym>;>#}?~IovjP4oC}}Xz`aJE^=uGz?Ssx7$bRCbhM}# z@6u)Ic592BNycl640&Sc+B*ht$U?3L2$~M20^VdpMt1E%%(JhMleX$HDcAD!Kz;Gl zXZDDBqr(4)lY?(}k23$_ME{~-&|QIh_pTWrs(JR9coytsOaaWfd}ohhV0Cl$SHSM< zRZGz*^F}x%1Y#`K)IKmnS~+ieE}h#lf@Hb~?_DUq1JSb!V&rftmPH5R(qqFV2jSiC zQ6SkrrLIlR%nM-Q5CQHGJd;Gx$;9Xn5bX9NiI z?LUBgN@K!^$m@XS`pDbT_@4()Y7zLMLt3A=%}{wz$pR4%Fn}Xn%%JWx8Hi)?_S{~j zwWJg&RXnlj>aN3_Kth_;vmxGjK9@f)I` zHuxkTB>bOd_Dm0)iZ2_rHqh2;w&WtHgKofI$zE$h0CQq3boHG(x|pnWcXUtYOPRp( z_n|cg-^EwK@BcaZ;4acd)pE$mU7el&2T2eYxdzGe1h(&2{Lcs7-WcsCN7&w?5g*{d zj&b&!OLf^1I~8yk7w4qdrA_p=-rrqh^5H>`obo*ZR{xFp}?+0vB#DF*FE4V5X`xHWvp4>idg|!Ub>t_p28yGcFO*@d?C1 zCv$;&4IWBc!&N7u>TK1!P`GFo+@L_r41oEO5{OodA0q7p2kKvL1UmmW${Hw(q`yG} z85Qtk1#}j3>1oUBLZ{h9JCZR(Ks3gObAxmNvfFo}JKXW)djbSE0q}+aMf;d3sL0Q0 zkZS@>2t3jK07^xK=eGM%9~;mp1?(e!m-~gImDZv=v&k+^q67Gl&4>>Pme?xVM}Tj$ zgOJ&K$1nR7-uov+|6u;>eQ$yqlmnR$0M8o@r5(l4N6j4y4A=f;&FRLy0j6@rvL`PF-D`8ryKaR;l9uT&so3i&iThB2XOxHis zEjX6?lN!a%#=gBc9GV^GG$~C~u)lJre=@oL!JyL9SPP~I@td=D)<}0qGeo?}zq=PZ3-w9} zmxI!P_X!kmKrtfTbgM<8aJ(E}CMCB)n-sMKE6z*KwpZb=wdQAVin?W8+xk}zel2HB z{}rAnzvw^PhZv?yp_@ii(p)Dgey3QcJxi0 z9}?vBMbwE_(|Clb@ExIMOG*dmk60dtslk@Yh->@Zq+&?h$r1)Y>D4~F@nwcL4aL>Q z#pPxGz#5tTLNn2op&2IYKi8G__WwEL-yBYYSk>7^d2z=l_i8xyj9a@L#}5@+{HkB{ z8H}ss?-DF6-{uzCrmja52{hXjyKqFt(V#J(PH(NGH~RWf>eEkl&mGm45Lh#=+uXa4)wzBAuNyhMhk8UMxHMG1y zgg`h87h5|w;5oIGs%@gmMm!0vE|?5{XTF4hCe0ItFf{r2g+5z?44YN?cYlG5T6R9( z9_F{1WH1L5;|IOeMB)Q|)G;Y`%eHDB8rSl9;l+eh$&E@SYp1F~gKEMN68n!mW$H4o zDZJA=zOMN~XU*#2xqq*YU-jDg9o}N5&Iw@)Th_eVS=CjwnNp>6J?lPo(D})k);pdM zuwA%TPosBL38}*g)Q&F3kX~IADEG?Do6l+cz!wDluGz{D)SZVn<7OcdWb&G)vkTfZ;R zQ(& zLW+1#P^k2_V&49-A@(G0(TjCC(N7gaDiu7^?*CH9)H$$qHM>>LcI%$ipmdzy#_d-* z7zcajqHhZ3fmg;+$=s^n^c@xuEq-ze`5E zwrmiX^1D4j9j&{?9i}vrf`xJZ@|<~jOO@FCJJ=yW-||6=>f*#>JG4%rvx;T@3ZR5p z_&roq4vAuvAgLvwR|u<(NLcyU?J1rAj5SMX0x&k|XYM>FY+KCRj1$&4BgD49v&A4B z{K`Kf3qrMfE4$Q1@R=-3InD*zZkZMtpUKf4PKgl;TU37v?o+oxFW34Vg-Fr;R1WEG zp|d|nxaJ91kJ+Hx*<}l4OF#S)TG(9c*HRhK2|4S=@l$6xv1ToK__G1g5*x&?6G&C^ zFZ%ocPX-i$VM-#nv&M`j82_G2#O9LH9g13XK%l5;EI6O;8RTpGr8qYyV7(^j2TKC< zZLSYF4!NzRJHYtKk~U8FjZ|pM2ri(~1I<59bhWk=@tO+&Ti}<7=1@5*d}t@07}p`~ z#TF~EYGb=~d-{B{qk%;2_8YzVKcaYCE*`aw4s&=Sc=nEha+Oj$9sXDhaH#{4X5?u5 zv{wTtn=#K^DPksYs6+INRjCpO&1UIWnl>GPqP5h+gz%ZaQ${B~4-Ox#*vS>tHh z?E-JA#08Hojcv$p$U~)f%~(8=ea*ZQFNl2(e+yN!?S>yL7pE+{b}g?K>%tuEh4&0Z z1KP&lQ|XsYoE@$R!*eD&Cpj`yst;X!ZqDv+;IPG=i#7O$Pkp#y*kX%#;Avf8t+?;C z$Yn|caek5 zYnD&+vZEx=wZ6)Ni2ADw1P58&ijmG}iQ#{|4_?43J7r^a|JLG+Y>dDoj#0Ihe%yyd zVQM`N(7_n(f7+;({Y0rV$rlTH)TRV)YA_C(aO`MUE%=EQ^X=BlC9p|pYri**+j0Lw z)#u^>^TX&viSh@X2ihn3Qxz8XDCWdi{@TC$z8U^I!gG4QqE4LRLtX5ZCi-+l&0(w( ze#%BwYf2(+M>1RV$MdazkymDF@AeIaY1aL6bT)Di_r_@@Kav_p30vkxnWp8aPdE6U z4q8fSD)|ajxHsw0GOS)?dxj^9q+F$j;Mn+0ruiv-oZt|Anjs8R@VWo(tHG#lK1RhU zp{Y`F##|61XI$8DzzMpI{&qB`v1p^L-+W&5cM_}5&s>dG8Rs8b!i6|h=aFEeE#H3|eAjOcRc}Ob+tVMDg7cDLNu?-vH_Bf+UjKNq7v^;P zVPPMZ=e$w^ImYMLWLJL-riK{!7P}6QO&>5EY|deIDEz4*YhTE2@Jk%!Y<&~A{JD_oSwK1uaX?|Snqa@s$65D zKy$I*ux;@2zy{!*$h}NjBFN?48|_$gHcND^?aTAE72yF}3gu#Kr|u%bzhTt21${fZ zKQVIoqT=dZr8Ay?lzhBeO$WVP-(&;!_+3R6`iF*BC!I>^5Woq~6HcG7C*{GO7FZa9R zQ%5xaj~$O=Y89jv)Y>o4KJU)nfD9qk37opU!|V`Ru!atCy!te*iinN+pZQD7mY@?Cj? zc`di@he9p8O^k>>YB<*evwV+tHQ3xvh;H;h<@*}ye=7-56cMey3s?Vc=QwLiRF1gN5%DS{to=fS861-RP&8SafdiCFh_(e(s`V~ zFsZy)0n;KB-CPJuV#T`At}BAB@;2|?oJQX6@+EE|Z+zSFtgoj$@tTW(@M^3dvIN8R?rnhxGX z@GdM>!HN%-_oPDbCJmNzCyQ&J4r)l=jk zv3OF#0l}6We)c`X1-su@gIKrPM835tj2Ei^+Z9M}IxbnnHz(<8CfUSFCI_uU89GNmD)TJD~Vjh<#FgVhW z{jOA!h&mh?K^HI-Y+{~o_B4H1;+9`&$o^WfN_k&--?(k8cmk={wsR))%{4|2O$~}q zor%m+M$20ZB#N6L2TU#Ur}swE!S43fV_qtlR$`=%Xl)J(mqPp%oT{|KCCkbJ2T*Q< z8l@QN7%~Bsr4M*+x{z^}hZm_8W#y&g+pD-!R3z?|oTL6IXiIpv>*!M87LdCE&|=68GlPAuj9-KE)WHG&d9W$M%Zj z8`n}@Q+*~MNPKJHpjc@69>ru{CNu}98lI8bPoCvffE6?+>%H76b%`b?_icM9ccr)+5I_{Gxd`!XZHXfyi35X`xo z&N}=xloszk4JEtpBv9(WDrOZ*tz(X-&leyNTev`Vog9}p$Cw8JSHiPf!}E)CTDReA z=@%a@lKl7ZL=37&nLA`-=00CtZ<8qe$QDiip%T|S#XEcUK9RugA(h=tU5-0}gBMQ~epCj1(T-f(}p+a*f5YCI1^1Kl!+&|yrDT+ze z^cS57^OJTTwn1|W;l)IWPPDEW>rcC+n6(7!aS~ohy)o#mjzEFy>)T&yiHky0zUp9k z*ru?zPP~G=y{6T9#^LJ$UBgQ_9im+sCANM#`3)aTiJk1#+BJUG#(%{=?qciwR!W?V z_*1<2Z3q}ziq(O>B_5q&TUw<$E-!R|Zz9QtU0mo+K zI0$B)`6A!5LFVXxIK>Sn&{}rpgUaWy_6u8dJV8qBBDzne`JSBX@cu%xUspNKjODkoWhq{|<`@umJ?kakVlZq^))M_($fCIP z%Hl{`#pxZAu;T7r+Y?laR})v-k)Q-FIbWPdd4>?$^#W{CT=Hb&ZS)jfX|%+cMp8ef z_LR;%vw%b9eR%#y&py{g_KHTqbcA0;QKDp9jO88Mm#X9Ko%$yXaj>a|Z zS+s$1JBBtKU3Izdj~7st;A`kquFG`DC!_8gi6`9K!HzB}505=&kkdBM%z)Ty3OWrc zexk_@@rd64LVqb`m9X|PK-#I=P(Tt{0)3AzjNfNGj4c4Xd)y#TH?gCF(`!7V0MExz_D#|iCnkn(eMGg6)AJ?~QMWJ|K+vI8%()zu7 zmV0lt399PtH8f?rmoRo?`+W7prEH>OCD!$qB)oM5&gbhYyFX7-fPQpb%9knXTGr9b zVf&|Yb~p;;^CCF237~jfC5_zdojdw6aqVBuo_tv-rH7s=g0yEO{E=`r7b8I5xp$lA zJiWJSdQ3MMd%;Hw@P8q-$UIY_7qPhp{2|zs*tiZEt?TD@t5*cJ^3K_0uh}*_oUXgV z5+AP2(#2#v39{-9)S>LLb8}lDY#AdbDxvt+f2#EL#Npo zlKb}Ls*%9T(Ju>;9ZB4VyC?D@S6gN|ZcT*(mkH?*Dw*k`$`wK(3aY7C6F9CzI%W^_ zJ=E7VZd^C07%VUCV02W+q;mfVt-%epk)B-MnaHy+q_X^Zw*3A>Xq)eKA#C&unLZOw zs)rQJG3V1P*vKusOqUF88`Sg-2q7~Ld*TDi({T6U{oYj}TIFPinN9-p^AX&_K$ zgOyq$4Z)OSNeM&b0=vF#CE(xZAUS1kOXy9e^{da$2%+67Ny&Ur-VYLVIabZ|3goSQ z@QcW*I291oT&lAu#?tZ!B=aKm!L$WvNda4b<|b%$6UuY8ijZo$;qO;k)OOu@;-DWD z)1)uSk40+nL$yy5*Ln?MChf+}Szei%#gU}Q_(t$&uKUYIV2>ZZQkk}St(Tbyp6F|# zGenxzH#5_T6qyyT=1}WN@Drpd;O+n__}i(6wwpXY6(YBo}fw} zdl#CB`&w}rUe15saens0_Y>mBM-}CqL&5_Hs4c^55`gQr5g`VX)t+J^8H|eE8r|6WTO>nThOo)q5KJu1% zM#GxGpp?;l$i96^YR)|616RBx5J#_77bR}Ev!l~*aBH~@u~w|vaAB1B3*n89(glY; zz?QzqL$l8_9pP4gSG+9x0ai^UR|lWjBFQ~hLa6?l3Z`!pEfyzkhw)E;Qr`8)0o*K? zGUm$(!qCwq=u}K5X1dXSAr#g{g11TO@8PSl)ezVmpiled&(9prsiw+;!t&l0+OR~{ z0ysUIx)T?jM8)wBEObJ#eCvnCVvXIO*{$d#zhpz5mzWCznK?R8&ya6%63?9y_TB`c zF$J-Ii+=l1F$cdPMgF_`Pvi&`+ytwueo-Y0JPyF-95Z;q$C!2D)JNDXUD~bV>QA1U zj9C5gMY6OG2nUAG8^dQzJTO(_bYUvWo@0Kgu8|+(YsSRbw2O`Ct!`mVBSbehO|EF{T6LKewI}V5Gm%`f1OS3uJc`A z9@rJcYz(|Fb@o(7`W1E0Hz5T_$W)G7&wt-YwC&5pj5x7B$=i@}MT=zLb=iLNEZ&yv zSJM1QYl-dNhg0Fdik5r4u(TY@;=xHrs^;i7y!7so?|37_cAJ=pi4Mn9j|a|^gfKJPKAO=QgtHNh|~O zfH6>PR+Jkf)#^LMMr6mGUp+L;1WFTvg`zg4{r?R0Fp3P-;zVCQ=*x z*!ARqA*eW|sw8;~L)FE4+)uVm9rsnH(fvkn?Vn#o5&V>;RxbM5qg7T9*W$2z7q>H{ zJG0M-G!oN+L9Q3t@3sEvS!p$2R9F?h5pgT9(p#IMDiv~0is~`;uVfljz5d%`*I2f( zDuO4IE}}2>dAqzzL)^~C<67gRtnkfKfm6Uf7zOB)w#V-2W-IX|YF_T+^LxDG96ti| zMNGO>P&>v5@r!Xk;WwnB^wz4A3Iwb4zE*4_k*}G5USuq=SB3O3DgBdTaqip8qT&<= zID=NJCoaTZ@Q&vEM<4Z5g9^yMo;xp!SZlRpFhMu_comWaqd^~=j{{DA*H60AL(<1f zYizMw9>@mU;p*P`DZK9Vya-~m_?-pykmZPrux{L}Ik?_tU_F;MlR#%zOv-)F)J$=o zZmPNuDzs10`uRrIAWjzu>cqmGFUF#|8vT;u9wXK4ch+usMy~Yzc`R2W)zn3(;QH(R zd?cTAQEQKyRK1oN3Oqk(wa)wcC-a-)F=WB*E7PZp*W>Nm0<~^m1}@yshr&pWxtG3$ z4F_c&0h{SDW1jhI4>Y<$e2raRHHPC;hnm5TE=d;j zqt@g6j*)U^sv31wr;n>>tSh1Q}Ea0ytWSDH~5CA(i3@p zM>B)@B}&En?sSX)tJ2lN$*h$3lOozvy5-Px<&VF0$}$5m_TOE^gFQggwUQw?Qe)tANX~&EpeE?1AE^4o>ITghnG{J!s!*_Nw6>X zVjM3LY4zz%x4+>Sb-hLrp>WIyD2fp7TgJZF!5=D4ev;oL)^CRjkDYb6k()sZ6T@vS z)>bN(ez>%wSGPo@9*duvKe?5`sg0*8VyaIGnA3>IqTIbdP6!>SW1->MnHLg!`K#sD zkN?g9f;@e$8GSp4|EGa%E}Xly5irk~r}~4}(G&WByH*%{90}}mN}vDiIdM1 z>vR?0nE#x;L^aAsYd$=9tIV!axHTC^i22?Ws}ZviXE7#w1~iz0YjXHQ)v-L)#doE= zH@-!$QeQqmvQVY^Vh+l10t1dYXub~ept(rnqoU>rX>GG{N$kJ70_Vjp0er+~wT`I<}#bNem{UPH2N_O)P)LAMa&HO)A^JR;;vyQCpazhs`pEiwkC7}fXJf`R7i#_b742z! z*8X^VL8)WmiQ&BI2`xrjGUgS0N-PU?X!ncN{h}@EspX>e<&q$5)`-`(<0f3i8kgBJ zY5KzW*?(y!=Lg!-#<_lojTlZuG8iZJMuC0A85r5x*O2>5Jzv;8p0ikbf zb#>I96Mqsqp{DJRb_nu8Kz z01*d-9-FY6+0jJWqS;Z4P`?QKU9KWiZ<#1dZfq$kO6axC0uv+_x=sGXd%1=cOSK*Z zl(jj2gmBE~8NJThFFz=;4E))8{WI2Zl1dk+Wb%y&JlABQkgwdJK+{+;hwc@aPANm_ zQG3g?U$#`0JU5!M(pH^hQCg7IQe@lH)t|sQ?s&Z@_nl+>{`ot?Ld>XpHBnKZj!t8m z#1o7XjQF!Nq074e!_fVQxVi{0XIK<0$VLwsgC59GtJ%Y(l+v2Q2VDB^Bw|fa$aA1RwtKuM1!hzpqw3qqv&*r*7HW zi#I)4NcS*d<1b^G#T$(U>M#o!CO$2`-LS${lzr8*awI+ZtTxU~o7ntgh6tLPWl>lN zle28-2!gnZ*M5TOR&}4dj^k~F*=!D#S<}Ucp;o-QS>A#-2|?~Jij9I$;Y-#lTOk<@ z^S?MhFnj1Sz23GTaLKbR%_P&9$;Qv^`0B*<5Iig+fn`fm;yUEdS!IVtPUMh*yO&m=k8yN&485Ek{3TFo$Ch*G6-$96S?w-U$^E5e<}$&(b+;<{%?Z}&Z$lO@YOS^hZ#j1=nM#Txk#D0~hKNP!7(ds4ykDcUE?(_g zj`TQRUQ2Ug6?Gj(hh2HdK)a0JdG%X=?a=Ep|ehV>Puu#20t6yi4Ze7O{;|yl!67;$`Vuo zK1TH#9@kTZQu+gu7j23U0`-qLMYx?`Y57jJ@4BMGp1i!*aLT^h-PbhZSWs0aej);P zw{uGY!EzL!@qm6#EfASy(cn%@$G$aN7q9}4f!f{m-T!Iw8WUwYe2vdKWcmj)&7V-EeNkJw{cS+gMy1Sb|e2= zbnNW#erk95$)@7rYno2Uq7Q#7#g1&)y&hE_LWC^s(v^rs>er|Pe%|)hZ7Ci}N*+oI zVZLhF{lMD}eIu(ZnZ-~QDa>-D+l0_w%`%J;n}r9g%g^_`S%B1Z{1R#Q#o^dXN2~qg zcYdHJ1fLhG#c=5G^tSvb)s#`_Xw^0NpUc1?-7)pAB#Qei&+V~cu9X=8zotf+<&Jq^ z^}Bg4@FJv;q=vOxT2w#p$~~YtNTBh57@Z|rWf>Jhrm0txG>k7~@TRsvLfl5F>a*4M zwZWrw|uEt1EG@Y}0w1 z%UN6<%n;((d=iRS&&lDaF@Nn%HYd~zw4?a&^P55SC5tEeS|tIqlf!!^KEk^uBMEMO zzov{96G$CXv?wXi9@0vGaAP!bFSK>n${>4@wZb@ULQqaTPQ{Q!Wdx=?g7Vx;wjzR` zNaxwU-v>E5fq43&Fjc$(VnaV!&T0yyq_a?C)V2fy#8K~!m4&3p=SrhRuhQd=_lOR5 zkdS`m^lCjGpDE(8=|_jn@zfA2?W9s?Zr;_L6;~5(8jo!@FFb5i>cpa}fMllaHQ zm(QzXTSz?adl#x5z3AVm_pMYQM*2A}oG;@TZ>hs9|6@?hlTv(W!FvA>oPOAYPQ6T- z(L9(BRFE%vG779{$L=q;UQoRT-*!B@bQ#4QkXhL|HGra+X`P`>L1$+`^FbBPWmBP~ z(;JR6R5iEio_W-SaT@rcs;%d$4|Ou#$wkfnRRyd(6=F|rSfBxx1gOdRy+%#V|3|8^ zJ(joJch`GFNEz>C1-Ro$2Ruf1|4fXYiOD#1vU460M#9er1i~&9wX=6u8YcJe4NYMs zn&fV?d2cATxxLgW3Uw+vk!*(y=29CTJ~Rs7e*Kfr=Jp7*{9P0+>|gFCOJq}D;-BVD zzsHBxTfUM{T@WJwP>~>&MA0=lxBtP0cl&}k!H(DPFTqz7|CJ|;CnLq@Q~bGXO_)vH zdeHmO?cY-kqh~AIxe%i$ruw}HixY_2Vb+>98Vk*I#pc}v&$`C~!ViA`@5%_6GS@^5 z{g9#BkH5kDUFY}yJ~Pi&4JAg%HZ$Ol*9(5iL%uRMgJn~3n@(D2f@OZ^e<|8Yr9bQb z(cX&qf-$mL;XSQ%*c^+F&&(<^yx;Qeb*H(IVT*EFtq4M0_iVX^*=4F{s@a~=-f(7x zC3F@v!D3j0PdwiCM=`>x6jnBS41VM(xbZ;?W}Y6LtiPKx74dewF02nffhgyTofAXl zpLKk?|JwZ4+UGtG8#zaozS)p=(KJUU3O_yXh)2Re>zXN9`3sp#&_*29^k-yKY zzPj(u0Y$}09d_(Ax*lMI!(E_sCaDtxL9OrJBy)oxA;}u{Q61ib}2 zM)NPjgbzNemo@^K;91n$oH?sW>s3$5=oGydyADS1myt@_pP1un<+BhcGk9;uP*|mo ziJ#o1L%#VV4Z6jAjXgRjwJ;#R?B4Zo642Vm4pf)xC<5K~-H7p-FzOWntkK(#Ukm%E zlF}HN*CR)@vz_A6k_>SZHS)o#MyCurna|II)!3x8luFLGq9hZX(#*@jh^YU=Myar$ zORV*QB&Q`NewRF4O*d0VVF^@hI7Poh0l7-8)JOJ1aP?Cn7m?#`52@`VbSk4o}1*7J65F`u(=#3iMKk_gXHH zW?Ye-1{9NvAj>&}5h_bra-U8+wpueeg^*#cF1B8gk(m~N8jd=N3)CMaIF7>x@&-va zdyr1fFl}e*koRWY1YN1NGW0>)t)GG4@ptYeLu<(rt&NgZLYl|%--q;-%Jf;s&|HXp z92R4>+hk-y=W3JF`$6q8exOjIS|MW057oxT+NR+ju#Zx&x0J6b#38g#GH}yOFgIgf z+{(jlg4jolkp;rdc|2Z?%kS@ZlFMi5TRl8+^|qB7aUl%>4h~uiC$ovTrLK(W83*Nc9kMsRi8dbQ4C>AI9 zGvZ02i_O$>HOh;$Xosj@`Rv|!h(sd&CSYmIyBE z(Wq-o{DYXpS@oJxe7ROvDCOih5)=f6T_KhjnN<%aqv~F_|L)_`YYhe6l8%I4?A24J z2tj2$k&qMNTn=xKaS1Y`Y06(64yxCV8|JZDc!eVcG8LO`X*Eerj|*l&0ZlA~`EewY z2`Hyxp>KguNTq54r{Fp(d1-aT^StF#gyG6 z6r?+I&}Cwve$L!THw7cmHtA5zoCyM3|dMa7K!t|L@wi7&C!uyHq07p9YLDV;~8oY}ks1ajPjykYAEVDtB-1K{jNb zyr7lxj>^cU(*exXqr!FLu7@P@**RCEaS=YceVsC({?i>rOb0TVzLSAOeq~yRyxD zpwa0)AsuL-rPkM78cvLC?^~KU#8v|CzT_!JD+@@7+WEfyG0VoO12^>Yl6T{wZlFX~ zK*d-6pu{tHFz=FZwoqwX%@lJv`VoG7M;gK z>0XR3;~iTt50@&JE?Yr(dw-VizJXv^{UnaO$}{N?)#XEUwEZ$Q+O!_AnPa_%BXXZ; zfKHN8*Z&)<8E)y>^(@JQ;u6vF1h~d*Wb7LP_r~tke{WuF7*Z0W2;y z4{vt4I|!nhG1S*o75h)6YlclBS%vil^1f&i{Go!Cvk7XcOUF5JpK{UW~hlQ zpBL;hIW?kco_+Le_Ywt`ebx7zSGxBkllQRYNZ{{w*qWE9YUzu|@g5qtM!l3IjJ1N=AMINNF3yGF8r$<^xXJ=7pIj3j( z7PK2iPGu8lPR+t)HuS%_6IM%tn&*~Iz>*V2)o&=kL;)Gtj)Y*5C@nNf)EXkJ8K=uT zp|<|l$0UdyI>2y*)=+3x>GOMH=u;MxPz3*`cG@!+Z(zjqdAC6iW^c_P{w8E^Z7k<- zin}@MW1bk4a{1clFK(b0%Fes!hm?^FhNn)6N4?l)W$s_y%#>Do`SF;v2y{b1VxaZ- z;I z{+uBxxJz+`AM>A5^xRx6AI_^%cde$*Ckh2xdipU6w+H?xSQc`*k%}ueOMR_t<# zKR@v7=8%A-EN+}FDV!(eeIe1D1>`L~3%^1jMD(HhL7kR-(HxY<@jUXn8o#TJj3w)c zIkwZVltq-E?=#CMk&O?NLJLCuF~o9)l^S?FRecwY)H47gCv6{l|7%r9A+7{R?xx}= zpaNjnEDug&}9kb998^`nV?zP@1`(5>mpIg8%Ga1qeMOEmy9mML zo1SScr1HNH!Byfyb^Nl<_^eVEjUlAaEmz|_vYC(01Bu#&v z2F?GqnJJ$n3oF#*T_Kh3&Y3)O2X!?9B~+{(&ANlBu-#ba;6jN-wU(rxMHd?rq)_=j zHc}%<`bM=pzB7jVq()MoY-Zg5q3bQ9q72ul;TgISC6opQX+*k10qO1rm6D;PYXk)a z38lNcL~7^(B$bd97&;`RQ}VsXbI$kudEY;-#aaWx^W0bMYu|gD^5Msc`&se{{TRu@ z3jS*xDPeot6o_<}DKA*(==$WBP7rJT-s}@xm3QTsv_89sMR-!kb+NMJqqzF4d*Wm%!&(bj%=38PI zc?O~h2*z|T=31m%yvTH#>|KOc^Us@9{a&sAvISv#o!s)Z-$S->e5)3dZ`o01V>Nc` zU8-Y1gAjYBByb5o9I#ylWb$;96!9hTbz2mh;TJ~W3$pAa%&M01 zR>*1EJ2e{Ivy{?9R=zPg-?@MH(;WLs3E!;^LP1#sTh;2dxU2P>tf^R95TB1NaoCkTHTOxf?A#_z~Q1qx02x1@^cdA3bdQ*S?4O|DLPD}_%vD^|-ykB65a z7h5b$#s|b&WYxLFnj?~NaY^PSQD<}YYyc_}@aZMS&Un;s zTBiu=pH1hKj-oWhhZ8~)tTA+7y|YErW`y!z3l=;`>HP6RjM4hXH@9m*>3hq$v_^$( zt&^b;TfyY^=Xni#2(Yw%zcR(q&o_F0ez_Ql)v5s-hP`GVwoG$Tnqai)cf>+zH`5Pu zGa*Nx8};{HHv{y)X|1j+a(Q~!F1K%zOf=y{T=`JtQ1wmCfQes{DGl$p`{n9R84yw^ ztIn6VgW$>y2so!Q8ZG*aheE>zLF#So;Sn*paJ;LL8xwbsGy0fxE ztdF!ugJS~h4b1;*j^Gq$#Q<`^B}Dt}4(cJPUjgQp<7aTU&A`1P@;}!r%ivx;4xmRK zSI8v)-JWY4AN)}__^LSBHGop1#RSC)_#%aOZMkNkKGae18m?xOl`(G}`}XV3lSWzZ z2uTtt6X$WxVTd}A3Yx`E@us;|?f^&Jxb?5peeTzdtYGn}O$WfhuK1Se+LWAaN_aA-9ifFqNh!aluOLaxvcUewH%@Uh~!Yaqb`6vbXp4R!7B~ z{g>>8UA9t(!u|dKuDgM&ih3Tn364^FYX?OWu>6foXeLO(8-uHou9hJuc(2YcYwiW~ zjU@zjf`hwv1lS$}Qm5x`HD+}iT+ca%d&#dhr<}NGwV!T2`&0vCXZsad7coKo&NN@} zq0;oJ{hkKW3Hbl)0~tz0QG-F*bn$dLH7 zuNXxu3o?|N4^Sy|3B?E`MvdIfKuJUr+mtLF+h~l&tT(ZH_dXh-(3Mw+$fO*{dPTz; z{1-pP2G;3nX|EAK@O>W=UpgIB@Bgi(e?=Jx#t&}wpq}d_^suf3np7N8^C#+I2pXL5 zuD`fE-(8hcW4&*)uU~R8Lg67-KJ3;uv1ju>ohyP}&53J0h6G5AKI$?V=(513DYD}? zunNzMHQvp*5i59bI#Y7x$>guQtw0QlmUHHOPZ=e?s?(@KUASaS;l!n5AXQb20`XzY0JpK*CHBFlP}!0ITcFaw!6eY z1M9yWgVBhdtibx*xA4i7)Xr^ze1G)q&DGgMGKIA23h`BHIf80j0^WD_UAGrcl$mTA z)O$xQYfuxNSxVIgZ+~lTr>Nq&I((L}*Vaq5 zLdJkTi%AFY*Jkug*c`eHtUNs~RIQABmewF(E{R};EXQ#ei%pCO@?k_34;c1UF9Fpi zbNGzcQp)$sf_=4ByZi3>^u0#5MIWpG@zGkk+XxXJd6^(_a)-^gb|SZ(6VqsbI&0xS zX(;J>KqAwQmT7vDs<6EGl9=|3?vXR}*DCkCj)<;9w7UKV0fL*A-h@F|iFHwK2J^In zL91_syY5x&Jv5_~UA+x#?weeqw>Po(zH5DzJc!#4by;G3#;`Ll5;|}=lLApyzOQKP zmfqrTO?QI--hdP}*V;^ah)WTtcVu#4W)W|nYU+4H!han+MCX<*>C>0n&4>fCy9lneol-mhL;u!WoaHW^_o;Pv1gzx zPs{GHb?4B1D}IZ>VCB(lV9HH*Ciz4@hhWW<{w|&K2mQd zuUyb|8&ON*5SDKjFYo=}@w|HdvGa`UWJ}pQu)%m1His*$v2@rY{ETgl#ppceeI_$5 ztC#xy9vs%@jlsJal^c z6$XBEu;S+2ObU*R-#K{W6S%q8ypi;*&%vEHVu)$Jyo+jPZYu76t3LH$D<78YIVOd!$y%Y2@{r zMtv2f1-|MQV%R7k2t@%jANRCl(gH{Gl9Bu8;_$$K2 zxp$I)7xnSAnjpn(8et7*G8t?3DSfcuJXUh^GpaQ8W}|Qu!oNd~)dzQkZ{I-X- zUH#FW6P`a@3;pq|mPzNItDZW7*d!OWzhpn$08YUEVOJ`RgoQKmFXz8kbtzG}nMbB_ zBuX`zA-9)cMh}XNwGm$m`V4x?BxDm;#FS+!q;6d%mCFf3AKr*%RO2FQ$0y3GXJj-5 zHq_prv<}CQ&jTLbAvOoC<-&oKNWD!#vJeNS=rN^(L|@qu$M*4ZYSO5Jd-L{}1M#Rz z8m2U3+tl{28w7$1^ot@i5>MImRMGmK?4Kq|Q*0y=Du?kc+Pn|GZytNa(Ob#eh_nXA z6$g|=)UZw(xOrX!g}?B}gi-6ZgovyCEAf~0>dZ`A;Nl09?YM>Ts8%Nd5V0yE>y0;L zz@wF__9(gA`HcUW_-B`c0rTRAMIW`YL{aq!8lIhG=aeTLv8^t5o^#JrESEU);6xUB zGk)?-dki0v23=v{2LrG`lH`hUTJtgD#8aNfm|iyF?l(R(k&0Fr9k^?~9Ny8A!mqE^bFBD!~UIvR2 z+dufaYhBAUc=zcsZ%Ju$#da3fe#HuE4REz^ysvBMIQ1vI9t*b2I!DCZArgH@83=jW@rwDYIC7G&(k7;lN_=Gs#(Tkpyiglsw>6>CpQKe0M?&Cjt1 zYtOa#vb7J}Rq1#)wf@=2(vap%@Cfw2pmny8iizs8y8l$z-MRY5mchlC^m&pYT&pCRcNdc0Mu==U3l%qA2P0Wn&Iv%NN{+!aP~U;src9Y_oGJ{7{r z*`KEaF=e?D-C|Xbk!~QlrJ1ixaZlKNO%-^{5dvR>4j|$gBOMf2X4){q)#fD*U;FW?(X`2v80b05cYnN>f5-V?rH{M%d%y@#I5-S?&kOFt!)nvpRaZL8vM0#;!e-a_=Hn zRssdUMu!w^>)Sjx4TZI%{65aXDp; z(_i-@ND=>6zFl^K zcKeH7+g9q~z~aAxG~!(eaHKiMZ=(N0kpNfU7L6mFl?e@^wWAaWhJF6{0L6emK8LC0 z+=nITNz0g{^Wr~%k{KFMs>Vi%gGV18!V{bEIrnuTKz|+5tebC~s=16-edEK<8!Z!FtFKToLQH z!a|+bkhBdt6C;kd0SN_FmFrD}V-;J(-1w4@845=OSOZ34UoKXOY|BpyOF`$ovGRZjUt`*n=QBz>joU zX9B{J_SW$g5cn3Mhl~TCrs@zbhDR3=8IwYFy5*lBWVG|1;ZS|6Y`abgygD{m7B!%? zql3Z{c`aaX{ekh^_n4}Yr_de%)h1Tac7_t?USC}tN}r=ButEkWACzihN z#}vXL^-PrmdEe%AWZ)*d_PnAI7&&k@MuPVk*ClYt_nj77+{d@Er4ljVPKARhDz-xw zHL3a3vE&OA6}q=&$!}pleWRHRZ)r_wdShbn7HF$BeoipG55B#ElMz|IHQg5vew?K| z)Br3JTsV>C6jrsJ7%1b(?oa$)mFZc<0q*W&-b#M7)AIGXjjpMrLwx#NVg-92$zYYB;?+vUn63w9X9F^e|oZ7LhYQM;Y zfGv2Oq@SnnE8wxIi(~03IkNk!DpxriOp{N5GVXBdl>pcLp@ET{V!wAHFaFR^L#5guepRLk;3%w-A15Eo7C}+ zUnHipm@?+E+~L{){&tFptMzofGefP@OhRR`emQlyc}vQ&2u&vMXVNADJQqg;<}hYF zm#r98CgzdGOzP1oGs4IhPEw0RU1~2kJz)~;G)(%yCh^IuQKj~lEN}+QZ<&21$9@Xc zk^!&u(iG}T`ody-A*}zGhCfD-sZIPqFWd1P7vU!VdyjhTI zvt@g*DeoBRo+I$3j+~rr_KE%ayssn0b9XL%*435Rat##Q+miVt6LDeu9ke?q8BQzubwA~JYjQLgoA54AhM*&5;qO=eHr8LQbiku? z>R;Yd0;{-${@?f2ofAK2NH@!p<$lY0%>7V%;kn<2-xRkNCVU1~!iP)2`^v80 z&R_d)pyt2}fj*q8H;09i0r{R6cG^3q?67|!I=@R&ocS-9qc|-qD_N1{%f`y8TF80y z&zd(e+yw7e3u=oF%`NtYlc{Bsqn&Ne@Y|9+@*iFrYR^U-AmRiUDtbIyd$U2Rue6XbPCn~ zSo>{^ut=5R!l-ympAl0FX#O-i2TllKBy@J5>F5@qm-K!5P$MHxHUy`NlS>`MRA`BQ zdB5uslH1Zq)WTXxk@`PNe?=OO4=Hh=^P)rM7_<(u@FsF~jUE z$jXi^Z!(q}Awz$LaRvP<*9ei^-OtUfRYN;8%f3Bky>qZDRxJBW4|pcVOuK2rv>4yA zEfBpfrH6rAiXk-A2}>kQdWqKI7&$U{29|prr0SE%SU@cI+WmE`Yf%I=Ng<0VqG~2EvL<{E z*Y0U>E=+hM`$I(qN^xO)`0WzwTlK!j4&bGv_>j-xrV&wDAiLm!z~fD=E1Y849r(tf z%eGOodXNiHDAuj9(~`pKG0rcQ8U(d<3R({w8){yBr<8hE*Pq0f%STP?4_#v}hr{8F z8zMCGNnc+5(ghVO^`KV?n4q@*;nDz9Z)0*4ZXg{WOwEAe_?8%Ig& zu&7%a%)KC_@bRv0-ZQezsp^OE+$Q>F9rGt}lYlF(cpVlT1Z9j9Xb|kjinMCH_pNgs zD_P3NJVWPtSdQKO4W8IDG>8gX>g14&Revx6S(8*`g z6n#A4Yzw>p$?aRaUhpvuau-wZKr0>W#W02<;QRMSs&om|`Z&nd zG$C*|$OC2Atp*g-WXRXGNx3I>_Vkbu*lc6GCTPIUzk4?VQ03?Xm{gpOhgR>8dmPZA zYgC8>vm%Hg z4+-81VFwe=$ngrY-n;!~2K-k)!Aw(R(-RdZ9dvzb>e8F)de&?HCzXZ2Ebu|xZxAzW z_Wm?o=k%R(aUezTd-gs?X6f5R!WGif;zX9XKcMV_LsyAeZ$MI!9Yk7IPug1Y=(z9p^XsA@KA@(Y{EonC_x7gh9o8CA0W0A3mm zC;+o1VSr~@4?vz_pZDN!dcwe9%{sgag+^T8*L_ij!BoN4k z-G{CVk`84`3%4?wG`O*h7ioo5m^R3{WXr=3xoJHIK-|+EvS}sUGx>|RAY;VIv;gZrzJ*Ka(AuHZxClQ zp^W@IrC2eyWRqpf$L2s;T}16rj}w*h=>hA1(#b6jAln!CNEeSWo*WyM1s4as(UV9e zF+vn*G}4S~?Ais5nmoBFc+FA7wQfB4$JZt;GoCvR^Y6_NE>_b`Uc6LmK+4^GV{1km zm}roVwFL!51)m-R-=QjstLn^|wxBk>YBGtomG6nsLzvW2x0pI?c^Mubgmki81}I(pPCEk6ZCo_(WbKjVYL-2J zUX9d~^E7*1<0O%<@bAzX2}Ygp)=GcE+#Y$oNfDm)rmvNngoi=akLvCeX*9>cdSMjL>x`k7FSMxy{>lDMu&v`q3wH%%krK z+_@j`@s9xiuaIUJs0-SqI{Yplv&Z&yd?m3Gvb@9sO!vTpSH+aH1p>}Sp>x|+0;yT6 zfAUD4(i3m3R4${(IG>=rWx(k$2w(hiiG|VBKNYn404HEVoOef1MFT`b0a)ndvg;Hi znTF6ou!Ui$EZ{Gy17hs2M4BU11wb7kAUV8r8vus%Y+gGke<2e7dGLDp48S$M#+FEyQwzgX0TNNLw@*}t#`HvydmDBWTna!x0JK7v}A;u@|e_>DV+ch1L1gfozO_}N1>k|zfg`noSXZZ ziulDr$ok5<4AX`oQ~d4Qiz9bO=D&YiF;31M>fke}g>|F-(ELC8kAv5=jY|fe_v?PG znngq@oSiL7s#VxP9Pbp6W~J$gX?48*%MJ@Ki(*|A-Y4OrQNExgeqAJ0{#!Ep*-xU_ zGP=eEe#J)DCFgS+&3he^qb?mv;h&K8*SzOH+|EorLB%qSefH)l^u_>5jqY5q5yv-v zG7fA6XQddeSg4oZ6C%e{%0aV{Or*YyO=hWq_2UPawH|jxGh~7cB@a-l9B>>z54B%W z@*wb-@DcJYT0w6QR=*#rXf)pfrnG_s>Eelr!5t02!09J2VXEqbe*Xr>xVQCMUd=}# zGkXp0zwH2ch92Fd!V=SK9mbco!HcCC1?}VAHZ1I-%d>r(35xI5OpM#0`0fj}g8sC3 z28`m?!n2R8I)>B5y}TzbK?za@lVBbI=c-c^s`o{${(eDs?Vc>3@z51E3^W*9VUZkq z2T2%nI50j@k}Guz^HzVQB(Bgt8$(wN=wKBvD>2ZLI1gC*hTose|L`|-a`G-8twlGu zdCUw|TrfH+KUQyxGF?`Jev!jFUq8P^t9G=}TlX&$=E$sTA?d%7`NqYhgkubHE~tYl zU&^Os3pY`f;K!w^N&%VbXIf=UBxhVU7F<`PJS7aA9;N17`=wx78lsf)` z_1Pa!7oDcG7V6f9oyhsZ7rnrJ6BS?oL$2AIQ?_)&)4pC7+i@PM=}7_yKDUeCC%DzjoJ7gp)p#c}W_%zRAzA#LiTzH{?8W4+t23o?i1F zyqJ|zoWep}(Q>HJgXendDO6>++!sLsBq&YY(37m(d-Tb%UbyOE2oliR`I)Oo6tk4| zH%l0myYQ_91Luq{!i0N<`ZL^QOm-l~;23%f^3a&#>&pRU;Odc!g@3!~$u-pDJxGM7-V{vD!hY=lSQ%Zj`gqzDg| zfgz7bdc=72#rh$Gq_4p7#%LJnHmZTY*TL@`k@1UiVd74Sa!Q8&f8XgiN|9XDH;u6? zz<-&`DQ)=uj)l~Z->+wg{@_lVW zS`FNVBtP&H7^3ke$NpYd^y5Hato`S`O)QV7;GiRf2^$4Pb=(v5{PWASgHGI2v+pyD z&qdqKHKDe{H{g59!w@#3mm&~46(Itjn!K+V^*m7z+cTxjyPYur^fE~%Fo}<1(3GyMHkL+>;|zZv@C(f}7T4wrU72>Dp?^7@t2b7S?bK(~}~%)&BEN zQ(W7nR8uZ-N_16m)Lf;yVYjGz@D6HPvC9y_>;nA=N=ZvG%xA04G25TJ5I@9CXpWb97}pkRlIQ5R2pd z5If+;9cIwq8^<22Bw2;&Wl=LLJn!E*L=V;pYeK;43%^}Yt(J-PSq?n{*M$dkzo;m5 zPmpYQ_W`CT8cRgKQbF_>X3m-PoQvQLfstAVD;%{QYO0OHU+T$~yde3^k1RLVBPj(U zqyedcXN$NchE>evAn=||4bMBx)NwQPgumRBY?Wfx7xLR*!VUoHg{ZDveViem3wl0%X>Vi%X{mjfShD56f{L8H-YLpA*R zY;Tc6d|6n3;|T+Gsb7})Ff-^ejzCsODO)S#L2}SO>OWhKmj2jH`HW_#!n=^P(3s*2 zsU`Ig9UcIpnC-&h@tZk{(Stly0O5TROVW~zqc|cJJlf;+R53of)*0w`t3KDYxd$-D z9Dr6*$2R#Mb4aT&(tYG^x4%2Yioo4#wq;-VOK9^DfiuL3H+**p1`dHBbySh#@oDkj zL%MDYG}s6*DHeFUcY>@-0iB-InSzP+J3ze5x%zUjXkZZ_k4;FK2M`c9-Lj)1qL*W} zcZb?{Nlx!&Olp!`((kFh*f3HvdpLhx3Z@iemp3MCr;qpO2ex7|z#^-ly$-5tJ7!Lh zdqsJ)*m>dg+M!do(Z^SOR7*^P*?{2%$!S62o;3m1Lc5wBk#i!}OK zN%ut4^NO8`Nl2SalA!p93gcG0AWOiB5< zqF$^_LZ9pN4$>B5;0#xqHFfV)doQj$^FG^SA`M>7Prm=% zs>Sy>95&b7ry>cEx?l^Oss5g+v$_$2?cZ1k;%xv6SdinTqd^j}88e6N6pU6P)Lesm z*hNv%6zIG^V!mHL#K6Ojab$-yg0Uxi-}qbmf)s0lmCV79WPa9CbI5cg1t%p4!|&Q| zMA(p%8Y*&^hz1b6JCnF=%U6fqADMLt}ZSurPk5&S9DemppDxw(fT zemp`%zpyaXSoPTZ?b!Z73rY61EixffmYEXr|~$a>f1Zi$6T z=?}8*5|vhaH@`E3CNdwxFzLHx+|Q3TB72@c0gn)k3kaiY=$Qh0K6ws&mwlnUwZR-8 z>23H91G@VWI@Tcph3?q{2-w>sVBxfa=<(k5B<;}?3HLBPNH83S`yE)v#2PdrMX?`a z=wjU}B@#ZGv^q%mOW^ITF_*7GmBMEeDplf2v-gPBZ~5EbmHwjh0&keiyuPzYHV;;w zDA=~nVZYyeW^r%$@q&>=t|fD_lqCjJ26h?tp)J15cQBRn@y!ieM0h^A5pjFo>4pOK z@jo+#rt}L~Ade^(i1=@}WGlFwpG9rjX|oZEgFCqhqTzMm8S2x)D4>XRXJCaI6M6^o z1x+9&O)JeMCw`82oN+_G;ruBHZq$H!Z@n>*&{=GiM+Ssk;I>bBeiJl=;uJhyI~5yb zf*|#MQl)ivrfVY{CM%rwGrDVmC38NoowwAHW79_W26Ra76^XCD65APv+?+G$*)sW& zp!4$b-w>J_AT!+PK6lWR-Yn>=waA+5ozq#)-()9$v()W)OrvGZl9y1ud%%RO6}R=s z)=A~Mxzb2(V%A%4?fn+-)#b&qKCzLm`=$N#wg2n`-~2ZnYtSrMa#U#B%_gc#@_Ws} zq+XM3Yw3xRygh-guxOz575TJOO9C$j=+0*MO4`{+b(VI#IpYW_# zLcih{cl}6}MNS~a6YqXj$QZ|kJ(3#=(y+JD8^zPIwj*f@WB2^5vHNn)A?A3KiK48| zX{4;Hcp838&ZMndF*i$yYiH!#`8@SRWnLSxm-!=om{t6xanQVO-DoBC-B;(Wed9v4 z1s-t(C8g9@> ze^DafCPxlFSC4Z{krpny2w*>Kb}Eu}+zaSrM=fqPxc?#1`@yL!1kh9aAi{nh(dTc-$E=dTwW(b?U!v~PhS5ua zq~g(rI}c#u$nwAZ(Ho`}gdk)}B8_U)Ho!)?1y3t(O_WbXasmTStT66c6o-DQVLdE8 zyxS7cmERRa*Et`8{wln$TyggoRPF(cSYx{7fRrOltRJ5%4Gm%4tIib z=hDCEk6T;^fbwr&%MS26Ui^|LMq;NmFBr4_+bM!jtp68^`u6z(AQajDg(6fY!0;~` zHEx!}&{yundWZ-?uk#kQ0{lUXmt>8^!cfm!|D9V|$m-m_s8{~6P)1=TY&lmUl38T7 z!vm~nTi;%@1p7$e*>|CbmKqAY`V~W`Fj;2Q8St7GH|AngL)t1fq}4h6gBe_?ssrah zuFYKSL}!QvRDS@YyGU{y*RcI2W+NZE4ImC%13hFiT#*cH?qq?*^lztiEH4u*c#gLe zhDd~z#DXE#7~Pcvmc&d}+NKdENg>3OOjB6Z1yKGPbE9|PN15KGVE_>d*BalvyGj4< zFM<9HJPP5phr%md0*2Sseti1!Pa#=l0`09SFZ4rxTvjq>%MM1`7(LC? zVtPcE`>knmC`q^BJ9%u|8L~;x%6v3SsEV{z6_H&IlnvPP$GvNgeZ|kBkJsMM>g^d! zGK}l;c^e!+`^{6o7Pv9s>*8ZU_dyiNcGzj6W8h z6}yc@^wj^Q#>NWD7d>JfwDaaYUXy1Wu(LMo5_IjBi)$P7N}++N`@Y_Oux)lmH{0f) z1j(sOanJ0Ke1h#8dq0En6wfL1=cjb|C!B@xFN+=7B0?dY z$nDW413TD7O&V+$P?LTF+#l9WA|kE?&Mq9 zE?!08It(@x{-qUAi4h`oUha$+5;W(c0Vf>{st^7Rs?FJuteNG98lwXyUTlFb2OYj&wcZ z=hl5{GRb#UL+@~6BuKo|iIxIow+AZ;n+=|Y3mZt!IhwSQp$Qqn*G3xRLZBCxEMO?a&5n=`xks35J;MKXcE z`*Q~z>k&MX#hB&43!1Yi0C$nhvlqubCEw%5ZXOpl;ILfMY4+Z~JD4gJAg1BnAv(_6 z`L@da_h9k*1~;|dyGsAhAO3x*<#2RSP%3Vc`AbT7N9K8EDbxT19o?2o7}&y z3onUbsdnqc4xGVH-o&#!`bz@6Rps`3{8UY=P`6mymDXP(@G|KX${lr&KU7xUV?^KL zo+}r$e*Fn%0`?z*UzB(H#||MCZ@zP|UNT9K5gvC6COr#tRu$8M6}*quEHmT_RUCLY zzL?g~`6#N`5+C7Vz%YN0PS58@8(@AwJ2*}a%NT?4lanqBS#2$0QD0F)pgBH8* zvs;u)ZITCNq8`Q9sqtT4Ig7164oMZs4&zT%zcO%NygE9)IX>(;GMUjOipQWGFv)#b z=y5paX)KyW?mWp5^aJm52|4O_Gtw#_>cs=~z^yvu47~V$L21=vfGi$wHL)$bQ{j{K z=37J)jlNkhrgOLTvFopwKnxB!w<1au8_#VP!))NwZ`6>xKi2;yA3bi!B5j@;PM1Pv zo4nz*A)$Bx6wg%@R(Cw^z4dhTN+oponk7WkJnY5p$EXI5=o)NChl-X=*3SD&Kc$17 zGm66c|HM_kbZ(uv?Ls(^aPniw6^(ToQ!~;^jTD}$!M`M){7}?@rT;#kynC<_5X0tBq17UdT11^3^fb0yLH1aFzK6~+kfggbERQT$uto)P@=dqx;Y@;Mj)b|Sfu zz*w7y>h<1A+q|Wk*Ak&&XRRT`q(kq2mDpn{CkhE-O9d$8cGIB9xLC93ekAVrITo%U z{g;30QpAVdls$F^X+^;ZDJ4jSwiU2Ex#L`{2$RBU3o zSONqlFQI>XI2-fo;5%=(ik6~Ctu=&BB`AT@U{C~E@!w3LpP9h{Nvi;!xdTmxtcGve zDGIJW0(3r-9Aq_iF5cS>a#E#2ZUD1YJ_L=}sK%{K+>L&L#c zGV(CBV8Mk^tp!TRecC4jm|3G>5DpJV@Y*`ljd`TIk^6EywtvS5}Vg1grVg$d`&C-M95U%%VPZcxi z&WmcQ;Y@`oF4>8!SIRBH5<*H^)nxOYm9AnUQ}f2Ah-O zYQh#(WU6jX$OPg||LwEr$rd`^K7Xh5K;Z&6dJs&i4y_ zhc7PT9ODy^g88P`@2xb+OYEu{*e0pw?^@~b6iwlx+-&OwE^iFIen6Fzq}q&#m{tB_ zeaI6Bt?4XNMCw$3eZk1KbR=2EtWcuR4eH~pzsZm07q3T&o86PwJRV(^+do>w>KcU` z`YkTj>eQ^$JZYxnch;^!go;(%GfKaf+iAA0MO-_lIO)5 z<{-eGvL7gYb^%u*8!%AT`1%NYCWzgzIP1RbHs)z^@FU0t2d)*i;JR7tKKMC?-=7B8MsD zf$LJrn^_v*Z|hN`Z!78I$W0QpJVg+D1WDTL+?uSsmm%qM@Icb{sJDnp{|>ab1Q#}b znCM0^QE2060V&FJ;Zs{=g|{i^4weQ~*;+pRpu zV+dYf{bCJIes*1K=eB_sIIzQsFPEn` zXN@0@l-)bH$6S(dAT-z4oFdhlxnyx|o*Ab6EN_n+1lafUNSS0r0e@aWM9!q<*le4(RUe|I9>Js}ta z_Q@+-p_5yF(WdHlKELa&z>5QRHRo5}()p8=gVjwhy$Z4H54BsW!h-WoFBjDsy*3y- zN1ZJsnDP$)v7VTnKrtz{<8!N2Q~eou*+w}!s|ci{&2qKG*SnH#roBW)n?zJmz3 zJgag&AU_W;*3N%Srd_TKjiHDs!Z_UXGl(q(ELK33_`LAakscy&eR(+ahq=TQ&C$?U z_Y=Q;1gkwcFMvM+YA=dzxGr1I7^b!V?i2m|`a(r4;JhY()c*$^5cOPjuZ?zAQ*@;G zii_%qq%3{qe>&?WE29hl3CUl4`HFk}jmhz)AmBO3iP8}Rb;%yw1%mn)?un+~TS`QcaT_c1tuppU!%I+3#^X7M* zhN8x0xh~2RQragz$agDCci?bhElzUX;5>nKwc16m;8VFui?k{vT7B}dW*)!PO z)pq?UmuFiKzGEgKgPu9l;)$cCM4*LJZH2WqJ;o;XK&SUx6TDS2?tB=R#B17hc}C&z^ZDW3_cf^#_Wl;i?9&`wW2vwlkg zP8%`ZHdifr(mG|g++`XF5LHq}1FY{c&eQ?l zAvemZZVcb!!&em#bGPETeF zdvQ;X0Cn?BAVbzwdNYJ`yJ!-^)8e{x7a|qVc>Y^euvq&hP1J6fvH#Qkuhuqav|{2zictOj&juzR@{K{-&Cga=QSGDx^GV_=)3=iozr1Ix`#n?a~{woR}-5 zzo$Z_)2-`G(k!k5qy;G0B5)~nEp>Kkm-KR95^G-i`SSGMisp~{3k)_Y|kL~M0@FD z=&4$}lg^>P+(j$8lY#y}JDHam++tgR)t(Qwbq5jnKbRB3eBI+wZP71Gs^Yc*P=_Bf z)=If|Kv6xizeGv$;OWNJ8-0J5rV0?@v3GZiX9jVZZw*uAV4$LY5GcIy$;mVCKu&E=A4TxwH zdCXEq>sH_^>R~gWLC^vayeO|s6@lRb=FQC+;OrFx?q_pYzTce(&yX`E=|Dkfb5v^v z3=vEDAHg^GhgFz0DX?qjX%?=U{1>>#C3iWw$|5B<3J2`Rw-|F+Fp5|21M5T|6n$%d z`dBrqM5mBsTru7J9gj^C0(5$Y_C8 z5T`+f=5!6t7ks$wCuaFz@-46teoMi>5ED)zy+`{KQDx-=J30k_oxK||%1cWDNStK+ zSvDE{nfJJnPSH}w?DaCMzH&034bD8SxA|~L<9po}Uk?nC3S5{;twYzBSAP#y?ZKUo z?wTVS!2Vn|yW*fBKy-N%>Mz&($wh7VK~GHL5)4kNbz;ku01HM98F!vSMQv?Q5^*`Pz^=W))ju=MLO48J=qU ztr=>4T%3cGB}NS>P_}i0+1#EVvj)r} z?=Kzy9-j;XtfV|@`t_HwaRJ69-lX@~m%=;Rfq1@HbcR09thz}n1;avnTq@}9p}+4g z$AD8}$|<4HSq8>tk~%ZeL&Xn!&qoDW&X;}Ti~?&oknYjjF*V)5x%8{nS`g9WW@iV{iwvAwG;_iY)oRCo-%U6{Vd<}Yz(3@wITz(r5@N;F=G&=RX_h*Z=(}))R1QvFbVTcMKraYkXUDP~MY0jDg8uw?nyx zxWmNCc)q;29?EAr7vDMJq&0Xdl;_*;N9s9@*Ff`CQd2N8rE;~FAKr^LneGKc_y2`y z$cX*w_zp^oSOWmLdg8CwkzL~MYeX*w)28x@3^(i0n`l*HZ|fc~k;cH?u0=inBG1%IKEleb^?#{Q_CbCJ4LLq>` zNI$7`^G4})k#NGpcbxGACs{aL?F1rsx1o@y48uZzy0rEL;KSfXPbVZ=D(cmLFYH$O z-ZHGpXp0u6yOeGOX+ac_ZjtV86p@BacZbpn2#9otfb^ytq`OHF77IiW#JPr=>w@+3udb3U&d5dsaNJY?91=j?C zafv5%@3O%q^Y?3za^`;q;B&;$wj&#%12Yo@F_UD~fia)hY}GG2jAAWrBcd9XKAzAI zT)!zkrg#IK``;0}kTWowu`l#*K`k+%-e9(?JHK#rY2;sW^LDA(TOsd_VixY`5#Z0J4 zQ4Qd2?F|5($^7_l=bkMF8i{T0mehw6EpYs2=n0OE-)1C#+CNt)_RqYy=>_Q3T4awu zL|oF3oOSVYcPRen!4!e+q zTeqzY&3sWWxfZr4&q7$Fu30ccG3Gzan*dr>@^c!8h|kM2cz7=;zQS|Tfu;mHg`nSg zik!;H5&D#dGqvyN7rGmviMHFMpz{uaQ8cdHCG!Jy$06MD2*d5gzDa_?ov^-z)SV05 z6FQnkAOKJX6wGb#YwbxFQ|pZ()_BlR41EAh{EglJn*%!5A@pUbGHCdpG%>5iW})me zlY>*cKoHOnx&CDVvF3ZXX6%la`q25OX1(#naxeI_16x z3R@m5Mwg^zJ7-yq03)Os7ox8aS>oB$9^*5g56n ze@|ZPqV%uB)-xlm<$krFpN5yzW+A$;PR4qDP8oXiWNW`@)5&&DpHBX6BEKHCj#jiew zPvpOEmmKyR|0p)tZtC(L6l`Y@6kG1iCQXL+=VbbRZW6Zkq*+}^p z(@AMu%hfz-?Vk~BM?xy}=uI!@VNA=&Ry`( z>RGaaE~ZthWl^!|Cjh zJmqXMye`1O*8m|Exrv7xsM!2#LO*(WYF7c;0WYB?+$btlGOH^AOcLH(eD^ zrKOwT2nB+9*$*aB$3fKquX>`X^P3Q^6u}s&0bQC%?C{RQhwa7@$YEB_2K@CJZly$2 zsV9HwNNAHHv_AclAB`zBnCAQNBV!SapUIUBfM{{SYJvpu<{Mg}QK$`XB!apItg$0v zvMegK#)bwTY|)t@WMFJ~o5R&M-(QelX245}JKj5Dz?sRveVeaS!O;4C;whx4x8$Vt z63hZgj)0!mqcFO(7h%eT_i`4q1fj-HF(Vjbn5d+M1i$qS!`lz%lAzm%x*Z@+7dC6D zlkMCBoya?4Q;G_gG}`-e)4mf^Hyp{^7Rl)em+|`5!t!PE^VYR@5f#tCRj^mIscucT zbx6J^!3c$81n_(~b_JG-BYVu%4E=h$baih92p z3>Ir*R+*QHfb+#*E?aEV#_AOu!QH{RqseWi0hy9u-x2#Da4gA~sZ-&e?j$>hbq!fc$U|@yD0NZ!i2#JRYfE5aC>wyVy zZeO(I-fUMid0w*PMy&>uP(74AkMc3rq}HmI$VC7YgJ%_=nzStSXcT||jX7k4{ci8t z(c^TZxao9EWOm7z4R1!;7g}36YIu0Z_s4myJcyAUqWWa0FOjN{X6yzWGX2_~ReE z)%5a*@9H45Vt?BTv-Hi!Ey@f#Z;@#cM~ z;zwrrdoQ9dxsrt5f>)9OD77W+AGt&;c%$JGwfOvU0Uho(9*%IJRlh?6r~q9DTUta> zEa7PjU$2mz(Us96-Zb49m)aFlsOeQ(%W#?vjvMusR8FQ+FE58Tu`^(S`7AIIJ(~co z8-t3!wi1fqVzHpp)nGb6`z|6M2VXO+J?yC^AzCur3qHuQXo&DP)Qb_+-xU~ z)T#DalHu<{@fqL6(SXdpQZtn$h3k^p)r0}%S&83eGa=Hzxqi5VDFtgW<`I6$C$dv_ zDtwE4ZOL9-7Moq8!^ivAcFJ#%oUuBoBT$doZ{n)JF^NLz4mpMMw5&SZP&r6iMPbln z6SS+dLYsPZzs(BJ6Mt}c!wF>PG8^Aq`mVQ(I-Rb)VfhcTc(%}yTHCmNL~X)kH50F% zy9yX1r3i;(t?P7Ld0K&L^(<&DD}Hr|ktH=dyiF?)9)JbPpLy>|=r-hrF|}4S@fpxS zI}~fX@ZY>ihPTxl@)ZA;*@+QDM)9FW!D^^`H)2sK^feMv=;_106@P;R!M@S!4mX_j z0o@C$;(l)n4-<(xFm`!Tx@V+tn}GA4M{hNF7G?HL`TLMG<)Tljj7!KJZAm*pXh#b4+1Jj21 z%vGxXQyYCnsHPg_5Fp{4ee(P5Q^OK%%$pqNqYrPJkyuMwTUg_{`5o5Knnl~>q6FPf zlz~nGNTK8zdOp0l0JPrD?jr=uzDr}~T!7*o$$u1WDb}mmNRZLKv1|=M-un_fGnkkH zxQGcfB{GTL(K@GYp~02MfAL=SFZYI#UL|@*op=pXrE*|W4$6_pcVS95H0;jRl=jdF z(3r$g!pmh9!b60Q9&uk3gtfXs9p4XAul(%{zsp3b$X^lm(^<(UMwvN|K@#OOqygy9 z$zuUYQ&%K;cOT7rBB6&Ls9Vtqif*LA^Zqdd8(Bg?s^rO#1NsOaP}*o{1SNGdQgS%AXI&P?>VRf_tA!*B3@`8V7z1mDWI}LcHOMC!$9E=j&+d%o5%}T(fRmW;! zBR)!g;43x7z_g88w-E0ii|$@t5=GScL}7TU+57g5#1I_Y{FCJ^=hF>^w%4U3!|#4d z|5vAdWPohlNPV`TD%bNC{*ZMUdwDXY3Pm)`hbDaxi}dx^EN@5s%d>5@wwfH*p;l(P zQQ&~ef4N)MYY3|1z}VygE6QzFJvlgUbH7yW5%|MNn_yrR^7LWw?|pM4^u~!pF`&A& z0vk@jEP(OmYH*D@8JYIjcR&xx6_v5Fs7%w~ zuD=#4lS<;-miV;G^m&jX^4|Fbc<-soScT(JRu^p%9k! z0UFj{8`@Th(0yr1c+qAzCs@h)c4ReYxJg9ex&4}lH%0dO$+6AkOpHmXFmRbw0uXx2 zxa$A&%*Uo@3!DV4^B9ymW;5o7yOAj^gYX1@w`aMo2ym4ce#D9`fKb0qI?2-Xa0~E4 ztkOag2s)fPrkiVvAN&qSqtAVk|1=P?l0|RxD8GC`h=QjX4DNcQ9}~rcE95rF2?$6n zC2;y|$c>JPRXNoV18`oW&>_0N36}X$lxLR^4%omnp;#kF7&OJku;;SR{CraqJ`f@G zfYA$QS#wtPKe#4L!{ns|fA&f>PjTN9IreENf^dnbG^(vPF!WAk!uvp&uTewAF2&-4cX8^CE;973jR># z2tB9)wfSz10xKbmREEoJy!#9$vfI0`w77mQ6<*=Espz6BdDq~6`uYWiGNEFrHa|K} z6&jHDZY1DNPa@V#caMr_*P&MI!*A{+0AUfvG(Km%J;j`#{&6M(dnF5;Ix-|24vkO_ z5neo)a~Dhr6w()9}m z!gs@N^;ap+>)2|?0_gNW0vemQRVW&<9*e96w#UB?24u6ChSRAJe=YAWX;)6ve z_!tzGLfJ5`DgbuDKU4SrK=RMOY61yy0R9V_K>+*m86doP{00oULM#vw5X?cVjAc<6 zlq%w@2w-KCEBu#~Fp*ClF!%%r0D8%9OFq^Y3Sl{pa1*r4Wco#IAkF6kK5PRf6Q@`J zQUj>W21-eJY$?vSMgmvi59X_^5@e&krs-CL@sTao+27|*nCxI+6{A6lL;j|J%Q&1q zYrOvx7zYEzBZ+ut6-YPPq@173-+vzp?6VnS@e>Z=oxia@ zm2UOY1|Oj})IQrh(~p?2Wg1P>wj(TT5~1s-F-lff)346h)l4`75F_}@ng{schbx1K zD2js|>G|oQ2FIBDl*01!Qim!mcpw$9{0vu(pc~A&x7-?-GDs@7@?0)HqExTq6SfAh zYSKcYc;6BEhP%F^)o0;Qa`a4+yPU=dtU5OP|oR8 zd|C(VLxJq_8vtMOl%fn&zY!tm8v?HbYlkNA?LiLXrABGWhDcjP`pXwUOdKcd?Gf9s z{QReYtF17~=LI02KdPo*zPMcS<*`J}n*vJqr0ify-bn=OkZ>Cy7!FM45lP9$6dcCPn2smN9V?m#FoTl+ z<-Z7o>P1`+1}Pa0f+JkmM-lB3r~3sVRTa)e9n3^v%#RVE@Sc%p0Pj7>J`p5EHx@ma zDO}iHgugtAOKwp390QsUo~$AUV@q*tfQ(Z!Ou*l4qgw#e^SepI1LFc@41#n-R2*fX zuqA;wgR?@Fr(O2JYX-C$%%GMQixGXm&_}k$kWy=G-v>N$wDsZ7KKD1rsseEK@NGMR zi#ed7#oQu3Diwx1izMY_pyv0v<83dvIrY9d%K#rvJtfrp@*pMDk@aM}esafO9{^d& zmKn%gfi8nVKrK^YwGX)7+u%D1NJ#$R)L2cGtglA^aUwXaD{ru--k*Mjnb^F8t%>Z$ zmASoA06<5Ku6!@df8+qh&~?pcvIs&!7F%vEc!JO_$TaqXT$nnpgULfmeC_X(}CU5A3f0_yV=H17wlll0K1=>EU<591604 zSI#J4#vE7mu2kz*S;91Nv1edk2)J?kD!$pja#BnG&F!iq+8|BNUh$np`Tj|Hw!y2CfeUfWGIKB|NNF41LJpL-s26l3#64bEFxNwNRQ@|%u@r>e&PJ8mt& zn$1IGD<13l6O|Sv*n3wZ*DR#}cLzr^|Hs%Unmds|ir^>{c3_!d6HyF?k$afO)qS-^ z&Ij08euiuaUPH(k?oh#t$%Vso(0!p`O_UxD=~op#Z;!V16M0OJ5cKsvCw7#RRHbI+pFfSBS73qd5Fc zHaMLT3CXhK_iGJRmqXNB zi2Kbc&tIuJgI@q51B*8gV+X*)9Ivv{DstDaa|#8{kZqg9FSJF0Sc{HAE=^d7TEOjy z1`KUp{yG1jn?UqZy=(N-=hAqzesdr`RDg>lbl!u}K%=!gnwqmC%o|__;K=0xf+i#$ zSccS~y>0e=OkK_<7xr>PfSU&lP#}#$fv=XNgqzusINzDr9uj$U!i4M=Tu8YCC>thS zzWfL{GZ7`dH+2Ga-sd|S;=1t%W>yyIlsJ_9Z-J*o*46Qt%BWfwyN5Y+%y*D7z3)wqYjz+GOW=x)t*zs^Io@|P-;XP0_Br`A?y)DM zcsJ0O$Ms-^i1t+Ay{_fsspRFSose-Ka^)afgXunI=OnMd4;>0SA?oz#TCgC{SYP7@ z9~@dSZ1BlyP{$>ZiZC1$ZV9{TrI8bVgL|;j>)JsW4751IsD$`e+<-YJ`YljT=YskU zx%L7G*wX>SL=|Sr0hIh+4~5_!IOq48PIn^fiHxDxfoV2T{D)>xHDMX&`vO>#Qr zA6EoHOD6?5dsD>zFv}NEjjWr%j4*()i5j>jNZ{Bt3JKs{CO?DH!TvV0v7gcwo)Bis zkwq=w65+7XU(g)a6-}+QQT^;Nz}3bNtQG4cRu3OWx2*>5ix>E)6lM|0U*mhHYuKig{Q zu&CPZcOPq3h!0DnH?i26pFHx7$~ip{cDYQY67S%`tWksSkUJYGd& zw}dr5XRW>qK8d%pdzsWds0YY`Gcn)3Z=aN5tLJ;zu`EEcyH9H3j{?c_wrk*nubnoT zd6++}Z84}k>Triuv+YR9j3O&nWIQS-{(i48*f+QdyTXQwYSv(h=otXpa4kS3ngv`B z>?PqB9&UC^)yqCex=44n0*Suz{(@Rh0FRE=#vC*937j{= z39>xK5kA}j5Pn?G17R66FlYQ{ufq8Wi#jltZCRy51Z4gy^O1nkb{WTIqJwr|vG8{n z);E4-F}5TG)KuQh& zX#e$~IjVj@RBXGV6qT4CLW6U+f21A%r4zf16DSK9W}IwKq|@9t|TMukH{y%%kbT zD8n;7FZ9EFE*~U!1b8uxK&dD9bhh!2#|L;zS-JN93P8jy|({2DIwRs+f$8 zKuX)Udj9IauLhL6 zQ`@~dp`lldog&$Ev;~cxN(iy;b!MmR6<@eX|L$THK39A-LH{4S2G7(4q|B}2&Y8eqn9FRC z0)H6`j%9umF1rxUSfw?e7sYiRP=CoDsj-<`_JMXeAM~Y#x(rJY|G@S=a8n9m{8Kjj zr-0%Gtg>GE!RN?OWjzyv3v|u?VB?m#U}QBM9!5IR96UVy9)USvas}wuI=o6OVrK_p zL2ydKU4e8k)!g^v)(eOpi~uBvL%al8X|w;3TJuop>F@%8e zmQ6MN)%TZUo$0&2k0V)(JhcWm)VILLOXyEG2w1VeTZ;4`^igEJN8lVk-0~!3v)!mm zD3eKdHWiC#*Wy|GmnWIZF&$!*Q*3XY`<}tuF3@HTybZvdZ|iIXjI%DmqZ&|Z?N=JN zB0MycFuvd$C4YG(PoC%$^k{MxYcH%esc1&mQal#p9ghjCkC!hhxUxRd{x9ubB_l)u zx?`=l9B>7qhSk#4=19yi#mpCk3{e;X5LlSDD$r;UAXC8R6{x|gBNXtqyJt7Cqnp?} z(kE*V&0IN-x{54X+wtl-`&i%i% zN`9^{?QDNns7Qppc&A8jr5^zlGo1~ytOeYyLlZaejJvl4aWyK=)^T2-kZJJF~5)-H%URvFT2xT*ytBFk6h}asdd3 z#S@&o3`rm!9cdTLLbK%3Fa1WMU|?bKu}Yw zFNvI7{JYQ|p-S0A{|7Uuz~H^{8J=;XZ-SX1g2Z{q_Tv1XaU#qZ;9uLyGbh@*9UwLi~8&}x0HW7V?X#J#$8 zGh+}}B`vgXbWd|_AlMK;NPQJ(Ys4=)gm|bNur|Xi8UL3+xt3Kjibz2EuH{y1`-oxO zOhBmC^+%@VV5NQR$4vd4<~Q&$Y4i2sKQ~?Scz_Sb?6ys^Vx6D{vo-MH0L3QDloJJY zy_XjqCC#qc0)e^E)N zofWWlwVc{tYDETCs`IB{r+Ox4!X@OoD;oN)%!K}Z-o$zl>QUJ{XWvYyy|913m+~$2 z?hszL{yo8AwKvQXQzFeOll|-Y%A(%0Ww%=Vp6|&G8eI~fGWJUAypGS6 zB{L^u{xE!dHc^yU>A57x?_f>1Fp@4E^iifULDHD3f#d*ry^y zt+ISCPeMv_blXvnS@I+~j#JN+MWvEn;G%8dG7T|&Yi&DnZ!7$CUDi2sPp6lBti7v; z^XJwfr5bZVyxIPagu>wa&936uO2;AV8!gAQU^&ZxD~rko2bIq91tt{)HPm$);$56+ zL|cvV?^Y;dX};K-3wHc>1rr4^{GCgGQMmLUh z3{SWmPVPsns-7O4+8Br1gS>Bdqy%AYB~M&OC3MWVKf{w|yTm8=(nx5;Y8~A@lUxTVJ*Y*^s%C!{rwZxWJQjVAX3Wm9IH+vC&hZKy4#O zcD*TwtKfvZbi_`-t~|PWKS^w=ggT=o&y`7WZ!Jzx2S*{zj>&y=?3-IF944P*RQQW)$=9Iv-dLYS|7I#M( zaKs7$*+Z)HaT7plfp^;IPpt|Gxl-r zeEn>rIuC|_dsH~n+x;KR!V`n{)@Rt0{(G_{{E{k2!%LR9%#r_+G_a8Whgm$#o~XW5 zX>kYlfwOAGG6LAjdY0?$`yl%2FMXb3vp(m>!`TY9E?)-wLf!8vH~D6je2>riQq(KdK10$)FR@A6l_v&Byj0UtU`}bp2MVT6oc` zQy6^Q|M}9+LVop6gVD;aOy%*EVwdAhq$Q+oho*WBg ztW{br3H*xK{F1QA-%KOrDW8DmSvCHJ4%#p{H{N(0U=+Pr(%O7C; z@~q_@Tp9dH{%`lwPcHBwfwsUfb>e-jol+nd0Gm{d{VLjhnA%M37OZgy*@wRvHoGfQ z)^)F#z}fc2@3qX`L?g@9kH+uEGHZl2aODpP3s-q8aNL;e{SU;dvsS|9roJD;oLr%lhu|{^VH3(P2Iay61aEpaY>(Flj&=h zYg>^Oz;~7!iExT2*y#0V1zd|LAk69-govqP-3-6At{5-1u#N`t7^UDc_$7D!zjTbE!zSa&b(pIQKy9`{B2y(FSlaQvudW)9_lp`Zhqk z`D3ADF;XV`UCT=r=>m}b5CSd|c` z`44~m`rlZ7R%MzqpXqlCL!e|70ukqdX8d9KDOOi*k4oy!<&tr~ch8?*r|ZP`&Enyq zNdh+Z143K$ly|#k{EcR>x{D_6U3=A+$I>$qY&B?utv|=u>94W)MDJo-}R=9-u zu3M!woNZmW3mY~J8q0otjVc7SPf|QcR!WF|=(OM_Ethlr%9e?Jkx=(PT2$VY5wqt7SC0czElQbc3@%1KuO*7sx{UYoT0`ft9RcJ>g_ z;aUu~x$~w1H4{AV4ABJ5>Q-6o@ck|$cMFuf5vxJUFH}IGN$gvt9eOS(A*~8O@BJ%( zz?2uX78fN6rRBFCJGwV#poF!xo_6+0Io+-Chj`fkEqW=X{2fDxFY4dB|IzlH z>uB4CEt=2i@3=?QXI$Q|lco2Fo#C-Diphpb(pA+aWj`*g}~(Qc4}(|cyHdrmTv&sHdCi>!>Y*b9w)!o)o%w_yR6}MRp$HX zlM{xsu20g$e3#M#NNt@__v$J-?i}|p%Wrsxjuy^Xik~MMkbtw1`Q1%z>fyc9_`PSamRbMSCTK0f*|CLy=o40 zu$M&hX_t$O8Nj!*@yR66;2oo(txPKQ??1Jr7V(f4(8N+hQhuvbaP7pRTo)R4-{D_X z36Vy2UQB-^l6+7XdAPK@hI*WJM@fb?%zoHY@nFz=v7U)<%j(M?ev)9Fz4VD`J1P_V zlwvI~8s#vvQYVbb)fcU%ro<>6oo%%6_UmF;n!KaR%>C|^My1=^8>PA7|9JsutQ+Q? zI`nEn$qcx^lnBJ*s!bV|&i2S8b_RRal#XpG#IV-9rjAITDiYSHuXDO_O`56lbJ*p* zeMb^gM7Tl}+hlaX#ZamAAZrnE=RJIBCV8XbPx44LUoTnVNuas56ye^hd@qc{{UQZ| zNw^UG`9S6Qho-|b>Yo;dkE%On?f!Gj2Gu;%GEt8bqG&a$gh=pWqIgHR@OCL&kK*`C z0is*al)*^+=Aix%wi73W-;$ya2^8cBK*;k}xu^YNSs83bKo63w}96-HkJLU5@S zr$fkO1Iiwzgg?15h=7s$cg+(0o&UK{Z16!b z4VyXp;OEC6!X-4d8fxF0d78+F_jr@#s_PCVNT-BFsH0&Th;f(OtB0c%LmmtSZFHOX z9Ybd*&!$rv)#}*R`wz6|(L|<7(l|K=ia3yuYkU@lEH0+fm`+}x4SCn^JFrkvb9|XF zVHCItQy?GA{ZQ(=^>m=7&vSIgIqLOF`6PNxzS_Qs!S?8*;N7MYmt{cK;e6gMPR`eG z(M$5RL!(PJp1)C6adRAjYg@|NA#>DHZ$|$duR~-T1?;l=e;BH5x}>6ho$C5pvF8{}o;&Bmsii_5xqK>x_wm*%U zEahO@DCoaj4-oG**G}RJaz8~vbOy8+}(Q91BuD3?$U`k}&Bh>~s z`?Vm5IiLC7tJTy^qS8m3`oZh&VfN?pa6bK%(S?;>TR#ZHDiD5->Ee-LV{*_|&eJzpTF0nZ*17%{ zWU-r(SZO~`XMw^}sF)!&bJGYSpUb&&5qwr#u>A#5k(PbwayYR+b)F$s)sjuej)Rbs z0P_9;&-QWtnvIQoS6Re=)avgV&Iwz$|EfJ$rQR{A{&GEwVB29wF@95?#;3~5iskay zEst6tXzr)h&`3u-&aYjU`>1lF!ab~LB^;aE5KYA^(fhr#^=1M_L)uaF8qJTUZdAHM zV%8;#F2d{V7fu3tI6S%3!4UE>E59`(JUpa3Nx0aHRDO$x5XJ{&e`SeuU}g)m$&zde z2uqm}Jp*kLPO)}bKnM}2>1Y~T=ts-;Ew%Le=;x^-Hxk{ z|1AUsn`}6l&k@2Lf&5b%U%G8y>r^C1VeS(&ea`<+6!9FC+M$U|Clg%@I~6?ybVs*GI3+W|^ z-cm*AePs`idbToU0>=isxlMkQqK0fG9V(S;jQz^?UaiEq8ANQ|SNZThOgfxeGiYv? zXHcy>l{9W?a)3xJBOuCVcp~`m{AewhJa2g=aUKIw*3+zO!J*R z6qaOWlal(cf^3L9?212h(p(sI`_ZBee)+wru|~3|I%J~U}~WG zC-+TQ7*WBYgN~M4u}+Q%+wEe8j4d zR!DuRdovob2nr`lXF+R$@iM9b8*h%WW}q=BLG z^Y@Lyv+h))mHU%CpTlxZb|>O^5(1}7y6fMc5}%#7z1fLTgznFXM5_veRl5XWahqbZ zWXhcTLmSfH_TZzZwnCEd>#8q;{A6oOo@2%^ekoJ-?)-pWvEq%ztvwCabVvg#LKd)s zQ>k;>9Ja8@R5llfO%9`3Hs9&T}vKRS9W z++QR>tawtCzC#82R;?&%UMyk^d1*d&RK(aLOZUgjSQ<=2f9+5P;!k!%N5d`I_73in{-VjV|RWUoHduoo;l`P8;=^<7|e4*Q+XyZW=! zI;W3QPjhlHH4G9(g68)7K9A-iH>%GjMNFHKey$IfzRYR%&Fk}}&aSU18NC;H92Jt7 z*oJ0=dESqrV<4?u^nbJAswqW`zTjk6yL+po5x{FO^>{6kG|EtMGxPCESoZs?X3UjI zSq+lZJeNNOarO&O9Qf`MJqX%ts(qg|&8{f=af<7rN{4~LzVcC@*gr_A&^3lXp&Dv_I=v3306eHQDE?0F;ydsPZ zAM14Og7F&neD^-Jz=G4Nh^2X)~qc0${){=6Ybrh^HI< zP&L7}Qtg_sA9uY@%l@8CXJ$_MhJuPg9!^RLmhwV>-v)WQu?W`mSmXdS5A7b#XKnm7$O6#7}?Dq>%&C7{8UFFBe$_FpV; zA2oX(8r3;6t) zJJVrQs`59S``SgCgqvLUh!&^dIh8;~vfcqD;&O+N^7=NT5F$d~1u?fzJmYDPx3^k# zXG8WH2?vXu5S|kMW$X&t`I}S0Ez8>2cLuKrw9+>7Q@WdnsM4Dx3^kg601J?E9lg)| zRv8G~OsjHH$W?t8VzNUtIK^*;kOKHzD6-INf>|qb z#(z*0%I6b#`X)*fD}sF7~7mB)7y97=1ebUZ*qd`DYf2z!0n)DUZF)WZjbaAw1wIcntP5W2-(o`U?u(U_# z9t*_a(FJnlhX#p}-0lEI&5_}(&zBY-5xdtIik5dUY9dh{#VyJSa2yZM2Hm$$ezZRi zn&TMG#}tQFbxD?Bzr+2T%}z*!7}$(r4y0aA zD{aULHft+Q)-$hjg0wQz^>xD*1EzsacsXGp~< z{GZQ@tKj!0X|P^oCTZN*6K&mf(v9~`hfty9OcV5Q4yQ@+jC`>-MSnhACNZR%%p2vx zamTST`O6EFXS(!OYq-P0xed=YI&EIEV$)lEbCBA_t@7$naiv;mDkY9NE70pt&9y9) za@vX-ST0B{bgfM$&&aAyT}1f|fMkaqJcIlF_LmGU-xY-N{@HxFYN?{zyEQ#mAIVc< zSLJLo*U;kxz<|5qOR7&N+`ql|bQLSyeRyi?{ftOY(rx!b!*Y(h%0b-VC&%BXLbuk| z#HIRnOGVrW2NON~1C)0KK~Ji*owr02>~^@Td@uQD_kwvLlU z^OrP?AZPk#SveDQJUoQ#6xD~=k2F&O(zC^SJY-;_%&{kh?ZKpM;2t^H_v!Ym0;7bo zt$2agxve-)urNsX?(|=_x=VTYbpCzVpFeAR8<#um$8JG;g5i+&e7_XD@ShEUUvTErmboJIcJWRAY1kX`5x2DvA)Cjlnq zVdyoTR_D1ji&dKFx3;5FPLMwRUV~p${=YC!KSS!*=N>92t|S^FQ4asUa2HIy^A=(w z(O0|<#TR*H`cgm8u=kpwlXKi`m0n(UE*>X$?6WVcZQK@oWjXd>--JikH6jV8iA2D2u`HLT z{eyU!=maZ7&!-jxDJ%mu!%_pK8f9oY#Mua+54wlXjwtbl_3&sqiVWd)W-J3zP&3h(}c0Q2*PRlLLM}-8F9>pZ`$PF)nK3OM(|Oy)_kFz zx1ABz`}SKSyGtbHPw!Mn6nnv_eytZzp@9va(S=*39Ms^!+gG=?>xoo(_BQtU+H9P# zfiU9b$2b}vRWjkpjGcnKF&y~&KV<`hzZoJLvfFsfw#Jv5RUY4$7WBzO8+{+&c+ZX; zFBTdWM2kIl#akb^Jh2lrvtNa>kDJyUQGvHEISYg<3c$06R+F>YaTDhlArx%-Q~^{Y zwu-M{xWw;q#uQ1x7Xw>=46OaMEH{q405>y)jD8 zdMjh(ROc&_^Xk57TaH-u*VsrqI=(F@@h|B^XIJY5^NT^2Vh|Cpq-*cLSAbhTP_HTX zkbztM()s3up)-_NQ)Vx;Oo)NO--I;m-H_lZR`HL?yhrnh$Voq{Jz%(E7Z61(tI2?>Vb!YY|5m2t5ch02vF|i0_or| z%-aEwF4>zH6qBWuo1M*QP+<;v+YxLPuw9dG2Yd-}03=u0P$F#a=aUjT!tV4!z$zk=dE#sh5q` z@L4%p>oM^-S;7xHmwypPxT}*;sds<$9a8^k!CbeYp&lbsqeAk`vNdVvuJ1Z+bi;-- zuI(t_pOK(PGurHqnEShIu?R*@LTPelNt&rf>o^BNR1v9ccU_8LRRT(sn}k6aT3d0H zzz!wa5)Co#zGq^L;A3T)fTyA3Y`J&5*f2Y+o*aqY6ZAcs&XA|Lo!K1ct`C}1Y<$gp zQc>d9|4s1CP0_$C|03cF{rryUNba?&2feRGRG0hRao&){%4o?B55DbjmiML8+2MfP z*~o2d!P?J(fxBAR>G>9~G z!0LJ!E-Hl7P&Ls|I~T5T@D!Y~{1CWB3Di6`zlU88#F%{TFqV7 z-M(-tV|9r-neZO7bGxmsUf+tqTP=C5S??yjJ{1XdybV?n#YP;nl4F=j%1}ZmfX2~5 zfgGcjCH_RC?6kKhj=D_8zS6W!P3bM;(WV}0Tl48D7*SXPgwkA&S9t!+`nUDs+4-}Q z_(0iSukyY1Km~U2&0d#UQkT7cKRIZp?!YKd(3t8rq$g|uUf%G84Nw(!25l0Z#h9~n zb9Yt#I6yOnt2s)V^+&~JMU;srr0>!0Z>=cjON-K7f&2ry^@GIGpP-hv%rW61cEk@T zG9f39tj^B4n5pgNBbN9hBa9x;E>(1QmlD;sknlkuy3&d)gU zC=N5FA1$xVu8Y~7HYUQKRbke_cw}_R*jw7EP=A8nqX7GT9L3tW{Y2pGPpi>gs7XvZ z_CV$f&gl&O$@wpo(wIh%Y1@RWERPP-Q+dWqv0CkqOy zd>bF*sTb7(GNz@#Y{(oB<+|nXND}Bt&P{&T?(8OWn)=lmxgar`{q~^sn(G0G0tKV1 zDY)cd{RNL*-y zI0v@E!3veGKmB6l!*w%!90w*LQJ@ah4^%i#9k7-~I%8w#`FDGbCt|R!tK3K4m$BsY zvk#|o{XIbLP3PxWx^PCRoI;nSWr>XGw!Jmu3Qz*&5A6I8|JKk~h6u5SvpA^E1ozf2xo zmPrNf$=bxd3=y&yyToBq%X}v|bf6}pAEz+|cQ;l_!`9Kbp_EhJ>dF6>*=T z64TyMk^<`K$m>l!!oH|S9g^9gm&wBZrTh5iU@2dRr7J5v8sny4((zw)F+EtW2sM~Y84;0RJN z`zX_YVa33_v}}ZZ*zt~c`7E~MK)b>oC7By4Tsi+pVKeslV({v#y;GtGJ5K>1#Fxx{H9Ow1TN3 zi|(cnd_dtqJ;zFEd<@to>~4n%b<*MTt62cIu&DI2?V5b=g!ejzREQT0SL*Qc+Y37i z%dHL}d;Dt2MLAIv<<`rUFqTYT@6v9}`JI%bWA;#v$@Q=7;Ha2u-xZyS+#}zC%+n_f z^XFSzM-@?l-e4lQ@<(PNTzHG=yk)p^H03p(kFj~QXJd`=4rkKh{c@dCl%w_zm3lcc z;ULn}R;>mubb0P#8&XEEIBb8njy>{N9bdR8TsmvA?mp}n3v84@{wlGs@FC46g# z(;x=rfzlBA1@H?`2$@x#!^FUVrp=B>fahxf6p2{s1WYQQ_+q1ewSui+8h}W{tNWB! zIV>c@OMTRO)I%9n{@uP|cYoiOWe9*+QqWI2{YOu#lr2FY#|q4gRxBA1C*Z9aIt2P3 zHQ=WyA~o@pDj_)E9`AkXe+c-Iy>~fK$DsVLn9DyYNE_JysaZjp>VbMv9kG?E-=778 zDk7*#MFA$xe-CpHi06wkuh$-=pNvQmo57oZHv`p9nfey5Q_d$ZFW*M-zWx?}D%N*74wG zc=uTXSB7|doz@jqcZt-W2k<(Pjt4r9ZPdEsXeeDM#KyIA-EhsXg1^(*O{MFtt#$z$ z@PbyPK^vf_7R<V!qcLR@3Fh)k@F0DykjUand^) zYYwTaM^dhaZG5JSqsb5~$$Cv%Qy6Pl_&G_c9@h}v`Q*Lx4$jCRrjA{X8n%eXG9FxP zB&XT1ZQp?1a3IG7tL~R+fV83e59T%ewO?!fRJRLxy>)DEPg_KnOzZr`&NRYK&?cCu z+gv(_G*`OV+$!PCHh)B;y2_G#0)90`w5Fa0jdMrT;n6JUp5C+ncD}#J2dQR3madm$ zY&`zLueFMLiBWR?TS<4qI>R{{n_~*6aDDMy+wr34J%fKp`)t9yuv~G^ftdk71zYp& zz)%RCvUeepKkk5=L0-&TRCgQ9L#oDZ;71Ha1h9lQC{VvsDSrafC^gt?sp2kyAp<^o zbNRbdbkV@q+~mULpKgvE!`iEc&<2KC_bzgbOPZ}782y!zrnv+W)0?2FgXk}%Og0XH z9^j3sh&5}dA^(7S0QT}38_6r?|CU7;BkB)Jd|tMLxB5~rQBcJSif;9{{Ck47A}D+S z^-XzpWg$8}2h>9@Xh%hsH5pCEgWQ>#Y#|3zaoKJxdNxSGOZ_4099o-NEi0YYFiSO= z6ynl~5x}tvM-#;u`ji zgYwj_jsJFZ)G6gcsZo=j!uaTTAoelm3APW%!>1X2AJ}F5*>wY0t$86`jTzTFq|Zc} za5E%YXT8X`y^2OXg&TbyI~WR&ymiLLspY1W#;AK#8!dbBM1EJ>eAh(m-Ou4|#kAuV znN#oEEgVvoKjegaK2uNh1{yW6o`oy|FG`GjX#?FShz72mB_ zZ8tE2j*1E7znjL5jHIyn-7-@vT96ro*{Ldeuq&krKpBF``H6B}!4$$fQDQcmvm)&M zIdf#D(OP3|j#qR3L_Ft(3|s0+_m8cQfdzb9`p z*uCuW!tH7=P4U)z+f@>)W{qYDV75O0<0C4Y)JI6XpRE-z=+yM%t*s|TAAi>>5`1B_ zAB4PD2)en?oQf$g+dqHE8MxM~?jaJX_4#Uf7M};Uj)-LLfK-l=8Ithyq5)!sE(;=Ve@x*CERe;{^T#xHFy^Cy#^4Y+(ZkCAH& zYS_ugI_CP7)KVOJcsgxIc$Yq3Y#B<8K2d&!r%M~-2`me)s=O(7Iydg&V*fK5xa`DA z{M2Y?-uk1~{(9G3vs+r@>EI{$631nk=En_{=}2ImaabCSJ0pj;H-0nSvqwqkcwpKF zka_q5chS{j^EIXdy&sOgRvivsuRW zYBGYOlIe>r%V6g%@C9ilsu( z1prwSMJv&INg`L81?Fkv(u$`KrF+dx4TAxyz>FJBA>_Wd^ZFhLQppDK3Gu|AjSubOy@ub-}r@%K-gRy&9QE zovw9Vf_;}UOqLY(=aMp3q@$v3+4C5$`{xVNcx_J0ozbrTF>-j-5ogOz=kxCH%FH|?R7OBGxlX^7hjN*b z_cQws-vYdP4xOS}#N(6p4%dC%z8>7?BOjf7iMCjEJkM$8ayazwhBc_4$VC#iK$9PJ zP;O;332l{19fGLAC;3H3fPM-iIDA?lNHqnsy0XWMZ5_GAsADsklQoa%h>vYuNhvGB zc{pq!U!UfS%Lltl;4&yT7;a2(c^1kC;tMmWgt)KZd+wr*fVzhE)_9U!4czNuoITwsMmh zasCIvfYU8Ga?-=sWwkgVvYg;Ni#2Fw68!tH1v~P>jQzr#CA;HWCn;DV9k?wl>E`4m z9X`{8e`^Tdz_Ov>EYLyy|98Ws?KB*`Z9!0&N8_CSqWu}KH~T9<`~>GxW*Uc|qm7f1)lo2#C z3vy-;eR}4aEV#WpU_ijelhB9u&vy_6`-jXDgDAa)fj@wu;zKs3tD%kz+3i4Cfdo?_ zas+*2g`sVi)L%+k1vQ`WIcBsG5h^_{lGAX$@tA`wzGIGHqxb+x*6!R%Wh?7DOR^y#FH2rE ze4@huP>IYZMS1}#5KWN>tl?#kz9+NEfI1-iy{Z4xL}yZN6IB+qNALsS^)3OkA@M)d zYD9B_kKI=W{<5NrN$h``-!9ma11G(O7F{(2SrZQlT)P&&B%;3{43rrEZ}Uq-{F~Db zLCgR7_ha93{z2L>FsSp&yg z*>@q}JI1~oi6A|#0|^iUAlbSO6As2?fiwwr#+}MpS&VOV;A1I%0wj!vEkXXjxEc(K z28F(rCt_t(vQVT4*D`^VL@D|2gQNG6oE#oH?T_Av_9uYf7|{Q7%RZB)nT|&6MGANa zTFs&TZ2q}cLAXZJgs9EnW-#Qw7y0GCCkG`CHtG%2ygbqJ*qAF^ zK+`1fZ0SK76g3wM*=86F!16a%{d4m=*m1E%ewan=Nr_3HYGuo__gX~*B%gl)tf7zO zNhtF!xK1_B%hCuu5=^d+MIiei4It-y!6zPwHRrD=6JcntM~E)LAIQEd>|*+F&knth zEIkIv_?(a|`v9?He;rWK;`nFBmiu?d9<0kZ1UKc43@p{M7eE)4oB)1=u7g$Skj%lS zRQ11~YFf6P_V11A@LcX6)H@D9`j(z(3A@)Zl8CJVLN|A1M6{y$_a+BxBSH@XQDS&T zTx7+Ji~vqhgCA)ArOBWn|K2(wIZ5T%$h=rVW^vTm%YyQ{O#Lra5w{F)^#s%K|J;Q? zDA_Eep;nWbyXm#Eda4hBkLUc8B-N%q0TSfD4#UD zZw^u0FSd$_`CcS|?MWW!t>WCt5p${rGsQjvP)r>FSgsq0?iFFOFV!l*Iz3oi^b*ri zlNR&K2~NtF0WXgn9he}199w;zvwt4r+nzE+}06wKeP8?K;r&f zz3jjEv}`!1+_flZF=j}stu+3-)u5=H&_nq~;*JV5+gD163xFO3KweNs$$&(Cy-Vb@ zQjm{Am!zN+0fRzNMR7m;{A3b|)utsWH=ehsVdMIQvK17xZK^_dElQm|s;(w=!bh_8 z)MDN>hOaCTumO-7>Htm?F)p$@j(V2evw=h!0)krll|GBP?~+*$ewaL%xCK_T6Y$Z2 zb?;8espa$?J=z7eBGl;u%t_JSQ>yDV+**u(E(Giqe!_kqiJt0z_-Q*5PP^c2vC^}4&=#P3x=5m z1r}9XVjuV$N4bQ~^3saXNC#-Z1rLzAy#)o0TMkK|I2_oPV=e1JKww->-w8+PY@e*@ z|LVg~gZgCK3Ae$+iBI_m5R{6i3``?*Rx?jt6VReMt{MUe#-=*^(Yv~>+gH7)KPa7= zbM_y5>{9`Bt*`PLW&5(=y-6-e0UH5n%3FJNi}$TYXgaZ&a738}D1^N!1aJkHNw9J> zCJ&#d@*o1O)sq$$Itb2}=*(<7`qDput@`m|xU-1M3Mv@7+`s!^%)g0YPI{Cy$`;tl zG`nUc16Z1^r)Nb3K96rcxLrZi(xZe(>Wr~lX_oydFen)+ebV0oEd`S`=RdRdXhpcF@C^zbCy2Xc=V&ExJiWsq!3sv*9;|wVZHfKTowW4mwv`4&ss3w7 zO67Kp+T9J)oa0PQq;d-TIw5MAekB5}xmueV7zcxZCiWT0qLDHA*waoNkoBK|sx5Qw zwxp75rz;l@s-@!YGSA*mK=ujly+S@hu+H6k)K8q^ik<~_GXVU(V9LbjL5xts6~YSz z|5@>ICXF>F9NGYVx;jqx_BKH!tf+eRkXcY3-x2Aj1Q5glWV~^yc6o=(6+VJKaAmK{ zu33~7P3fQS-vAT){exe+{$UmL%`DF(!x}eO>ub@91g!s^Y7k^8*>-Bgm6bv@4hEG+ zkTV066^wZEj-wHSs}3W^&VeA8p~av_mtaArAR~1I&q%IxMWW!BSMXFhfQm>6)9~c7 zwA_M&e*8&JXb_v-=v`5f)HtB-E%@#cp1lN%JqP4Yj04#!BF7)jSKD|E2=8CfR5DN` z5kmQmmo;Ft8OZ)$Y8C~_$D2P}hoTcbSK^$b8E*mfa?*j#UCetJp_a>iFw&=LD!WQ| z1kMUcTi8-$K0XCovJM0}CsLA?z_A(|sTK)C2~Q9Joc16j$QId_U)LRC`usSFd+ir! z5gS;Eu3p6tayHB{hZ>STqF+<+gw%m)_x$F*JsDCNZ&TRkFOOXP29nv7&55wl5fePr zO=QNNfc42n@^^g#fu*6}n`8LvVX-2D*ltRYIFM`A|MoGz`R46T^W&(@X>y5Wr~5r4 zB%B6IKORT?0M`%$*xb4whoLLP6it?B_io3lLxqUKWq#4W@D)zxjr>vLMImzEsnLRJ z`6pJDwdG=-ga=olFB7F^iaK?y14n@VFl}B5HI<v7)a21)`LmRyGe2wbw;8p$d3 z1c@xmb7;)MDep5L45r<5J@VAXK^?_`*V+nwk(2AFpe}#Z#=8xmti8!HePc*uP|t%> zLLhWdP{kbvQlF$IwR&79zu3qFB9T>=o53T2Fm&Q8u-}V8ewTAoAYRz!ZzvaDJ5&_orL374wU>Ur zjaA1swvjJ0yFq!mXj}Y;2E6SSWdMOGdPTJzoN%)w#)I;ap$&%-?Y}w?GzOQDRHZu5 zLf-Ht5+NvXA5>(i`n~CD2EV(@O`Wgyx>svS>J#|93m~!pk$c8`3}RzOL6J1EmY0IH z4-PFmpvpp=EvFdAu)a`$oM>2?phh@|fP=0=@j0*uxJ0gk(Ob$&TXl>6dBF5t>@aQO zwN4C%dOVhjoEnhSp#+D%7U$#F8!;c|I^S7YlFcH>J5Rx zA`ih)5z$h*H-<>W0;eDc2&a*HlLo>;0bNNb^;KHvCB6`tYb%#ord1Fn-22ly{62N= z>CO}YXW4E$B=HP~P(lL1&Z7aFqml4W|NMNgl<&pYuMaXYCaM81F%DD;Ta)^+)!kF3 z`m>f{3P<6i-LH|lbwlyAc$oX}F?6Is=1A{Cx(Fnk9#_Ob=Tn}sSFDg#hO%oLKbF9Jyma}VU;NpsSV zvx_6kD^MbAgCwZX8yPxZK(pGb=&;fda~f#0)GhbE)FA21jXK+#C0xkU&_@48dddc} zPIQ18a-BrN-}k-YJicQ!?hep}Px`nWE`8%VU&3H+(GVr8D<=80yV#cX$+YcL ztt0w3iec6On-ZA~BEJ=V(Qaua52)wbv&QSolXrq0F6s#&GL3Lze9qix`lg#fcjB`4AM# zI|S%|>fQG~P;^Qzu7ZHmQd*5dRdPhd86*H|OauFg;zYQ_GEF}5Dke`cY2JZ(EuQ#= zWNZ))8Bcoyf4orn?g_sybrVm~FkGm|TEldtNSYSENh7;C2&Ko!72AngrVY)-VX@Wt ztAnQe^aIFkUIc6|H~t1>@D_6}U&@-w*MU%3VGro`RAm<2P&G^3IPoySed6f^z5yZ| z5LB=~o%H=uL1M)qQ%+ZHXv_$qQ0;}og&jab_?aPf5#$~ zdZ=Mn#2AQt+jQC7I_>pj=Y|m~60+wfg|_vgHqSH}qj9 zoC5`4Jn%n?TV3F}N5ff1b^*ORCob8KTvm#Ygkv=G?x%}*#2sdIK0@mW;puU(PUUF# zC;*8)CqUoz%q#NU)FBrcqOCaw=QD~PV49-_3&%ce$H}KRSlPQ9s6IBW+-q)j>%TYi zxjsv(-Y=Xh>pH~I|y|rM?|lY1<`+A3e=zxSxFW| z`zr8VQ40Yd+(!kpuixQP(1+xpF?wch`=8|{5t0|NLGr4Zskm!A3D4#mK=5Cay+|dE zm^ZXm3F8}P=pzo4AmR|;msgA|rsMIcRQ&2OW;;Ax+e19IM!<@=UaoGEdb^`c3|kbm z9cka~zMM_>z|jNyfj;hu1&k65v^a)_Dw^^xU9XWDAbPYghX@ivT zfE@+ayx^q>oBmHylN7T0#zD$>*j*^9dWSzFoL7b8F%?x!EVO1{)&s7~-uw5Uka7B< z@6vp*k|syz+8W57Pfv>VROdZ>WG59zpLlW>Nu678dY){5PJcrk$-@1W!^n)-{)vCG^Mp6W_s7!|_APe~D zBZ*Pz$$~WK=iq+I(8ZBLmnn~vI)|aX=Lx~(S5dI$Y%!BYSG%uUxcO8kc@;QoS}kH| z5&-2d0R4EA!}pKZpB5mddPjVhn6h#;+aperS>%km94PpNYcw?;4Su$cLLr=3^vO-) zNHZU|NDGvbdYG`xAS-+klF!Qws&k+HK<`Kbemfswkf}Uy4W{6*Im}dvVsfNNsT=&- zw%I!Uk?wx;vzM!U?({`F9bhG{nBKoWSw1D&|ex_go^sWUU!JLXy5pO86jdfopnEqTjc*x ztsr}6O*ppP@43JXc-@TenCRz=S9M5wN;AwrX{yi)THHLYona&rx2<7l#IeB^@)vEA zi(0dCbU#0iP9JPkQxfl`EAw@I+AR6oBah~|-k>U0%0>J6Dh*WCPMROq1Xh$etD|PoJF_ZEORl;WW)J;7KMTEFC zgBeST*DnZ9jEur9a0neAOTAgROg0gmaLkIO?$xM#po*DPsJAvbh)vD?Ml?+MWosP; zMO1Bn^4MOOmoafQ@v^`0{-f^5_Zn!{@13vLju<}ts>sf%@-cX$4Zo#J=Jl}iJ~^bh zt+vF!ZQS2JdwZ!Yn9H6eep|)AOd`bmBqdFGl2%!x5oi=d9j*#ljDh9|>-TDo4{rCY z{zSt~v=IVptl=g>%xW5usNvzIn7*0qj8MHf}3_V}UzZ3O7PDqEw zexTID_bDRTIGB^PP&{7z$k!Kgnc2vg1QcU|Cz2JY=<5(@t64oBpIy>d15!nkrP(5iQp;uL<&1?m4laV}BU(W+yUy~`QzRFXVbV)VH$mma zgvNtzG**79#UTPQCo-DEVHLO8uPVx{f1`@d;d3dXg9U@gbSvq9W@P%=3Nt7bYn(;y zkkWH0Be35?v@!xa=}u9C`LVOrZy~O^@N*g>J@fY3fIoLw46J$~FG~rN2D^~llEMSp ziBsDp4bT$r5l+Ai80Phq%{Oj37yA+!CT00=P=ufqW}Zdcgx^I+5lYZviB!)HA7_y0 ztClM;fYG*=`Z?j9SO3p#qQ_tOaHeK32sy%~hC;j0uTmnGjQ|PnUgbES#=r%cRjy zM*pB+{(Nam8}bqovchuSGPt(^Isn7O_$9nOhuzX3LE4#M0M2z=e}x%1<%xS8%YF?S zJr4rKx;j3mRK09NknQ&{cQQyePjeB!z5mMss6VaCT0WRY+w6o#v=Uyugr(-j z;@@d`&kX#TOybPTj6FNj4@N$i)dpcGrwMbW1OSEe|stOCy2PD z`Zsz{Kmy2^mLlrBAb|^CJ=|i*QTr^-b!B-Yn%x#8PJn|A$uXeh(BqtBkrfLMN{ALG z{Rp-`Q;2>2mPFuEAEWrmuWX~i9zXtkLQ55c)F>CGlO|0^o?W6~UdB|g`E8Q=OBQ!F zA%~i=+OIV9Uf=UVeN4XUSe3d^cLadlH5&X-Ly?15x>b&ME&(({#cdh}auQUFguW~q z3Oub~G}Om=Z|ayM!n=(N>H6*ti-kRf#S-9rCAsXmCY1H?rR8~!V^K5zd87@~lXlrB z_K5c6`Z6QX_4v#F_luhOBVqq3SiI+=nJOAKiDYee2l)gTGap8saCkQsOG>hAQoLjF zQlyZq3Lof03aDRpJm{-EaKBz?h(hWYxxDs%##5iJysZ%8p*h1TH_@P0Uoqp&weC0W zW<6c;V$-gp=>FHB4&s?HkyxWi2Cl5zkV21vybkZ3mLQ$x=iF|Nz^>%HBYNeSD>GW) zIF*w8RfCwA=Fe=k1=;P(1RL{xNFD5tAnorWDJ->ty3vdP?(uqcs*vwaLS)tni6X-D zYmCQ#;dFCu-oF&sKXxBm`g>!0K_TJ5V~l-b{|+f9O;ITYz#Lt+h$71R;WJfsvjl=d zJZ8(o#d6kF?&WvbTL1yjUwe4-{1tbT6h2ZCR_de9(t!LRrKg9lcYZ#2s2PsQWb7uX z&VkM$6=&HABQGN}%azr4tkSAnzUKKBt|V5>Zh;)h!n$<-A+jn?M|KxVFqtZC>RJBD zDkchX!VNYBawhr{hL6r=Wdi0a2Ny1u_$|EIv75+Uh7%7}!^~b$Ck4E0gtIW?>f(=!^vOU)LYCm@F&m>z`okmQVopGtG}TVx zLMNKR8G~u_vNHmcJvHr7HkbEBc%&}$JugxeFp;Ai2rXfcNA^&~WCj??`1Pmpvxt;A z;7h6XAY+Aw2ps#UWZ71KxYuh%$!u-jc5@u<{bwbeWh?swS}yO$$@~LAailL|veH<- zeOig_S!D4UyQkE+*bw%1336QG_1#=mJOpOOoZ{&d{;UAcW%{yptNvR1!1EQ<8tIi_ zE7Qx=k*+$Db#Z{iz28i`?L*L5xirYOmRpO%#qUv+s$tN_kWf&OhCaEeHs>Yej$3)* zEBmoSZPv(1sA-1-Zl(Bzk8P!Q2z#!s``u*o$bBp~jZV1_qw;Ii{LXk03by>gzTZVS zmb`(0%XZdM^&UE!`foKZ7)D571X{5{b8ocHsr#1&@lXO5B5$|VTGmfF74c}^JfXeO z$K_WNu*_FpKrsEHD9hYqSK4~+1kbuJ-wG=1h0os{#M$E~m~m)V7Z(&d(3G}i9Z^4G zA}>N4`XE&|K<07k-L`>QPTfM?cuR1MxEoyO_N|t+6`HMYK#s>m&lbr)4D9`2P7wyWBhyERY_Q0ThHBCrz@foXGsN+Ey!sQ_89I)@*L9o80o5qqu%5S3q%qOt0;)Rp7CL3cO5)gOkf#~cQ* z++>c;V(f+=^j^~*^J^hH9^G*&PjeFi+bKDi=-Ib`O@;}6mM8QgfMjFANntYI z(nk-f`B#+=vXCSJnmyhgiB(=C9vNEVM0xmVxdFDSERsNPx z7qNjwNS3H!4td$lSSXs&n3@_X-$2iO1=w@_uGCY;6W96f5j=;kwH*3xZR2lF;_&Bh0MT2KD`4W~|5 zo6Kk5pX#3yPE2D_=1B`Zk5`-S@tck#V&rW;;B^^1nOssr z4H$`xS2Ro4B(CF~xdpWwg|d!99F@z}@!9>aAChaY{YG8Rixz?s0wdW{)u1lVrPYAk zA2vg`R53`s$Hz%dfQlR{$qIEGd@A+vIfyq=%T3;Q{M&u0`^jbC*iE+9*fTIV06d5? zVwTqX1DLOw?=Eo<6DRu043b4`JJ>~gYjT_3uMR^&rghx36e8>ThQ6-LdY#u6Q!8*K zuBtZvyL-2z(LKz&Xq>hP|Lc${qMdeT2oRXA-gdY4D|5o0^$G({@`$ zCV4S=+u6*E(myED99R5(lv7V`{nLHu=Uz#m-@2ALOiDRoL{gtB9oQW6IDX6{Bkh(VeYMH3qWZ6y@~fz1^=Kyib#WVd)ejuH z0RKLC71z7SKr#XN7ybFd^ToZ19kbZ1L!n-vXX}ZrdO@g4`{h`^9u05{xM_oGPY;E@ zjn`uzz%cMJcb|1{*!g}KUperkjz=-yr2CzV7Dw7;R&4okG2rR~vvs&!YxrF5oZ%n) zMRJIA{a=PK%eWvvMJnBI0XFi%!9G0Q_4G!wbnIAV;9O5;{Ra?3uCz}1rCgHCwED6- zJR6DDvhGs{B2VnqIBbkM-zSSt>=j*BSPIp?II&8&W7fUCewWR!P^&o#pD&rXmf>7A zd=3r#BM{LJ7WL%pkPxKXoLKPR92l|<@$ZUj7NH2O5G3d+JwD*6Y(oL$ou_H8te1<6 zSm%OrY~+aF--9jLwUd40&%q3NF};B`Yg2v1?#=%TYyTT;PP!i&6~?3Lx-}pQ04lso z^A*~%UlyOyk{n<-9Xxd7fYK!mPFwc3FwA)At z3(F00&yQq7#rt2daJ`I->c=Fj9U5nmek2Zk?lmUGa=)snDNnrGnptCq z-BcsSx_~LPU^9!@qGDwUQ|zT?pCS9PEH+V?6j3c7v#MmqyPa4GaJ8g>&9sEepga0S zs%OtNWhka9*>4{bLJ`(zunPA4O2bx#ejH&#(dFrz#Irp(Of}bqSiRn`K*2E9 zIr;d{$wok>mIKPyI*RB=)vP$rzitst?bQx8%O}6#g1_Fy^f1V!`CQ*Pm?n;u$Z+KUIfW6iPVJ{hmS?U3PNy z>+ZrjV%4j`DGwcHbP@?hZ6p^d!{(n??Zgz-K5$o){P-9OR)vAf)$R89G<8!|M_8rQ zJh3H?hFi1uY3Y{-v8`x*1K_r5{mFZ=TG2IsDg)!|jlMc*B`X?*7ZZ|=+N=p%oMEpk znZ%Sf(X|=$^@d%cKU6Pk{m9a>2Y{}LV40Z6ppoa+FwT(FPi5W5{1x1slLy_o+WE7p zeQ1}sO+i)WLFOe|1MZJo3FO z_ily+;=5B1;y<;C#Zre04HGID{(jI&=?FUr=(#BVv*{H0jd`y2qkAHOXcnL9XHk5| zFRjl~;OHI@IC%K5jUber-^P9a}C3T{6mvZ%E?RJ<0bK6Rq-%S}vD4=f?7Ko*?oc&d=UJQCut_Kb=|5mfa){8^Q{ z2yt|apt-b88kKxtAfB06G>Y@xq=CfK=!oVi}|SgxUg|2JcN zok#Ixehs&^{i)v(nn#aOrAHq&^FvMa<`%Ba_(ddI-@_oN6FJdiEacI9K$W*|n;_R8 z41*G(N(VVd*P=(%z+!?g!UVZ-dVzweVa?D<`|pRG-Ds`(2!b4RDT%PHq!vPWm-U>! z8#2=UV7gE+?20-h?)kEfoRkGzxpLamrBwN9C!IOPn1~RAXE=RpvaCaVX>Z4I1LoAu zC*;>1hTS?+xX;ZMAPJ1XRln{E<6ell7C5xA+3hgCu&rdM6m_&*AEpK&M%1sT@MN0x zqG>C}I;UKb86rA1jwsGHw1(2q+~c)e8heXIlK;+GdQSSz*s2ukGk_JE64!?;p^nC>pZ*bPh#D{cny zI?r0h|E|HRKJt9SfFFO?U|G#8D!o;=))~! z-L}O5p6St4S;&dTQT*ErWng5xQ(~NQvQcaMDh|nQJ^R*>uThYCzJ(LV1%QDRikfQx z3DV5ZW=umYB|e0o#41XffFAM)A)_V4dJN7?B&k5K!a_7Ya_DnqY4ADu?Z-NQH=Mhc zsh=c%#lwcdMEGSpq()B}wU4{DqSx#ZdWsh^N>Y@@yDk{>$0npF_2+QvK|AS(03~a_-ioWk+>(d_%uHz(k5(D zM=evdM8~rn3j;2rVbhII=r2m1!|^QjU=>rxm^y@oJm>JUW$*pp58&rOVMCOorT=qT z$x~E+8a|O^t|cH7hQnnqy3b5e9ue=pGREt1&K0ahHqmA-?9#4nlCAcZ%UHN>J$Lbi zUeqLu!s!EoQy=I1x<|chD?+$3yKbyV9I>p(*Tdp;2^GB5q zon$=wlM8v>eoci+>aU&$Xt;Kgc0db=TLdExo~FMn13V-1Db$H~8J7U4316hEeSI;- z{L-8QVe1)1K~i_v-%6C}e*=S3AyyoaT>=VF7rmP7zJq9ux@2;vG%a&ON63QONfCm0 z@L*&PbqIGZOL{sQZmla3YGZBdlrs#4fFMwe65>$x1>#Krx4kai<%?8N&s%WZa2F<_ zMW*GjT;Uu8(aiSiZ%A={8u73{X2XGX>|MW$?HAqRr6r~M&ZzMN^(^_}JPAwED?i^) zbxxyG!KF@MhR}qX6xo-1%j9nC2-J8AD*i(|AhB2fNA$>}mW@1PWQOn%e@?gvWRd42 zYsAFnp~+cz9!tjqIDVCMmW(Oqr^Vq-jnA9LYRzKfdR?;jF%(#1b4|mkjjOJ4Hc=d> ztua^8c|gphdn*$8sJ28pu{%EcRgQ*L?0=`D`wmB&_8}+84=3n0zr34VOuB3St{X`5 zN7A?ZI*>FWJ1g!0&mE_;o>_693?=ZWiDJ_o{`JlnXYC>qlr#RDA2Ijcfz{-Duu|oQ zi}MnE@Zz>4z{gqLvj?1qedD<#UEdZ7nm4OwsYuSv=CFFAT_@tnPVf$pJ(}{~kfPJg zQ9$Gcm(R`zUvFLa$Fc$k;DqB0Q`D`|9M5{=Ka?YFOM|mk z%0%LTA;cohWHbiQ2t67?gp0LHPy$=R2S0j;Do`OPsxUfG%cd$7kR_l#o}636&@ot# zQxc%@wERp<=;+2oN&QS!+U&dAZ^=9s>khziX#-80E)R_LNH&aSA7oFZATxXl(s{>c zJv|>fErHIQGYyebO8vwhvbc{fu-tQrQcdClFLc^w3N@ro8<98{u%$=~H5BDAT69Bu z3M*AV3>Fw-9G1)-WPIXbxCu`x*C_9{;)-FhJoLZkH5SDA;tun&>v5Fl%dqXuQPl^hIv3xVDKi}=}qw_ z?ZB)7s<~h@q2@atKfZL9XRf)ymnO^{J6&iXJ)zl}tz(kd`o!~azpKl1ce;A={5eoP zo-BvcvU6XdGA@Q(L9A2%D_Q3!(RzkRUm@v)9jY$PB6aFzUMwKuAS5Rg+OalGxFOI=_O5jcP6!$XEzwJYYg_f7j!;h~?MFqFPTKeMYD#!(+m_u`gaDH2O}$ z`=l6qnPl%%3^{)(&&Y;6rJ7K2AhUX=k@1+4`hL~Q$@O^A=<4`zORVvh|0PxQPN90% zrylzRp#_rkc|esG_IM%u!k$LGbNF>5J=VeRxE(A)?cTRX_?ROGcLA+xS!>7T?@eMQ z8d)7qWC2jFJ~;OpDe69h>#bUB93IZj^6$kumxW_~wQaW1C^Byx%O_rTA4-3GGO9pZ z@)_eXm*ZTO5uF-s(lWlI>cK3+bNi~!(6m8(`_>q=nf^mJUhngaDsZqHq@dwBT-jNb zls!gL9dF*eccv^yK-UHjo=yEm=0)cW3^Y&dsdrgT9|Ehe{+HTQ#JrN{L+MJkLV=+# zt*1{hdn|W$d&e&Xin>(xIJ83r( zjy?0~J3@1*f}lF+>NSr`P$WyJ-NMgk41wwlQy?D#7B)!8F$)e#v&Nf=Cs~1CW$I5u zgJ|N@F=!C__e79Lr1mrsWmBUr=oo^7a-7;FPyLf+A$j%BU6AVihg{H~)eZ%1VVEvZ z#UrDjR9ii?6(#Y|vZ7d)BWLQQ3^3~HTgf<=Y3nXy_fFCpNT4VL3Rt#)2)x-nco?ST zOH4?oEIkR@bOu!o;S>ll)NKrEm_!v`;7CnJ)};7%F=tnSSyHAY=QImX^$OcQx*dPb z3|K-!v*iCq9*u2~f|<0S5%uOs7JJC;E8|Vrc9ei{&IgvPQ>AAYn^)P~iX&~r8y*k# zrMw%`y$EP#3He;e7(>AD%g!=BU%c$TkbZvt<)5=66YPHOZQR29Ad4Z#D7xRt_aNIf zk8+^ZOsaSKj=Swfuw)lKG%C~(7U(b!G-9RgBTByR zvm0}c?g|8QvRkHkS-4+j-cdSW*PxhtUnk8T+w$jRSTP?XHClA)zBtt>wwk z{ucH<^%EPQ(CZHV4q|VLufkhDq%DE0Z<~h;!50k`!*(tnH7aJZo)Whwgg`;2hZcJ# z0LQzEtyiLUh^Vp7A$x|6;aNW+V>HsogNJr5SdzWPAm>S=t|>DbmS;BW?~ zJB;@eIstRU>c$<_0nr;9Ol%}GJwHmZL9+PH`gBLnjS*7WOCb;i0~`s3>8Ca@<}(Kn zo+H{YTTuzF!(Q|E(^pf&9(ywdLAjtJZTawql8Cy;!KK%D;yh+;^WW&>T= zMHg9ROdbW@9Fu)k6FysiT%}C{n_cmNeDTJ6VBDBo^&MCBPuOZ*(~(`h%d;Em%2gLw zvkVW-X1^yVrez%2tdtKb`w`G1v=+_gR#3tdL3R!2La}VU+)q6R_~L zuBDIu*m;kiM#-D)P(uND8~hd>SeFeOh)X7d#%w&w2`(%*Ew08dED1XvFyOnz1E8tV znuQIKNzjL|LMDbZb+JP{5&dfB2)+;kXtsmYQ}X;wv8X^tc1t&?&|}Gza)Xxbn8R$% zrLj@^r=Zi6sA1W#X%XoLMOu)M4naVamX;1_>F(}Ex;vyL zHf*FNMY@Cy(kUR4lHb}s&+~rY_5FMQoa^A>xc9y8wdR_0%rVD+(7&!G6Q9PAJVlYk zuM>Ce?WAXv=G=*hAV^bm4*7&*mkqS(rCeg)yefNYJP{q?Ll*9Hb2>YHbJ71PSb6Dd zFlEJFcg%4#mcj?<$Vd0I_rNSUAfws;g(&qBqwX^8=6%$#XMbsNk^CR-m9v?uh3D>5 z?&c@|8_@8}6_xo|>bLR5)@7pQJCh>u!}?a(AVe=f)o%tLk8vP_->y3Ft81z|AE#05 z7KE@(9($Il;QNu+rO(B0BXjC73Jk`5q$wIB=@G62;_^Lv_nOeC5q-A17*M#D!6Xbi zzUJus`jpKBaQie9m_5ENfo3JM@#BG#wCDX&^Zhp zN$vybX5(E-ECvgCAS%i$mkdpsZPurY`PYqid1ybo84DLoOu~UY3=%H`!Wos&zsU>F zE>~5BZJccRF@o$Xp1t~{1FPPp{qnmTC)ky9-V@NCHA5oAc#;T>fMDgWYy>8y4L`nX zn#E?UJHH=DKNifFS)Av`L_*~%xubo>TqEzLD|bAw(P?;g zdJ6}x1M|%t{#VQVU_>N1llbq{HO87Fmw`kh1-mq=m50qiC$TZn#hNe zV(j_|#FzbwhjW>IHDRI4F6aokeLO^hX0fD>X*qsne6c?QDsmF&?%K;uFJ*n*TY%h^ zQVBYiIS}hlMF<5sKk_T{BTJnatR$;{NlO?CXivLBmSi^?CvPO?dgk!s?2HolFEz+8 z0(YXM{}Yk$gWl#Em6d8;#|XT|2*4m2ExE=U;7`6}`>P}GOw#A{H`g|wDRP^H_50VvfgnL$Cdou~W@~no^NaCQszV5v+It6= zc!bD#@k&*AU75v_fB!LqyVx(jFz{nh#a5h3a*BZppbN2f=%nK2u}59KozbjNS>%X) z&@3o?r+=Hdd7oKf_F1;QP;W%;9I!y>b&O$}sMyG1ZCIX9Fi4r0;Bv92=+hs17g&Ag zl!zohzHAQZwp5 zz~tJ!M-PJ<;X6e}?IVACI+<6EdJI_@r{eK~V*+IGAwcx)VF?qifTAG!zvKomb@IPP z5R5AnemMN;w;U~E)QtwzCgb(n9j86MFTMd28B6B z!X4%5^@!K)2YU{4wMM%hrgxiLcpo8YPh`{o>|8J^^=*%$9q|9O=IxBD+R@^oJYOd7 z35MHV79}kXN(67&={93TRwzdW{)tOAa!e(qMzS)VFsnryD)Tv>-v+lTYKy0*vT2Tl z*yBEiVq$Uf%($1DIG*;B8mJvy^b@kfche@{3UjgjypU^#rk{WrCsz+r>#hn_y#TC3 zHE*^Pw?_RMu9fIP2SD;d@$d|T|D*QQ=^TnYu8;_B^%`B|tm(w^ef!o&vgkSwk{Uep6%tERV}cPQ&rIx&@tp1g z9sFuTi;h(aTpRngm>Lf4>ooy!iq%EtIm+gb8F#2!whbLFLTpD%PTXs)DEmV_aBSD;@=t?==7}dWM<@zJZ>xx{H*|(sU zjXKR2LvEC$H=q)hVNbbiXmTy|9+Ykl_{6_{67yOe#zoj_QQyjTA5o`iFdBYn6v zoz!ly4s+bu&SaQ~LV@Gz7o*NwB;6S)x{(CzHlpAuLM~RxmdxJ)g?-jqQ;Mc|7z z#e!H9VR8AQjJ@V#Gg>9iI*iBVivCg;%A;NHQ5o%BCYi{ObPcZr%h>8x(tDT1Dy)uN z#8w46pWv@f-ybD^{l}fZ_Aj^K03jM3ECUvP%ES>%DEkCVg{Tw4uVck?YT22p>j|DR zZc4QOelIc}3EIWRA<=ne zLFc5DBu~X{z-_JT{f4@(n6>*kTkW!Fl&5iZVKWw?jk}VhU?f+MOA-TPgmWTqwMnZE zGoQ&rC?#X{@1?$ae}UhW8>N}0Ze^t>f3E;@P`}yUNR)gRq1V>qGzIMKq$y_XAb(MQ z>hqAmX$6s)Y+0DUIsivDULsW|M1U!A^Ypa!cTE3nj6b-zI3amu7{@T11380-Hc}em z4Fy8mks)+Hz!>J6;*h&XRdYw;2I1KJ4GUui;;lIfKlLOJQR`c$69#2Kt??@|VDY}; z>(V8fX^`)}WbP06lJ_j=WDor%SsxK7ol6Z|b4(J*F9|$Ejx6g%WHZLQpYWv3+ zj7G@0Oj|0_x{P*CJ^22bB;BrYbl4s`V$Ai94mC7@G0KAtQra4NI2?J3n8^aG^W;&3#2buOX>JR3g=4 zt*S4RktEIccaAeIVW!u?my@?*lP!GXhfSrWrQtkd*{)CAYpNvsPrT#~F^Ha(@Tz{^ zJQr6}^9_FgZ2Lg*1YQvn^VW}uw9rG@yO;A_q>}2*a^K#-_bhQc>i`|diRDt#HiQ~- zna%ry$91^V2F*v~Z-;mAv)m5V74;A*%JILL$@*W%h3X$P5U$+gGQaCaACh8f20I%&XEvU{8<}YS_ZL*gjsOz2D#y3OZLB5ZrD&iZ z|Lw7lWu1yL_^gH%N;A_Q2;Y2a2IWoo5-;c89Mr zY5P2aO2@)>X2~o8e1zi3m2?NJj#$RXt2jPdx(4-xf#tgrJn)CLZ^GS4~jx?}XPAyt{1FK}rhEI~)Lf-@t5!Rr4j~z^E zPx<)=g`Mf)=w_b`Z?;@+#ddvTW@hHaQy?g5q!331CkRZ#S}(#W+CDZ>WBUOO#M`MS zK^Z7n#SZ29=(nXx<$pT@bA8(5+pyJjBOJ7g!S9++t>pF8g!|;jQg5%c&im9gKsJih z!n3s9>yZAgkoLTA3#%BEM9^~CD_KAOw*^~)buHtE7&mQlwfS`&x$8fDi7E;@6chry zCD0$3p~p!2eH(Z3U)6Btj~)|wuw(ZugXiWz>&gp%m?dgA_8JybJZhCPBw3(oF+aE4 znB{B7+%7r#tOtkpCC>|0n~g(d_dX^0@9af?AN|1btSU&uVSx7}@OGp&XqK!_Iv&jQ z?Y;N0rZx4B;~)SOVUwD;nX`@UQ;QqIlF|Ba++@v-QI!u{Rew_U*BUv3uI%m-P6CU8 zOB>eJVn=kyjbqdoitLom`lN$13(w?>uSQ^Z&KNaCG7VwZLLN$?pxe?9y!!oI3nd1E zi?I5-EUDp7Z0`wutlc@c!ygRA)P(*be_k9CLTpc2{n!dU6~)6^H=FnS1t%JI8Zi9c z86vZ{RuHc40e>6V{Dy6i>+}WBs%A#EJaszmd$9S_-&|~+$p0w*RjqTvoL6q+p_94@ zn+DwpHh%51#r2(PZP4n$_9?|f1c{pT<06E96Vex{-kqJ|m^mv3J+QmR=TY=tub9Ic z6#cW})Tx6IgWZRX+LGw?D`ipG^y^7wxktPdB7#NT!{!9aI(z}8$dAJ-24@eiQBUL@ z(_8-l9i|@^0E+L#)+)Y-5nYuS!6q01Im69J3LAVm5EB;l)%cF=Ujif6l5-3@-OG@^p%YUAz9UB>d%SF7+M+@sAO`3UN z?k7#m2fjVGxJV8Bj9&r~c$*jTL8lg@b6jBI&feEmZizz)01}jBinOB~OJotuO^9tmex4MWNy{-iRmf-H>VToMM4^RO^ zst<$B5>GTbb0ky~zyI)G(5%s40RkcR4h|AvNaFDk57Tw(*;@aDi;Ii!h_R|$9YM!{3}Ia@@$oHugV6XX~jla@2$ zZuk-+@ajvFR=hPjzkm&tF&ica0xI%*eJJ$*7lCYea1KI{8w~#6j~{o--Rj2iw zqL@ByAv*HBsIyTm6eqn@M_z z>UAbjyy8^#CddY!4O=Gt8S?x zHI;yUr$stnJ($o!+WzrF&M^Cd3u%&jy;6og`FsDpLb=fGnlY zze@$VZDLFPTSgJFFp3;5HhfoPq<7Um24M#5eSvyNidaQD+Y6t|=d5aFhH7Gw$uMBb<^jDM;|u_Y5{%hs4GVthyC2nfL>61_-!kWLGe50NXJ=bi zi_+6qhI4XR%);$i)Sn5vB@?y`&9HM{PU_sJebLW7)wS)h(ZrKbV=Pl>nq{dAwp`2} zK~4+UOr@71e8_K80NM0k5axeiGJo;M_}!7-BA4NX^w+4|scmko=KX1|YUVwJHUDR` z*+w4iACbeV{UjzgpY&fJz9q}{+Q*(SK3lhH_H}u{s&630w_cl?*~<113l zQXc1Fnp52CwQ z9}hA@U9lK)80t2Cct<7VJg~Y9SSvk11nKFF(-bzCe|`zmkFl5=9dsC~U{i++uA2PE=UvEC@o(XCAe&-N!b?`}eU;*KEMOPTS$?Pg z7m=2S|6MrM*Fb#%SY$^_|7G@t14@69Z1RxtVz|Z%0K^A!M1`-fuaO?=$hlkj5;Fa@ z(7{!A{4ljnU2t*g5b9hm?9#rH!)%Z5v?-pMOyKj%TR@aPusb^OBenm~gX!(Q#xxJ3 zaUvPyS?8H2HAh$X4_L^{2zJ8*0ksWPL=5>pG9WV$SVOh0$6jZ}u~4C01FyZ;uQ961 zcS}&qNm8j?38t9Xox7O_Xb_q8hJzX!fzK~~Th&sWzA8{@G*D1{2Z4n|!K8l3icWi? z92%^Q_pr@1x}aGsCVAet>fRf49`0l>$M+xrvD*BZ2Lo6bd{3}k(G2zr1=2VtzsN7z zEd{Ky1RUbob@+OIy>;@EhW+$nezS$Zqd-ec{jyhez6W zc>jeM7#LLQ!0| z7c+AYcK^yoy2Km4@Y1@~&AO`Dd zNcrD&1;u|fCI1K?s*vF`@RjkJpXPjih+MiDwFj;wsIab-Xv+T+I1*l>IDv|y7vk{{ zd5MF_uGsAe`?r5D)q%a7+Xt$v;Ch+Iu9ICYgieo|gv zxERdl=`%6t)$4G9I3OPq8pX5$g|WsNe0(b$petVxeQACFAf;SAWt7n zdL&TObQs@==Yqvcp~y5264+mLw3gam4|rcJwdQpeD8+NWwJMU|XVKMFEg33zbvd2D z%M$o}Z}j?Ld9ctroLE>4^J(#VdMQa{k_AKTgI_tpt+2R92KjvhHP@x*cP~gAIyELqhr z0R!p_lk3@-=?AGCANm5*PkSlQZ+*!nFN;ZSyzUExo{&e8?e`Pd%f+1SQ^c|Fp@;k4 zrQND@w&Efvk|&LL$eUf}s@5Wq_Z>CZCY*R2_E)ESn$Fu}Aag|-NMyi4+M@EW(Z2A_ z1Jk(f7r!5Yv|(DDNBuD@5D3cn2TlP!OMV0bp`0g<^4u0dmdpx`i5Z9mVs5cOZEtm$ zeBz=I-1%N#Fl#E3qL%Bm@&P9<_RBN@hsVrX91G;GUtIPyKFl{@0l#i2bm@5W zJKGG9%7W23eF6SZ;OY(nqx1pdKY?VhA-E3&9M{9`$G!t+a3I|u++aCLf!DLer`)MK zHifsCPBJ5=dwgjaCQ0HRY9LdJ{|Stzp{{s5d>feX{`+Ze+lC4ww6H!}lXu@9B-WE1Q{Kd^|-*Z<70dR=4@*B3A1(VEAwQBD@ zPX(%HkE~}ZA0No|5pr;FNNis3PO~8uQ!KoXHx(XE7GJnto$dGPr*Q{jPdqdiXn<@Q zgNip}Zhi~`!_YYC|EbeY@4E^zh2wUip#{x z8}2E}JtvEtTwq#p^6zMh@b{!VSqyYpvtAkO*g75BexmgEtZd#k7WCoF&ucBURX-lT z&TPZAa?^Vxu5Z=sCLov}fj>kXt(qjy@*c*>V557GIIT z^??DlN-lSz`9K&+PuwHV;W?`oG}~j1?R$5c4;;1-8jbQaPn^%idwg}!blHxFQDE)- zu|_@X=ofk7us)S+nu;UUgwVc70VQOS=1cJ}D1%a_5^9SP1CKqT#|D!Ffp)EDi#6Ae z@ZAHV1((l;2Z^axU3e{4ubfw*LsWVie_Jf%)K+rvGxd1wU+2R8Diqs0 zK^RJu89%|kjDlzIMfCwh;NZuj*n#7NCa9pJI?wzIbD>ahF$(pG9X&;&SReiy2;_K5 z=$Is6Nli8jp}W(lhiDDPz1Y{+$D;-Edz(Pa2=)1gIeZ`!MPM5Gf_Y33WLs@>n9y8c zEyY5o*K_HtX#cdUUeIw}Icl=#4Jw5-XwMsqG%j}pfxVBU&XI8%-g^~Cb07P)+s;I9 zZH54o#X0cg#qTFVFbbRljsYo(3i`7eL5BXnCH!<%fr1S8!Qp_cb}g$97#vI4IRA~_0(;&O6C*?9+@G0I--oIf%56x zI#qDyb995eiyShN+nR40>Xl)e+lBCtMO7?r16shvW1J|8uBI$VxfaUZUs44Cy z6}dK;fjlVxqxQv5l=RnN;a`Lk%A99&ntmK1>Nq{0H9vl@W8NX0HPuB<^Zj2EbcBm} z-(C)n<6BsAcTi@3LRbCc3|vH2>}OAT^$XppY)vasYRk{bUsFeE?OnH?>k8M&PF2iW zQv-wT(x!w?cGKqKfxtiPj9hPQ-v3VvfHmHV3L(;lvUNVJvNw*BT>Q5@>7M22VRp>c zgX##!!$JP!rU1<+ul-Z7<@l&VaU<&w;tqe>Z*}8kA&OcT9a92b-gcaOj^7TAZ_EiD zlR6;0B3>Bx#j?e2#PP0KVb3m7^=9U4%x*l^>8^KHshd_S8df7)5BAa|4?>u+Jk-@~ zaP@PLf6-vGoz=PUtCxa4V>S5duvk<8?n-8gqXnBTn+zx5{UpE-MfiH(QSh`D5yo=| zz&Ctpo>2j5C~yCuZ&&4<_U6z?SM_BJMG54~FJsL5hxz#nB9C+bsCQ82>={mdS*l$Cb(aw!(t)DXgbxJA4z3FbUf%<7lF1x?qj1I{MAETxAct zx%!$b@YxR?@zM0HzviNs%k{;<>#~O8_qff|fo;!!YSo?myfe+b4#_MqZ8a^(Z4>S@ z+6xU>ZT`?pGhomh0r@7SZny+g;XIlLnEDZy3QSQZ)_z}({X&0w?%uwBEFkDKGa=yS z$(u4_&5>n^l@wF%EygVm(nlG*VYR&VgMyv)7Fy`VFdi&aR_II+fG}--B3@v7*H%F` zA$^ZfY+2A>#_t2ouMm1RsJWh=9uR@V0q!&sXpDm!DfhI~fq?&GU6SoAT^eT2>y;i1 z`D`I|G(Q%R~iB@ zBvbB84n!m|8_Fv`Wl-(hFMC@UOvyg|Xsp@vTgqc`#aJA)Un=n_mq$lO5{PE_ zs5&>Dq75@(>MJ(Tn?oJ5;$gWJ+KsHPzvl8QzP_+2@o&j1XGb?$o*`j%r2TK^Tj{^X zVtBvVvGqDb$T}2EK|f2}b+tMkWkB$$#syRA(ZC@-s1rqos91uO4?Ts^jL2a@$r9$jg&* zDZ)Rd$`gfA1E*Eyl2+SAp=pHwY8nw?@*vrT>_P1xTf-{tMgoUnAoUj2n(E=@6*XrL z0$zyMvr|IEiJOGT~kH_VGVeb&uVE3~fOEs9w#5r1L5$;k49E9G6`I1@5 z9GN;20HL{h|D0mWZa~KDr5<=M3D2ZRmx=E}?ah`;Vh#Yh$5>SD83KpU-nvj+nj0s0s=Rsj;dgZE)pg6ov-Rb&HsKwV1EKv2+3-vQmC4KB+ z*3Z~RzbT@A7q4pRrtVWy!XxGtb)ml=+eXl3_6ViOii4sVEUA`9_*B0Sh)diVNK9jV z7h|J6K1GslWgpK+^$-8GE;EUe9f~uRl*6X`Az8klWl8^$q?!GPy@2c#?bE2QYp1H# zb(XRw4!Sk7o>2K}5H7Ml7LCNZ5>}Vl;MGtB6K1~ZVF(bOSNc*Sa0o9qUGEgGIam6v zsT+p%t7?^3j(sgi9N;#6CK2x8MIETG4q|MT>q0W}0Rz`LT&B zp!#Z(>HT=$)i=l9B|V^aqKx=xhTlJPE#PU-H&eaMiZJ)1^)nE!%N1*v{K)~=k)a$> zIRL^|qC)E1dHYu7KO3efeygtY{KrPjrL!A2hT8029mXlAfawoNc) zJ>4EhU8kTUgi--L0>;2k+|2SY@xnaQvtK`YZQuZ-2Ev|FvbOh=fNgE)YVWBDJ;>Ne zVjG@g1iGD$vS89dPFrWLtq7{8~s3)xtDzmo8&38 z?LOo2Mj_Yo8R!ANPFFb>d~HRyH%Tu@A5W6>DwZlD0M&(**%EaXbm#A{;!C*fG}$I? zH(7?lk_n;L^k1>la56%hRTU&5wu1i$60Y=jVvQH`@!ZlCsL3G441t^hpqGo+7TNhh z;uM2KoagVp>t0V$ETA zo_JaKE%liUC={gI&%*fHUvpLkyOodZOqPb|R8-!9toh07Jd+OQ8lc87*XmXit^;JO z)HPI1YNlY$&D3B@5hx=*7FW}bi#}JO=a$ZE%}$W$2KHal^8C%G<+S9-)3FsXHv~^~ zJKDw8Ugg>E%~X{O7VSNwwr=E^QS9q(e1(Cw))z?}m4T!6&Wry!E4_Qh^CwJ3fl>e8 zBMibi3pa_>^_}iYS*8;0(sJD>`AUiG7Ql%lqkhKG!&gUSEk{>vyMOSi-ey?Lxz!I$ z-nx4pJ|;PxmEg-ZM+8|XJ}=OM!2YtiNfggq&LCzLEBiJr6{Oo@Cl6R_ZRwi-=s8qo zBW4taOJ!RH2XypF*He%4{x(whyz=Qvbjo*i@_OHE{eqUL;+RsFpPVJK=|7+Wb8NkW za_fTZJL-v>l)RbhdK$V!aSIjLLbF&UR}OPQ&& zxaPa~SH9=Zb|gNR_%F1G)~{@=>2&{vDWB$e`iu{@Eb=7#?6A^pfv<jo|D#Uz8lT-0w^585m;|ef z!=HDg$Qt}j7OPTNlOYN`Y&&K)XnA18kLx_3)0D?BlBFGx)nc9JGpis0|JZ5srWY%X z&M=*mPiiBYJzz!$-Mpsyz5Dj$$ zvyW_$n5mS&asq;49mkE4Y@PkYJQc^rX*hLR$WRw3;1ZbPM!tiR^@`3S1yZnXCAYKE z6UI8n%6)q!f!7K^Fv2{}u8yQ`g68S!JFtDb2hTdn%O9+taM~@2SV-vGh$DW_*i4P3 z(O89f<69xoCCSB>iLPk3jSu7Z|6dFgAk$@?2<%t^>l_|7{AwijQT^w5`QI%okPKs1!)8qC$fhy)fn9j;5g(A<OY!_*K6D3$!m{ZRZb`Iy_kO)EywP;e$8yE$d8W72a0yN!Ont1`9GF@9xssDU+D#S_VLEC43&4RlRI

      muD|T#R5*p6oM=U#m}txF|Vn5I;$QgPzgkV?%a|{ zju1%Z=5$d&P3D+atdo&0+Z#zNSt6evNCdMOhoG$uy&tZUfHSTSCCi0anEH6)Vq$h~ zkHbevxWSVu*Cx&5`&-#y%Pr4j2qy9sJ%n1C-qWGPzx%ThWgjqBt+aPwjXN+sv$3|! zX2@YdalI7S^#7>~{xt}YoC2Zm8pkhfO8wgcbe!yy_cgji|9e46IfIl-#`0iu2;>2q zGjHOVdij9o1nZ|5YGD#obX zfN4IG)ddo1HB!BIGVp$@wPZEMe2rZlA%x0@#7>QLOy+9Mnw;h!a&la8(bmj>pxi z!?;4hHu_yOG3cq_ph{w=&0i8iqwNVRUi&>>9f#mklAA#fvOOg=WnU^ieyaYYyY;{Y z&*66o3L~&d;gaq!e&4cLYf(^MM)|wdaQ3p*G200r&^DKTV`%N{StzYFsV2>N(Oj}g zP6H}WhzTC7$fj3A6}KYFDbNNBuCRT8vLkDa+w60NAO&?D&wNUHs0JTU+?mMrRjc9op~5us6u9Y-Y`iVXwG&QVx)d`2r`>g{-n#)=IGRE zQ#p6El2FGy#A0thlY6q*Pu4vBaePGyv=}eg*P-Bg^S@6FAlDQ;7|{tezpZYqjL+Xc z3l*V-$%agEoaZ#5}u9M{L8Ad_L z0WPB?yicB6aco+!v|F$(r!Y$4)xVFfbvx8=BaTOXws>0UalGldY-7JiiRxo2;sNAo zKlM~EEe{QXo*LJOInH>T1JJ^gs$55 z&EfeEVzEWoX;FZ3U~N1JiaN@(g-H3opDIK}nmwq#g{BZ~6=z1jtP?_=;ug{pY9^y$ z!DnshyH#sQ&`)1^6B!LnpnId8U}L?kF;eK>*2O$+(Y!LY>OGoxfGsXUP2=&Y;HYL{ zT1aLVucz*`gI?yytZdpvu$oFQwu;B^VRf6$-Gxlm`N1jS@P0aRE~@i0v8gzj>d5d+ zPN;Fqlg>MiLqd+m5`Uc^9rO8{%L5sY1lo$H!fz57KF1ewF7;~^yU1~_9x%?$Cbf6@rL8~NHRgfH(4R`^%L zMr4{QpTbDrW@O-*+7Smk#G=&U+Ns@nJlA@WLp67^p`@|nb5=C>&K zja~6B0|}fdtFz3hP{yd}+X6a`r_^JWKcfz!19VJ23E0vAfT7h*#0gn*v>|Jbe5frc zyEYn}H(ee;1l5pvwFZl~Swb$d>p-twONVGZE$iV#i2_?-G12qlV_-yqQEtxK1Nstp zxWJBt=zw5CJ@vA{-xa`#^0Au0sXqP+6>5X=faYl^E%*Cy%Q4+7N%O%B_H0|P>Dbe8 z#^!|G4w8NVK86_RHI(LjL$wB5+}2bi{rMBo=wjPNcmP#kqhe=D0}m82bPFOw3}|}b zlp<@NuKs=*60EY+Wqrj29TZRYG)|wKacORQYc&$OC!OprjkYiK5Mr(GPUc-k=)cOP z=~5dl{Nii&c8{>HX28&~{#X^DBN!+D*Sf&SU{Uw}*5m%CT2)M}*W7Q}eUG*oH%~9$ zWSzge#LFzr(O80XkN)x72ZL8xT@OCn3Y79ihH!F+B8xL>qUQLVQ zXU$IvHwn}+*k7FtDnwHxNuCHBZR$KtpT*VWu$8yaNdOlVtIylkfDs1G zlytB6%QIO*v6_9IRcrg?qiNup_yvd<{tg!Y3!rO73g9c_RkUmZH8~C#z>m1Kv4ZY1G^qvMBWG%Zxot0>|gVeJN3&I1+ zM9pG;w_gTp~6|MLO9R7uf*SO#@5jNI5b}<;w}MhOxSyP%$A_ie|=x z^=)2lkJGP+$Zg^z9sKNg5cw@bc60YzGe@tyTf4wUTQW27G3z8aiHjo;`w#)h1fBLbax7@ruB|NiJk4o;M(K{-FS*@+Kl7r^( zwjRg2PeXE8;Ak8q+Mp%)P9*PM&b60*djE&@s=O=5o$I9^b8WTtWedKmyiXL96>1g> zTg_{o4UG~s0he_B>9}ra zZP^EH(Fkp}S+du?R&X$kv?*WpXe0;%b4vCV#vyY>G;D=a@Mg@%;%zEcgjA%u=4tO6 zm8m$z>yu~8Q|LkNjs-)^sy5l|t%cu;Ij*8MGh(7y&|Kr+v%R{Tj4EWyBhy zN()FfQwyU}NcJ2mlAs`ojqtrXyAQHc{8)4%=b~k+14Ik7>|Lv?jq-1ml6UoH`A+6~ z@~eRF#9GAmjfJk&vyp@E<-H2f&Hz5-0lB^tde^`pO6p{HT26yBPJ7M`AkBF?UT+ik z9?dR-!P9V&ziVI;V<1I=^Z_}ip?^+28VcMwlONlk&|X%tVgCK_${CnRF#fI<*Eb<_ zqp}1>_(8pi?Lhe%IHMRXi7X}`o!zrVg+Rm=$((Wc$qiGS=xzoqQ#a-OpIb_GZ6&d& zswC6xfL4+?D53MA*_Iup3Ym;q-h*9pW4&oYk9=feC_>_BUl?x;B}0NsuE7y0RLmAK z_6~IK5l+X+m^Zcs9F>>S2SNX*d!&qHhKRbKqQ$d?8X5iLNp+4Nxu%$aja%=x)-^V%>4GHu#fH+_lF*T)*pH}hjGJI z-`Ve}nwWG}eW4^z2A73i43OC`<}n}113o~jY0;F-jIu1?Zb*mXYsnp7Y@`|llHm^s zm#Ek1Qv+KR!nNOV0~LS+2C6;AGtnY&iNKt4_-_R{4NiXX-V!9146?)`nXrhQcPn?R zD2V_;onO2S^wL(sfAVMe9Gg$RGH%va>@~==K_>^FSKE1fWTta}c9fQ@)SQGX?jl09 z&^C_ub$T7XFY}$Z9aV2hxk518)9-cr&3;oJ;e*UCIDX}Z=^YDW4xBsrzlavxSQ6}@ zw!Rzd`piIqt1iBxA6_ipb@=nb=*_6U`|9KOT%5x>W(OS?l+@6<%#UKEt2 z&k2rQ-x{vRsvbTz`;c7`!?K*>tT)D=O2(#>5L$*XW7O6C=zq5AmwLt;`_)D29Zl~| z)2G$IZ!E~G9(_94>0g}W1g9`SC(vq3u>vd5+%&P1Jv)x}EoS@q2t7!r;3rE_MCFd* zR)8(h^*Mz7Xs574fFBLG5&aAfsiz3%4m86dvJKtlf@IG=MS=A{813IRrH0nZnXC`% zq3*Y$ck>jOZ1g93e0R7#v3gr0y-@snSXK43WHm4r%}xXju6ows^xAsiiX9X0-3@KHeKv{H9m0>L!f?a*Tb zM09*LFmGXkRhF3f6#7Jg0rD1jxm1z>{Q&7^3}tjE1F%75Th`f)n*awz+CMQC3%yvU zRMh?Vz4a5g)imqFB8Ko|(6G$QV`!--z?B_i6r54{^XCr|s_f-LsY6>+As3t?@JCXv z-U44dNn)DfYmi<=T>}8P0LW0RIt>Et;ow3vD4c~H0#i%fl!)jnqN|#zn<2B8b9uv$ zy{n?#^nsj$*D5%T%VZVwl^~E5ry|kUsT|p5<`0%#`=ZIW=Nl{R6O%b8xwVv>=)zk- zBXrf(?)LVUb?WI}WW>#R5aJOSP-lXCPm;b=sZF;fm$AI~y+Q`^J%N-LB<$Kn7*vy_ z=-M~TbV^QOm^A1Efo1Qz04M+o4YjW?S(;?)B*`mIPEU#JMBvKVi8Do=1kYtp*?UQ`UNJBy zN8=B?7taKhGhU?2L>91RsvsdpHDGxqOFE+}1bh(zdxO!q3izpY0n;T3E{Vv$=6P8w$!)=kNQ13?D_OId3(&_@m%9kjc|gHbsgOX z%Avk-q$UAxhklLAfcEQi>7?N&d8eZi(klS68-{eXp;4+10j$b4`v-HDITlBX<-)HS zkgc*f64{0N)%;Rz%>RpzU?Y_1{t>yI_h<+t#411PPU-EP_mzc+-UvS!qT7c3SVj#$ zG(&uso*nY=B2YEB zdw%CeLimd0;YPOSfm9O}aW699GB|yLfJ1B5>QM&{t)axfLyOSfekni{uZqH8gP*9Y zgmsb>p{vg_CX2EF(!ftJf`vwF(oY&ytQ8UBPodI{5s=wO40x|p{4~6m{!RVfenBboLEYN zy1Gsw5nv??xL2B{6i8d-eplF6D`HL1VEz`4GZZ zuMgU7ZEflNQ*|R)%H;9-8fdI!3~)gZ-33yiW{u$b_YmU|G?Z`e-w2y@vNsmD zmL>!Q%eOdg5O67aC{o0e2cUVGiv1VvGU<(sxQKik(m@b+cd}Ctzi4*Q!)J2+AmVqV z@}0*OB-HJ@ea>Ag>OuC#A7fwHa$T1}s!25W+T5K9TS;B}+A1)nM1<%tW>#G=x<#`` z64XhmFWRUM41|LLV}ez&?sCMIV3~og@qCs4bHrt{vpp9eKVhqXF{8JG+VSS%0SC9P zoL;?^<59&n??5BA#+;ISW#uP-8kyDuy>8YiRvZ_64pgP$$aQp{#)9M9-9>z3e|jO? z7`;5RdWu1B8~7e_!Ry?-$OWV3pwSKIR_JF|wx#}cRiCh1)%^ zpM6MQ(iOmfW!g)dRm8a^^U`Q7k&e=C`*CU3YAX>{EgGaN(TNxFt)k|Gka;cjFPPG~ zV{73c6w@|p1af-0ezeRaH0k`j8A#&&ZJbqKs$smAA@BTee7P0_HZ|%yz%#o zTvZ9MA-DUc+vZwLp4$EtdD_SRuX#en7Q3ZT6U0Ue%MXPtYp96pnphqoN}BD>s{Acv zlzgMfxB}bnR9pQY*wtDp7-YR@)d&e?d0}%ISf;zizv3ykm690j&tt|Bad7h>qe^jB zGe(8Zw4)TJT$x0gam_6=1%uizXA`sSCBFT#7+#NufMz^^AXF9rN#78# z0UsMGYytV9URu9viLh=TW6%R61O9s!Y}|KO5}no{C51+R%BDvtTSu$Bf2r~jY1n62 zSGU*8a3br%LYDhT5?$zd`jcU}?~UhlaVqP_pk5@U&~xzNOGa&s7Rz{gROm@##HGbp z9ttw!1^_ZP(*h7HG6Z~sp~Z}L940Jwd$}t@04dh_Vq1Ka<7{~kq9d9nlU$0tc&j$E zmawZ9btW>;#rwa{bDwvzpWbYKr+gSzc#&cBD;~67OD9Vb=w*xnC2aMvd*nX3T*_+H z#EL86FsyPI&xe#C>VzX$R#bce6paDhD;**2chyi}c1B%zf8NtsCVDTBSW z0LQ6x-8hFHJiOI)yhVOpNRDest^9wYB*>b#c320cl&3R@+GFKO!vV#;%%o6jAl@xw};m z7`?qXqQ*)rk|gTg0H)2~N*}l%|MIhcOLd{E8+2E2yuWAu#oL<_E3rg!c<$&WFK-5p zB@I(froZnSFU3tHZu&(`_g^F0KOYQC==8wz1)1p9_A~p3{vX!fI;!fZ>l!7cq`L$` zrBgZtq?GP1L7Iby?o>cPLMa6#rMnMZ5`uII9J;$f`tIZNyze)@JI4L*{&&Vl zUVE*%=9~-iZGpbP$4UmL+h@jl?e?&LD&`|GQ_!*_83*4O_iW<&-|d{T<+kfbSj4$6 zcZEu=c3d8_nQ?*oq9&;l&IOtt2n`0H?C9gyf7OT}<4Atwz;=BF+7^M&f2s2WMF_8< z-w&i`bI+n^keQjO4C}9ElTQ&veOof{*Ziqj`lK!%)9C4jf%C^2_lMhY^cpB~TLL!K z-HT6>S3oT#X8&{aB8O6L0E5nGm|e zr3^_uv`?LH^u<;KutCa(ks|o+f$-j!+2S`0)&|ba^cPEjoP=Fx;7s~#!+?W8`D`;0 z3bq=tWa%4;Zt(6!fMNzr5?KbnW#H!g&h~INtgBx9eJ)=B03OZBy&nD#;!YoofNjv` zDAIIfbb!|5W0RG^Zp|^gHtg*4k5{wTcuY04I zB2bbnk3r69Bne`ojD7;E_9?=Ydk2i1x4i6JR1F zOoWn%$JzGmkc37V@g5;Po-O}*kGcQ3c3PJSF?+-dFa57T4?eeeRUG&pC~HdILnu^} zz(sZ#gP(T#;dp|cBmrVwFko3D8X?4NZOALV&6lfWhT!yHGPifg0kv=!a8+D7IEVqZ z78XF^xlHB&u2UKi(k7m*bVqdpHYTg1{l@Zg)_VVY(2Q-pzY_&)b=I~yU=z^m*m*Mo z4X0b)z_-sJ4$FbRZ+{pEeM()#5-4*8f~LkM2Mf5K9FuvYP#q!M4xgmJVSH zeMKPQe?pI35e)`7g8T@tLx>sC0IPYH{tNU0BIHz{&~Qh?Q%wIOvBF$^OU+@x=T-r< zwM1S3(yU5m!soU6jY&sG*W`aog+=tF4G?KQ3pttpP8B9bWS9T03QDd zWO#&Ns8e%G=kZU(&0v6+P@f`3_P;mNj<}g%2&QTeA>w8T-NQHjNnit4{`(S+NEb;F zH^&e3!iX+Dzi68qKtRE^`QPU7he!kz6S*tK%w~oV5)brshJY2h_!b-5Cgl7MR#zto zaHcSjJU<3zi`(Wq;|1>l)MEieMfv(wxyb<_DIj51Ljs&7@(c(Fp%sAEhu}0Luwca8 z_J$e6vO>G`zq_FXM1~o#r2hQ>wWJ>Jvd#bX5#I+)x^evo2GvXVZ8Q}KZA_88ZieS= zd#?_xC3y&=IFJV{H2z%djsNIT5Ft(3zVm6Zq$fhK=E*XI*r1X!T7jtDgig8+f_dO( zvccBrSgQr|8tr-jVP6{b&C&G`a;|u0briG#F!US+h`oV+TBN~si($JCGOJVF>T^*# zGk-|W*R}@&2Z5-&gI0+Fsi^xd_pXT2&>liVFY{pWd@v>K@P!C^xJ9G+n}Yd|bYoAI zE#<{=Y9 zwTaESb8PWb%WVE^Pw4WLiuFfd*!s7AL-E%$2alMnR{Af>C=7dXei;$z&n1G*_gDk0 zRf1pLQK^Q=fLF7{$%r@&$R$QYJ^>K_RhpPE5QUjvDC1&c60D5=1@#P&%%T!Kt=#wH z%9U+=6ZXpWY^&2y$u3Tfh6xB1dTc#jK1Zu_Ljh~SEm(Q|DR}3B%7`o^*V)+` zd_-)aXS~i#h~wck$wzkNl~Q0?8`-ts_Z_<*7h&$Uy*p>j z@8#AmHKNRxk0A@Fqf8v}vYDaUc?V`|Q;2y&W3#}JUV1PpvG?2ayuXGuK!UK0@|&Kt zq}TKMoCAR|*%1vp>@%pdHLS2ALfud7VS6(mbW&zDE4}#{PMi;Ba@#19myOw%@Q3fe zn#fb7Q$GW>KU&wo?ss7J{L%YtyB&BYsHVRl?bP??_zrNUtMiF_YQyexkZMMNf+pPm z(F@;?07IYg!D`=5KY!UR4J1O0`-`N-craczvkatWGNrFChUljR@>HyydU1bR(8DV0w~sN555cn_1&~H*bX2`fH+n zSUKD%2{a)vupjm)$ z7)HN=m;&#NQ5vB4VH{*DRkBVpNVVe>#NRD?p#t+XD0T?L#vlzWh1a&w(;q2xUUp#d z{pe(GsK60d8I&WuNH5R3`V;GJQRN<8iLp+m)CT#D4u}yDY^b3)VLFI+Gl;~K|Yc@Ts?7~EuI_6^UG~gg8|bEBwx&0 z`LQ{La{XA&*{!;uiioMO=)8Z2ogKHT1j6XYLu|c>m}E9U;NS*R%NQqLl{Er{l#sK0 zolH3(&Z<8V7a^*dK&amUy!_4HJdPJE2{(uBn)v0=hc)m4F`r%y^-SRVNp0rAFpg!U#Wy2@`m(mg-ykp+K>YxPH32b1k z!QLUOBA{f3SVZwfXp=0KpvDYE=-z%V0O%R2fvuvu+HyMku5}5dqhzh@m@2K6rDbJh znC@W{G^I$YD>@@Y2V;0l}vzsiRq>n z?Y9rIf*#@PIErU-DGnm!k2G(E74CGqN+uz;;(r4!1Fc(&rN8_U$$PGOVp=3LD=;Id zK|&nAd#mXduku;Z=_V?q_14j>J?eW0PXg=d&>V#Yj!%KHvHvBPbBR6I;6m-pr@uVL z%|97Dzt|`Y#Dp5GxLzc=&;#1tt0ce3Vwk z>i4i;>E1{-#`aWM3}`c~bcW$01ebvhIm8)HV}X%zG3!TJQMcVcJjf?hv;5M~NJnxN za;5d&&!|AY-vPL;=ue(58J6I@0TD4J@^>8YW~u@C=a*^Eqh)k3j2*9G>=%GXCwxU5 zhckk_AEly7NJuPAQlttPAxaB9 z&kYoI24f$;r-+_c#5Cbo0L z>U@7lSB^r4I6i_UjS$u-#eqQ}U8Tb8$SamaQv>M?W;vD^I%4l|Bgnz>Utb@~yew%0 zXL46k)3Jcvr28w=@h>Up_2|=#B__>Or(I}s&ivk|o97e^dVVwD*d?xb02@ep@_cY2 z#nN?NoK)}+OOoKn%77G3>8roLq9$G9e}BY=iyS`!o*Dt7&6pNN^=o3lB2%DeU)~MYLidtV|y3G}uCb-xDBM zUtf>4nFmy`dgW$PvC3JE-fw|)bu}*TF|tngC^#WQ4Cxa-+b?HIhYe>+WBg7NpVf2w zpB|~@D%myAyDwXti|7kQC03tybCjr>A<}EhZZ{ zV#A(JO}jK&FCNW3_dIUJfhwj^0;0ZrivsOuAxoW_=5zYRIkwbk9&~)iM?F;-y0IdP zPCxqf$?E%SyOy+3Wxr+O94yQ}>$vFVdCN7acex-lOZ#a4MF=3&FKxAM9PJMf!y0nr zMuEEuOpfb`a-3!vXSz@rqN?k8al(oyI}wf|_M#m1Oge2kh>vVf>*)|H>*2qZ6?%3= z1**b-);9x;)opuobuqEF+KLrFAlh=lslqi|9VeoCzAl1;VvSgI_dUJoPjIjst)=mY zyk8MKFRd-~_T37>UpHBZ*7Tn`x*8LWSN?{PFt#c$9WzSdzOQ-%?4=u4^P{i}PQnFR zB4!;gh^r(A8&@l-#qIcNxST1C{e9?k=EOe~mFaB2v@ngV~XWqY$xoaQq zr~b_9Nc5Y1g#XpT{YgMDs5BVu;+gfd{pro+A|G!%+$~^LSd)_ay=HXQ5&yf%Feu&{ zQj9g4VN@taZ#MF@!A*r7$QLMe1+sUrzR%8-c_o`EW!6fqGe0l(d-PdxH)0kemRU!P zopVfAV9Mvm24e|NNF=pY(r#(uXA?9dQ?0asGKp4ct0}GguObp6mSy2TuotP|e8)G~ z4_`E*Wn0ZXU^w0vwh05}fp^ww;nO}w6%#iu7%J*rJq4wi1@a=wZ z1b5ZBThtxsANf?5T?swWrtvAE^vOKFnf5*)Da>WTJlN$QzwAZ5Y)leY7x~0FE@$=r zRP=f`(X*sCG{mtQUsyv|6q0wE7zes@Q>xu(-UniA)TT5$?i zo@tv5@n#3fzs_#mNerC*exYhnbL=Y)Dm`=g$Z+g}W0o?foOnOQXrSd?yxi+njAfBx zZC<-XZ_-$=&~M5$@ytZh=sV#H7-e7fO6Gq<)!dM1QZ=bXQLLM;nu-W9-(6R{rZd&s zJ_j12d?tFT@FYQ(7@zq{}rd8wVUjWDwGI#);={8-ysj z_T$6N7wHlKj{rv%ca%eTIvS+!pbU})K3fwnq{jq$>60G<;(1}qzh;x3di4(+@vZY! z-Y8H>q0z;u@K|({sMG_WnFqGYgU#SqsK!qe9P5>n`3Ub3_9ZCO2=WKu0#dqJ_ySVz zO!bH#SyrURmd+-xF$^jd_zqCNgJNRvk2i+6j3R9DLNlfTRv~MgEU~4E#6NJbJyB$C z41m}#bH|JTG?9U#vv-11b(=H}f7xUV;W!?W!6as4xk=CgPXLo(M)3}YnqG86HmN2jM-nr^{t1Y@FaWQeD0(|vE{f=^TB6jbJ{XV#u*EmC zu<`Nnoq}EgJxW(owcFO$`RvUs0)rD^!63s^Uo&={nUs_SElhxH-T)*oW6E3s=$fU# z_|Bh4Ad@5HG7%g8Uen-l5Ph)FY5^pWQk>_lARYZm*L*%k+fivf#L0Jle*Qpsfcn|q zwZ`%4FDdeRAfQA7wSQn<9utCm06HU~DYIouzL)TG1X8p+-UgY+rX>+_!y{_&$>@wX z1kzx;*f}5Q30fj9$Kzv{1l#wDVPx%q#(=aN`V03^D#$S^M?_p_C6593EFw*!DY^!* zAZyZNOkRBVTrI$!`e{qzG3V9iS)!J`!ca3vl`}AhGpk;?1dY$9qxf6z>?&M4IBqw>;`MtPo_zLijX4;;~TxLR;m>6zg+f#-DCk=TZq44bDXQ^E_ zx{%1pww0@J>3a#>LaZrmXVa%)BYHSR;mZR0MP?%d#&+7lE*Dc2F~_r4%Yi74$-&RC zFd^0Ne%M^>Cb_-Jl8jvc0t7V$;`GC?u6Cymo-?bJ3>8Z>fen)bj?jQvyXVV2u7o|U z>4u@1*ni**F6e(-d~$`0t#v{C&Tp@0@mWZtSy@Z`yO#F^fqZFsrv{vwTs zk7_EN`8H3}tBrA68qXQPe%cwUVEsvRx6FQ{?WE#Z*<-Jah4O-`r1%$mbwy+#!_fHm za1?9;Tb9>hhJ_om4o@|D6zvMIs(ozqgp*P*I9XNdd21wiDNo+*#^!m)pnXl(H7c%w z=J`I-Qc5sIYQUeD(43_y5Ppqxa(tOhcH@yjJG*oEguSU=Q}TE$a>rk_=FHl7E_kpf zFWYRiSjbrL(4%}j(M0HKmDeg^Ggor_+UaIX8}i&qiT*0FuN5a>>{aIHPq8R3hbjrzUqw|`t4zUv`^o#%tNobV>CF{<_vy ziMy*EuJIB>asU~SZh&N4sx$P;7wN3Ttzd672M6JG&5YPx~HYM<@(zQXHfRJs)urBqXtv*D_LCZA>Vs zxWvdBqf1Fh0$2)h@1c1r-~XvKe)dvoh=^-EixPI-R6~ArIGzpx zJ_rB9c1w*=>Htb9KT)VHRWHqg^%Cu`IJTejou<@QE>7bZfVgo>r z+>zaYq}S~i@HCrJM0tfnKG{l;f~4QD8EB%3OI))xUB!gyo)Zb&TuYYhw<;`plv+Y< zXH}B#W4aS{lWAJOpU=?4Ml@!Icn-*6s(dGWVem z@X88muE` z%wo>E-E~~)fD~YgQca59hi@M^i*V-5C>x|oz51nF!MM!Uw%=*U1ob~~SQ@4V)}yZ9 zZwYuTdg6>vvWXG!3b6w(7s31JS$$N2T9%hQ^5e$2;t` zB!{`BQYcB}`}EW;GF!z-SSU zatdkskiso|K~&BnwQ>|Po2|N^0S$3rqQea`B=7oMor>~IlRb&oI?+z8oL81P_1Cy5D@Ce`1@ELo{Pq6uKI5 zy|)n2S$Q#1uv~BO+?Wu3m*#O}#oxcDoor7`=U)juZMCbH@{3Nf7gBX{JAWY}tChKN z--}YB&StFs#AT#@l+ylM*{P)YNAcEjWTTCrXK?;YZU;C;1tF6G`%OG^Nv~lR?5gkB zQFtdSdU-}^&F4{S*9XO&pHy2HuDUfm+uSn?bbY(|Lbp0vMtZ-n>I0XxzRO(t)mrU> zhKBP?)MGwb+^*(}l*%6JJCBE&obL!^a~IvGRjw(B783*Ay;Vl+$%1}qM!1vEUsT1E z@odZpOgMRlq7ZxNq}EyTqQf0E;r{mfz-IE4N~o!g>lHcIw`H0eiPIPSy7;*hD0Qpn z-`y=;c<{aVzN!5X?;S}@+woH!&^_;ve^?SyQ{px7vY0pt zoE0^fIuv?VtK}t0>(hzUEFlbnodz{_;oGaH@<_U%W5#1WNVCKV1LY*WvER*KLcp}s z2^s=q!9e(>4c;n>Jtrd0`M*bnBl;X@6B?rpe-+BZk6&Xrw++NG;bYd87&q3!KK>>k z%5Fe&`urds48;Mi)Mp3hk7xPpCm-?&pa9KLmT?VZk9be8{^$#8j;lfZ+CQILLR~~Z!DS6l*Wfz+31h}I9GR+ng{}U# z5f3SOKTg@Bh+y^cKY)KR+|7`BFQe)0_hd?|K`79u738OECUKa)Pnit%?2W(=xczTD zN1{_(vF=>m+|UO;_q`o`SryM@O1{>Gb2{@HuL`YIVKbidNk+w{IfmC!5X+*@b+Q6^ z=CBV6aw}g9U|Q$z*SI<<0B&JdHKx!r4?_h2{}Xfb*uFaCZZC=NMgKmJ!#sk{xVo;W zvKqf>PK@HtGIC>+2979axx5Ps1+?Q)bn0p@fJe83wh44^hF{%kld8&giuN$OdJA^kXG{zyX+I08@;?41(XT_ zgy~@zzT1_Y57}JYY*-S?y~%rv3-#H!aaT(pvFMhYwpt;{7dU*sd0$G?X3FTs?bJ`m z^qIHnPMg@A;EvE1k$R0fa&UbDv2Pb)`|D1W*l3CV5G}le~&Smw*TPU?tkoUcLyndbW%< zQ-Rysjbac-%3D^pzG}Qw1Dj9STa%k^=MT~6{L>IQ(}$f;$X;<=B|Vqqb)TQBKR6v4 z(>r}F@gt=$bM{$+?NZHd_~_E7Q*Pk^_bMGIchJmP$}f?ON&ND3 zadP~TS}V|IPia#GUp>0w)YF(M#BNjav1hRjntgK_(9Yc@uA7_3G1(>_?UcdyV~DYU zQYzddq1baSf87wz%>9Fq+0r(d1D|E&2uVB6o7KV=>%FL!;{yisBB ztGC_M121Dbh=)GV!-9VDzVtBBqhq7r1BQ^Or}ll1&3AR5!;+x*KEnwoMn*QM}}0hWNjtq z7shx>1pW)HZe>w}Fot>EE|*ti(jx|GaEf zPI~NjvuZ~vE_HXlMD>+mv;~;~g;s~r_&zXclX8?*xdc0! zxSWZ$UnZ7yE;OaPOs6CnI+$QN)AJvA9S;wxXr=*bM_HGKTcNoZsb9z(8k|-_M`nGf zUz(3c!-KH6v#S9K%<0_Wm_mo5>ILcGMxzAIHK{>vO&Zro*%s#sMsNy)H-q%WOd6H zrfDw1k1qu3>+AMH`h5H)995z>gl&nw1f-F07-;b!PrZ?Jz%*E#oGef$S^S47@nZi$ zwW}aJKVIXZ>M;`fO~$MyiIfv4gS=~xx~NW5r$!cQ1+<$lk?UR!r3zQ&Pd58_Bm=MR zTCCt~0eYPe;OUGZLLbcry<`a{H1Yd$>*$Gl+l$?4X(*CBH>#uT<24M);t%#~iuAnr zisFl8Jz8zKfyO+8fGDRn`r|;EhG#GsopfDUSm$DUB2r9D4AX59`_t1wL!f+~a+d~R z9{GMPl%Si(fEwB)Z#Y}`j(o!alJ*E1`QlIm&1?q9o3Jp2fJn-YzpXpa6PX4z?fmFS z{iJ&1=`JzCuj~Zs-!9V43q&l)az)>0!UeF+=8fGBgt}4d?pXwP$S&BPxs#QkauD6r zDnCwN^JDfqAIiV|DY13oChZn9dnt}Hd}~Oazg_o8t08)=%4nu}D4@q-rv66?v~`bn zNzKD5>30YJ6yc)IY&wL-u|abtj|ehxP?3n8$nT+B z4tYP7U5Y3x=jvBJ{}X-vqq79slXw;x(cRbjaNRa^hF!Ti)-N5JmDw#(4!1incKf`wWyS z1>*Pvq)xET21{0k$S|*I11Dhh*yh~%ye5q^Wu(;`Wy@wlrVi&wbV*Tr$k=` z_mo|v;T&GqV^}DP9OEW(-Bj8<8D~weVDLV&{DrUsa(GQ!2~C*mnjG~^#)U@#y5k;g zRrMZJ>;ZyJ_Au3Te)W)bvCrNG-ue8hm6t|qNh1PDepg{M-#^7s?M5g8gpAPplhf1c0iqqG z^6qF_HX|Yk&WF5Gh@qax0~qeZhgz9AKntiAMa3@@N8|vS*ThR>tKL%hFj-+C-j^6{ z6@hOpWB2O<2ax>Qk=1ePkOxsdT2jO3=6=o28cI62Y#5YUKZWA7f#T1;R@?JCSgl#H zDCdC&4x!Dy98er)Hy}G7ud&y?T8&f12@s@wG!$!0*kD$DoAHM++Om8*q*(TFqXjh9J> z(VIbs_w)4~wGYeWA)t|nUb+940;bd2*ZR(6?57Tvj6D>loK(WiLANe9HFW*OaAirW zWl8Pxg-(5tV5_{px2I^JotuGVSE1`Ly5j$xBBCD^x-{zPFrHv{`y=n?f!49t~>m zS~cIq&-u>~TkVX!9=#FOM&nsVB_(!Y*Bz#aqN!tr z7?jQ+D*?N$5Ir6<)ee8*F0$|~r`!uuRfaZ~@PJyeru(xZ9v!^68Sh_7afhmK zji0Iv%gXLCS!c+tnsps#w%tjS(Y!NPGcYvA8rxc@W?{*1AWlqF#sB#3HowDkeTFS0 z8RZ^BqLSh*S<23oRNDs8mlc%!Q$+$Lm%?f76VVH`l=yPi|88HZrQO>0W95C+&5h{i zVsz;mvn^S4hg%tBC(E|KaF+z~Yb+zpm9A*EDjI{10)aCPkBanp$eye%pUMwB{tS|i z>|huC($PD^Jev)-fEnL2{Gvh}w$mSY=ypZ6GmtSCSOWUH5AYld4^B*`@h~pw&7&Ox zY+vuNNuznT2phN0Z6)90D)bkY&>ek9ZDk&rx+bQW)i_k!Kk+gamfSm;%917Z(O=st zd9_H!?bWiH81}7pEw-+r8~XWE{inL##r)&zgx~Zuo+@1TL(->`7=9Q!fPKv zeHJHe3(F^XRkHn7{?0{eIj`Vn*$j%q02WJC@@6+K_&_FH;x z_X(7{K7dV#5OgTlz9Q^b)F*Q2*ciD!-O7fTL@9bI`9CnWlJvOLzle<`PyqDaUND`L z6WJ;>?Ju8j@cG!r-+0d^&m)@!aYm?jx~3 zj^a%ZgOdb|u;9zS81e=m0LZVA%$G>6EF1g_Kdo*l^=u{#<$`=CZDIwcmK~Q;{wc8~QR{ z7wP(eC|pE1Y7nVz<4#XH#kxA%)S1`zJqC^xX9mX~iJmCr;=o_D z_(WNG3@jaP{)pU%?|Y&DwqK2ieBj}I7jqMkvPA&BK1k6u_YJF4sum@C;JDXE%mM73 zqY}sZsJs3{eMO`UZ`33^YMF*ov)R8r=Y>)~z^%sy&kbgR>?8QWctP|6JVSAGqf4~~ z!bLK?r0jXANVS6ols#PGb(RmQXO_BG6;N@)Bnf-Yy_|KQ?mq2CMc7csQ+_ok|KAmb zIn0PlQrbG+#Dqp3LlbCy$DhX=<{Nf1p!_V3pFXD4iI)ZWK#iarEZ)jwS_yVmTFM)n zyjG&5nxNXkWN40j6g{5)I%kZ$+|}k7#BA#gq=8U!*zGfU{TU4xt$aeqtDYn(X1p#r zJXkF$7~e!=aGx(|EZLh-drqdt-giCuU2ct+thSIU@%EKK`RWaxU0pzB0!|s)tDU!8 z(yhMy24tj)lKH5&{<+42HzlJv`y40QZWK-8G&kga74?ls?)Z}_Rud+Ax@k?`a*=oQ zD$RI9nkk-#-vx7&Vzr7>q{;-P_eU-;^00cWYmmQxd<3`v=tbP5INCdtqswv5H`%!Zt$c231FPk#@mzP%Nxi?ra>33ygoU{8sy@#u=<85U% z36sE=Gz|$3L}fL4PidOLq2GKotF%noi2qWP7ZqGCml6v)Qex3XO0T+Vh&?o>Vl+FttAuLb1518WhDaSq`*3^!)15SZ_a@F(h_C zebayPdXX$$VxiJ9vX-I;0q91sn7QANo3wC1Bb5&T%naDIszMXX6k*(NdkLt3=!Fzk zh5_$uIFIH4ks-5CyC}ll$wBcOZ_Z3!v$u(f$#}jxV-iZ;j78ydldqlynLsz=3Rt-n z#@-Ty$Z!$fmLx7y4d55vMNrKNv)af3c6?Y&-VYqlthl^?@IZHdo1QfagPg?gWE)-i zAT`KDJmBSia}#sG)`QixkyuWev)rN9ZIy{xJ;%G-7DwhwN176(@`aHp#|dCLJR-pqDI-^cFF9w_2L67A7!SYb^mXj4$8V$T>=UL z5=EAi%6~&S)BofO9Y?Ftc!hmDMcoM-lPdenkjAd8!>X3clQX3Lf#}(5SuEnb9|??X zkzx-VwJ9x>J_OBDJfCRF1f;hAveC`tkvSY9&4CPuFtQ3D4~yBX;2b`br={>1#Fo+c zpPlF!akuYMJYG;y(i%v7ba__9p`%uamgp14TzzuIQ+Qd_rH$HFARadS(}@^Ua5m|_ zCF?`v&c_!>(kKz*I2B}C{J48{H)R8lRvvqmgAkq10Kl7dAL96G>k_%-5i2uVy_u6Gw z_=E@98zX;Qt8k~qypBYZ<#+D?En)bLscoA*P&is)DamUEN<~F@<5pYU-_ae@o4ur7 z``^h`*A$(j6(-hvaBMu54Sa1WqMn`=B}*y3sMDw#Rz0f_zGCnw(T@6dM=ImkW5fjP z4FMVC^SBn&^RR@Q#E2i2Fe=*}+m)KiBqGRjXpwfvN+^Pw!Hf$84|3SB*iba5X!;0Q=Q7zEs(@&GqUL_;|q zOVQXma27N_N5P(YiEL(NM*P4U4bJcm$fQx6yRF;7*vi+VghYd2tG}{Qud-6sdh9D_ zG_<7imQ@1U7n03^f?D_T!QC75tPm8d3)Q`~9q?vVQZtC2vft;`d!0N3eIW&!mBVGU z3|%m6F*5~J&*Tiyhrrr|omRy4m98n)Aj1jR?<7nrG*mz=*X}i8(hS&*RG`hg>F3~9q5L>TaLwm?s0508#A?IsGtVJ5Vn-<%MWkjMnuu0=i-8l22m zf6r^#C&QxgBLkS_5MD)KF1iDY{0}Ge!IQ|wqE9|y_%R}(acXuuFZ|wZ`q@^Z)3r%y zy*Sy`#^IiFYyV)3E~Q(elwqPkXCs6!&t9cM(Cw?ML68jx9*TDx2Q~;0pVPz}lug}I z<-3a9iOzoe*ACuA57OwVcq#fzM_oJOY15=MW#~#Z1ndNZB)iK0w~Fe%ao%nSt9pN? zPw|Y;^#OJAFmKB%i^WNWWQvN8Hpr*1R`aj^PnKPt9SHVw7Gght`v2I^62$=Ys@gEn zm4D^AHGSO3 zx84P#y8fkYfx|Vc?EA-04b-3}7fv)9~f zMso`B)CEG?()bXhw_paZ{O46*D0mWNTfJBY>7&v5QG>nfKz&84&s;l)2`fn`ss6*| zu=A$59K~VffMWIom`vMIabat1H{g7PiP%fH7e*FTue4SndH`sI;x~9IEbNpnNOC`blQ{<2dz9G6vt)^ zRIGtg0O}Tm^I`dAwShszEXED4S;ZfukG>s%hTwJ!UoG$mIx4V3QvLg|7EKxqqfiFy z4#HB{-i-cWfH&&qa3(5;Nz+$sQdSx8M^f1iP2Dp5Z|lrZoLH60Z93T)id3y-#LF)P^6QtgK&uDn~35I6D8QrCv~e zX5jR#rq3l<;ffJ1zIr zl?ODS3-iRI2$3nJ)zfQv%RKpgOhHXJ0IQDD!}h&OuM!tpfkxKS&9}UCY1|;3BVnHX zdiSC!t&$X)t<%XNi2L~s8r)mep0zJ;@DvMqIEq*>%|`ytNa8?oit8rxM^Bzc%^lO1 z7{_###-wu+CysHp9i!6)1?p!L#6?zkb+OjIF8u?O*vfLOrS+478=Uv`-zTH$;5O!q zI;=DxfS<=hcdKAP~DSudzJCyPeCXgu-6`EfufdmN=3ATh zt`joJ=VSXPgSRh@@l?oTx8ENKXry`^GW7}Ll)XN5Ho3eXxll;Kyyr8O68>UI;3V(A zi(Hrgjt`^v+Stjq1O$#O*PKh|z5=0SJLy@!xZacCF4PL^ow;)v1M~y1;c~mN$&M{5ce!b^KW<}8(e*nW@@H+Y!@ncYS?YTj~wDJzhuCA%m z8|8FULw+r>&1t{B>a2o40gq~ra{pAAhp}cSK@Ykt6dH>&d#Ow+`H>qYa16p`H6s|g zyFWqK??_3RUra+^_$5B8Gq~;DYt7%y-8c8U7ks4kc+A@F5yNc^dlnWGM>;Vs4%EKv zUA4s3Uj-`X-@t;NJejlNDy3t=Hq(ukdGQyAbeLgvCI(mkrECkCYgdChCJuB~#wpjN zY?o0#?nie2K%&Nt(BzP8Zt9F=GyV{{v0co2#P$-LtL$F>lfTh-ecoD!eFING8e>GX zmGNM2(`}o$<6U6yhAFQY|I&2D&?eno;5~Fd|N2y9E&VHEMk3FyCiB^Ts9FXSH&lTuFX>vf1hfVH z3C61;Aa!C;M0t1qVxbiBegz@L@FL}I46x%`z=S1m=`DVJ2+;W^LPj|P8VAeR9%eAa zYkQmp#W%bhOzb%O^K@qs9R*g_fm;h$)YWD|=y#(2H!$p&!E^~zp=p4}EdL2}!A0pN zp`l@4{>vkh7}~W&7TpL$G=v*`%`1%Xxr#Xot~PU3Rn=rMFW#k_u)q^-AoP-7lM`%h?LbAp4TbIBq@k*-!1)%ZQtQr_p ze1q(mBB1?OvTJRAVZqdhxOWh!U6@nHo%SgawliV4=&_8r)JFkqm@vr}xbqaWnP)vng_AGEMk9dlpU@W|@gt&Nt)A;i3&yX8q*i z@r)jkzSKOv+dQ~XgR40;Ui`qW=f)GeiGG${h?*2ZN0)=7hq)*DruD*AX)S{@LlESaS7WKLF(J zCjP#0$E6i8g_#ZuX!VDxryZL^vl^yr&v%d}9yR&CbQyHaY41t=*hHFet=aFZEo;;f zp%=uqQ~m{XZz#=v7UT(z7F;7|(fI!cu6hfsfo*+O9p8u`f5*SQ(vLGpZCHFU>pbL% zTr=^@By_QX_5DS{`_&fv4|>K%nRUFitnu{GUHYB+o{$!l1BGEST%BJ=pL|==o-{h! z*gk;Iq@b3hL9vVt3b?@Gr_t6wMk0|Ue*MCpSQEC(P9nw!xGWBON-F@zmeA+KkAk$m8g@Azd&awOeQ8b9$ zypUb(^e=v*nFFrjq8nBnEY*5NFukC{K%EQVYYg7*0)f-O9f<)~q!mOi2;G%ygE_DEK3@L&xku*bQasLAV#iG+>!V6^BV|H>8D{xmQ8VKGAs##^ z(8wVgTmg)WY_Ajc)D$4EtZ!_@5hAgW4_xso_bWeUi=%-K=Z1c&ZeJn?TlJUy z8fJi)Fwkr=46f)SV9Q0`a|1kn3s*Y(S%#G#RGoaOYTFAZX3CcdC#tre;sj6%WHp#DXI?}{_e)5MHEE>z0NPuCPuN>|{T$J(g{EY5m1O(_yyV1+FT=5U-UKoKj z^h5;!tdOxL#|)&qbs&x+=wTLSZ!4L^B3rbZnhxqn&^ZS=6vKVS6thUV|5tWa`WdDR z_5h_xfQ+dU&;Z_Pi$b6MM;N9CR5C$@&32Yw*j7X#U*YugV7KAK$C>`atMs%zSc{hCqBv zSSD=W%GlPA%SEzcov+qaG>_J?rZmSUz-!HaoOR(kjI>hKNAdY0nOoF4lGpvU1>S(r zN|a6hFvB}igB&4TMqi~xvRl&t?=Wl@HO6(?6X(Ja-=$va$y-bagUy^_#l114f+2o~ z-N<3C_7n`sI8A49vTHcpy!AVvt?6M=`IT-+Rdd3&GX;O;ra{-b_2hbFKQ(m z$54y#GkNgoAjW%abIfDEmbZB`bWlg_DhXT2SB)j?u(O?#?*i^ajJLO7{yx?8OC3rV z!v}PjthkS#1)iegO}m{#J|n8xEq~Gll?WV#Xr9bdh77+345Gr--ZXxx7ig$Od%rwW@+nq%oxz-ljH0{~yT!inWcP-Ed$)~ZfXfqqDMS8{C-U>ww?`1p^B(E3UU zVUut0E#AhPYA{66*hxIlZy6ZrbrjIjKE?~A#Ji*r#OMLE^K*%{2?r)=y};SJKHO5_ zIcGx2>Eo!-&nd^M)K8$-`Z?}e8$LTYhViK7jn=ZJ4L-N2wNwd(b8#*CQ!!td35p>w z|M?_$_PfuH7%dV6Yn(cfg*9mmaQBPioA3x7N7WipF0CR3rum40ZngR=)bZ2j7`k7E zj^|HzM%?J+fNV(SEir1NOeK%Yfm3XSg8tJ{kINGsAfE#l#CT z1TDT8`%mLz8vUN%E9U4ga#2cs^XW_$b#@%FE_%MZbr)&0TTV(}!W(+Fa9LL)lwjKD zTr-~<{0+Fqtw%o7{XMNkl8TwDmy9tL&pxKa!TD3+5E>jG05L>-cwo389tZs<+~c#8UfwD%c5;UjCF5fAs7YaGv57&>wfYq`(T2=C z4&SRDFTIZquPHh`eV-(LJO9UT;<8VvWJN(_mj$F$GSbwz&;p1l{hlo2OFKAmFAmY` zD7B_D;et8jnaO2i5B!a)j-+b?bDLY@h=nKDiPdsS^oT8Vkdee6#-4s-c_H7ZZ~;+w zyWdBhb!Z{SM}hLw?4)ns3i5^f-Cz^#D>|-%?|GR0C;v4*-h~@2tV4^}-IThiDf z3Gh`Xs+IgwAN}wPMqj|a(kq0uxI9+I;IcY;>-sX&30%vL8kEx-`^$<_Dy+L!gZ3iq zHeYo$DK*X;?^n0Q+n(9r#nP;&NAy<^%@){9QjV@+*E#;?)_N6&6*GGUPfw;9D-;b- z$S0VaM|!=|J6lfLEeQ(|v8k7n+J!oEQTv^|{C7KoJl=kv@l86p&50&CewlvG5g$2> z)F4ue6HqMg>lM^Xo@4#Lo0zy$-&n(8dyF0gT()*=e&&0OHc^Cfs={fnH&wwo51_?CT zirCm#4YhpI^DtK`x;E8tTZlcmZ4-S_5*Sb1j?@-@5xmhSj%!KSA33M)VK?++F~Y*d zmmQqc-rq&0I!0WeKt+fri7KH-XJ)b_Po_3+tb?>+arCVFPh8yJu$@A`+1UU00K-1S1wXJBPo%Lr?1;U!qL}XCrSle!=GZJk4qf+SUm6&*_qwV1y}qv;CTB zJL0S&#n0<93UH$PL-%+5Cc}oY?8}6+zUD*{oC_IzG3neZutJ5lnvyep`Xg#2R5Q?c zAu2pX*>{U82yK$as3zW@=a>B}Dc8V{jJ2(vynkt$e$Tks#FK)2Y50uH>*YrEhq2bV zEgo``iWkg2`eq^xYNa0B?+hXq2*dl{_2uaP`g^H@em=^tc3*F7hn$h7Iq0*IE3;J^ z(){fHbSr#0kN*5|M9cWp9lsZ!4Rq^XoO!BF{!tvT533J6#Hp3s&dJ;c^2*N`3m&Xt zx<#>Ld|l&qf1H2d>Sdk1Z5y6Txb|GgUaQSyCO^EjfIB8I=!{JvvhPPN+ledI)Xrh? zOAhYUC0#!YqqY%y3zF2Q7Km%AG*X;aiia2NiBzcEKRDfTI*O*{j$Tn-y)X9h+vc26 zqTwh0z(>X-qQPPlXHzV2f*?=Wj0W+cQ%nSIlp3-2YXq9YE05+Qp|rZ!rWnAei5zir zW8$LkpR-{z5}Z5t3Jgt4LnGEN@uORqGJCFSYKouK?S8bH1*=8;kCoG&E8cvn8*!HB7lOJox&i#_y3P?ie#<6k04V zc!r)lD8@R@V;eL!GiIa{sS@uF$=L}lxS-O|KzbKe%iZgpA_Tw%;<(V}JDixH|5Ml- z7hxSci#q%g*gxoC9g2p;Jt>S3Cd}Iuw6KKztA#&He!fy~q|4aPfiX@7f_fKO+nC#{ z55D!eAS@>hJjE9jliLd?{$;|ZsH@9Q#h&4Y$+fMS|3^CD1}%ypQbQ0)52D)Za0< z9tX?bF~#B?qN$0=%O5ZbAD9Slj7hl!2V#tkI&+>95VVcd!ZyQdi=Oj^nmHjqV`n$) zkyDqA>tlhy_Nv7=XVNcz7m%sjuyMWsB(Wa@!=%XEkvQa%M7rOsV*}iO`_VVAcxrBDw|q#_MPA253uth#3`=0 zpOoDG=KSk>*}c)h<+_PEN!hWf(CoH_9^nUjZ@*USU}wh6G;>`0RZ`?NAz*PgW#u-8 ziPH)s#RB(rDwxK@RY%&I9h{52r%zF;{nvcC zd%Eou)Nx=@iad;CW=Bx*X-zln{}BXK50h1@{Qym;5LhZ)t6iW)4vd#m*xp#As4_D% zbGX*d$gtH%Lh#{mFISA-76mZ$==vd&e(fd6oXXSe?3tg@yHC$mJPYd>lk zlCeZp-+m667t}Xzs7--+L~cEznaJt%Tv2TLyU>*~zca)4|0q@%^nGK^BVjeVJveyb z&Eu=Hx%@u|N4DghM(B;RS>HxeOy(ZF4eACS3x3tRNor2aZO~FZL(KdT9IuTt`0de_ zwwzN8zAfpmVYw}g*ROpqkcNTM2dkqcTbm0i;S5qOKjk63@R>BdfU5aZZ``E^y{Lh) zOj}y_<3o{=(mQFegj)d)H4oDJFO(!tU<)tX))1_@(b!8zVPv9URl@ z3k_q;B*8!EKl>HpE*RNMFtWboMVTrD{|z`Lx=VS_gar^3jte)Bde2VXsGS^Szzh9+ z_0P#mF}{nM@%8we4&m>#c~$TW(;M`WT&vIX(2fxrtSV0Znb(?aL}zu0DC)PqpS2?t zzagi!l)XtKmAmWojV5^^vbU)1eXQr!;Y>=RsEmMe?%^CJmA(upjS&_8zk;NKw_@8i6FJ@xbJvDPdrq&e~h-W??z_xMSXo z_=?k={~{>dblA*FQTtX1lmwqyC--y{blKwUhB&^<^quxt!kmit9ki>D%Mxy%;D6_s zjL2}4EBUo~|4t5EiPBF=Mp2`fUU|Czahz}UWLT3-B2mjZjTp$R-t$hot#b^Z=pDFYabje~KMK#@J zdU4~_%YqV}^}YJPYJHlRna!Myc{%h)FkET=hJw^n)C~T@=}F?ietNGL|5~f?y1z;} zVw9lRr1?4Qw2=YDlWdp-H?nRqx{9!ejEyhd4&*l}3rzqs!pT1vQkVJ^gim&3!G;Xf z+it)r%S%6IfVBScp3{^x_I<%8i-^Ff4c0+um9?CelwQ*(a5%`SIyz^(`k2DH5xrR~ zorn=1;o!d|{(rTt9dGz=bku$ihjA?AQZ@kn8!{AV+71S7`=2}){ym?3AbpUqKgQ_& z%VCnxPG391#|7#+ALo9f`A2^Zu4LeKjM(Y5fZ&7S2JuMs+j0S)MPf=W*sNn|9x&f|MD6_R+tI-RVz#tZ^ z%a!c7`WXbW@|WrOF_U9w?W6vj|8N&a6-;kbmhl5giJ$E8E zl2=#9${v6weIoq-D}!HNDJ9&8U-4~7n21*BoU<51A@kxv4}(iPO^mvA0JYu5NS4t;eLnhIn+zi|0=hQR% znU-77%BU(_`uS6BdU{&-!9)@)lluhAfaSCl74cYaJx_$5%?*%s8ljx4rw2Z=6?*i; z&vt`iKX3R;O&RghsmjqQ%Sd`ylQG-O$ks{U--wTo@8M)^2@2-t?B*927aw8co~KiU z3x26-HvFXg5?0Ht1h%L!G0|v{aJ(H(&MBJ#i0cr{RLF@}o}ka-)Oxo0VPA8#oj;LP zu^db2q1wY3N}O-Bdk}1d0ot%NTIkVx!I+T$yyNZ*IH3cXg~boqp@`BZA^3NXAD5aa zPB~DrL4U9EC3A3{?{1sHG|Vt;Va6nSwqGhmSTIhUlY=Ad@bHk1%Rw72mY41kX!fXp zGJ*hC_p%T{*JJd~2^JRC$w`EJ-sXQR%YS6xOp(8(?O|B9*U*wiE!%4M3mjh$vZ;-sYsceXnktRu$kNtUB=J-$AAE~A3=CSqdqY&ctwV&_QysRD8zdW0f z{5?!|8ztO{`+G|A?R(PHbmWb|w%D`k!SZqjDx{3q|Gpfh(J0FUBuJmjoW=zXyv=?b%A*g0AWXaALbQ%fpfo>i4m<>hQY!_E*<63(mOW7898Af z)u#yhtlIIQSEvHy`jH(_;JgG|RBlgl>lVk3nRvd}6k4p;GxgRP1&%v#hvGr8`dJL_ z?{1(7ysN<&omR?)a=pakN>(rP2JDRJ z%Mhy@F4R%MnDgtXR=4#`7Ue|6vqTqIpb&O>K5c?{7X#0!4MxNaS$TO%WRD%Ht=VjN zyids7+~@w(cP9S9t{xF_x%QG6{Hq7$Y|`y^`fhx*3J4Zy%omAF+oZXX^lw>546V2? zl|KjPHw^QreCvA38@-&t*LtWmQESHyD$2S*8xW4 zKEJ-nDZx?-qiwv$=3!|}X7(e6NvhAUaef@RyT^jQji5vAaGKn^7=rW?DNt{>qc*u> zOM3dqSornIegQ^$O8oTrsrb8}g9G05I;$^~!G{AhkK7Uyoph0od@sFue08L>y&+0lhzSgBo@lFnpf#|Q)$9X&N+~$QU4;Hit_IW(d57E~0Y}lr1E4Lv~kC7YQ`gi`}SU7b}D8)8Aj5To9 zyEKZqBQPfu#EWe`_xi)PPRet%@(30)891ec2qQw~%Re+6R}n01Pw^1sQ}VLHRdIh` zBnxU38DLc|=`h{22~M^b6cXpbs|Y-rS1d5BDTL5B5pV*HBP)=OgXRiJk|an!YgL#J z$HNTBSTaNbgI9HRXZRh!Pw8Ak);fLb;%DF1b`kOA#r)&C4s(m9Q$HQT%9Y z2objdcY_sGZ~vuI?n%d6EkTeBPJq%ab)cua`oWMTXhvz37z+Bco2ymsVsws*VL`i5sIQ`ms8wc$-^RB>`_E($edZK9cD1N;co>7Ecqc~zt5G8 zUL}(cGg?K=Kfp-Jg*k%h?`85gV*yjXvO};+K9BTzkOt>EpE0-+hq*@#_Nlx*^lI)@@} zq+;O)-K_tuzwL+G$jyL5k$#gH9RK(6q#aQ&&_dVu{cG?z|5_MPfr@_;E9MNdNF9ZI zR(PggCs{0l4awXD6CTr{_oyAcCs`EtyIG>BDs1DLv3jVqG8JJ zg%VvW^DU^Ul_sNFTTV!Jlb~9_sLo;TG8aK6=sF&IW~hpjOntM&i}u`J$=%!oJu>9Q z$L&>+qbO@&(71(QJ^7uZ$ z*O~~ML=D~Dqmp~u{bA;*KmfRDybjIV$#Tl3`1WFtzcZS8{R);dfOKELv(tO)dt6sE zz0q4wu6ntP8xxIolS2OP7<#61?78(fc%j4$LY{AQaF0&_v=P|^cc%g?KXJ0}oh8N7 z11EcaEYqsdORg=&6@gRNvLd*s^3TgKNrTfveP_|-AIAeH8;VZ$|L6U#VOATgyuY7C zZEAHIW>M6Fu9fQ2k+c$B?0X(phhD3COtSyHcO9MP`&A-%S&5Mc-+21#Ap06Ya9XJP zg%7Gqr(P5s>7iQNSm1W_*?S+yb&7PAwpT`U8u{+LVF5p*ISC3OiQtZk?A8i&)(%h9 zRgrb5T-Y$6w@?kDb5GW4#v%9R^@NioB8cZ%AEqXg%#Q9#$S^=7p zok7g?ov|7;oh>0iDI1@=2ilaHdqyV)4Uclc3~$oQACyR-4PP&T_uzupcC%(le_fhn zqb38D?^pDIlV41>t>H^n76>-H7zd z@eH;W3He|^J{6*7T9GHC2q($-gIxFNzXMck<3+SwEOy%|AAza2XHvc`!^H--fi-+j z^A8Bt_XE`RN+sno2zygU)TiRvJ51Fx0r^&Aubs^HnSd3~=1vlNG&yz~)SKcZy*+eV zG-GMW+Ia=QeLQC*riZ?BVb^gzOZP{}o2K@zjr* z)6jYd|5~!c34Kb47pJkE1xWwa$Nl0~qf z&miJ_FhLTRilQo#4ii??OsjJLyECOogor-zU2BMUM42${23@w&?Qkdt#mY&@&^T=T@QDEeTLGO)1;{$ zz`of_hQG0w8D6yIwy@EEmwHx_F*a~}BcEWf5Y^B{9$rv*~@zeQzYqZ zYyn1=@jM0s4KAz6us7xAwD+Go&Mo73XWKFR2&_QwORLq#`QTTTc|Uj8SDVqbl5RohqJ?JwuG3tg5>*ahiE$*8?agQt$%iyrbqTW z{5r-CjZ>=H|NRVx3e9p?|EH1S+IToe+}S9x-B^e0Jr z3qpy#rzNjucF>QB8Wm9Ud>K^KEf6T~YUgGeTLA2#;Oh46&F8HEezYo;)7*B3d|)xI#^2HQyU2^gALs6`nZg)K2l-=!-5g zBK#}K5W~il|GgR(G%n_ev7X5Vv0`rCml9j@(ycNx;;Gy^15umb^8mQlnA>qXx0As(g~vc^El?9S79h_tO$95My8jN=GhKbrOymZ=K**A; z=-+#j;?W}FB=N|F==(x;qoiN_K(-3T;$YIZ)34nOEW1aom#qEo-ten^lKPk>O$K94 zGHPwlN)~w}d((O_sh;~&=~pv^9QE6ugS%{*6Ci1c`?78;`0r-~k@-uX8$CH#Z{7S+ zHQ2vA^g0)^jZMfUL}d+&bb0-$Kw4J0PhINh)#pqRXL*>5uyitkJzSO`Y){$qV~xkK zS`o_0*V&l12kc|G!VZz)J?@&V*PpL$o87by`T7n7_6!mpEOHT)Nl=k};c0*>adWM1 z#?bv03}cj%UpCf%QiD;$k*+T41ew1DNCh<;2a3*~LSawLV78G`FB`;5juZ+<5T>VbZ+dmIx>61Y4}khE(|emI8ct$@y;G%+o~$^VIG&-5_3 zoxp?>1YGlZ|c;G$8P=>;Zh%K9I4Hyrtm^+d{1%yY0{U3FIpl(2wA{xR>)21lN*) zHLCUT$u;o%g^-JxmrBh-k1tw2j|*lia`E#Skee4bw;|gtFvDyObh|ZybOGN z*9LXy3$R&qM{1f+L(i$fE3=g>+Z)w;uQygkD^K-7ojYFetOSh6>yyGh?)%FZrF?ic z(j!n(K3>jVkl~{8p#mN6sGID=K zNL0fFp|%h21p8-&Pfy~e0|f=f*k4W9t=$#=W>(%#BE$F@*Pl5%;frD!X_%#0dlBO^ znt!(_*6$g7lB)#vv3^F#`)Q5A5l{dAd~p`^J6&hW^}7|~QAkC`E{Film^8D|%-|~; z6RaG!acyq?F9t~ZD>4)_2tG{2)KC|M?RiXnk7^FEZXQO~&G;ArN_PpgM-riF9qMkQ z?@j8chWSY8Wab2<g1P?y_o+Y9XI*gw&69B`K#JSBJJR%|K3-*x}Q*kw@@S# zwgQ}zSa#?2zqieS3*B1LSr6b?>})aq#xsPi=8y=bQ~?G4eh; z(q^#S1U>`i3-tzhKOxk9ree{bReDmq{LnxYV;Zsqe`A^AY?o`i^s9f*6?aTzc3>e3 z&qX~u*Z1!yfZvw(3*46Zh+hoghTjY(SBRaFu6j|MA z&?!RY@CrtaE@$-w!5P1l@e_J-e~Zk9#tRwHF65R1JXa%2fG*-ei*^s>J>I=8Gptbt zav(b<+yl?`d5m+X5VmJ+T+Y(jadRNhCO`vc05G#$_z;_raugxxGOQcV9!vDEcD6Pd zT)@{SJGJAw55x!5V|#NkQY?TFJru`m{i%)r1-3nYaO?ce43dHQ?kGPCy04irMDFa! zvLwlrN$XaMt$~34j{WnCB^84d`CLgW#PM5S!et`}lg{K!tMj?pn!f4@HC(@%Z8KV ze|0ih6~Y-fhTXimfK3P$1+M1Y|CG(u0<0&90>){}2yf7Is|m0{zJzuF;!{b{OQ;4< zQOd^kmLgfv(#)R6|F2hwuu7Bi*iwX&k;5H(KopZ75K!`PKrbZ$1c;RYt>%sQ+8)vS zTx@U^n9DIB*V{&?_vZ0~FBO*_P9MB`b~PUM8#<@A3dzS@w4*$L52t71xh9wr?z5EP z1~3FG*IIiZ?va+8QEgn+QV3WhVNj7MWCA9zzJ%k$hoR*&do<_96c{H5E0q{O{tY=U zN0`zTe5CfDchJLK>0BY>Ge-wUfcF-=pY?#3>qlS)Sl9skG`q!gVFwdV*k%FLX*Fnp zT3?N7#I-wO3+-?SXk4@OI3aP|HbJ*u*sEhHBedsBpI|3DAg{eIC!WwV6#B>BfX-&h zB6yxh`~5fl{2#k2z5DYszE+drag{#PxRm#8f7$YzrCIhH^fPC)t~~h`6D45dXeHA; zaek7$Z^*JDU*Y;X`1 zR-Rm;L31Q>>#1Q19k2|yM4tI?Cf?gRaFwGli`GMkXz!K6R@0$eNJX>&gYr-PGyFTw5Q zgz?qtrGV=AfwEvQM>oAN#U%F z27H2c||wUW=oe+kRpOpWT-Yg{A2hYIK1_3bk=1OCci8 ziyUQf9Hi5POd+-BYd=(}%@rMixbYnVz+@}y^rRf_Ftj{8^PAP*k?k}&i?JT%F*tVq zEDRFHPv)Y8kwv?VhcFzAX;l2K|G-_=#Oxj?3^Nn6k%ESk)o4oY#x|9v^8h!IO|j2n zQ~!C0bPwh;sC=dN?bGWVu%=@+_hITxa&lz)SHghoc*)`*J)F8F^<%aK$uPqkKeqo^ zEBRBU$rkOm*v<5Q!*?i}bD8jB#Tk&ZQ&6Gq!aZcN^fueX6VJPOk2UXBR!!KotrQG|5355tRkQTP{=agH0pWk4n3y5J79SEk z4wA4fnHL%>+@pfm@sRy$`LJtz6L0_U_aI?Yv7u+V_wL5a`N1sHr!xEnzOx;{XspFK z!`<7C2e9>~V1e)x3!d1F$7;#_l7s!#viChqe%+gI&LtzoDg3B$>h#J?YB=@jp=jFr z`PGP`-epzy$*;FmyoAKF5(?SzD0|8xH3Z9sFMtnEIAi^+|GoGPvk0nh#hq{mG2wj$ zcE|=UKn<@k8Qmo@`o#UsdO@=lZ@tS7GsE?^#u7@Ymo4p#^)+vANeQ<(&qGFT$BO@* zUk_P_UBXDn?vM93%btPg(|*J-3(dCj#tFiv$T^cp)Kl)I`|Wn%6mSOrjAC10L)T2V zRSYr~Z9Yk(*G|?m46S`XheIFS%<`-9l=)uw(TT8$t6rkXE%zNgMa?zsqV`tB{o>%9 zr0BY@wY&^W#6Q0#s*0#6l`;$JJSX$DP0Z4ZNwQ>%sT)a)ig2CYRskaPmpiu{8s5eW zi+WwEn3Ltb(#D^8O=?=L4q;v)N#T&%LU;+dQKF4^L9?mc8z$`q}V z%hVfWNUE9HN@QUpv5BH2TbOSzdE_`|E+cX5eW)lPWhzh5Jgn_)n0|kvg0j*?^eD7A zYet>5XnKoKDS5v&mu0KLI(jX!L?tKLuV~~^IE(UgLxnGgQ*R#U+wS^izL%PKSaor~ z3zN;*amy1lP3`P%26R28t%=O6$b2Bs#MqkF^@06(oCQ8d9Are#k)Irtjs=KZgebGd z__7jBeXcm|IY$^bx=(4(T#Fa=zRYRd@=V-xd{btnJE_%byZCaRFwIHQe#W9o@wlc# zCiMZE?=$&I>$z)t1KP(8WQ{r|Up94PD+N6ir*@z6^qBHsmM@Xw)IS>O1QD1tOI$I|7#s25AGg#Axyu|3IN}g)L+Cu-` zJ}-Z;P5M?|h{FMB0F|)2@=K#z8L57b-F4#3=&0H6pK?9}x#Y?I@@p$_o8k1OX+U=A z1=KBZ_sm5Lz``xW-<#8VH^Ac85#jpt8a{v&zk+~xkJxS>Y4Ie>XTLx-Q``V(3EWc0 zyE!X1Jlng|p6h+kShRwCVC5Rmvxt4Bwz<^p?Ly{rzQ!a|7vA!12!T5kOA3s;G(PdB zI~HZzW&;3B;nxkeAR$1rO`Z!o*#DCFG^Pi=!dI|EFy#4h-P6t4<$7puBBt>+%!3|X zc}fu1#NTE^yxYz_4OpIz)a;vXH}aX~LCFKvg{v0b=jI+foXl7k-p6{DyRBvj#9FRi-oszGkj@M*D}y&lJ-nZ*T)=0ss1x+?ac{%hCn zb|7m!5Xd*(SVn|9S9Bj=_uj82ZTR-*f)J&y(MP7do#YxcrI3)xd{wQW%ad|WvnA?4 ziS`n)+T0I=WRt!74cJG4Bht1K!foAwyisP}nWcfpT~$~=c*UJFqvyJY8U-im(= zAkuTYNN2T7aZc1;N66dFUmM2hzznb&qrsT~*%efiK4=pX{T5gW3#BI*Ou+y-I*yOM z8U4k)?nZR5$@zVarV{-m6oy3t*>?U!F3#Kv<4LS^&}rcl-t$|m>lhEl!z-wXE4sti z*?&^hJ76-V4K2Qa?LU-*JN10C(|#i{i-TDX9|#7&!b{fq!yP$?ev21*g7%Ej@hA=y z?tU~yQ&xU?rhZ-3F{1jk9gYf^;g}MOGMR1f8?pA7w^|qeLfeX8P66B_W_Otus2YU6 zSZrtI-Ae0+CFAh&C!g3WAIxGUpsE|X)MK?>i;u-88c^9n z%M~{&=l9oneetBM&zG|FX<5Z{IYhUz2rC%WgB$YshitwN>N+j&rDbw6UB zi)bRU)+kixs#yPrnz>ud^UR+gZd_jde*fSqu1&t6N1oFxX0?=4y7t#qLGGrwY2m_Prz>Xyb;HV}W_M9^dslHspvIRosdVPu0UQ5gC#vmMiEdTK>G`qm-G_7avcT~XE|8ul5N_5X0z z6OCrxZT<&#_#us1QTgp2daI}9)@idr5^w%i@;hz;Oql+7(O!l|g~Yt0YXr-QS2iBi zI6;6)gUU(xd5=ceu}0}9i=#GO-qcq?z&h z9ra2*%S3K~tXTZmy^{96H?#~2i+0#~CxNvFLqvg-6tZi;cl0PW%tUR?0!>BCAl3$(?DKb%m ztMck)?jLMnm)=(=x+z~qHo@qauE#t*Uw;uO*ty9$Ho`vJ-zsO^Igx|&ct0hF=IA_I z`=0Mea!urh@TI%}ql`hqwZXmk6^@YDmSckWM zWGVN3szQG&zqD4~z-1`Bl3m!=>)z0hPJ5K#)b(0?NldPE8+x3e@Kx)x`HKa!E8>gi z9WvzcP3-X9UFajT-b98IomFWtYzBp3hgES$#Dq@4EJ`Wi7^lJeD7`pqOz*={jlzPJ z?Ti%h&;C~}aujFMZ?{ZiDW!;HNe4Bq_lWd+UQrY9`0Bz|uM?blEWMj1VaodC@cYZY z$u;dSjUxSG?c7lciqFR0EL$>dE4AAxx=?Zduft{*DE;E>s-1RlDCUN@En%7_y-R)u z(&Hp}i5XafH$gT?SDgPD7Re>H(V9>Vg%_bjw0TYWj6`e^v#dCo+Drn$-_K*4W4W7+ zU{70BS@tn+)cPyU!}Kg?3{NU5#7)E9K+dm@!+l0JY?*~!F zca=^gP&ZAb^AE$mp&J%L(uSL@;T{p7$AKKCn)Zs4;p2`Fn8lX&OcKoFx3{R20M5oe zCuX*+PwX4R4+n3SOG;s06miq6-&>GAN_uVKE-qJ|+4Kpa?|qT&kf{<$jOW9oJj$$M z+O?zwl?aHkFb!o=<(=+Oc#+PjN~K%F2zA?hT_SY zM$I$7n5hoE6NX=mQ^XZF8^ax73y63nIvh-?ck4| zFo1U5w*8B{_e*<@PU>n7L~&$*F>eq*fxV^!-ltDgcxTR@LtXLOK>L&KeLE-%tO3=9 z^*YL_74g}xG~bN8aM7Q}k`BTpQ?f9y8$h{JVsy_`=HZ3d{VYW5wqC=H$t`at`SH}V zdd-Y{s>9h7c#FeN%0=$xwA%-;d)aon`q`a{JC97{uc?F5kIzO%I@}s3kx-_<#jl)F z=sH52<00*!q2uaPJDR__0pFMQOC==$V%9?{dfTpCQl0+V5kJAgwAb%j4}gVOX#_P> zi8yJeP)Jmiq(3_vK-a<~rVRvjbZ2Q-;aUA83xN0*sfIR~>22?hr@43En7NyD9@&J2 zBSyP-clj~WXbd;nvtx{7>gL4_%LuCq5b&0$LWd*)?n3cRGZ3~4a+FAqi-dpS4SIYFBed2p?iO(%-*(tht#?s-4?Ry1dVz5)~d|ytwt~mpCYaQyV zVa&4Z+f4@!Qpd-9cyD*=jjYSyHSPX7lIs2OQipd1o4BfhU@UftKszZtxKJtk)dQYy z6>~)GcC#sIO7D|z^N8c6OIF^@BjPCP#{e#gr59P-puNddYsc@{_{HWj=}e=yPWPW) zZa`*naB#DxWsmphGeb)Dqnin#+Og~i^dh_kK~ zIBzqoy%knyfB5;8^>AQHG+`2y<~MU+>#P5-y75GMN$5M28DGRS*8HVOdZF$5BK%$h z3+fRP_7II9NSYgnBEyJQ}j`QY23m!QE_rGsGJJZwiSE^~&srjG{6ve+_r?_6O?S4&#l&&ejSu zBPs8?a-ESHryMnzT^32Uu;Cce=V{C!kKGIPbfPrn6a9#Cr+42=R6I-HI$1nHF`3~j zcrt;c&qD-iOrR;d;R4hN9Ro3xezeW~D=qQ{wGh%DIz=(HdGaND3!Rm~54DgdF5lm; zd`mDOZqawwYpL3dYH5;m%KRHy038yqXZFDuHRG@!9#uOu*S8Mr$YI5);cJ3<1~}MO zXsbOnXqCRlbXN(J_hbA@_4^dQhuhj=7EJf#KDq{fTIG$NB-OsK#(*bq*K^hH;H<8X zwBHq7&(WTi*E`9Yj)cTv8|5(@ptglN0ksn$b11M|F0czC zaNnOYTZQEV+bd_w`76xBY8Nz;KZOiuhWyfcQF{b??d&PvF-vsmqV||!1G^TgtaH8f z#Qvx0TsW2J^yv01r)iEO@fbOBs5@oGY<(q(nz1(I`*VLJa|Whiu6Y>2*OISW)b5Ss zstYzcBG#d0YCz6L{GXz~b zFn&9pXT*2l>2k-CuZb!2;x#IleC4KpHXG6l5!kP~9jiT}in%a9w1jqEdV^oNQgnXh zV`$Yy#o}?N;abYd3pjP^st$|3qnv4*;YKCPR9e}}Vo8*~y6=B*h>b<3EJX|_%70Bx zjhURR_n1wMT)VKHJT>V(%2igr^I251bQPbkhHos&1CKxN#8vf>%V?@b*XCz?3vD z?FNdFUx4kNEl!wc#p9C9rW?;w3GDe_hA6qavk9H$VTw??hR3JL7W5fU9-AlGXxLnB zu0dat@}e!OT910}QAl?#P1I6*5ubSJ1-TF1n^&B0*L!yYUL#OBXkl{q0 zQZ$-2&Xk?t?Q}`hB9l-zIu67U$miwnqdF8R?#{)WUS~0fY4I9MVcR}{stIfr=o#HT z7N1!UUq#B^&{yh6MvvZ}{Cs;7Z~OOFL;L8HiP0M^8(W13r~^?nYb8t@aAS`X@-@96 zo;>Q(T8D8gJ=g2HULV_mQvcd3szbtvS!7sgGN;>G_Ku!Uyfn+-%)3YBqx-#{0g`<= z<@YG=<#7)a1@UfvM?U#0J`TSchd}h$WolO;W^SCUC_8$e)n<;cke`0Q$*rkF-+I*! z@}Ko+pC{N4Ha=ewcMN=KLUT5A?iYeT;Pv3vj!#1KUK-Z=0!Pn8L`h3%PFBrpj}hu) z{0E5WpEyikuTXKX!)LpE(Ec^;(dI{8ktdE3O5+WxrRfI_j&#feLO1^?Hz740{N8Fi z9z0G)a7o>%{dJpAEFrg_-kzp_!LE(N|;HxFpK8Cf5VGhQRna^!A zti5^iAYPheM(#~M{~_IUwY|iNW*WMtocw;j#62%sM_ElyhAeT0iGCtRTawFIJW+6G z8tMpyI|%)%!l2RG6$}9jF9;>?AR>?b1Mo6dmzD2xP5N(Y&DsOFRMx&ylNq8CFGx@s zr4&pC*btmUMJ~+lKPLZ+q(^Ut?oyaET=|k8NI5mp*bVGf=6XpW_~gm1?u*a8ZfRjM z3spp5uZ^kPxF9ie<5jd|pdZx@8jFwLaB|SPeBR6XS*ybZIi*)~FiEiRN;X`t=p(pa zv_(C3n4tsc13dkLb=SJ$uJkE7X5t$1X@7wos#~J~3>})IQFZc}yTKw5!bsdzc!1XX z#U|5*Uc9ER7^kj#gg#Q`u8k+kl`1Gd|8=cr)J1!V8eWN-sJ8Z@rL#s$4O+f7J01+o zqG9)$P=Olf23gJU_#(@jOH%Cr$U3enA3Zjuv2%mi_s!8*WmJan&ky`ZB}2}@OZ^-8 z#C0!q6ke^>oo**Q2TZHl2z4n_+Sa<>B4`g&E}`Xyf%H;n0jOe?JIQ1!Dsupofl5rW z{qiYfq*e`QQnsG_8(T1FdK_{6D1Gg_$mpnh@Q1O{*KnTUS1(pkQh4sGIslrL)`|~^ zE$Xn8iP~2MXl8tID()S7~nau0%>Nrg>rteV^YTovFFq~qcnt(K56`z_lk zlM(77;SxVmB|0!@(;W_gWad-7_babtJ48#i*~NF?tjvy@%+MWLJ$-jjeG#W_)bZBA zoIG)bQ{rj$`9D65mx#W4d&!@J2oadS=t>7ZBENMn9doE3-x?CSQlr(g+oS`e=J7W} zF%v|X$v@A~&pq_sD}4;^O~V(JVGCRVn+{#Z>p62#r899d!1#RZN|{y5CKlTU!Ri5{ zaw_!x-p(gyQU@rQh4D0#Fc!-mF?GmMUw3?gA(q&!KDGBmnC9$`)CU!pzP=>H@f+yc z3E>pn{m`4&c~XjJ##9;dnjSe!(?R6j+@>PHwrq!I)EhX`ukC3x1D@3;OF> z6``DS7LMH{)AyOY9J^?a@Ev4FnGLVjp2IouhJI26C?$+O~{R{KKKgd4(^Xom?6=B z94z4!!`sfQ7W9IGue+VL#YOrUwL-0@D}4dlk2dXVt$8E104f#yU`dQgI*+P$S8XlF zbvUd=)=lU-SvrqbVlIY;uzD7)ZN}?WVp_6H@;gM|EynHL)vBn9gY7c$>|Ktg7Hr6W z-Zk)8ll!7S2I9GeDdL>4i)yA%7AUqqSI1onsvI4h#;D_QmosL7hb&ny zaiZ(dZMsZ0cmzY82_SJ*KvnHDm0}@M+s*y>j;*&S>D0Hk{y?fzgyDpD2;GcO?pE5` z%;mKsHqYO}*xZY4H$}V6s>dAN%2O_1Ly~ z3!A=PkjN4xo63~hOHQAzV-NPzTmx|`I(B=Dvq9BC&U7t_jQtp+?zG3YnARBtAW@)Cq8LzY>7%p zuc@#7BN&ncPi5j{mlj|&cAcN%Kf<8&JN(^8<(UDKseg!_F|#$25GyH<-ZjG_$lsc*mE#Zh_HvcFOULoZn$*dCOh z<7G<*8pUPQ<_cQ%+|$Q!B^;+H+Dmrc1@}b)nwp=x4}6)hA)Ev)l&m|q-yLYJCe<0u zSw4q^v}qPIQ>D|HjHYDP!eg|>;oY?zFMs*GN#;Th7A2WTt@t8F#&4^#4hD5mc)Cm| zc@b!x#6x$cPuHnG?Q+vFquHY?z^tcSSjLx0V^2Hp!G#5|$R`I>;wpyVStZQi{cd;p z$AzJ65-(Fm`5KC9^vDEvG308qYe4&b1lUeoZ{bDL27*aZei!9x1zu}F?#-wG zBlVVipFFiMP~@-f3*-iIEpUbA1&^)P=X=1TVZ z?cv(3VWArt;@jHBkM9Z zbJ3$F>%Xq!kDs=G$)(&k%(l%re&TOjwrMh*$ZWG`80g$v$ubYE9~CRUg%YN_H_B;Fe>#qBi5E|8g5JNE7;mzb`v zJySn`9!BTJ*`7U04tLG`boD3hki)azt}K>ctDK(mWKAe1;gr>P8ok!cG*9!b)`6xl zn<354d0WFP(n5UE7xe7~@29*Pq+}JUP4YQW|DEVg>9nSB1Q$hts7F#a`=?>`*36U=8 zF6nM5=?3ZAbc2Ajz@|$;x&#FNYpdt`8{>KVjNv$M4(G7F_dVB|ab2Go*+rV{a(Q!~ zv?&S1%@p=IMV7~F`NLZS8-sC3PkN7&Ha6)sM*7RSX&UROy1f3^*D%01+B6jSpUVp! z3z!G`0*S^VIbfyJPedEVbe=!T?V{H(Z5znOt&I9V+W?%8DmbXZr#C7x`8#@0lUSXc z&<&W`Lri5nE)NLH`9tVP>&3j$pObW~PlJ){m?ia{)?L!(YEIHL2HD}jY47=3<^he{E{hmusNA|UFqy=G z+ONbNCQFH&)5!}R^M6aDn{WDVTSE>3ppk3~ z8p%d8wx6}$fJSnlHEM`NCnJAW*Q1hB;d^gdr{6b}+{*tj{m3$DrHUaSSLwJ(G1Dm|c>!`ttZ~>1ry1 zvpyhEn1CViP-b7aW?ynojAFTVU4r2}J~$DsUSS<%XI|q4fXP&VAH3Wsviv%umOL}< z0&>*au?PqMFxhu}qM~0vd|X`!U%n}^AwDU ze?x~ocf8BGm3rVpWb^!GXPnS&t(f)aj@siE)_9pS53}ekf*h@M842=*-Re8brnP3_ zy4epbSeNm3hS$~)q%oH52c)mP9*ORg|HlG&EfLDe7bVCL8n4qf9<|%iy`S8QJX9Cn zPpLS_y)hD{^k@R8I%6vZi$7aHcWR7b(%ZW7dxnfDUGGIUm3ID@c{z}YQ^n3_Cm?3JmCk)CUc^^{lfV7HY+V&(Bz20pIoyl-`w zSv}EYT4%7EcrqqWZy$P$fU&h(UT>rJr|z`^M+0Pd~o0%srgU|Yxr=ySbU;#=*-dbsq7Z{1=U9{cvs#4yBD22Z{J~e%wu{R zrQ;ICxcvP7_Coz5zun@GJyW1-oyZYKCg6G+LOW5YSjk_4M|~f$Nop%8j4VWAXakTM zxp_GD5@-!eI8cjKE+o*@c|DTp&>ZP_u`+;QGzu(@wD{mSsn~iCvQpr4i7ocde%56Kq50@bIR-A@%KCjo zo5=bwpj?1Oys<1r(E9vRjrSFrJwp8`J5t^efuTu+qv7mcB1$bwo%{K&znVzLlZc3i zV`{FUNM7$i-GUObjR1ef%dhh?fKj-<&{GfNK*`QBZ_FAq1mxwvSN7e3D8z#Q;aI&U zUcY+BFt%%j*e|g0OstY=edrR0S!9L4Rq(a*&y=2U+_4-4FXB$&2(2Hu^~SG~0)7MO zfsngLr%GpeTR*vhOXkiw&!=-)7BFsPsaNr^?dQSiD?mSbb_AvsFXQd`dVs*)F$2VV zA*yve9&vjfQ|Q!AR&w(089O4kL6S*vZW3LK=f&qTF1Iv+dfP}DmG)D(LA~EjbzV2u zZg`7K7H%~Jk4vR9xY#M|t7~OGBOlh{Z{2T8Pi3y);7z}0l}2j&mDCfOEX0&?CyMh4 zvZc>crtS|YOWAn)*2Z?O-Y9SA5!o`qWBo+Us&$%=veb1kjz0TJ z_Q0C=wtjmx$zSKxbO7bQYuJy3`fpn#0CEbL9wBdF7QXlWHFHE5z>06EXcr!)UaTzc zX4dNr$^v*Y895wdxW`z`VCJumwHnfpN#k2|284fVSbS1XSBb=YeC}@>00&Z7{(6O9 zZr}%^F@g*zd_ud2_~=H5feBAYH+=K3_6_Fnu#pJC!zKPIexfeW7bMYSLo0px)(8(v zLfg|qV6a>u*yu!3k)c@bnU9scGs*mqe5d(Za~XtCHgNmSfo6SH?^_T35(Z2>=LmiC zFF%RJl2WAlO>p3-Hde*KaH7aw-)@2*>=397ERlM8$P8B8CIG4fonOT`AKn^x&qz2kjCHj_d=&ITPkKyH;rr1ob-^|>!~#+ti4NtD=exJuqoutw zA)@WZ6R5Lz6^J1Moev+zBe)w4Xl8=uPbMUIR?kbX_*us9XU9|s3X;lSB>5cyjp+SoH1@xBXTj@Zo2BDE0CB0&X1 zi{3WsW#G*dj`D-|4}Wk_Ji}}ZuYsb453_swRgc_KHU<@{y2^>a;I>JhkHY7!IH^ZE zEC5P<6?@mv63_&(!1n>I7?4PICX|nuitjkzgrv?oZy?Ca=vz4OKia_)%ikUgv(4X@yaC_!@LMg)_l$f~2)|rFdlqq}eX; z4MjCA?TCHOYo;!YwY~O`vo`P6{BB8Ocbj0Uhh~@l->ee%>Mp1-Htq?ryV_DN-NZf>BKNl^Ln8LC6h&{P(X_@ya0CJR(d}uC zn?5BVigd=V;E2oun-{I{=PF_J2S&=`PZ4fc5Qk})1l&&YUJe95#e&Zh{st##75$P^ z26P8M$~(T`b1oBlQ~GF>Ju@H_uww4!AaZm`Dva8-MVQ{ZjuBZ$LyuQ0&na90;vgkq z!e2vA9au^e8dVSX6sP1B?YbT5sT!duEAX8)tU`IulpatGI(1%$IG&br%-@Q_O2@Nnh}|J_hWwVz--%eH5#_BNLpKj|;P;e)+1c>&)3Vmdm&1;r zp<>3uU~m4c!nN!i1d!7e5az@t`B@bXF?sSYp z{XzgV2=FZ}CX!A{)p;fN^IUPYi@&Js)!HU?>?F+Lau)Hr=q;l1>3y(wH z*J8qN-?P17uw)=yTR5?Omf)GcOFvfJ*XTpE6h9I!SdX3pvmBfxTQg9WI>)f?=Rzi7 z!C;VAF!f$gSY6JRK3INp&-bJR!YQNAf@l^A&ZK?r)678?E0@hg^>BYu3r79?jD*s~ zeh!426^-0vRp^?(Ud@x==5vh9BXEn_gSWP~kr{=%R&@?1nbC;HrZ@=BK+Df1J zLMuEpa$8X2b4fzwf&tqmgDHPmea5s3a(cMBmHEjt{&CN{RAau)o61*1bL%Z%`$5&J zUcz|`rI6Dn)4@TjMu%n!ROu9)(PvLwq`4Wmt@Ms2Q3gyq`L>x)S%>m6xB5Ac5UR<3 z>j(3SsbJCFc>jf%T_*LU|Kh6S$wLFw85KLrM?7f2V*?Lsbv`_VQzr=od=UjZipIxe z&wfUOfvkM}yvUPSGvJaL8HRf~X$be!U)xoRQ{lj{3pf7Ey~%x@_xnc|MOW)-5jDbS zX;0Ux=_SoGd)JzvepFY-iHGsx=*31kc=58Jn<0?BHqgzu8_d6&Kh5J7$i`yM2}}f> z=7C-boJN70!`D2hZy)eCk-SLmPX^F82l)J>#W$N@5WNEWx*Op-Pu?6u0n)=O` zqMM{_PjDF?Sv^B%6!opR8F*3HuzLIxObRqw0A--|2(EB)MFrW0G*jpv?-74qXKw28 zyuYLgLW2F`>U=%rmh!y?)@?pr)K^U;5ah}S$ zeCI~8i7b5wE=|1!wp|7#diq97{5cPs6hW`%>f8u2bv;zU{fyv7m~Lj9p{(d_ZRBzK zBYXUxoW{P42x$(p755(=)8JlE=m$PB>oHz_flBy_BH$^SIu}nAxldVzui@dfPlbNNsF@L)FAOrB%^+RPR_krv&WCd~g)jOQBFqV_TWM5n++*ESt_eP)X=4ZBv+8Iiq9;H1~P7pqjz~PD~TmCbDtC3d8OU5>@ zDdC!z`xz8)d7vAwqcKKv2my_$6OpLZ-nc|H9X zzWtz{VdMD|YE+HW@GOJj((upL$P7a}z?-Ng=U$3{??du25SKzOOq4$b;6Lz-bBO)l zp8~mh9KV}GoodNAxy9L(Qv3uEM!zvvDX0~|G2erv5Oj<2Bw>gVT8B#2X(+nJJmk|c z*JZpnnB+MuRw;yE5+@DpJE;T`@iG$tAe!$qT6X7Xg7CBl#E*u(f!#F)OOM)9cd>v1 z!ujs4-cy|$cL*uKYpz)_^iLim>1?{+q_l&p{;#m0`P&;v z(f~GmAr=5I<9gu{+b13hd!ZCGpxX+60UWb06@f2Q|ExDwq_f5w!YX)gN&J9 z=8ATfa@}AI2@^f70MG$eP3I(5nRF41He(^scMZdX34zJmAKJ`_I$uRy;rjC^N0jC7 zz^j9xo+@ltOQ-M)GbAEOe66(uY3^8DK_22 zm#B%jmKPtW@e5E`VF{LIa8)ySqJRI4Bm5l(yl-@a$vhAcfHf07qk}H+8EhDU4Rya~ z`wlo1FgiWsusa|Lc49^z$swaLXQT6HbmYKvBgubsBYyY5H{SEphoVs&?g0En4v3fw z{*n~|rU^#BfSBb!xzx&x(tvj4&irMK4*&VL5dynp@HSZB_vRtof& zFw{b%w-IAN0Bp7g#v9B1gnZ5k!2D7Y0gQjtpb1m1TJ)y#=J6Gcq$2ef&}UQ%X3>Ft zBS#pp{{A_J`aArGz`ZXiL|qdKdsOJ~e~q>QpAq#d{lWL4Unv!12BhLlyq>?ll$e4y z5I)leKfW96Q=*4n!jYH8;6j&L9OVxd+vx1qDdX~J_3m@-PFE_R&E5)`?z^-= zP|y+^D!DLVd)ZeU$6)$oFtf6nLW=BtEJU${9MOt*0@^snjq-4J0BKp?9$Lfy zU+g@z#roSDUpipi0-Vbg6!1>E2auhHV8fz^rZF<1G-UrjC6X*`GHEFt;6btS3ZQx_ zYK&z5{*T5G|9ln?eYP?1vj~*`NE-NA`_V6Vpqy)LBx5h)s_|30?nIXpSoz!Mkz z&g;kQ$cR{feIUp9nAgqT%dQ;f23K3j$ToTJL@-I1@jKxLbg&LvA{P~Aq{zz59{q>L|XS!g?%jLTN8weTpO_=)W1dLQLEx5Mjpc9aR3 zIAf=M)0R5&>gx{`xr)r!WMj`usGMGTS+b8LUEP|_mW)yACBdCsbd=MLd_@}`m?P(# za=t+cJVr)E`AyLt_M^Qi82`;l?nI22iuWPAk*?sG_DU(9Dwh_^d7Crm83qneRt9 z%#xD;WM|3T%bt@#H7SAcKVkEZFFxwOdVYb1!_`kxEtdLhU7orz(qc&dQbO~78;(NC ztDcRTftH4ffxyhG1d`^rv%PVp?-{capI6}VVL^e>NAgMZbr4;e;)bOc-1D5>-PimF|D%w`__hEzuI6FIiu2N!*^S1*M+_pJNQ`;zd$i7Jrwe^M zC*5UCajcTG=HFc+7e7RiG2MCz6)9;dz6 z(rvMmqjDZH7hE!)(F?_5_H#3^mD|&jV)~RB8ex59zQZ!darsF4Uf16IdQkBMbY@;P zDGGKA+aa?wE0)xyQv}h~ogvb{d&vu~yU6smce2I`f8mm>hs0a|UGUjbuzEzaYD{x` zg#;WeFxu#!#KZ3Iq`2Mf^c}518$<*itz>&FOGDp~kktbK#vn&s$PR#5o@fP3mnWc! z{pwXOy*&_h47~7P<+PlUs?={a0lU_>ssWrQFR+g14aC*n?{lMOl@a)=i4vcf10rhf z8VMwFbG?b!vG*B1z^f#I4hq6NXu490Mht*HK|bj24An3~Zr%;X^^#@sQLHclBMqF( zDN^s5J}$JYW`8>)i`}D+QLnWWn^iuk(4ERc}OZb zXf*LHIT|rEDX@U@9Uhb#^mp-Jd-F?wq6mdHd+8AIyS^U<=yS0+7Gbz1&&`snlyVd# z8*8Oi*8g2i2I#Q(tf@dW8nj^>qD}dxZlfwB;i^_&$yLnIk%# zkmyK{hRQ*+Lvch`OP6#@%tJ1g{^eFgd)rU%uRdY9+LPwE`P)< z*o#T^!U&h8lmy1qMR!Ij#jgEJPsOiY91Z(-$@wb&xk40I*-imQdV#;JB{>pE0ZIHm zlfrtH*g*Z0BU}+;)?hV92B-(sO}GC@0Um%s=mrwI&8wLdf%yzZ9WJN$fEFwRv54ru z$d^r~kbimq^;R=E@)q=62Z0dQ1Y~UQ6ubLAps)8u6B}TraL7KRKv#jOFIh+UutzVO zSDbH##;Xs~GE4UBwB_Tw3I;9rjzH~JZRd$~wZ8qBu4K}zpF(`TY-SJ)+=LZ7GFP|? zo)?0Dz`F_lr&IAQ{S$IgE6&?Pil(9y>` z@E@GjKUOGD@#_=gtS<_n?5qES_>qRC)!BbAcr;7eb~<@d7;~*24Wbl)`WFkhkGA=p zhUn1wk|UslXL^i;{YDA61Czlhe?bQ4n=ue-J}f6dM&pA$%eS+d_$VhOD;IYedne|F zWhX~VjBXV|YHp>omt0{HuRip1_z9L+yVt4Y57N-;wT6pphdB7mv1lm}Ldndc50gN$ zEcMY!d~*)EnQwRXj_PuuigAJ%+N$ck$gfhJMm2PrP(3i+|r>Ll%eQ^NFE z-&1zNjFI8~?ncvlfo&MOLE`S(xQ0UUw9I5!MPI*cS_hLt;q55a4vwO$&Yhd9fkk}^ z4GaXZ+%U$uef72G@#a+*r~DNcYgR6IJp*3ZuI}!16egbnKg{Vr>1O%ZvpMRub%n?0 zg^=sfdq~@7qUTF5XcWytwG}iP)_aKYHFjdLo5v!-ui;d)wpGJDA#4xKPVBjd=^>MDl%T@Omrjf*SOJ_aE#%WQa+X& zL#haTw6HZ)U8Pj-Sy@S3vW?We+B7W$uzc&7XyZnJ88SRa~*=UHI-0U*&*c@sSjiWLqa+^Pcsx~^%BWEA?s7;J>hpB&wsCSZhl`%R4!7cFP?G85yyj)K6C-$v4_f75c%O>>V8%lzW?{(hp56b zcl_epQRn`2z(P!6H$nYdagM?=cY*oF!RV>VdA}6*@=rUrK~Dqb=syAav?6za{S*aYOcEIL9usaB zWFBtSt#+&aSGAz}9tIt!e1Lu2y$95wd@vw}JNyFZy~;Z<<`U4>M*T7D9rt#^xQbw{ z2nB$qvH|r};^;3kSR!gY&!H9#*mqLEhz2XCCICxYxV5Ys$Y)?gnUWEJeO4bIXaQrn z6MzPwRjj)v_-O!!Yhass32Gu(YLMyuY6$Tw$X_W!&7BT_OI!!+buyXwdP|Rt!|>*O zc6;3sG+;}-!Q?&>-~a&G$_;xRd}`SW-6RF`81HYNg-e(LaDicr|1{!jrhpEY)pwFY z#jGSCHIM}-b-uaEf}=K17U>xx%(ddZm)_7(>c0TI-3;tc#pRvbZ&oGTE`pK?W>x~t z;jRw$>EnhtNT0Emp~4^*LB{yQJGp#kq~T*_RO8l*&W;r3L-#h2G+ZyTG#u0zU;rMN zM()qa2oL>r`Q(n`b>*F|vu%n|EU~k4p^yF&@kJWufYCiDJJ^cMMXY4jiReu_8zp3< z%1~e2VYA7*x6k~R4aMTN5Ft`x7i3}v<7zdhxrTj9QHxkKGl4hplbzorRILo-X;vL3 zz40k55ALD0m6_98-umn_IS204_SGLIe&?1`Jv{K?_L8fv{4^~MQ)|U*d5ZYzRo>2m z+9yGSE_?ue2}FM&U$ol)qW{gG3j~~?ze8Kuaut=-vYgiyhJd_eqqL1OXP0}`R{9fN zZc~GEB_6Y-*$0+Gd~TVUpQO*zo^caZx3pfADpY%%YYrN@UsXuoql{0OGuK}k*wAq< zWxb8!c5k<4{jHHYQyLStceIHoZR9F=Rbng6YvztPGJmr_nrJMS>DeMl?=tF}ym=U) zlMhXMWO_M&Jk(v;^zGgjyX>1tNkhG7lHc~MsqwP1i0a;%w2E0A<}_dF31~_AXt68I zjQn`-^~r6ShO5o-*57lSYWJ#i?%U#tT>X9KvI5a}nq^OA=?sk$b;aUut|`3H)QXu! zrx8Tq#3}mUemhI4@p|-Joa%4k4$)=6T(??)Tq!kk0s*cDFhHUnV+AS^j-lKr{z>p_9%>ov6NjN*C*VdB-k-e#2FJx}!M!l{iE z`~}#$@T$daCqFrX1uxz14y@T2x!Q^RySb#E)8rM(|403J1N>ptACw){nsJhv^%L)v zM_(G9V4GsDlO6A9or@(6Nigaat`)Hti+Ef8OYd>Ec*a%(l#4~>!VKAjN1Z}48|p3r8~in|fXQ~)I9&Fo&Lgfg{(QmM z&^m{8H-k<)J_&F5bP{(na}qP()|>M()068@ z4OZl89J@RPZd3Tvk=M5*TBqWz2_aHu{yKSnJUE%&tGt&N=Z+=(j0)DEw89}W;r3jV zb$it3<~GEU0QdZp?C-$Ajf5T3fye?LLSXptxo=Y2dKTfndVn`sf^E8Y5x=ohoyz}| zm^1M*_Jk-Al&ns;33d>_7@tuKGRmr~7Oit_7ns42Ui=jDDwkAuP#QOCf$2gwe z$sD{j!^iPL*SwQq6l97UKQf=wF%wAM$U^S`hDY@WNY-K=<&tvNcJY6U$ z=%Mk|rf^Mw9W0<|=bETws?Yk<$stkxQ?ut?@GTHJ0w$;NXbkV)Zp82C)*9dFmkVo0 zKK3qJ&~hOy=;C54!vWJ{8CnHLf(XR~qaZ6*xAu^A@RW%^u{{XT?kIZ{DE8s(Z4WxNp+R6|AdCIlZU^ zJa0Ih?Cmj>RHRArr5Y+KDqL?a%FzvIF|7gHJW>8^e*qW7Db^l#dD6xhD8+pHq)Z)@ zWor`5XrOH#m#ElplgK)TCW_nJ+rQ(8H#s>wf`N|0USV@O|2kR~`IT=U z6G10gDd2O*4_idP8*3*wZcQtn%J!H73rjRESlT9^1N4v1_6l2`!j>gsi~!!Do*}-i ztu5(KWr3H(k&_8_vg4l8nfYR5%+h_e25@k2EbqUO=mH&U0sv#nh(VsyPXseSCtk7U zT}{@53O5iS8NPLF}b@~NUv4fqPQWbU!OLt;y@a%&hF;Wmr&~Res)NCT~rynn9#c- zCrdRoTxMMBHc_zM`wC$!sjBByXwGvzst{Ar)%w%MaH$0T(upX2zh*0C0bRa2VX3-S zFCr2djzwbII=cloC}nYmx2v^BD!F`Lid~E1e6UBpmvr@)z1n{FN=Fo)mgn1O*P%46 zob#i71{h>g7z1#uZShR=YI7emY1G%ZBfaMP5O>b&)3%&)#6O%O33={Fc)Ln7KtCo6 z44xXo$@wC(JfvD_gs+8Y+D6*lF#e#Ys*|T6+AV?3;NB-#(>wS1sdWeaGN-W{^4Oh< z+WF2^$R1}p5RF3~Jv688qxc?A!>Y!8J7_=&N~zg`8|S*aKwdL&$fETsSpJhf!*Hx6 zeM4HP&rq!&17wR~P9!X_)T8Tq<|;$;RkeT7ve~MKSQMt-&hpFE`uI!69{F?$^V8!+ zS-HJW>JiEC(;~_g1~Rq={Jx5Xsz$snO{hiR-Ah~>6-}gw8<>Cg#bGo*-I?lQL>xJN zx`BJbaBTU?wQ}i2yQe#~IKgNzZgd4{7 zC_?ku&1yJyYkmBfb&q_4c0$$yA6nYG+9a~It=Nr4EV9G)x2ATN6HA7-Z&s`1^<6!0 zI4}#pMs;zX`)ELrAe4xscw)rZdOXrE7lRmLJBj5;;NdkJQ64f>>>k0_@+*?8CShUy z?=h#qPZY@SrC@DqvHKa2bZl?6KZs6adq~v*pCS~3kiw_IPCZu~q!Y%H#%ZZenh-}Z z-*h@g@{!|3oFsVt-#1d2CxOvKik<8gV36V(AI_BHgI--3cQlYf22iNW0JxEFOG}HU zH^4>2XqyL-4J&~5=;6{JFe50{mmQRQB?an?XP*g+lrhYu61SwG^zhY}J(@_Gv%#xBk(BujIQI9R` z3Rd;W2r|aJk%Kz{2;4WtaZIkEx}D%dE(|0y6H670fUONNvAL4>Zm+{ljN@FTk*M6< z0Zhxm#l4G>5X*exH>B_!EVHaqFvbHqAN1VBj}UYl1Xv{6P?^6Y1CdDE%!pX^QMojA z|0(@^^=JGj>B=|qNnB|2Q9K2glF@W3c{*83TF1&^&T5bX{2`7Pq}MS)3xUdkrA+J0 zd*?S2%^3UBYA)Rk&iz4lOf#yLp7}21y8P8}yhz+)i%iWwG%Z$VR83~6mBq^NY??KS z>j^fZr?kStyiHfRY*Xt2g6HE>{rg`1Eh%GGDk#w$8{PuWWsXr%{=3+>8|xF}iJGkW z+2|i`MqR@~V!b~S74A|{N1Ip1(}XbFqcVpEEgV%-yAk~jwhnlLWZxv*y>bj2+w?jA z&D_#3!f#&hNQ`=KAkG_$4Fq<(S})G`_SdS^|_sW zu7zncy;i}Gdaciy%~U~X@CehAzAlw2jEPV?%t_@_$Y#YPF^Rh8qNp9&`aSV*ziL0q zPPPO%(k^;MrKjX+EmA(+_Xfy*S<<;|DZc#8J<%OhWp}?T%}LdX8p=VGuokvA6(5E&CV~J zo=B@~Pth+oO`$yHj^Lz)a_!bV(K^}9IoRb)P&aw2#&|N+Wqn0utdwVA+fDT)nRlXN z5&itg;q#y{AIY-$RoO)qb?`ljVM-%Q|H_i2vVLX$Xg^C^Q^?K7-I;NzL80**zS~ zYU?!RqF31Pnr3KsU1uV`PR%_B+TP5qH1OP8yz%yIl@p@fi>t?p@BVfnx^r2Wx0~cc6OQc33S;p?}qtfDC*d?qXn?a zP)rGui3%2)J{M-%(TCTlE*W32i$&+hYntmRRAw&qomDg!wK;HTg-P(wP?i*tZR;Hw z1fooS%KgHzHKjmV^|c1G`nip-_F{6Fd;G$EB-#W%>nD^&W_u>O6DERRX!xF=2GcNO zZ6@zkFlh4|Vks07^#-|h0cnO$f;*I=T0XSvqqS=W;tO&RA*^)i{qPZ3-%j}bf^^ou z@+SWa5MOe1!_^s#3%0TG8E_SGQ?JgX>zeL0+4=lEhYZ`{8KggK4NYU%NH^w76(VB( zICu?wb5DT{4-<>JlLH7Yj8b!^lqqzLyY`Eea#;*J9$;vJ(5aEg2D?XI07fJhhM9R< zf@c|Y&e%kk z%Z@jKcoIODJ$vto&H4-Mcm(Mq{KeriGsTv{bDQaPkGtPZ)s<7mxwjci8DOwni?%`2 zUTwFxvxCUpuyR>TLsr$$zzxWYQGnE5+On}}C(;33_P1jbubKQ}9=I?$u_rP+WZmIl9FF3BbXKKIyu@d5_uyHORw zNRP^COS5vjwAMFXQ+p*XtYuMl3(mikq&Y?kXA2>0<+cj^UUt%A^Z6ky2_~yEQv^Rv zqd3&TWxDwq;s)1}gob^>UOr5#;GYo3!S{?eoI|N+LEe#XwTH=|DQxc0({v%%f?iLI zspfgN6e)7UTNBA+medFTB@6L?GBWAL+g}HiRCVKehMy72?6LC4@wapFn;pHvh!%`- zTBU_?6O-s}V3B3uRI{G}`;Az|-pZk)j7x zXi%b=+xkt~bX=f^TAckb7d|uDwi2J7%XV4My~BF**+Q{9+i<&U ziOjuByD_ofSWZ2OFNX51Q=pEMiEcxFA92C6>ubFAPdoaAc}Y66auy-<6AQw0^_gM( zn|v}#c6xTlpNT)A&Ig#_odj$t+>~zr+;+YFiTdut7{$j4mt(Wd%SWcVN!KJ=zj|{m zPu}#pl$7-=^|6T>){E+Ys(s{bD%CDD({_O;s9;B1@lk6Z677OT12%2#}z9!-$HNe9-pkPho z#}L&Pt5l}XWT9msXA%N1)GwB^Or0YscJvKEyZdUUauy9j(+!#(+<@y(uP%KQ3HEJO z%RBC?mum+B8;Lm`w1j;BBL&VD7-N3}vuIeAk@@b6t&Uh@-8;{$*FF-p@5g&Crj_hW zSDk^)@H0*C$6}C69i5yQt))M;O}?t($=}#uJJn*_=v`Y2KiNi-=x1v) zX2WQz)84}y&?zV{GL~+v0|&ODJYvI%i8Q3u$sWzdU@6$QMrXsyg#HaKN;5O=o`?D~ z|NHq^sT779^yowx37j=bh477?GlQpAd7lQ{J+~Qh#3DoCeatx2dQI;7FPV>Zo87WF z)D*;`O2T>GRach?*(5Vq+X!Tfs)^gi2I&Y8K)PTz^Phw_P#8{IzpQ}*nmH$cuk)_H zCQSRbZ7-Hpku(3G5~0Duz9th}jXNG&Z&p(oxiiDl#<5*XGkh-q9gUzz1 z)u$z-9fu^z)p?sEe02%2gnh2{*d_Y7B0t8U1uxmBYu~gLDaKS0MuLfz`*QVpYAkW; zzgkq{u3r49FqAKE3da0hB*v1LTiu@>q7I5{fS*jN&%UvCaURpPy09kC`9AZb`h|WR z%dNP3uGDgGR?pRGm^~+kokIZj_{9T#fhN+N<#&lhR%MH#E~N4T^@q#;LdH!#o4#kQ zkE#vjo#<-MB$mQ5rl+%)h?(ArnYT)SXAl89dJ(Wkjo_$YsS7xz5r3qQ{ChMV55bGP z_kb_8@Vz6Pc4k_Qo#p9bFX5j$po`(5EM`WN12}QP?wD9GbM0JT?G6qBi{4{&K|>ii zP9GpJ$cG{j8^CIWE+DH_0(?B!YAqTSt@Qk^&!0)eB3@t|92|TeDBYR|M>H}>Q6^Oz zDN`GDc{4;M$6Y`KSbsp>{R$jt;Xmqnf|bGkAEj)O#}u+j&%k2wUa($GD6W(-Z~-iz z%>iq#jQ9?h+a)7jbS~1pM6*uA4DEP~ynFDx%8ovU=PbCX{c+TTzJjj(eivqzdM~3+ zM%krL@24#5q(6Rebh`N5<$Ag%c%tzmA}-EQ);zfpM(G=BP<_T@3cah8%3f z!v>AH?`WtZl^<+9y`-T>wG(RUpO2WKA!P@@S)i}P7SlOWOmF8)x@+(9F#$} zH4yBn?`^eH3X>2o?oU_zc9Wi{=_rV{IqYv9$a#Zr4ig3UzkJjX?rk6}u?M+C_!Hdz z+tR1P7~0`8(BB>3@~iW@v*e~p69%uj&fYptqxj!mw5h|NWABQ zwuEu8y!n00*jY~91n6keQ9bbzcZOsX!F9MA0{Fp?=MEO)VTl4Q07cN5MUM#WowMm%XMhOF+jCt!}eGo3JssaNUoWCIAla5v@j)TkqARKZ*L0L`R&MSp^i7jGiW`Nfh5f>YEFgkRl(z z(mz2m$(hz^g$j0nI|3)Fh@l=>NgNU*ld}uj%@~{(s`&;Zs;3H3!ZKL`QpU7;mN=i&4Hxf)3^ zvI1fB;hs>Z%P`Hx=>ET=$!`es< ztm_oQm(tw+;@}d_!`p&J{j-A&pr!}?Ar$cZJa&G_KzwfG!cfyh=a`M+ zCZ39CoD+WbxXv5-LM}zx%5^cg=om+krlVTC(2E9&--Oce!_UlFc1D+Sp2*k!ALe9r zp07HmY6xKPHclJ**l{r-`xk2kYEtiu^iz@M7Z^&5U)N4NFa61KEIM~9 zXeK{I3|>D~N9n$ME}Gy_NEZ2~CM~O)iTUf!4H{hjsS&RdVTol5h!ep!C!|y8NvOQ4 z1>d8l;rhu1XiIYR$|7sfKsbiRwfy>xCc|WRw1dg~&tAPZxu+tn&b8H^a!$~g(QMYV5M`Qb`SAM#gp|NYKtA8%gRJ-|Awiq$~a4KnBE?)Mkw%C;D?` zmc4!$!f&w6Brkr64D+@5lh!sxn>0GB2t{VySma`0Xb1{ zO-+p^H%@s{&gjL#B0i`W;G|0uXx3~1T_>GPsu{0S;J<$U0ff?4QqThwuL%w~HqWt9TMS|GCREjAccbN=@uR1rSPU>!HJk5P zHfX0`R;}GKx+*73b*E9w+`EOIgI+As>P2Py9p)Z|nfv7^8QF55bPVQs3uAoVDBLg7 z+rxvzTg{zC&5)E(6`t(wqR9|+*0}eD`F67SpY3OMS}A)^c~!<3;=PjaN#QX|ql}$vJANvS_xM9SqU_ zMdQv~4#^g@C2elU54_h)5PdS4aQ|ZgG;wPj``A0*i%37=VuE^m-eVdsP>O8gEYZBt zzw{wn=cB^vmoKcsjo}gJ8sE-cC}f?~qo#3XxXzJ!IYw*{taw;f^z8#blE#j?O%Zqv z8Hkun{vF&M@LdlcGBVGkVcD3*s)?Cp;Dt!V2E0y{`y~i*`#88ChY)8`e70M~sVPuZ zF;Iw5G8fLtITu`Ha#UqmMIU9I?wg<$mNWP5_DTM0jY9*0K=A-4w5Q58PSOe^q|zlH z&F_b@c}Q-l3oF=(=-T}@_^<21)4m-vVqnxbtbH&S#*yGnF5aiI6NzC-#ffgjkO&&2 z+Jyr(XOPI z1$q=dV|maj;y9S|3Ri!9f9Mp1BYu5%n-=5yTFMqVySnd@3t1G!xw8A+3ewC?qp#T7 zv!>D<;dT@8Kjsc4}S;LMz|BX>CzJn z;th$ps)JYD%s+c_l%8)+8!k^J%PxBa`lRAakpoUb%JW zo&<^1)C|#<)H(|lR2h50ty`AvG>^AGD*4$MXgE1I>@+;a%L`F;a6kWviW9|9_|wrs zRC=VuGv1y?xh@&nvvK)pXT<)X!{{uNN*c*NKFpnsnYV;Bav=fSl;7#>e>)MmNQcFw zKc-lzI57`PNJYw4&B#(5c++3QkF>fvvi@W5M)i;Y#5*#-&>MRp>RM%aZ~Z-E+P>tv(eC!yI`(Z7XcR3OYy1GuD0NJrRX`l4@-E zK~HC+4YMUNVoeng>Of=m=N%=(5lxxPQaO>vQkb5dLz*HB7}-H92n=+@suK6`?`E4>H;s@ zd+yb0isRi(mSp;C6y{()To-cN{EDJ)Yuk^a9e91%A6kL{uw0q$JdmC{coLk_V4 zTP-oCZwYcW`I`J;V$S@~pr)9H7QfnT{NAJs=-#fZujhg@Uay&W22du;G^<4BAgjNm z>GZ!C`ZeN;IPBzv`MRvS(<4nw*@Iar|eJT;l za)aR*(51W+O88!+-W8XD21@N%!~N`2Fa-P7vZ`n;GxZYOGftI0C^O$kj0-%x`F$J+ zZE6f?DJjmplTCs_osaFd6}WI-Grx9`-}?D|^VWpU&hr+mmOQbch@fxoMF+*WO?NVf z5{<4VkFQ4)^mPc>+tLYtrUfk+O7R5zuP={a{HJ#%)9CfW?iunE9L&5=&*mdJ6!O0+ zw=iTRmuF19ncCU#Lbk`+%T#W2v*AOnB#dmCXd~p;{TDx8QW?n}k#!l_AtHNS**kj`$;zG?Aw)J=nOWJhvR6n#_I6nzE6P^Z z?_9b+-|yr5=kKrkb|<&%{eGSEdYN*pZOc>GsA`r;Pel-z|3~;*%zy(t2HK zQaL|P4KKeBCEA{QOQfC)Uk-m%v|A4d(Xb56Sv)rBYGByF7q=3NqpY=0{GqSHQ6yfP zp?f=PM1#-3wTtb9nO)nR0P3XD-UI}-cszo7U1s@-G`?KSD_5uY#!P_!w9)uaLCr7% zTMpegoWrX24&nJj4IWD(WC zruraWbC&~x$Is!U3|PubXyt(;Or}ZmbA)w~{#$fIE`-P+CuHmBGOXj40C&9#^X@*c zTf-e~ZPFoCj8(Bc3L0gpFmd4zqv9HA$xxHg@R+tohqVhJi=YO& z)s=WV3ane!<4+E^E`iR!9dRWEo08{?qUikQs!IE1Clx5?o&| ztp5?`d09UAg^xpt#;lUc@`Lk$$#>{9>ra*4G$nxCg!g}hZxV9Tlep#C^_HAkC5)n${Hc9H8?*QjOc6TMpeQc^7D4V1~HJ zx3Yd~wc!qzlv8ArjXJGb`^3{As<+zi(*f>PG*iERMrCa^CG@(RwJX1{BnpdW^z_(l z+?CMhSp9Tg6Ce39N8Dz8&}~+})uFvpoly2~BO%XVUzoz0n98r+&!ZF6k2tbQ>u7F6 zwntO1cub{jm@eqU`EWiViuZraYosDDuV1DQM0Wb22?5OORR1q>yRYc`5z8LkVo2!v z_(PJH4ZF;0FlXTPgKxG6;CA)a@%0>RB<|cyOIjD;GiUq^Tq`+vb)!drdfc|=+pe0U z64nZZv+_SOGQV!8y7NTIHRiK9%#)p~K2zy76Z$Bnbgy312IP!t4cN=_HOjK5!anaoa$+au=xX1H^9{;WQ5s{e&A zsR!;*y*a_RdZqf{@hkQNShmfm-YU$Mi=UsJ>>$)Uab-(rx}%jtUv$61KE{D!&Nqmr z+LaHG;Vqy6EoF)O{@1Z-QH3x+ef&ug&7}Mz1~-i7JpYj-s%Vm=K;)SC`wd_UB`|NE z*k8o0W%x zeo5B-o#nU~$onVK53aUc)p2*cqbR;zKs*KE50|AzsG zi~nm%FcaJdIb5)!<> zwhqN#cb@X2`?$=ywL=aH|7fAMRmrv?)Bg&LhnL}zl=!u4CHY=cGk+FCHU7bGY&&12wJzm$Pq z8nAc|(=ViXIKnU1(u5U$kX|t1*ZSgI5))ZWdnq(aKfkVMAh?R}QaiN)a_(n(tp|gs z;4<83UzAfj3hx@e!cIc>AqqPO}w*C13_j)5^X~mzr5KL@vsTZ}F-IE52#@bqltKQXAEr zoD4q;gZFZ5g+8ULqAgSSig3{v^tIaR3K4k}{|^E_MdyR5?Zug!0srnQp$?w*_viJb zu5`;_qoLx`=+l68bYo^8``;^VJLS2#`DAWHi~M6@-U0P%=R3?OW1%`C_IG?TiP$>P zzkewy{4aVL6;rO-zND3ev>ac_L~K1jS%8;6X)UxJZ=1JhpFD+q%k59r(PBzSVy6oU zCy)e>8_v}N<)MDr86J9AEC+rOj*%GNz?SN2-MMA+rby<&tE z9Upg_7_13Ua%JcSq%6DBJ&)bB6#h<;^(DOQg8_F|asIE0m9X@;MGp?o{+~08{#bAF z+H#fV4v63SzJ_=6e6s=F7dz#E$U5Wjo$(w;yj@cEA+u{6t!T+M|6kxKqCa&k^T84e zx;<<$KdK&yNWXRd`gt!Z9yoEv8_Zyg!D*lqA#m7jz6_`%I9o9F+kCr<$gS=0v}!YVDent%a*IP0wDC_t`CUCq~K9HNIkb{$eLZSKt)()En(&Uc6rUXr?m*V(Q%&jljejQr z0kN-@R6|7E&+zY*c;;_BXQHFK0N_X#%t?4GdT+Kzep`O-);#3lr$l#+u-xVLn8q`T zWHx*dwSXXOZp9Z@x8@`$AUMTZnr>y?!sDPTyaz}K>mn;{+r{~k*Gc^47YzTk{FtY_ zf#$^N@nzfQYq@+;J4~buz@7FsPXBZT}fc@$Ao1;C-~T zM#G|AcnR8qnL0ma*lQVAu4E}MYdQ29X_kfSJdbD*SoPFDqmh@n#i}6$k}n@^*TcD) zdrFj=8pF9h+V5vriY8AKa^L5Tn)ZJ1457Y-eP6{p--UnRJ%!z@2x2risyVD?E0*0{ z;L`O+gDXT`LYywn(?Q{S3ay61jaPg@n(tX!#mn5QKFq97xyZwjJ! zPL&X%Ks9E0<0TRu1;C+eJTPefW9zW{_B18*+Knfj4{oM;*&=f~)#DLfq;_X1W0V#u zrS~U78`TT`N|-nJn$mwTqo1#`2wv%m_Nt|pn7kGg=c>sLgSaD^%L`iUUzQ*<*eIAq4a<26KPKQPz0ay^nTb*QN>?w%Vr4-8IRP zQ-4^RHt64h8(=u3kkxHN|JvfK_I-O8(fJwFcj!cSW7>8_k5Mj3zby41sNF|5?!BfM zMAFM8B)XlQom)A-7Qi-`ija`3Vmnj~A(KK}x$c-Y>5tyDFwpG2g>jwnCZGC|Y0BPJ z=znJ6D^kPKQBpB6u`GSiBJ#k+E|Ae6V?CKuj6eI9x2yJQF#vnW$uf{{3a( zpglZRXgUWU6QEcjFy<5da=mI3y4pA?(kb9;&;OFRXYi%6aomeUCe<82BX{q0Aq-B1 z$bwxhhh)6ZXaY?~j`WLdN?R9%EgW6eAIIg35^TNB5zx_!t8lO(B-A-?g0B!d>=NG= zrGTFBPrnN%DIgTN?uLo)5Ai;$;1@JC8=4|O)`12Kv#AbVf7=y$QU>JuyEhFlBNeNp zJ9?N1?m4-jnp{bO5Bfe=NaG@()pq%)XP4$lO&SLoB;$W8@{T{vH?|1moe{4fn5>|{ zslFU`S9U1DxkqJw=!?M06u-a5vMO#hU$nb@2I5Jv%poiQigO&mz%D5>o{?Rm3~2ZD z3>pkAaC^D;LEn9Yh&DsK5gAOAG8dO^TK>)Z__u!NGVpk~+8sB}Z+I^>#%bIjq*2wS zgFILJ5#HB3CdIWGLkaw^qMo~0p!8`kf7FKA3KifSDBwcKZ_n6E3i)Md4(Yj(*{uZlb zTA-EHf+=87yty#EFA&T-WIGwokA$u&9QbuTM`dO@biIVqpHD!H!?Dz&iQV>D>8B^* z)PGP6K3+ty`Ax0sgJF5RgQA)D-(6NBCSD(7VVhBo4>n^eZ+bJx?Be|?IN;*E5U7L3 z9z6d&6^{TETK~xXzo){CZ$R^*5&cw*_c5c;Po-Sy{Hb(3|L!Ps{ohkr_-UVxjs+nA z1=}$#n8g5flzp6AH)`fDJN)Wp6NHRz7ai06Lf&gfax&BCLqt2%EYUT5M&~-&z@lEo zZra`-HN3~ieZeO2AUhlRhAgrBQq-t>-FcV8Xj`qi^DZ3rF))?lJ#VwEGVwv1y1&3u$TfY(Tm@?*W@>{7K zxv5At9I~o47gWdIzAfVGMg^!KHml~oMA-iG5E52}kPgH__UYYl2SxLbRFSf)+oHoG zy9uIK?=5V#DJrA`Q~#;aSeJPE%(Z&L`NtVjY>{SaZ1J6X5Y3?K6f1V z2Dx61VKb`4UVKxTAmxwv_Ic}$g?{5hsr~pc;d0+Tmsd7!4~p&>dYX;8tBEQs_Z5@R zS`CpCZCK{|hv9$kP`uvemX)=(Fdu*`Sm~Qiah2Kzn>bfC^g*rKJ5yCF!y8)su3;p9 z4)RHI|1`K5Q{(Fy_Xlx25NCJP#aH{#{6yn() z0ha{Z*SWMyhsA@%-8XN-Fl7KV>cg;VR8&+tVYMp^ibZkg?e^`xc=1B5EPeC%DSXQ~ z=&bJAP6h%}3R|fI@`rq#u?4aKH88(YKgTQ7-znYrR091?OPEDdf9dq@QJ_IrhM*(D zbN?r+4)%VUsFzy>XKhQI166FTh6zZzT3`sYAFL>j!ShWQwrD5qz{2d9I~FR@5{gqA z&1v(10AM`2UNDhq6ij|zfQ}GNn?Yleft#BExF+%qD=_FGXZgM3ewAl`Z!ZWvzjF6u zA4uBaa|S`Y$}h(f7QBgtDU*Ki2ZC8}5@TcIwohJ!ZDr^s{QX2YJ0!iRW$g#Nxq=BitQ8~%O?0(;-EtDOQ3Ou3)_v~5?69<;t$ z>0ppO!}4@$~`90VVqWp=rz)!>n*9Pcnjqh%@G=np&&q^r3iO z6f~8^G^JQsR7MaYdfymb(OoN2biNlTpRE{jEcIC*r>Y~+fJjp3uPgqjaj)f|>0KOB z8~U=)Us1HiX7fLvpwWl1SV?~qLfvJQ;c4e(jF_xq$Q?@?;)8FVj zA|hp2k4DSW3{_?sPq++*<hFEi?;ODSIs5tG70n0p4H zOwvPSW$`2H={o)=ed#5Sfn6{pw0xxl)7C*b4bURYjr4@MYP@{ylH|@h=jH2^{MLam zD4k!#(#<&i_s<{n%0q=2h#qxV;tn@FCiM0{!`w$4FVV~C>1oG5+vX%3x&-#KSI$n5 zAf4C<0~F1&;Q@%};t|uoV)-cTMpQU_Z9w#|teo7o{N8jk5)Sh9>h5Q)@SKhjX#U|Z z(i@eEJ)ZgxH~rA9l}1NRDtwtDO7I7HA+__q6?;>o|O*l+Bs2AC)nj;ER6`*-AutjTS=zUhs@&= z2=h8Z&+1;WpmEn#WE1qxUT6PMIVgP5Ovz_5o z)K@dbuqwvnK@>5w0y~ni$^YB>OO^pgyo0ei(vu3CDUSgzRsWZCf9~k-j$_rVMY*yc zv72T3+;#dcZ9bhOc(n2fiFw)Q3R3&sgR-xWbGqNY);R+SN9>_>G4+U+;^zm|)+L#U zHSUOo->0=2yOTB#@J@o$)e%(PhAho?3*hHxbOEG*?M(7C%zu)IsH>OQ4oJK4H`7Q> z%PY2+R988&CX$Kl#N|$|ZzdYwY*uGlt+UI1g|NPZY!EFU(+U02p#3!4_%-XG;~!1R zgdhVp#+M(d!ezJP?n$0S-YuhIi!^6j=bw9<9;osx^_=k@MWYr<1;b#7Jv3G#Yqf>b zU;gA9<%1G^Qt+K23Ahy#7pS4|Y-=-q8}Z+U<;7*({$jm5Ir6XX%jEKt*h$~fnS2SuguK`#BvxY+6F0zZymjtV04Yxb zrXG<#EA-IqQ8oVH1d{E%+?$0Lp+}bX>QRG7UA1c*r-8Oif9~^_*QrBsNZICK9UsE_ zHy~aXwAp>f+K4zUWn7SfI*Sk31F4tGr3&(Z`wp!Cc4FCiYuN_v66p%l&%a^1nf{LE zu(1N4U1$!F%Mf7yu~A3q)KQV>0E6lS&D%__$$fu*GZr0SwNuXq(E)~W9$=SUP;uCn zQs*~H5w`wj9Q-Aa7PXd8|GG(&JWbfY{jTZW{QeXas@ny*PwsqxYLUeD-d z3QdaG+Fl14#9~g%8fpY;v)%gYAko*19MQ+?$W*#K&2DDW?1>pARv`2IYo!qr_MjqY zGNNdWUgpWFRItgG=8}E{GZh&FzQ68uD8})Fh8qzMPy)r34bqORhxfDRb=KTrUPq|Z zen^kPh<#hAvaW;I(#u)LVg$fDu%C)@UVC#0rMoE9(KOOpGS&Y+w)~!S=yM_J-ddYX z<>h!!WdNOQ6{E<{hIOTA#S;&&b$ zTtOfYb7cnnuGYRI>?X0Q_797iS+^=Pnz@vLy@aggZ!O7Z@u_ipb-R7|y6D|c@Uoc08?p+mMZw$>nnT*_Avyv*89`%%5+{uOD-R7IMh4MeG z3k4YDdzg@MWr++jkM8mzuFGWha}>q^vh0^av1+KA8g*T)<{sg zKfOlntSQr->-5n<_;C*&y;AqaFp>Q?&usN74cgj}=5x|O8?8LCeqb1bea`8fX+do< z8S5f%1qu!dG4C3|U-Y%Hk0-%n!VJX3Av7n;wKL!{EAwF(?i|TTL&c2|7)I)5lD~65 zoZPJQK~EzBqOY&tkxXJjog*SIMA9nrTpK5E+8*2FO{=Nz;-f6rp~C= ziD_-Lq)0~v!x?tqA=8_i#Y18HRKiHBZN1yZ-1>Uam`Y<`Lu2D!7QUw5ubIZJwGsCI zaoFfvI+lRu63WFf5;m7K?%jf0BIyF5T*}>&wij6O4pUxB_`#Puh%GRzF^Jbra*dbF z&%cAXT%u(#iVyc&Z4w-NDl~ZtN=skTq2_#>g?VRp^nLBGM)zZTU#z{&0DXgM8lbzP3u67{MC}4n5)BSk0%NH zh-64|oIHXP z$Fpe7@eghe-1GZ;MZvKv#b%>TQ=Y(UX8n#OSD`Tqz5Lzs|BWJLB^bQ1RP7 z2mA6+Mk$6fm_0Fa5y$rxOyaI}5>*E4yjx)X>%#-hs#tdGQL5ZA z+7fi>C4FQ;@+ZyHj*wTlq!UisW4lSGNERL6o^*XxnJ-N9wU6!?Jur5?2Q5cBrc59GGDny;Rk$)#@*r84N%ZW3w=EOl@8aYqPF9@5S8yTd`p=6 z-h@8yN|3j$_sl}7dRt4Dd|LR?Jnjja$35wJ7WOEyC4$$>Hoz15D}0Qn5VHgb9B)AeIw=8;qDf{ z*mDoaS)#9~#tx=rV3KV>bV`<(!E(&imiwL&%_QB}2MxZNqx{)ns?UnjJFoj+*DAwhvI6nU4%qT~2Y#8+;9$Zb-gCA?h>W>U)0C)2O&_bw_87;6xXm`X8 z1v45U7Z%8TjCb?M)WB9T2+CawQafp3oyiamlm?%EsDe!rEIYUoN?8<{Po+O!B^87N zLW*F55YWTg*RWQoI5R#i)3eR^J_$L|rB>w?OxOc4p=)Kwk1N3iD7lNpzEx<~0K# ztSA2UIF(Tl(iuK-9W?ND#wt2PNI-VrA&tbI9SJsrea z=JQqmdH_S^_p~`zU-{HGWRlq>a;}939C-&t%b8|XxNL0G94fKg4qe=sP^h6^OVH~q z_(&Np{RT%g!d6T-y%DS0>4RPyxW)H2~DdLaWt4QydN-IZlL^V)Wbq{`Uck|yHW zI$x5qZr{TxXyrnhtsQ?l1ekNbp9u!qA51 zI(5+`hmE|WDDzu}w|o2zFu1`=$swQ3SoowTKP*)>8#bgB5T%XA<^1`xW3l>)d-{@; z6Nw?b98;?%?~cAlmQ+&T2E15J?cOQ98J=k9fi`j)(RquhHccfg_%nPR0YvljuGW$W zcQW@cm_H)`5bjsWdWgV>9T&cMO8DfLSIC!TOUw_)JTe@5HLf2RLYKQSTdzQ8rLE)n zclF7u7rh{-@XF$IwfOG1#MpZ69?1R;N6M&M22Ls41V5bWfNQsjz!Oi9&R*)50hu7H z^I%UOv&y0-G>S_Ttg z-M`C*?1^eguyfv6*5irN{Hbxpr=u|805qFYT0SvFhpJBii@I5-^n)gJVdvkd8MAJ#E{#%lW@k@}$cFJ(Fq;z*GaL%oBCq&!h1tg(n5%FTfDS*mB#mu%oB zNTi9zeO`KSxMc<-S4w>G*%PNgG6G9RH<9po05rSVKt&<+e}RNiLj4K&KXG(eDb?U@ z7#6h6vZBbi3@O^*{NRQ~aXhqb`1i87HkQG*EX>pff$BPG@Z7@z4lV$|6X>DXFimR1 zF=s@cZFd%-GsFMC1K}TijFpXhr`m416@EEM)vrTEi{VCbxErafFZy7ctIX`~@Lq<> zZXKs*Xfuq{SWZ=K+{O#$deBvtk%jB;_C=538e`%U|{=*#PQ*lr0N%E9O3f= zMgl$=!e20=;;;pY;DAwE+3y(o#zu9MYdHz|^`C}sdxp!!WM7&3F^bn#@oZY{I1Pn;>17)65+q+VDcW}R zhl14OdoG(F`NykR7YzD!VpItqv!;pEk>Eb54dIE}dB(auOiSKp`w}`@h;FqjAJKaM z=*zm4z6(F@@Z^|yRv1-hTEuW5-720c)u5~XwkwYbmjJrOBg)q>AH{5)McL@=w_14L ztN5|HhgD&Et0U&p&YVDVNs{mqGO{=<^qpPxU>PijRULUylWXRhpTeb(sQ*_xYT@X> z9zE858cHB3H+d`a@X`EFUu3*pX?--0qP(jsA%8;Fmq|n`rz^*q7n&bei2qeu&8h$A zc$M0)ekDt~=#09;f$AEm1zNvihR)a&Ebio+*p@zcefsm-ky18zzoAZMA+(3>l>QCR z0y5S?w0G6KD~@pb@|7zH$M5Zjnys98t<%%g>FMcGBFw;-uee;af#3A)7<&xXG5ad4 z$LUPH_kKmHN$n5&iJrBh>Yp*tyUScaPqE~#8QRI7AG;xF!9}{=#Sa2Fh2~CiaExKJ z82cD|e*dI?*=!*LbkI5__K>8_VeB=I0<4K1gQ!T7+y9U{^OqIQ~7vS?txp z=M?4`Sw91QMYr;8TIc%4a|)}$r7?DKFKfIXN=3J~fvKc(j15P_HC8iMr`EZFi*iXU zCB{^tr;6b$mx=AZg(J&|14v_^d%1;hIgRj^=!@k3NfWCey1`2-d+^*Vjs}XX*`~{x zz6b4yNgLp`28tu>8Wb3;{Bs_~1}}V8ef4O;E-VXZu1Bcf7^bz4-mkLgSC;4|h#UVa z*4wRr3d(Z>X;h0<%~OA zKZ}WwEwu*7Rbpu5ef6@B|5(21+buGd?c0X>-#(Yx5|`T{#nr{0Pa4R)%36@WF+97- zlk0HwgYbQ;?a8|t7UR0?73tF&=XF8ma1IXb#wXr^98bEP__wI|){;qrxI$4f-rYM{ z@t?9w86JIiL4dN#-(MW?ZhthqLdw>q(l(}xC1vwg^r$PBFVjoDz(kl9hlSySs~gGF z*#|}1c;F66B*_ClIJdf_5vblIo=f0gCj-5OEwG+}ky)PcyW!^ECx5ks@Q2dK3(WO# zF2ss8Zq8T0u`+}HBa3lEO~@$Qf!V)Itg7e0R2#oZNbwH#Qh)01#)TA2Uda&;{KC!4 zI4ixu=ag#v6VT6MA`$PlhN^|owX{oA&>$eV7_j$otuSte?aKFo%|X^O&F{lL8L8qE zXwITtWUt_+N*!EZp^*YtUSvOEW5hNN;5awgfAT3e0eTt&_&OOT-H(ANQg*xH-i7%y z7=4|;zwN;Y*LffwM#A&JuSCV3cU>yNjTabi>5GFK=eA32D(#^CGlO~c8aym434jWi zL}Yf-o{t5!eK>uu5z0d%UibJu!3#Y?Xit|{=6R&eDsl`>G??@)fm2Cj(n`oh_lbm-->9zf=0N!V|(tY%J`ma{|OlH?ck?*z!;n9 zU}MMOL}fM$3fV&8p?Wf|)aiUahJvKU^KrNWB~GfLrczzo3t7mh0Q_GjrfqBff;D|Q zE|11DIKFFSDz5+OeBJENs4LUacC>u?wyC_l;(WqiacGEfBoC#MG2N)=v>x7*2~XPE zTHMn5In9H-;k&NF9?h<5OOM|j6D-es+bA<{m-5M~Kp7*9M{&>wbRbZk*PS{Rf)k_f z`q0a(q~C70sd%*72Fl>Q0&1pv7>+Lj3qDsMW6}~i2Vd1Qb-CPcWUgCyy$14a5DOMuYLWeqz|o_ zH^pV#)8px_)uCICvvaWORLY4tGpT(VO`Smxfle=R^H#s;Yp81!nu8JQ0_BXT*ak&g z7O)S$rkST;pB%lp5FOHBKPxs|YGi;~xB-6Mo(G$pYg@bl6jnymybr)>`0fDVG=FlgKgqEwWT5++f@FBQJ%;l&_I;WtvPEciauEcngzaCzc0X20kpuL-d$K# zC=T;94wBCvaX76y0U*OMs(aXZj09b*g^Xr0Ka;F}YFeXhk!K@2i-$DMQU@|QJ zs?>=$oP!eJA!>CmN%UhRD*n)J)>gDqSckBiakMwd(8%7)Gd?%|d4MVcS!k$Gb+bh0 zs~YDb=Qzc!C@#W#FI!7;EAs0G4ESz=ys=q}(wAR7gK;d=%zhoI$Q9#* zcZvd$Z#m;ufnd=T6}rysLB{_z3{&H5dNATS9s_DnaD~4X_sLyCbswv=*!ja9ayLRL zKI~B#w``ZOLgD|)7}81*WBps~T`UZ3dw|fC5f1fF^k{!h@SrCwvu}x$o{z$;{Tvs$ zADcLBrOpVmFwI4F8XsnLD~P+bz*|G^HwL^OeUKVyvsa?*J(!>b5-EXx9E@TVGG&c- z9d&TG+|RxrF}J*&m%0wo>;tZ21hPv_t0|lG9-f|s?_Y2NTL#wTFW9tPmRDRFQxLzp z1{?|)G+S+fBs`hWuQ95&OM9r|)BS3*M9oD{0d{kd92hO~w%JdL!|qokbY|laimjYl zIRXcqy1#cKNPByG1>HB7@7+e?Ko6=KvBj3QgZ@1sHKG~~DT{NR>Qe~tL*Q;#1{oW= z)?uy>7dFS(mxfyIXo6gX2u-?Nx#%q3x>B&rWmFgP3RUAM{mk{X=MykWXe-uxFGGfO z{1#0gP$wwUJ+D{O`20jjPXApyp`EmguAregI!h`+mfVc~j(x|UTN1J)cSVXvw42nN zDt0xWPv~5o%@pR(iB0pk`}3wHYMF&ppjpV%5$ohHi6)9*&u2VaoL?WrfIjP|?Efm2_=hKlPkXG=hh2K}{hQa+^9&@*7W0MYTfRF)a zT(pE=6S}5cje>91x(GB`oqXP@NB44XYj7+rALm^u9J@h}Kn>QV%FUqa9tpbH-C(!C zes;$slbJ=Y3RmQB4%wfVt(@lilwpIJ)}K-xj!upQuB|3YmgjYr>}CjkZMDrbEN1w<52FiaLsm2HpL`CQ8tC6q)7_JGGnop!JrMv%Cb~T6RpBcu0?es1NkS^ zcQ>mHIgn{-;UnFiVU}fSUMEjwNf%c-)4c3u6Q0(cunF*uMIv5MZ)X6;|FVuf#dxG$ zxar^e*!-;nZ_mWY4gKUoh=ikA@ZE`2ccztQ6SByehnz7Z48L!oh>*qb< zxMrolCX$bqxU`j)EJ&PPr>ah3wb&7W1Ekbq4XH;zB9xu?qNK#SjfXzGOb?+kzzvkJ zE8!AO9ep1760`wKhJE3&@7vww0u8Lop`M2c76q9{xvrr(pc(AjG3&ac1U*Uc6`;4B z{9sxPE=r%EEwq>1-O3q}k~LYVDYvX(3tqUK9b&M!K+Q$JZ5XU3crw77zzoclvXWlJ zEOsZVauAnw#_aW-tQdF4v1&SOByX1BlT=je^G~-q4zIu}$?wM3zCy_#W7*i)2!Vp* zdiVI`M7{E{e2naJQwI_Dmk-L5eJ-j}X@B=O*!LA-uHyf&0^IJm6JI_pK&j+?ZbQr6 zJ3s&|4#ZD~a9F(=#{W^|(Lk*HO!KRyeFWkOa&og3>@}D(r|=p40~{$B*$|ZpS`X%6 zgI#B)z!EMwS4fy4kX2XZ^IQftVM!-p8EaP(PqwiUG!0IVpKa~(i#}3TwHbQ7zFWxT z`I!_s&Yz%?Ar=80WdAB8dH(i~Z|sx1D+8Cng@k_;bGML#@(c_*CC#Ay#sX5lOLe;U z%leb~tYSTgQvb$l9&AoKF85M9N`|gcG1vJa%U)*5UD%~%ij4saV#b6B>}nUu7~?Ty znX{1RE(;N(935Bx0DCstRDANr^ZuawCMG6Zm?Gcacnp4)@N`P!`aJ^mg2Mt<^~=Sd zUPj%t(tOTjb{k%2J1a?k+34Ft{XnEom=E(b$ALZS;5B--saMR`P4+R9ToMj8QLc12 z#nvKQviEBeAcVX?*AGZH!qC(GbYKBFE97u!x3g!=9*>;eIHhk@w!ay3X(0V`UjRwlk8u zD_c1{%pY|#*w2R!KA;uL+K+2ze=DF5{0|r@;`KTC%MT(;#z2)i{D|86aC(i!K5%l9+lFq#ebmKeBX44llAHGr{eYn(ZR2_5GZ)9`afs?y+It#s zAV0r804IVc^V(5LHQESNw(T^AaJ?QBVCG=fZXjWjj8H{f0Va@&v&;N`cE`YBJ z-T6-n3`fT%$rgV%f}7`mUH}%osS3fnh0LMjz#nNd^$oXXN(ak)&}DOXazgtBNg`N~ z4!L6-U&~ao2PewCg`pVw{I<&??1)VwoWgz(){z7bvNa z+(=?Tb@8=!R40hP41vn#(SqQdI`2hUwEQ%C!!i9=8E6Ccbyge=(9i7LFQbJ7V6t+| zyf^d1RKL-&-@2ftPWz{(j+8?`)9;T8P=s%`Qs4M75dABiWJR((daok^90X5Ji|E0R zdWvoemV^DwqZYr5o(5SV6|h@P5{#783m>qq@)yMHcCC^kFXNK6!-Rd%Q}D}BZ->@W z!Oq;LOOLw~ltapay9K#FvCJF&n%tEta7k$ZBxl7dAr(l@?W;gkb!7u%p(m{cW>(H14l>m9xZQEr~mxbmi zt;bQ`eaeDZCE9^uy0BV8@z_LGbvcHId zKp5>^>&i+5jWvEHU^m;LbdKS((uiYGmm+~^4*g9j>gm$>ge2lFY;8dNf(iu4#mmD} zh))85aKWE3s9m4vsZ}@xI{6Y*@$IlrOlENk0(u3z=)pYPRdNX&Z=zq=(xYNIQo#1J zVxy%+f>9+^m%|-|;v^$gVBn_P{JgPK(>GPri|p)pC#ns(x1Xi1~4xW{k0P*Qg0gbY!ymvG?N_IfzcO;zVc$A$alg^Y=@j}=*A z{^SPl;}*yParxz7872i?h=7j_Tf3bx3@ornmqJ+UEmk=Rwl?*nvGPX%ZOZMYg_Idk z+WBgdAw2-M^G%wY<_UgpEyx0<5A`-Rfglb?tCO!@C#mGduI(6vb_Cc4~i9CFJ;3Nr1F z&?(u0c`=TgmqqR~&v~G;euGc%o$I3T*`)g-4bEqS&ePL7wDK<*FOmBq%*Qvq`~uFM zYv9}of99Zs7B1+sxhq+V*r0#NKQy)#c`Lml0Pd90Pi}&$FeK`4!u-2PycL$GghHJX z>WH45Mk6!z$K9Y)+6G-y0JIDZ_tOnWmFD4}KS8=RC7OBHM~n3?L7~kg#EIRC9w$G!`i~_xt#z1h zMf~MLR@;u3XU^>7>1;3eMZq-ykl1L~;6E3-@?_l%ejBpMk2di6)P?rb3eZJ3jLhvf zo;`CpGyBChms8mEJ7)8Wm84K^JrfCR;KVeKxsNG>c?_N1kQ~22J~=EbEQMe>_kbLi zFM}JtP48#Eq)iCezeqE8+fSXfx0tE-X%-N6UZ|fX#6+-TNYz9Xs~Z2^z=MC=yTbpK z0SgP`g&!SkJ;f*`AZRUN4`ehZD3@&+v+ zG1wPPB2|MNsNRUl-<}xb+&NPJo%=ejNQzh?C3{yffq9}0_aZ&&CHbI66#QsR9E@J( zM}6s{+2EEp2rvh`eMlo$;ogQ*oy)535}87UTDYj|8i}MbSrr5$8_cuhH?W++@B;~x z0!b((Kid~C>6(#O#cH2}gi3|UNJwNLo87Wtt5ExKIpz@d8>(PeL)y#*opDfM>BCPi zK=aR4ja3a|2Krs9u8(xr>djs=D`$ZwnkVMQ;xz2r3F;aJ>le^##u3;_(=VJ|)P9`_ zdoR=sVV2x&X^lVo4mNRn9++QlpACOp7YKKFk86)rjsK!-Fyj4HR{b8qIBqSnP}18K zdILnv=g)8q3u}JVW`)s=QAPr*I_7t#V&Y}=vx9f$?;rvHY5qdx141<{-IDnrq%1r< zG8Tm!=Z_xq3P$g~lh!Z8&qXdXO=e{^fbj!8??=%n16|`-&*HIYSos+H7iqQSK_*9cqAR_0#7Vb{AvVI>O%DJ zspdocMi_sVRL^Aj9PO(I;gDLwrV-HleNf|s@{Pj$TXKAx@9~!G-`yeARnURQ!EQ;6 z8^huKq1cz>j3gD{df*{eQNIw9NB8yxAMSQ>HcW-R(Rioy^%LFXldiZ|u;@oh{xx$h zKqa;H(Gn}LFNmB->h#=1-GgJB{Lg+BHXd7RcWU4IK_RHWzUl3;dG3X#gmMz0tpt` zli&{JI|_6RZ%0KPcaDBFYpxC=t}m+6;uY~Xlw0Nz*tKCGS*6bpS&KxA^=)#|5206U zchcNvG9kMS0eWDCQ6Uw{TK8WxU_BPPP@$?{^;EBEv@xQ}YUrhWwF<6dh@b8dU|rb$ za*q*r#{i3+lv6(r1e8+H_j)vFpQQ6$?Jaw1p>~M^6yp3&@$5R05Ii=h?jX9~l~}qF zswQqx_XY{=WG^%A9zJtPIvKxTgQuLoRr8j+%i-ZSMt!Jv72fM*OVg7!vb#tb%+xD_LXz4!ixo;Y>Y2;wB2bx}_vX#Br6XSrpGz+S3M-<3X zl9F%-=b;bshWlD9Zx40r2AClxm0y$M4(R|&_s8o@wF_4WDaJ3Duv`h~DU$1he)MvX z+wdJ&nN?`gEQXAtNdt>!RoC@Vb93W%?0GU48IGN$$5?VT(lw3GPVM#Y*3cMGfp-wg>OE_f(*40M48)tRw@FD_uuYl~t2m#5($bGVodOsM^hsYICR zSgn*7EN?dNCNrjWc{3i2Jy*akD410K?qGk){;2$2;%&-6gJQ?lx7Tz4uq57opn!D; zvv~A(YZeit=*yuRFVC~TzrWvzF_)($=@~3eCJIR_hd!uo!^ zDw~z2-IM6c5UmJ1a@MyH@_LBZsJ9}@re0QUbki=@qH|eCLCY&KDszNbEIaNEu4bEk z^-JrrG7LCZ?2mm6N(t%Ptrdaj@LDXkF?&uFRG^RrUy{KbJGim4y}QtHS~qn z_bDTgF86#6=Yy3VYxyVTuoAJiN?3!Kvyf-=cY;Hh+Y3J&Qe$(vffwzC#c+-Afx%`# zd8h-+m#l~aWm(r9jZY%^J@Q9JIJT9 zatX*P6_O8i;HMwl8Xl^)ol3YLLCF+oKpltWw9);QfX)F~6I8kJVe|%`)|5AYQ;s2N zie~ErJ&I37x7-I4-b}CloQe02I@HLx_QU2GAtqeVEe4qInK_+eZ}TGP0;f6;hjaV> z&tdsR=%LrjiS-dECq7C~a6fZP#FfIpx&pfJQ5~~J3vsX zF!{ijECjyi(vQ2acE4u<1<`O&^6TRIXTdgk^1?cwqbkX#qdPCZ@CT*b~rTks_yil`HT=N zU(L_;1MDIoLS?XM>9;o@ZPph*#C2yC%(Se!;rBX5IpwbT_aZi8yJ^6Tl2EPxkWUqx z5CU&@^WM}quand0f;>4VD?o&=b+cKzgbb(AdOKTIN}Xc!(B*(32$%c^ar}xvNHZNx z038RJBdlM2jKxxeKy4cHCEZoo=<#cub|YHK?`I_OfKbRKZKE9AQg*(_W%-j;AsQi_ z??QyeZZG`m(btPn4r3afM3w_PEyh3Ofd(MIu`zBd)}WCrl$m!POqGja_38a)3EE>T z{?({J+`3UDBVN8%rQe1dmW~79TrH0G9Q0vb!!+Dj(*GPxIzMW_XmWX;%xj9mUFt(V zU^k9fOw}yNvjQ@28#ba~<;HubFX1=Zj#_#$CP|!>LwDkG}&G zaEql_)#DN-A~{?ZCBxP?(<%z)(S)CGv zqow>i-q&(E?)Fm?ZS{QpU_BCk&ya3nMwvgsV|{O%1-@n4SV(vB$qy~Qeaf`1xvzo8 zsvoXvIP*2FdFXV6cxCjnnac@^K9o>cEVtXpe}R{@RI;{v%Knsgs?JYkQ&%Z5(mp#+ zm1c0=o-Akg*~~i>Y4SZ+XRni=^po|b97ck5uV|+0k*iMe+1LIQs*Qekl_#;gv4(Yk zK8pvPIiKJx{thK9PYzsF_BuY~fs7G)#x3a|hMV8;P9;rW^~Ww{=_Hr~N`ve$3%1AJ zQzj=PbeOm(KtZ>hRXS$u_07COFdiF&9rcPu$Cm5P1QDv?+3OvDB`S99PKu5+@7_U) z67ofq^2ylDIS9XEBMqpqoSIjB*6ZR751#+|zS=?s{%@#4DR! z!yo@2S8p8^h4%e{N_R>307^+&bR!ZXprmvtDiVWqcSs|sgpwjihjfF42q;K*BOLIv-hVqMcHwa&a;QHLn8I_9CDoA5s@CAFUMF#Yb|bMy60Yg z!m0ZqGVg=RQz!nc)pEP@<2s$*)kmQ;Pm)LL<5g|+6?GyvQx%+T)k}o_XoRW+{?4~t z=du{Tb63=0yxL{_F6PD^yUTT|3wn`hEibZuR(a+wH>d4Uh?(N+*ZXPy_TQk8s;WBr zVrY8N0C@%bklLJX#3=fo(4al2+?xw#yHAcPUZ@V4RRF!7bsYUNgKB$|Bh4TUBT1{d zgcWd2U%XD;MvKjH3d1P5HA6^_*o@)%7b%=0&~!*Mz{WC+_O#oog@%8vIQQj3r_(pP zE#~DJY}z3ImBI$5k^;2W>&_F)ZVx$DmWK+N|Du#OwTrm6dRu+)BJ&zGI1CESd(sB# ztBt)nG9kU%SUOztgrK4re21Eu%9MVb(jc6F4ucDiRjPqX@I33zF72$yv_0Bo!f|f7 zLl@w{P8dp`d~Zu`he<{j(6|R$2NN{|bVjd9QmwXk?}i+sF} z*M&yQt?9$0O?iUtuy^z#Vl}-=om~vGwQ{L)JDSZo_rI7zo3nU5)tqUU;M8A65r0-u zn5W#V6@Opy=sSPIR=hpzBQn4aNRgh_5>Abh4-HuJ6q)_<_}gWsrABh@QFPm)ts;E? zY|6HfPJy##VJlcW1kqtvnZ{(Jm*Fq?2o}5C$4;Bi#74uH!tHMHz^=mGv*S$-b@k|( zLrV7(gp_#$laZDwv}|)OyH9@qOk)V57FP=|hQ>plG+Y__xxZykzP}ZBvVS@?!KuR6 zO!?n?FCGfKxTO0|{M}oGEaCG7KjVn=T+{prnqN#9<;DxtI6Nl3s`}wgVz}_-94#HS z&5Y#_J9aK(&zn@Xxn-C} z_u;cj#-{Mb@?7v2r=6uQ-UDi%p39`>A04WMQvNU+J*l*|Kd;z)k+jJ5pn>GH&W@Pe zGxtlvovKc6vqV+&QxceGkEU+MP~kzX^=31z(#r+MLt5xh#oZRY^#AJ=RfDWZmE)H)iqI3^d*L!OI(a_ILM3 zPX{$t-e)c^XW;BE1(Z9u?1i}o#dJ84@jusd%lad(oKTic=5f|2s`s;0y#2{F>N{df zBm%R$Vc0Ds>V3OayND_(m@#pE;DWI=!V27@i{U;=fraRzJ3w79bbK`9%Qmo%yybB> zpdmY->WIgoRau68l8^nemj;rr+WnqPaJ^T#_vynkjE+Vi1_Z2$#Y24i zYoTpq@ATUF#&K8FHhBit*S9eJgrWQEWYtd#g_b2O%qf^s#O@xp)?Hj0_5bgsnYQE~ z;+D*V^#?qGQ)?wpzSA`_NqWSCiN$7VSyR3_gR`Rm5n#6F(<0cJDmzy1>3+1#VV_J* zeA0N+a`x-KIRBfel{)w(Fj;M3y2R@&0W}B0<#u3JFJN%NouL?};J2JdGVCYbT5g@B z>?lTz`YDQepPi_?lKGVQqIHpFfkx!#kg<2ST_itr0iU2%Knk?IqM;VK8SQ0vNm&S2 z$yA&$y)>ce8h1yFux^l?mTleM+ebI{ORAkWjUrqA@Bkl|i;;A-%{P0qo?vDrq4nNy zu6!dri~;%_KiYHx^fljY?FoHGcJ~Mh71MHA!j?nI;SwWq8=)VkL4xOfN$wAh<~BLa zeRJ*zI^W=M=1U{GS!3ri(k7Q}vd90s_jJr*wa-qp(uRBek?8Ahb%>tk*2x12S~&SOF=^Pq*YrLvG<7yu5))nvYu% zJfxB~kRe;E_$A@^>*Ces!%tDAIO(_*+>(FAQXW>VJ`@USn?LJ$j>5jN_a3 zzImrn!S&WJjFJ9*>ut|JJTj%uDU&f*h4^?okq@lnIWO(CESnC~M~GKG6uZt2i=TQk z?A`TsUas5l&VIau>gmZa;Y!|(#<|+POMq&BsiS1*E~+gG&BA0ruSY;d*$=0D0xKX| zTtH9u;Z>HXi*3WHAUPT-wi#dC^B9sGvnj7*UXDQ75s10AeC)q6NN-!)bmvlbfXr=P zI0g=TD_V45<|5~bc7caycjRe`on$nwI-lk*6ZLffsxXb^M7lx`LhnrWzw!u0hQ0W* zms?nmS_Dz-W(_n5(L?N6#%}uN{EBtV=h|FLO<{vTZ$DBZGWv?lCpVLM+lyB*DJ~~p zspW}nhhgc2sP%El2;rOZJ_kUoU+L%jM? zlME>VQ{^m%24a-k{>nJ)qKvL~TJP*tHwv8f1iAn>6veg7B1vBYppq7fTxFb-34dau z{-b?{*D)K{ycm)Mf}S2^ut z^fWU{C62w9UYj~B^xG)E<)fzbI=_}tUH85H=L%lRgU+tN&odSJ5lDl^H|xWTTq1dz zEohn_wL9+CD1UKo)zv%Ips%+UTnUH}e;-pgbbnc~#*2hyTJUg&^Q!8bM^9KdPhj~J z(}&55*DV3a7t-V`d;v&$7N*!+524M$C_pCITS}#hL#RO)IwtkO5-BBSFvb(v&mj8zz zbuEm4$m#tb$O}j;i~?B12wYBo%QY}w#ZwUU$w7ldw3Dlh@i6}(iqK@@GAjthxh}(j z8OLXsm?5plcyGEYR;mKvWqKEp(zsrD?N9j!Bv~HCVo$QfcfN2fL!=gA#a9<2fe*;l^_%^8 z6&640;mWA&VA;(_NuB&LDI1_mZr*q@DN{-Le?1}v`jLx5;AiLDI-?J8{1WN(vulsU zG@qtfkhF*qw{Y5DdCkheU7{Wv=z9mh5UZMt9|sphMvH6QsOn{)k@u;iYAA-bdfyPy ze2<#cX`H`mviP@;ni7*MbXOikn_WK(K<6RW0xs}fdte978@&Mwtw`0%?u45hkF1gs`ouulCmr|Vxf%)GWN*-FQqR1f(|=vjW`(X8s`R|Jd&P7QpF6{9M( zw5gL^C48gTzO(0kt$Dq-`_Hp)Kix3jjH+=MmU3;~9V+en^HgoQon2{p+h0txtVN~M z=*B#Om)Tesg~#C)8M2D^_a6-P@-dCwEv=@UGhrDQO`n_k``<}IeFvzkcX`n}{|$6N zzEM8>9CFe>LXkC=kI6+#obWR{jb5)14o_1Kha%~JEJieke{uKtWq^XW-c2~{JlQvx z(d`{A&i_3fx*gZ-G+i*68Xbu90eQUr+dNKDOd$AV=xpR(so3INI$e~M+;(iHJ&*PV z;G>OEWWY)=OEEl8oMM^2*PL&)ay&8j78})uUEo$TK|U2%BI`YmZzK%nq#?wm%LqT} ze>lO{63G5Z#i{P&v^H$Y>G!!L^(z*o04XoH#_j?Ow8R;$4b`%<(>zo$b!VFK#Wi&T ze_rGI_geOcZTqvlGlOHIlrvNTgP^YYY*D$l5phw%m$4obW@pSKh$e0X>2i#_9TUPI zN+IIx7NHxL@SjHu6yfYV%y@)C_}!maG5x;?KQa1bp96>I=cGxj@7e@+bpg=lgqT?dYxzof!w2W&rA>blgzeH9S#0D<|voH~d~JzIUMcO=J_!O1yc(V-Lga7=J7&FX~(lsIbw?7pCciFl-b zw#C!ZwJ%SXIklU44^54^^_E_^?eF46JR^<$HMmw14YN2IH?wLZaV~Xw=+%HR^{oR( z)QotvtvH7QwMfVs8^2q=UJSnfmK_frEdq7sF7?2fbG<7xdbnBui56In zf4xB(rJ_^U`P=f7@rc*;G4JRI$6g%qoS)fa=QH$%q>m8~lpP%kX2F{aHM5v&_-^TU z_szwtNiS`JHs}JMKXu@|ryc2%7tDT}-N|A4~zaQjhsd zD0FV5Y%LX`6E=xCKxEhO!-2quHLOZ3a7p6)b&{<6S- zNz3J+bp`|hEq;w+D!Gj#D7_xX%nwtQ9cz|WOF^9a$m1B z;@-7p-pk8IB*-b)3&*Wfz|i#T&PqSaNoT5Fi(iT6YSZL5#ndiYTb5EWXSw{=TtI|Pe-H%2_-NmW%Oq~B@4M@jS9Pv>$Qqc zp}bxn#fEzN)Kco3xZdxP#KcPd=&`1NWn=MP3|9j5rM!eMzT>TXn0f4`ULz*Y;}E3N z7ftSO7(s%y)zWWgBwcT|_^9oi3f%``;8ezn;kp_g+j+HJN}un7`L{>neecH_f~fZK z?P7kJ9o-M56(U;>7%Oi$3w!Lek2v7IZ}r*_)h*yej6(y9j%r{-+OI_HlA}%>2Z?Or z|J%Tlq8AL}FK7rs`&9I0n`%;px$D3k4Os@GmtIEJz|@`AH6qfQ279h!3GqbQvN$!pnggdn#3Iu zDr?sKytERaZ=1|=l#5$|P!Y@NV)2@34g@m@FUz<^$0gyf|AT5o(6!C4OPf;`UPN}7 zE?GB{4MHjcUFfF`Qkw}{oG-Rh$1Nz(*tgvi5lxe7g7qF;iqV)_jIp&OJZ! zt;KlbDWC0qlJee>t5T;g8z zoB{d`p11l0P$fj;;tY*GHu7obl2QrU{q<_2{4enQYsy!E)8*sf-*~&MS`C`0U!YC> z3^#eVSAn@IR=)3!>_xNq9xAE*@z7{U0VT~I3ARmI+#@;nYUG}x0hvuj&x+F6(tg<+ z!*EHO%8@UXb4g3TN;ajYD+TRSM*FQYU~r@0!lS@M$AJTe-BTKue87Z)FPO|f%Rp~> z@kNGM{VQV5!AJt}Vi_seD8#LuM^hNZlIOBLi%EH%lu)|y)=l|7pB3(Y9T{}>POHc} zq!JCR!J^#X-Q+4g6GU5Lk*n5XGSaUouTiyB0E`3-VIpy+-RbCy!tFBE%DqL}bW)aa zx+2j!(m?&JpNat&4|WVOT5d5-V^Qeet25=GRl@Yk8PFv@P6I{Kd@-VpRN!OqOKZ?o z5c%;a#Mer%*8#l8etlm?{YWjAohWy9v^}8ydy)|U`owWF##}D@`2NbkcN&5gHcWA` z)QBzo7|sW*+VS%I@Y;$R43@pnc}KH?3xImgm*HSgM2X}ZHzY#@Q(N%7CIj)vjKF&_ zr=58v?PW)yy3!ll9uN45UuCK!^gX)q3%N`C2ghX|*P+GPm()hWqjTndr9_D-)#>$F zHugS0_0?w_&S$CwIQ8vK76JP0yE>}tpE9LxrLQg#Kafo#7_-QTq*sE{fit9wza?HrLR+u=Jy|yU1$6RnJ^O%nM*CyzxpLyhdc@NvuRHb)+K?ioU>>p!+ z>T`e{wz>>5EK6;&t&cP6R}K!BQY603YK;Oe@qt5yfQrXN=Sniw4flO3%b%%ekl7Fq zR;AfnV&fyHK+LN|I{w}L_^a89%+ee!lu^BmlpM3`f@j!!L}tT0StUbG$FX4Xgy&&w z&Z%wMBXSW!oZpLHT5%gjQVOoQ<(bWn?#N0gsWFbfo(+&haJj7=^m}w_h0;k_WQ%Ij zD)lXV3}PdGS<5*dFXm41UK5AaOO?PyYOF<*t((A|4tnsy)5WGgE*8F+S?nj zoA5QQU^O@`o8*O__XP|szW@B5HHI~BW%aqGH4+qn{SY8ApfYEu^VHrzYBvZO=2w@m zQ6?o$0k7qU<-SZ*R*;AzUY+%rAh+JFd6RNDbo;b${0}PO%r)n0Ji8)`I`F=V!2jtI zn&`G3zedvkPd);BDbG*el|22Ssu0Cg#x`zdOJyE%usx@NL>7&S^XK9;K*Cp!=I6^C zz7M@t`ajEEl|oKmx@|og*YbCLOabok%&N})O0BsffS!Bda<7jPr9THrwg^0LpvHU8 zuKK>i(+IRChD?qaws-<>n1|q(j?o?g73kqKee%sN!+{wH042r!g)kHwqi%01grI|> zM7}%a04JyCl)1OFNHFZ`m0A$J;WwTPX^}hw2=jiF z&#yqQd)EbFlo|zn`_{K0A@JU$?d^hPe7w^lL+xQR1?`$%t%rjKU`6=BT+QphIHG<> z^R5|>NzKvQYJIxHb#r84EGHdoJlfY|~u6w(ZiIZH+ zQ`+kSu_f^m*@qq87&Act7rbaL=n=-w*rHPuBG0~pJ3cT0$e;L35MxCuI4K>dP&@1Nrs%j1? zw<*7lfvr%i`;#ELeiAk>8_I$IqPFD}-xhlknn7 z&2HA*Qe&FTQ0jizOP-YV%HWNj`k|VfK?)FS#OzgMnCQf)dOFVbhWL;aRZmF`xb*(7 zo_@p?)@Rm4>bBO%RR&gkhAnd2Xh(Wwmc4*1b;{5AhzSmx0$XVzi#>Jn7rpfsXI2yB z&zZV}KP>P_yM(=C1Fp)m?_@hcM4k*EgJrbtO(CJl0GN{AF?hbjYp=X#i+$W}OqG;O z+9Zfkfg7E%PX3-aEK z_Ii_O&d|!b>;4)oxgBK3$Qpa@Q4#^flp(<~Zf5+5%y@g_nevs(bDvNsZLejQW+l?J zS%&=y;;O={%YnAn3$Pz)R>0bU9C=P_tM_bEO2d0U~<j$v;9O z-%n6>ijd%7|0bv>fF5k7g~+yfy)Nn9GlTEZUl`$TEriP-%-qxpRRE@KWIZA$krZe#YS&0 z=Syw%m#fF+_7?Rmd3V+ki8wyq3fleKHlotunKf~%Q!^Vo#i!DKohLt`KlxP|XWr-g zw}oQvOHey)4+|y^yuuFS zFEYmTT;(FI_Zeo>7m~Zlzivzg{Y;(;db$0%Jrmr)Y!j=km4;?xU z(v$Bm3t~@HyS&$qItk!o8tJf;F+WekT zE7gi7V%QAh6mH_I{|@5Ld{;v3_g7TBbW1IXnXC@d->jgZqPk~3z%8Hm=V)D14ZiPU zmA4w?(P5mYdtLjn#yo~Z#7J3%V-WP?n5OdO0xyi=Wr+8fwie?ztiHpEf&CiYfWD>s z&)(`#LI{Cb_>Bu_OY?|Jwq_ykow~-lyccLn|e-7oOvyO&OV@+wi71ABD=~6@}%1A zA8nvrQ=>^qqFuxT386Wf0BIO72aULxdX7kvWVdVDd5Qpnq=DvB18CnW{M&7qy?=w5 zjn*>!q{FutKqrCg5hQ&(cl-H=M6J*2XB8b|5{nPyun#1x3P;#qpSz8ALVZm4e8J(I zI^kV=;Im@gW0b?fI3f`1PccI!gfpo6iBhUwy;%7fTcf0_%R8mYkSJ4o-s5juEfoAp zxCzvz&IKu1DSEIQ!c^YUG4mnO@t@Q6+^pv|DHU7?J4*Emv;xssac}UBlJV>QW>zo! zy&Wr=C2?<^W0YG4hELcy;I49ssyScws#z_;jG&n~$Ma0ol_WuNCZ*cklp!$L?<@=?VBvsD-kz*B;Wq(U|fp^Vq4 z3~RhvaP6IDfMW2_QQP>GIpr-~aZYc{##3z_&d7V$%8k?mtHKJ^ijAJ0rR#3XvCrW; z1S7-z?FiiB2(%3({zMi;KJ9c;CHN+Ef&dZYGDxxk~bd;9p0vqa*v6*D*{@*3L z%rAxI9DnRzKc7OZbK@;NNGt% zj6p_$UxpYIy=;^ADOA{n&BwI%(yw-w4N|cfoB%^oZc|QboZ|N*AUh_!Jq%F-8nC@v zf_2;vli>1a8+G@$Z(chL%5e4;GmqtGh;1_uk|-(| zuVlMg5W{2PV zRJA+%-V7XjH(?HkY2Cc!@iR}+YFEC6{P9HY@`LOBI7=h3?YGiRd5CR=k@T5enw*++ znBuOxKIL7Jt0v~HS)SmHB!6JZN!oitwY@MRV(G2$;Z4iy30M(O9yygY*%aM z*{CVM?J=@ocz!lg<5$j0qqsy|Fvk;U>G0`Bgi-(TZzF+Ik^ESgmWIi!H7xj4;6bcRPVLL%X6; zmREI1gfCp5%*Kw}4$$*8FO0Cp$j}<~eo%bl>}^h^0GMkrNWsiKJUBoB;>)w-&Elb&<$0 z^t{l+oJF9p&f`PH)f1Ff{%Gh=^x*$V@qK-Ka`$9%T>xUt!<*gw^Fs;{wywYQG6)|! zUcqih|4=Fl%U>UrGH~dJbah%plT^_!$)JTAJkx=Uj)*TStRMibKi$`NlFIGCgPG$& zP?qCce&gg<4WNKoD9>@K{6oA@LUY}$GB%E~M*5-p;&U-ANm3?@p7%ywF>18 zb46?J##d@SgLohbdvYq=+@226+%#Fcbc1u$`pM6Ru4DiJ;BN>rtR(FO ze@}Cv3C;5ky-5!ey_cNk_q=w`*3|bOQs-UnU)58!v@2{3QS5E3Yw_O=_$5TcCj=tz z(mS+NlDhXQ7i&kgB*Ttx8Oj1#JcocS&0fT1V%-?TqCqTkv%~C?ip~}EcEw+QN z&a3HFOdTbeYU^uR&yWI>DNah_(vReaplajP+l{A?N~pV>ujM%WwZVO^w%aq0*SODN z?d~AA#B8#7wVE2U)W>+c%MatSAIM#8f5%2qnyO0AuSBO`jhWULk2PN7nDFO{N=)wo z`mK8$re{&86Ln6jM1bN=8sI$%NGR)v;!EV#y~EmNb;AeCc_QCGnL2DfK6`m%;ysy- z%*R$UUKOc@Pw#Ll9E5p;rJjbJaM!_7b0E9d`tD>pdI*WJWZ_nTw4S|^%kKS2Dq*F( zOyvk>M=@~~iOR*~Wd`SqvigTLxen*VWbIakbu;~&%foHo5v68?%-T+yZCFV|VeS-C zhx9hxc+ELRTnea(4+Tvf{V0uodmx44E6<-^;idRLjDQY>eHyj~Yk3#DdVv+dkKU{@ zytS=H4EyRet40pxxDI5@DmQZnCc??*XO6+o>duUIca5xMsoH{;oDZSHK29xf_&a`D zEUw?Yb?y69i$`4$v_IbGn2N_2;1{kGra?rjL2Iziy|k~Pr$69ptoD3{YmM=P0LKc{ z-t9Q~Mbzt?L4tG0%ahl!i3sE#soP_b(fU0s(0sfndL0`Ua8uyO%nW^y(}!o;tZQyW z{DtTz1%2tqfkoPovcv_wj7?N`FK+fFIU<@Ay!K+jg^G`90)U zEEULfAxOWzNF;UkjQ`X8C%^0b&uG&t#n|U1(})G1l_Og8 z9Rd{lHSOb*6)OO^4CuzfH7td-f_{YqC}Q6Fh|r0IQS>XH44*+|qrcuQtj=;IEjk7Z zW!5lQFO(oF;z_11kB1mHV?3FS`~KRuPD)OkoKmF5%ri*fUo4q94l;g#l+t3qZoAQ4i5EWHdX2la~0u%I}EWvH{` zHf`8&XYb5Q2wVV7xUR~TM1-1|)TkeO6Qxw0N{RmRBL(F+l9C{L9(GYa;D3U`7`PP& zN@g0)I~zuzm-#DP# zrB(Yp?J_6s0V$fxT^|MgwQeyzcvhY_`C(xi$$)tz{>xf8GED9zuxh51#+>`jMdz>; zSEjx#*&7@}xR#BG9ogH|owcBre*BV`<7gA>1U=j_ZHqp8@jFVIj+f*+My zWTvJf>ZLpm1mJhEUGpWhQ!oDjVc;$VWu`N$x5Zh;XURGK`JWJ%{#`19P(NuGwo3z} zU@R>4%Qq6L!~|DFR)Jy7Yu2A;n-jD%PVkuL1=N6bl3Tx=hZ-w$41V-Kw`=F$az1Fz zmVFZ?aRNj*?M$UlJk^~tb>q}T{&rx$iTc$dcJGlMprm-63jdJoAEa9jmqB}1mP57QZ_L4|8v}$ZkVE#rlf# zTdEnrZnOVeEh1+pW| zy)n>@Wplbl-MQe0XuvY{N>ZgyO9p|?0s?&8-J*}53mM?&tlv>U5dHTVg9?urO=s1= zU>1WoT5&WDVj(oZWBPu-9@xCv0y=G**bmwiGOQQXY7BQrCfWiYb;UbyJ0s7p$2az*#ztZ?AEh~n7;X+TW|O!VWwW|eJ?)SIEwIpj7`jACs$csZ_M zq-3jn%?a7@*E+z&W++d)8H&_Tl}6J}l*bIIfvk(Fn6_=%s`r=BsQjN3mK!EOjp0~; zMIo(^3XL0jYiX)!+y+&J9|X(*E5DlX@6;s{C?0SydMX5@>v+Rfni<|POy3S)R7<6^9fOhC(RjK>up z#p>TraZSc?we;40C`8b`(GRv`-#;)M`8(yU20HNB$6MSyO~QE#%NB*`_>Zi zg)vNXx)Q|m`Y!#qH71C(q%n!NEP z2iF7}GW(9raFI;ZOE>Ggl>={>-dDYE@oknz4qf*Q9v(z4Iw_c#qqfZ9U%$3hXbrX0c-(-kvIzK>&sI65#hQujfN84 zXtqpWt$_N&V}ey!NjlyMgb!C?Daypjem`+|;dn90b{Jy=C4f*!Wqrr1e|NL~n9n`C zm8q@-j9D+mpi^vGe>mg2zwxhZum55_CBtMuon;Kf%WD^w34;IXw)@_SJk4~o^jm0i z_((#?IaIp}7=glXw~GwWC;n3B<5C0m4ax0thvkQqDgaiR-pI#S574hn%+@Jny8m7{ zCPQ5ax545Q_9SefN`*?7comP*;%=p3nI&bDC*2xglN21P@6`_>Lg@||0cMe;p1`tq z4gsrOWGZ(Ae2(0L+@;YeAlUu-HsSHT|4Y%tgbgL_k0x)nHu3iQ=2+xw|~; zi@qhDuuGbj-~exSKLa^-nN|41l>A4f?7Rk*KNSfI31nns9Kb3Gpw9=g$S_cZJ%pqk zyqv1+EZ8RJ02?1xer1tl{gU{}It{({l`RSc-C&jdQ&sX1{);A8kU{b~jEGrb3Ki-{ zwYD0Oeawen+B9n3^|g&i{O(2{0HS_UGXGj0euML$%hvHD5nyuhgH!qmKQ-$8A@g8D&`AQdnAx#@q_De2}AavBL z(QbMY@bELtC<8aA`{`7RS$I{LRlu4eS~dul!RFgm+q12j5XMY zH{q|Qm%LZ{xm2a z@XaMbV2J3;d0dpqGxAZ@dc*mdSehD2rg#=0wrqj2*{H3=x0!&}Ngy0L5+Mg?C z_z^9)@!82C7hJZU*GiR1sM{654lPkP4$C*V_6P&i^{Q;gN-stx_Kl5CHZ8oqEJOG=R;rH9`QqG-kZvA&K&R+d1 zduJopp1(m%!wf#S1u{!HyK{2O%9neIz0m=9vl?K##Z$H!Dwq;z?gkm-iy-CcAXt2! zlKNFA{SKbrkr9G!-@Pbm8}zT&uj6|L41I+&N`96C<-OaT{H)*E+crhY^s4nXFZu!V zH;4oKrEJhD*3C)g=MzOb3_7>4mokr6Ag-}Iua$PD9B@fc2}rW{B~o7EL#v%H(68tT z3BnnHH%S9r^x*;qyD;4kwW~AjH(?BH849?}yQDbqgT*vO!c*2fk^LstO}+5pI8H4p z+;3hcefHC25&BKGmO6m+1XC2mMxW_8%p9QBRb;*u>vU3Fw^*3ZY|{>vcjG) zc1sdN$S^%6%(jIvT0tv{a!rs6`a_^)kH5_oVd$<>Ea$$KQ)dc?b$jys&UW(SOoU`U zRTPxFGF+U|DJx_%Zu0OFI=B{}zYoE%qjB9BuaaZ-KDj>Q@FBx@i=dB3u@?Ct4cc+L z^D*0oUiZzqtn>p$j!l$8X9$dWAAt!OZB3eJJjG@oiB~6N6zx|;-!t6BBXEotH}QK= z@8PPAQ2j9KQ5&G)i6VDUN=P^;_vi(!QklIDnmEBL{+5@1Mx;f$1bf5{PE0=tb|exE z+ude-hL~SFu1mZ+!RnEC zV{D0$mL5Z`|25H@kjFs%L#yafUfY(%vXLXrqS9718mREaMUn`F%gJ$Yu5bFmd)FoG z@H<`=B?`Q7G+_Mer5q`W?&8|230p-**i5|1O;#Cjm)@V8pTG#K#%!;sN3`4g&t!t31vQmjWCOuAeJhdfX2!B>6t6 zG{sI^5p}A8jk$L^*kL9q=1RpQk43YeL7#(i2^Exr1yH4W?-52V=kV0nlKi_X_b~s> zA|9CQ<+sHA*nH|<wBfa&jyEDtE%75 z^^9p6&W&i*SvN^*huu%861e@lA;IW4>bLp3jvqFunqpO++BR=E0>(;l2K&Y(ZA(k6 ze@36iAza<0RujB$Dd1L|Z8Lm?&JsZi_CtrufLMkx$*ntr{Rh=UY6rEl-?HjWm(Lr< zf6c8j^{m~*9e6qhVm}U5r1?*x*F1uY9QPByE|{jihxjVhr{x0vUh~~a?_L$DM}wO2 z8muG@`DMOE_|giB<0GvwjC1#Iaa`mwEL7Imhtzw2OdPgMP%ur_OU>>Nu%<4h`tFr+ zRq5;al|GGQ`T9a^DU)h|Q;a}*hMf}P+%Hc*U+*^4fxo%|;5+Pv>AcU#6$=Zj0I~@9 zhRse6(B9&_up?361o$;xHcYc(1U#LNDk+{x>swhcC%#_@uU!;Iy1Bi;2#N9*< zT266}vhtiaCsir~&5-ZU`{^~`*SZH?g5{_VN2I)D&G}D%$UTIINBRH(?fq8MBTGC& zOe1hanva8_U=XGq7V(8sw7Dr%M8VN6*;5GuoI!^-gikM3y6g5l@-hyR`%n%`V?12Q zk{BYBhsO` zS05F2O50$3BYF{l+8a7#;iFE2^er5hot1Fq^j|P1fw*ALYO8n6qh5QpF_02QPo)!K^ z-laYAgq$d!2pK;7V>VUgdHM-0EZmqesjvTtQQ4)w&L!N-Ek_W39ni|v9*MY_`Z7#h_-aAdb!MdWhoe^#@|D0Gu)KRE z*~suGu}otiqX9#WQ!|YhPX5hw`zIoe4ut@YJ@SdCl0ixWQKY zSloUwoDr#><%7;cXl_X=>2NRM#?`1*GHg~{gC$t!Qao4+JlNa;f5S=NZ>F{$WW*3; zO-$0<#q7va|MN$|Um@o4H*tM2N)({0^dF#GFV{G5l$z^O_e8ihqJ^_F)hX)sr=nX6 z=~Pc9>phc(2AfMf)H<78a9_CoW`i{UPlL~8irkkzI5(GCe*PYG>5Tt<)f$mnGw+~1 zOJpkHIXQ647HUr|PhFRKK4_*keqTS&-C39r!mZ_*p$aAe#Q*5^(y8N8?lMsP6L7*whT|E2L_NB`Pes}gx zmQ#R5I33h#VR z;_dH|2DwL=w^2M39sLj7;Fs6>&C(V_Bc8#eb^wDJ8O1}H=m8=E1{zG1f80&Lb}>cF znGe2?R{}_d(;^g4J1qi`luA0*gG)n^LG{y^rFuS^+lcIR@tc1QP%fWrj7BZK(e$-$ zp{d7DjIx(SQR|z*Hg!ci`tkK59gdzDs*m%a*`UQ|j67uAoYBMIla@#AM!0)xbPrmB z?M3YIU@rfM{Hh`TJOaa?rgP~#FVQ}dnxF~nRlIRH0XtX$QRf#st#y}RLN}U-4rwB0Gf+$IIl6+s-Qx% zmdJ#&D?qZ=euZq`2&R_(UZs|cmwOBU-@C1q2_lonYD&UgMxP&E)q{Ojrukj;LM1sW zrOuuVV6PUdtp`PAsamLQ3o5N57Fh!lLnCMBHQv#z{>;+{>;1)bF{fuw@G2~gF)fRA zGumAyN0@qYn@4G9_O;3s23A9nxqaVi5L?`2$lFx*l;_-Ie2y1I97Hjao+H}Oa|a*^ z)ZazfDB}#>PoofY9E-B%uBeu9KML5-XSlaSoSzleUj8u8MTzstC)v2NI})8+g9K$F zZ`wnV?#C<7M{CfZoGLZFQ+v2}@Qu@M#VW2wRzvIta%(~3i;bm%n}bw*52Hc5{8Jti z`znUpbXPr2?{g2i;0B+TI%BOHN(R0D^j$uaZdc>Jz@*xmt_nvvfBHQRr=Kk~LY(q# zCxTd0esK+!?xB=IU%S63pPYTls`f-fzS*5{KY|1kRbiYSZ`!+Uey6FVHQPlAn322Z8=ikyCiLwHf+bW-35t z@e81bXP^|sETjgz>73ookRtV%dvP6J)@o_t{vN_U*p95E-uP5J9dpK{L|tvg+$nQ4 zAdu;si)L~#g``jBAi(&dHNMbC&O>%{&wW02efTt>S$l%={wCKvv6Ub zwP9lcqoB0LakXuvhy`T-kwJ%%qPoHU(NF;vMC}kH!E;A{H#g%0@kF;YOI-h0Xd~Lh z(Qw#hBAbJR3IDtSx5(H+D|Wr55JkVhCPt5X&`XCOOL$E2v8mo$0WX1o<)cm^i%Swe z4BOMHY3o2a%YdD1y!Q`fsI~NYITSi2f8xZ2<#E!}s8x}HfJT9PHfIdVvZNivL!}B2yXd%y6tjP0?B@8`g=7J=52&gLo`*SuG^3@b6eaS z#O87k5S9jx-lA&Ww!~_gGICa0@3TV=>xt?&f!wfb@{aD@Kzo`SlUm{SdBkQQ%pjzL z;n(XG7}cAd7`~g2pF^uv+Ai*~A@eC1N949b2kbj;%4O^mz8QY+dVAwA-RcQVN;3i0 zSHa8dD$m~CPl;+|n}F;=7f%LZQ}HkiM`0IgpbBd|R@!2#HJLmbrqAhYN=O)l8{Mh0 zasE(v*b;(ZXW9_MbE{uqvi&b#Jx;OCHjJMd5EKgAou7P?Up{TurBB{Q5c`#z7Nj9H zrsi@;PsQ-3UU;AGQ8#G`FN)LrHD|{5B%*iY3zMOEbt~>Ke*A$o*-WXU!5+hs zn=ta&2R~n-uG(F58akY`R-jCboEC@%jeqA;>Oz~>busV!us3JMK7SyruaEi&KOr!DN6+M$!%oT3`O{MSQ8n|L%~n6fU7{UROyM{J&c6EvoR^|%rN!6}H1q*b^? z^09@Lj*6;yI*X7X48bZ#N%PU@2`DQUp;<+(t?UaB_8i`f zVSw>&+8w3xaSzW7YLr2wli3uH2=&Z_J>~L!BC!EB;wHRX`z0s{Y3c6 zt8MoNuT#zF35Y59m9QHwtpKq_QUJHwjoRGaRL80g!wDIYIx(rQ$2TZG+*CZ#a_p%2 zuP%LOxj;W_a~PT8kz1LN?&0Bsp8Qt25+mUSD6+W|whL-yz!!?1n=$jV<7tYgMde}J zQNO-z-9mi$ri@9eFVU0alb#%LVI=WuS_-#r6`eX9G=jNHH|0`*Y3q4_Xq-jF+_XQL zxKnc-`@z?16Jk_e6*G}KF<#xBasFEt*$3=hmP9{{aVrkG{9Il+8ZZQCU`JUCKVA^V z*4gd|-gC(Pk*NG)pV*Y>#CUbiM1pbDzs2RiTjNs{?fJnR2@^-sDZgLWtL-8>+uRf7 zOwEbaO~lu^8oVj;&VCQf^OQ#HbN9#~k#=~EI03G3dXPLA*mdC5^cOv(F)~OF2T^V| z>3;@1E7oC!v@g2BTEfkzE=K5^z5?Pea07)CSELq64kjbv)`Qgyxwhz+%AOx z-aj+SUqxOpV=7CYY{_MvE5!Tz-YQ^z+rN!rN`u4IMHpa38urF@=lJ7Jhr0=UH9U*l zl0`qGCs6_y2p?<9>e;EJ=L^s$Z|0@aUE1Z5qmH!t^7*57x~RlkdY7}&bHk&jY8{?| z7Hrl5-F>^ey`G~_*xt!1QSKXMxyEHavu2BeChryRk8nP$-;046dFuMGQxc!`srG8xDuRcWsA;l51w-4Ch1i)UYoLSygK zFL-s#jCnV;^3}uMy;2-hO3`nybg-9|GdM?1#SnLv+aK3P-0RfZAn(*D7HL(Ad(Ah} z@1ql8+wF)7GIKl6jgI{UYBSdx^WN|9wa=RelZTcQ@2^u~n)SD=(|h&}E=9-MLue8w z!P_cD-cJ20%4=kE3F#98?K{E(myBWf^&!!!M&;*8$|HVqm90gvX%9HZRF*vq1?%8 z=5n{u=8ddGLtKL|V7(ZC_1yVh-$QkEsF@R$sK%s=i%B;_rG`Ua1w9avJg2Tqrq+}J z&T}04AH(8pi>0i|({wYP()d0*yo7v@>{1Emv?@ois;IGLH$uqR4n_yU!~*oKuK3ds z_$$*;L^zaOYA$Xf>63+YzXTee`;W89o4#WmeHN^|Zrnt}go#dyZgO$+DI z6LtT&qdLh)EJx`djN(6;GuZ>5hVEynB)nD{LQrQ&exdGcHTw@TH;wuSnLmrECl1_n zJTa2FUJMi3iGJ|jHHE&!BWwG2NCGUClR+Qdu-lw8#7S}kj8B$2$V!}lcW?4^a%+4d zEOei#pnYM2NI=DNdMDY@UebL6f2koxeG}7E`SYZiC(&2) z=oK)3d|kLEFW;YrYaSZj`ewu^nj}D)vkvmv6DjR_y-j=_)o408mG56}ShWa^darKO zOz~eUV|LEmjEA_^Y<{V2q_YT{kmRyJxKIpnGXV|9+&LAttcc?7B#rnr=}dBL`B4bH z{F5fc>0{OvQp`A*FC*D{&fjI%6>=^Y9VnCY^)Jror_t~qwW@Jn&ne=xOb=3;-Xp*! z9N=hs5|u7_Vrvp5%@xVr%=NUS&g1Wd^VS&h#(-!UW4!Zy~jR|{bT?1c@$>ud#!b?>%7ij z!26DYUeknYvF0gMjb^oS1w}^WMKIy3PZ}hxs0~e1F|D@sf!MT#xJMyDDaQtV^@D2C z*u;GWO00aQ%Q;9$>5se2)fqWKZW`$nWMIT-q1%=6$#~vR)#`Zpk)T|z*ao5apfWQ^ z3_1Nm|C*2b#lFoW`N)uK$6;l=cMZGz@(YrBUmLyZze|em&NdmH|LOjqeTX1F{ad;N|5Fx)lssoO*hY*LeCx3Szp05>c3Jr}9E1iU!1b^#t9j1@-}GZT`R}JGUZ*i64f+q|bZb7qQBHtr@Kn#3suCOOz!Gh>q|*K% zG2-kJi74r}x0$=dY|(&BMyEP^{>WJi-4S}glkCmxYa;Y;=E$`3 z@t?=ScK4b;$Ay=<<XND1Muzko4&0@s?Rs+oYtK9Z!&hCn2F@Y{St zk|m-o&EyWHeB=h@ip+zU;^@1jgc1DsU;FAiDSZ}=WZX~`=P9;hv$55czd!mvIC=VHOSFA)Mc4v4ptvWVk;f<&~Vqal+E^40O5W;UF(Cf?t z_sz?E10R3Nm<6$P?2UR=%@#{>2vP*<5-&BPp43eP#OzQFL481p8~9K1a4&`Yvc2>Y zl>TEljz$J|5CHFtSOZKN$`d>um&A-YHkBk3Cr3b|q?9t449+9gzg)kfQ249R zX~f}CzDLrD#1kYC=#+j{iy>j1G_vXmQ)Aws1N4tC@^L0I8rh0Lm~dhG2k#t|Ml5UX zD{FcvMBDw5O89eYkuo*6jsb*$Yrbk|{{biO0^evQej+ZVT@7Wmf3^1!DA#vE*9ZXnXYL=7MFe$l@@Ts^Kg(w4sFy(x7FFSUH=Roj_O~NYNn=;IBRWn5X6_zTlL;v0 zj&ez{`wTeI1peh)OgiCQp*`Z`<{D;{s18+Q`r#2SBWJeFt$8w+8&7+k?!}QiGTk);Wt{oJmM8)ktR~Eowk}Eyb&(yX}v^#ywa><0+iCuqJWrO25 zY4Z$*1#uTXjYnZd55DK5^<9ii9Qq`eLSHpq&S!)Um5NHiNTOxY&33EjUei|;DGLN*cr={om|fgUHw4oJ`3Ib@GZ%ZutJjhaN2C-})^1go z9ZE6L37Uwfw&$he7YLiW`NUIxW_^lC73iVWQ2`?csz~(CY^m5ux%TK$HGM$lQlpUK3V1vjeWo_h-S({ zF2yT2DKL}8c};sCC1#6N19%peXyN197|WOoDh>Y3JhPl?Ff&o-^hz0wfD~2kJDS1$ z`<&}UZD#h{L)w%4ylgO?wyldJDU}R$=E_?;hY`A3Kiy-e;2>9}oFPd$&3Knonkec2 zqmqYg8{grL>UT>{V7b=uHLiz#h5q~11FpL=)rVkrp7lai+310z$rJWk2G9QPMnE9n zzj~00sGz%*|2N?eY#x{mknw%}vs`rw>v;sF9|Y zpn4mBz@ps2=KShMY9iKo5I`$E+@q#9+U+RUPBK-SCjWa}lLM^#^6=wxSZ6|N#RBAw z&1is+Ts`2mMk_O9q`ba1VRAD1_k1$YJL0wJs~;SIQ_7OaZLbH)6Fw9S@NB45h#ba$ z&q)!{duU4$GplA@ITk|&eYCF>W>q$iUnInz*tO{|Zfbp=ca+(9Oq5@z5`Oly>5l@k zH=v*lhz){4GhsM4&XE`QzJ0jIzz1kp8lZF4&9Z{1+hDe7AQ!wAEcfigu zc-bT=yYLQma;fpE=*=7$ED8W%f;z5+XK7VletS39wea3pUm*R2xy4PJoJbF__db^h zh2yj`4qRB^nv$sSW)!8SN&}g`ao0?6DS~_SSqAbLct`B>P|?c+JZk7RR9MT2hFk;Y zif|?J#Y?S0wbW#pkaY8`1Fe>~Mz=D9j9KcUDzCbzk~-x4MQ0{?J~!7AY3*2{HqT?Q zkTHYALzaDmkemC^IMqBFFLtvhdl*$pNF;u&e!zOdD?AS|-7y`$CG~EyVPCERq^-*x zBfO~7XVpcn=>{=n`%SG6j&^i5-o1sjI_C^Oscq%K?`1EqeqJ(#W&cd*5wYzO&?u3j z@5+zYi%ozh7-01I{_>3LtsDUzpYzKP@m+!6Gq*OR;`{F3viHQ_{yw0l=pm}ek~*X+ z8Jlmnm%2hqRiw#2|J0nY-;tU(4^7Au+jFyjO2qjzTS@DU*N}<3P41!RNfVR z3uwFl*7JOwCw;(+;%k>h?%(lMaWdPtLU=$UI_E>JArM$Dceq2j0^dg9=#O*jXhLq< zU9RA6K&I!Oba4fl3F?Etd_bjKxq)u{DnJ?U)M0L6F<`w5_++on%Ho$pn7Jec8}9^A zle)MKO0?t>xjKsgzta0$Oi{L^Kk{BhMpH>%8`v=_i`{Y=&`g9IC$mV8*0Jy{8#kRw{o6td)gV*$CgW*I{To;Mp5G_5y0oe zERJT3c={_>^bWJeOx3CPVK%)FJlczG;n7yK@m)WX9Hy#J#{FnS#kCUijIvI-&d?t@ ziS59V#_V@qL`pc#)mvRY$11(Ql=KD-`FJbNj&tx&Sc*5C&_^4;NKX2I$;8EoIPy{S zPYtlcDuI^qwe`9mpQwq@(gtAWnA|3oe@2K3T%2~V$zJLwMU82_F4~k>n|G3{^}KVX zdx1cqYAupG-erX?W%P z$hlwtwl>=Hzw#%#l89$n)vp!7f785}pJ=hZWyE*=sEQD=I%gfWKjnQCR6*xuV~F)nfkqj>%S0w?1fIOueTXEph70n2fBq0+k>h0us zgO4o@%!hwrlVw1m96)}D{ZOQ3ogLg@XZ9rkek@~EG-^^}q;%8d0T|aSixzK!a61q%u1s17=mR@8E ze2J*2XeqBPRW!7-XsXlo)84cNNVxjqkp)Z`I20l2Vxwrsk`T zL!cV6snD0`y=o_|yvg?N z=P=oiGM4K=vHD^z|0Da=jp4LJN+4}W$UlBPJ=jzpc6Yaxkx)}EVAf!LOdl9>*}Uvo zdi9dHfpLOnVjQ4Ls7H)cObc7+D^GS+nKnqc23N(iB`yAFD-e5OsoC_NT@UCft#83U zqExMpSwV4bNQ;BYLwc1u71+)Uwx5h^wp?t4%G`TETV4tnB4I`}p;yH%j@8~UP0#{T zdB;iks`}^4j{j*H#Z`5*aV;Y)&O6IhOP1$<TRe)_;E!p4IAUH*C(+clgK-_MK3-n&f%O7is`YZG~5OB(!jUb;BXadNH3$8sv42 zaTCenum%K9HCpL|4kLcD@oO(}LpRE3vPd{l0(uogEr>uWHPh4v3 z0LG!Zg!@O|BBlM0u&;4iJ;97R`ikqj;qotc!*Qnb)%AZlEU!K`PrBz-vgs}*iosbL zI#QXo;tT|@X{%mwx)wKomm%!@&#%hm7|l$a*8i~5x-sFSk`p(DF4S_eXLSK5ztXT0 zUUK5a11>IC?LQmu*e9!dFb<2*F3AuO5Y&<>qEFSs?_46#)PV?Cw8%}3ym0?@Arlb+ z?A*`^H4|`iRy_vW;@MuW^?g!u+}K%t#hh;`Y819^U0NilDSFqC?f$uL$BY$Abj7|W z$hgbcE1T-EE3Kw2?wM&5s)NYfG>dq8Q^=g0hQR1#rp-4l+2v`|JGgL*ZtAZs z;@nG;}uuqygoKJHaN1*hVDVK&q95S&jY2c#}WP zAqIeyz4`|)Y*6sBbJ9Br!zjQUoXePFB3Kmt`}eo^Fc9t$sX^_=gr@8LerCs=Fp#@e zgi{6_Q@?hwI8Yq-2;JXMWDEvJa``!L#ocn9>EqEqV6L{L$F6d<2h4p$?lyG<{Rc`0 zu`KZGRCfJDgrrksfCh+&LCzdco7r3JtD|R#n<4K1@f{hcnmHz;m-W%b>s>F*n(7X? z#c%VLs?0j>l@_{!4D705pDMTW^4A%AAHqiOnWxT-SRLExE3~-y05t*CANl0;SmFOh|i(pv;NURO2Q$vAA2WU(a{2E=ob%jvhL) znXvKRZ%IQS?>?VcwnE+r@N+uG)}cjqOcHucD%~QT`}5Il4EzhQet|zeajQE!Z_sJ0 zb?7$X9s1KxV(-bBU*@#6T@C%A)aK`{PZRWLl72ItNSm3y=A`&gxpx3gg;fKCt-U}=H0q33y6vviUpU2|4q_!^&|Kqv#T zku~`p+I&3Lv&4p303+Uv+Z01aQIX_JnL2CIvPTU8KBhv@+BgHUzMXBot}#i%X+9_vOvJYdBfu{x@O~tyhg>L#E*O^U#z9{ zAwtOy>rVyG4ffs=ghE&c3@`-?Vz|fC=tO`NsHHKWw%ZijLaS!CaGhXLe>OXQr%jt>t zD~-hx*2>q?S%}B0Cnd76E2}5Hto{+_v@0*GG+Yvx=Ny-pSrBc$ZkkT}(ymRkrfuhe zFTxz3T_yRjoEyfzo<<5e#s^^J6d{ez{xLO-B{M~^yGg1nd$WCyY6imzW$J}YO2%xIT z$qW8SF&H$>dc=5nEW<$-3tvz7kV*fMx?5_lRHmGF58OgV8GCIA)&%80kM#;740YHBXw z!1+2RWIIGyhYX$3o=SFJ$JQ=tRi~jh)hbz5R{Ujqf^_plJlcc_{ijmep%zxDI&Xv= z?;?ss-)B5&{;9NPMDBmwKqlX*{ z{yNk8vHL<`A%J~`yi1Rex&j`uoCgq>_4o>P)>p}UoD#;9SyEDe2hEsZffJoPmjv4Z z<)ogn1WA|0ad_`;o;)J)6Bo(%0=;|R&C^95*4Uop^s})DQ#(gcAhPAdVqIpSkIgDA zpE(+vDp(SyVJb=Mp+yNGIX9lr{dM^1&u2IKgk;7{L9(Ll$WOEnzRP3$^FN7nd@0Au zahI`x*jA<%#ttK$&*~-f#L9?^KLxjuE2iRceSnOt0iGeF6I0ykL5YF~qQ_Q@4PzDD z-oY}s+^8TLM_`_fDpr7G0P7pNUAydAKaqsb5wj9}8O+hW!oTqR!5!m3A?f@PZ^HVk zH%-raYa%KBO&!J+Id%=}pZ&^gxuK39n7n|>BszdiPW#jTtngCn@86e5KR>)yi0r6k zV%g$fx*Ls+#l2lSf^W%&->>-dJdL!uiiKz1*se!=N&P4yOksg6QSB~IR&v%&j^x?& z(0as-CrV+ZiNdEik{)^G7B}+VpRE6F!Cy_dD#IR{!lRXtBs>K6duW81Li>g+jeX;s zwQg2hc083_;7HM(pV(nzn)EhXBEgxkZ1h0a+yuvDDm>QiK})Bnc1#zij)XHSVH9yQ z;Zo1T_s3fPfxp6RO-@q$1pM+B=mm65p>1BTrc-ya7x{Xu^;&g(XiI43z~*Nil*#i8 zrGO*5I2+=g-xUxhw6DosDhyBjJ-PM$DnZhc|F__T4MqzKESv(Wn%!u5J%LTSb=EMl z!O258q-cwruj*R@E9ajVcA3mM*{y_NX{Pr7cv@>>9b|x-Iw^tazuiFA005$ zQ+d`pvh<j*w5wp6vRA3zMhlty6|+O!PGng#Kp75bLMgFYRQ zM@|gn@N=w!|E4N%JZLV>U6=(aS@AD~E3Jkb372^40ib3A6o49?Kuy3fSOZ%Cc6OZ* zal~kizaXLlW*`^Kgdr6E)){;d>*z|JxPt)cU$n@p)wqoh61gWe&j8^hK{Mnhd!;9| z664bZ5req&C$loXn+Jy!1nm7FBdE5Eug!{_vu%XfS~EeHKvQ;udE&002jvqs`8r7B z=P>w2DS}?P(katMPL{~aOz0&YKY%t!QRCdU4G-(nK`O^bn_1b?Ugr6*H z2M&bebn~Ws`IdbF1nB-ywq2{F^L=(w;&zY^v>J?ys##SgP&O-_%h|P^zS%fLHpw_~ zrQG$7J4PgT(J>qUHE*LKl&vsgJ}L5(;4~HM_0L~)W+tq_LH74rzUQ|vZD^Q7v3}O< zokwgji+V#)+$HN4DYgwWdn|>faK+A&B7XC1%KTX#K+sz(D6N;B8nPxSI4C#0GN+LK zhKlB^oQFl3*;V~j{Ze1Fl#c+b2$Rbz+7YRl~YDB;R?nTj)l96d!bVh2G@NE;;;%vTYJr90&wb?#NH zDHi?viZ^2SsVtXL zlFbr<7gTQKle^UbIKv2zuk4n^B5jc0nM%5W_oclhBHh(%&Y_T1hSN29!cPyzA0m{vR7Y3u! zfuO@ZDSOTEN+tI_gtpfT&ugU%c$W5T+_0g{#MTogc1@L?%9AbeR4H~D*6BqYQV@6~ z_ut-Tiy8U%(mJb<9sBnXHshEo@GA;-?55)=tE9+T9N$RC5H{-mIz9?M^$Q7w_UWp$ z-w`!UB%MCCst?J!bvP@$(UgB{vDnz2Vn;Y%EqCf;M^Jp==r*T{oRZL36<6eje;6Jn9gG>5)g!lh!W;}qTI zY`w(@@0%8sHCHzX$oi0;S2t>$e;%xp5qgEUJZSL*$5UP$?2NiNt~{Gh2-^t@xkjFE zespE~V~uplZ35ip4F@}LwKFhVGE9&f9%&<7I?^9@U@s4Zy9D_7#NNUM+K-**RYjjX zZQ6Vod;VW9fF?{bftjUEOnsmdpG*k1vaqX@u~`5(Ug^xgK&ng0>LCG+A9Oip%8P3Q zs$>y~zR>TEP@9-wlsNge3B<;wFW#v!#B$T{8BYv^cl1e0rt9$V_=AzY!#-=#D-+8yb99*@JsW@VTf?gv&DJ6d=B0x z`n-?<$fFxX5OTQSz9JBU=~rMxguN-5B{eK3G!%-u2`Ohj#%*vm~K3A{Z>h^&QJ8eQ8 zJHsCGs3d(C*D~YQIL>;)42)|ufD@>6L^X8@cmh4A{_R2g2=`UTd`7}6dnFOe;!Oj` z^nBVwcWEv){8EZSgf*`yQclPREgR=lxV~+G#N@Xq91)RIAUHm;9;e(}Zf}wMqh4Hl zMC$3N&q~Sq5hAZACtihGs#fy>~i^4W3EkT>R8T9nex7JkfEv1}`hUkUVNXOJY{iWx( zwwuLXPmT;WlW@7Ex=G|1{F;b+kV!CS0YVam6X-9Ozu%(XUtd%Fx$;pc;RS#4$UQrO zO`t6)@O*tOB5$7L);;q8mzL*CRp_Z65#(aI@?5;qqy?&In^COHEN`wVs{IlTUbFp_ zv8_I?mR$v9&@y9-w3=9mi+=LJiI_kfG2$(S`(N&)dzP0f4~ggaDut-ck&CEmItYVs zQdh{KuCT8zQnqrIRr`65Bo`KH89{o3uQ94o>|WaJhaXM?zkaNbI2$t^ro(%)^}R(n zgwMN&=~ZckhX(-Oq}bW=+Ao;) zkd0q8nAJ7YXg7Rnd+-E|H~A~8E6iD{(jujB>Z$h3UgTa|=r2*|(|(%IxyK!*+Yo9p zRo;c&FJDRs_Zw44kB8YfmQ|Q0R>Dc-#9Qw~&b_B}RK8XMQT7Zs7>l%NxkvR{6Zsin zSPc+4&zY)zV|0_-LUz&W}eqJN=4IdszQV%AwpxxQ%oC)~G$&4BI*G~;kTdX6LOK51w0c$DcU{lbPZRUFC#!LjAA zS>&Qol@UMVIL4Fz0fZ3;l-ZX+RHB3JUi!p@+u}MEE_S@;Ykvt>H)>(_rJzx1N4-Z6 z=a+-~Nxq;8sK}n1RW{R0awaI zu(Pik*y6xJv}A#KXE|z&{(ad`7reB+D+E8;UP~gj^>^{BD{kQ$AwfF4=Hie&_6uAg zg&rFxu1)GACq!L$fsmw&BUtPHynO?@52Oq3)VAbJ=_V}&|FELGd+wqm`G@+E5U?e` zWseChpv)!`!g`YKvE|+kO^URc_`1a}OX$Te(6<6W7L$ul6EuIHVlEbZx}PSh6Z-;q zK$FJuh4uc$r&0cYeHsj)B7hGTEkdA`^t#w4h6z2RZ#|xY`(ma@zUYtiDKBDd2$;|m z&2|$McmFL+T&swAm$77w_F`B|vWgV1gj{1(iu=++>5QHAvsQQkzVLWypO0lEst{RN zn^CxjdQV$T0)EYA88Ub67NOVSH~DczQ~IFaKS(;lPcnG46K~Y6@{y$}M88pIMpNAE z=nioD@9(mNKA?AeI>0_7M}h0kDqu?7->Q@c4=F_mg0iWthy7aq`;d^kf}kYq@Gm_` zTS>2lH8D)mxv7?|c)mXa{m@O2+ei~tqVp`OK>LZ8O&BFf6U;DIDIW-|a7GXUR+3*% zqULHG-UB&@fO<4BaK=4#oO^T?S8BfeTYWpW0&KWOx!n$`JXk^wf^ga%0h~+D2pMTZ z1oIKUc)=GRCOVjasfgsju8#p%j;RDObUhsOFX~AdN%!QqZT+vxJ_kSMVv`da|9h=* zZmuoj=3Ghqd3=+|E3vXznIwN9i$}P>7Aao#?Kmd0c2xY*MIPHE{tPbAf$E-z9zRS7k`roG;X7%ro z>8zw^PG&&8LFTIB4d2GjrvLZ{H>)0lR}I#8(DAJ#n^Dqe!+*=0_1dRfOJ5O1VEe3q zQDWKuy@Dr#7%u(I2j3d*z2C${;+eMk-vg20or8kWE_1kCa?WdEc{nBY*`Ghk>9TkG z{{OzvecKU06xIL;Sw29+-+@dGrI!+4=A zz5*iJfre0p){7zliHM^Y8tpDH53SqkF9|89dNq- zv|P@n5yDoHZYqPt-HPb2g4&Qq&&qY1htI$M?@|E^&jI(cLRWyZg+D1*G7T>wbQm~( z7ylyL&?3Vrw*V2GUcmcPr#|o$dBDqPK$}jF+XIRhdur_8p5pRnK*_?dk9~^)kLNXj z*|eDw?Lb)A+1Z(g%my$mOBJ?~r0K-@l-akV(aXTgApH0D=G9h!xWHQb#{ieT6!@_8 zJOrj6(|KxmKI|svcP4W6fgi*hAhUiB&{Dce=b1wZZDyd6e**kqHuy6QV;4ijj&Hkk zpo~LO44Kh~J+k-~uNV-T;33)>C$81~!(PDZRkbwbYEWg-1Dla z?-qpEWn(a^f|jVf(qF&=C;E+SBaPg8G3Y;2RUSq_mw`2nF~x?vn5n8^9@JMHu^r=0 zS}l3;a}@*}y@g|WzQ^n?G$sNM6z==LpT;GDQ>7E#bhHZu_4JB?9yBzud!`S3i+2e+X{Z{Uos|tHJJa zl?-b|T1lSJ`SS7EP_^XVx%`rU$K~}JhnCysTpIL_SQ(Am8|wdCajM$573YLK@+*-< z{I(+NbSC&|j#-XIExY>ttwhRRJRa}qgzeG)o(w41xB%|rEM^O924b0FAVysj5eKHd z^a3WA+I-rj_kiO>^ij9+!@o zv7wzX%_pLDpq|tDl zUd;C|owu<^_3*HM(oN7Sk~npYY@As^y}=3^AXzSDn0xiVy_0=Wvh30LUO+*9Q#*yt zr&^UWX`LLg{b-DGPJfEd4T%EB$aXWMZ0^Osq5}wVKlM9%bP3Yt1!>GP)(+(2UIeU& z7k4zPSo9{qE>?0Qk6dUitP^(gA7krP4 z0RRV#)Qv(|GtfUWxaNE6B-Rb5i`)bzC56CJIIHM|Y?h2?0r*^#z*18q8>mcg0nk+A z)!)B=d04(W+E?pM)KsblnSf=52%3sq943{kP<2bD%dX-a{LfVt_lcRhUaB!7|Vh=w>LhBe;ecPU zD*y2k-TFY<2@;s^M2Zi-16dz}CPnej6IXnX_f}S|y1)oBx(jI2Oh7=_CKwPm_; zAvxeGy}H2;%q1?LA=q|-X%s(zf24qq(DggR=fJrtL7t3lFzoMHu#bmdu2OK{8Oa8> z=`X<9Fal3EW)2i9;(NHbX5d&v7XgM+JPp0pe`dmt6@o76%N_D1!kUM2(idkzXAy3e zuy9Xo=@v$0fP?9g<{MrwR`_ z-g8<>uDv|$HC_7b@!y@wUf|K8mef%j$iT$JZ{UGxWwix*+ESpbUR_uSRl|2XHyQ+@ zW&Q7FjohnJb&HhR(c{l65x4rW{?cLLTLW0aQ)r*Hq?I5n z@K4A=cL5Lo%Z9m2OjpE!<>Ylx6uFQUKyFL7jP#ZWeh19rTEX1Fhx=x6w@?a7DdG&> zzpojD0nET;mYL5XVB!P&k(Nt~_WV$H8Jz4Xz_^X~QBnnB8PhvprCK@V^o|_^T>__887LpCrvTr8Im-p@<)LNI^r_werd{~$0z8?264@1HxT{*!Xe|ak zL4Sj3f`mdFot2uxe+TMji0500=y`v%OE$!wb#cuW1hsT)`{RRCMW2xU96FiwIz+TpI=iwy<&2mYzFO z9+{8okL-~uGF493GpqI$2D*XmY!Qfn=Way=siX;8JqNcifjpbc|8NSogae*8k%L(s=;AKDF3{NHQp>44=EOrfvl@0}jHNA;(HA4ohR0&EGX+p=nZ zGav+zR&shU$0)q<9HQ`|7Z{Q16%-fINUfz?R6nb*YWE+YhN5dL?@vDR27r@Rg(&1v zEmM5l13js3UD2>LgwMB0m`BH>A<{p8%dp6deK%VD+*Oj20f7ca2 zSm36He{%{Tr-ZjUc93RS?q^f+7l4=w=Yxud)YvgJIMZnMp{3wPn<~yH0Vc3c#uQMH zA(8iWrXo@9_{(@05{Gf6Lt6WcPdo>6F6seuoDcf~h}nycQ+MKGYl|DLrl zJyN%*4DZH_6=)`EFhD3qPUm4>T_+o?5-HlS%H)+Iouo7;`3GRM$-`;J8>E9Z$G?B> zh+hI+BvvooY{=iZj3l1;d_i_~v-BVuzT@Ee+8 zK_r4|TT7M!H-8K1gJ?b50rz8=Ml5_1KDgZjxEa$1QE!Qf_Jp8R?tU!sy`sk#H8v39 z_2EAgSQN|z`e5)rz~=W;L!4ia+H?ZP!SugCFYc3Q;Sv3OoaOet5#X+5g}O)VB2S_> z90qYd+Wq9ParGWj z?*G-2ffXZYTFPahieaJzqpVydE3G%csn?1rNG&9rqil8;v_n7p86DzJE4Ccx34?pA z6uTiTBXqowzaZu;BQK@`P)#m5A2C0Gk2`zg^zzE z3MW}|=2-={GVqz_gC89uDYOZ@p}uK!yz^E`AL}^8Tluuq z9YrZTQ0nS5C=qz2x5~aF6U6*D=juT^ATL&!(2Y;ylzYlx#|Egw4tj&jD|hN)fee#= z+0<2&)NQVQT>m@Ej;mouNw4Nv>u+LbpGl(33FOoQf&yP^lk^tM0s2N?tflY|Jjth& ziMy!#iFB^B04nTAu0e@r0V#sdL%?){Np0_hsp`O*L3pYJhoXl&2cdaCINtacVkz3^ zH7a4vz|oCo)G0%eM4d}H<;e9*Fqo`OjzlrtS6p!wn6Sw7yBL4~AkLnkI3m_zjMd4z zvKZF9vGwgE5fQrarI_%$;TMEX)CAkIJ1L8o`bb=aP!Xip1$Hn^r8TYB?$rDxezYw2 z!6?ADJ>gI&=_62Q^9uLCl+0zFyE8>pZ9N9QPQ6LYj6pXwjbA>{QmlPTmNjDfYh#SH z(22=o3RgHwUBDNpOM&G0gv78V4u|wii3o2vi|mxVjws;1PVVbF0J8TIPjWf{GGkQu}l0L)IHXt-|_B403X~W znVMHjF~~7OHBJ`J-s%__zpJ#lw%IedFuw(EoIO1vfsL!s1yJiMR~-jYExqF_nbPhF zIsLRlF>l!P>M($~sG}#9QBof$7HJc}Sj*xKtW``w*w~A@X%{Zfv^P7)O)|lG=>UXO z4KjwjPzBx5%jJ#05Osh)k$`GY5GO}H9JB$e9T$`u^sUVfx}xJ3BpXERFG!zgw-!! z?%v`^Dg###F-YC`iZ3O9ZPgt zz!_lp-UE3W1MSmfKp%TF7!&~pB0M?-Uhjy$mQlnbc9)fP(}iEfkGS7gCu}>vK$6`p zLMU--x(pfZX_!q}ME~}MBtj@=1vdxV(*@A%;jq`5Zk!9jPyBm7Azl(?@5*lR?K^r^ zEGm&KE!4T;Rn%n^8Hr$>SBt$qwiZ~+r4L#0McRB5A24w7BXVz%zCVp<5zb{3w|Ks5 z1%0FmA@n-Q0bIx$(1qg@dgbgArM&$wcyOEv>juMZax6ZxMNUYx_*4(6CAeMa*Fh^Q zddRLs-jSUusAxNYa+3h5i8c}r$X<+9sab_)*dx&S6(f<5s|@it###e_7}Z&x1mn=V z=U^>WR><-Gdz;rU-ex+jN<>&zNPF1Hlv}d299YE1y%}!-mgJEh10ji0xO$~7{TaU3 zST7}qk`Ab$;=h_gYhca3qpq@%X{yKyU|LMgEk0id%+p?2eie9p1uEl3%?YVxBLf_s z=a7#IYw9fEg*3RfFa~glJ3>INjstSwM~fPPS5?)Da@es^WiK~C%8j}^-(L(G!oSO> zg2g69U^)+v!cBn4aF0I__xO)EKA***U854;-C`IPMznJ~c$QY$>GzJWqOVj{)Z8&K8;3bgvMJ_VZrnxnm?*HoN zwR}}KXtSIEAHX@ZC}vLZwya8xxM6Zocgs%?&pUoLon`{aOE*VBxlGgadziW`-m1=p&|5&3CsU$2!OI= z7p%;5TgJZ{fSW(uMB1pnu;h)Jv6f33bJQS!|AzjCoqB>Ul=uavs%=e%0qA=60XEz- zERs~mrWly?oX=2n*k|K4AJV459iWN>tH3e*lB3mD9eoA z3a;cor8pm!`;67(K*8(k<>q`KyfnNY@~JbN#65VHjrNgKhzJryq^;ZT!{N6p>OWfL7A2`W_g+xi^5_$nMFHIbU3S#9$ zPt9dBg9GutIh!+%Qi}oaEZ{>l>lmOJ01gTXj$d@PSP;cqfeX@mrhMfRDWhm5{BpHQ z#2LSgt!5GvsPhSz&X%BFU>;}a5Vjwq<2}+d3bp{TViqW^43c{)=16gpK8#2g4Hz`w z$||^D9{j;b{NH`e;TD$^AcYiKW~+q!JPYn0S@!1(C z(!mA-qzLCwoLB%RjC^0+DV5N8OZJ^%uO#n`@(*KtMurxbpyMKD<*9oSz;pgGxWoW( z&L{fn*Hj@3(Lyu3gHt)bCu`508p-`s0B1hn%Hxl6U@F3hNa-ld`Fj85C5|>thL(tC7W&42Qk%uGDugQv^ zIgjQ4Mc@wKnw{!i?pj4m6We`-n`E!FT8Wo-aQe?v!N% z0gk>el5Ihwhm#xY#31xTyrKIZPkw@h03dvm?CJLaX3V@6-YTr#Ue4+X#lyPzs1 z&3d^K0&Z+U3JL8c>I32oR%4NZxBdVODgYyk__b)CO7U!k8fW)jF&SARLc%E!klM!< zH#)H_R7nJ!=L|4)I0(;J;$!0ZF+)&ngah&c@TF8FljBL~I0q4fdvT+tX+Pl|Wr{{9k9q zi91RbyZ)Zu^eBq@0V0BEpT1cj>j*h40CEd5F_NWLMX%lvN>#&b!64w<|LhBZI?6zW zTWtlC2pEUiNOJ%?8y3z-dwV?FDrpOd;zfkfx@*GdK_&|YrrVKD@V>!gV_2OeTdWJ{ z9t=U^N|7Q%Xo zU#9y&M*zQ-&0b4~aZYZ_xQX)@f~h{@aK>U4hf0|OEZ1iYQ}wjlp~1e7 z>q35U-Vv_XENo5X4z~_DIwSa_a6jtZr?aR?8$Zos9Q+&&YjU)~mjrc&_Wz^KWD|G+ zcvS~^&$9)&pj1Le%y+puYV`sd>>33<>!FM&nh3 zP`Ie-xEtbc+zpY87(NJH^hJ`OxXl$XK%Gxd-3;(3TGh+Kl{}oIB-j=<6#o*?ZsDgQ zfE^>$6jB5UB8jKVgXOM+0A8M{RV#<6%$-pptQChNKHJxr7oiXatflj)AF%ElXG6!l zk+c+k1iEK-3KprMpb)CFN@(+*1vCMmnz*3cJ|!47_I1SRTe-Wn0F&b_Du>bM!o1#f z0&L9MlF>Xr1K{e!NEkwj4aq`cK>XzVZ+9m9#&yVek2Tzpg{_tx!btfv064b&P4oYHv*oc2pjmzhf%`5d+S4N8$)%8S>WYxL~kU$-4czekHTSMEjuA&Qjef|PEq zl6<%0+xc1-5_jFH8-UWdle7pv=Fm;MX5ZQ8m844w)|`)47*teL=r7v>2$+O5T0Fhy znApWQiC{fQo4^Q+=;x8q$*!O>)2`WN|3L1;*(yI3>>x^Qz(LqgD4i6CdRGa^vCfqQ ziM7Zei3sy&>L#k3nq!^9>25^8M4B zg{zE zZMHdHGq4DC646_7JBP43?x+Qnr->Z5UFC!b)qw(JUN3F$BAO5IH<+$8kr#~sAP{JA zG5(Sp4g&WibOY$J4O|#C+zQ56E43R9v5}KVPq4*9E9@jG8UG*E|3mC>KD5sQd(p2VnkSxsc z#D2U}*StG6=EFxg%*CphNTXKWt{&-6Xi(4rB;Q;dun^c*?N}aG@dxJ;aAH$^(TjJg ziX;#!hOsjp@_G@-%PLm+DagiYjDSh4j1L@0sb+`2rGx8hIASM&$7GLmQ_U-EaH7&Fv2sMdZZWVSO{Y|R17tDcWeHerMv%-DgO^+$fFwJ1(0<4-o(QeN0dxY zf!*Ay06&QuT)S=us}tUxzRZ|E`NJxqqFagF^@1&bP`c_l%1{-*$N;oikTT#5P6gf_ z1qFqqws*@!*8=e>{Q5b*U`(uP=L@Nju|PDFPJqpFIvIg)M= zRjzsgimLBFLs4tD4B_oL?Imuj)Z{Z(12k|P5pwpbPKv-D${stgFnOxlOwNpBro&M` zM{rr1sy~v5C3j@&`G#d#{aT&;v}w6L*a+U^RkruVPG@$_+$%~a6oXV2?%kRrPLS}y z1ekhBPdu33W4KD+YKB(R_K&Hv6Ng;t0a8dG+sz8Jm>@3J9WXY27f=V97{{r1a!SZ@b4T3a?h8F>gtF~XB7{7@z zk$C+wL|_mXb4)i1J~?8;l3F%uhf%(&x0>TqcsMMN=X!li&yIdJ#v9N%S06H=Alj4=WC(#-=X86Je;DII#{3>TMbtLSj|&>fq#)ApV#nwfd(S@s)6dD6Si1)r!Yf^ zx;8|n1IOU!E2+Qu8+uW8Ya9jj4IRNwFUb1KCx{}CuZ}2rDNPO2fG^kI%S%4}Zmo@E zW3#d-B^yWn6bT-BGYZ1XZoN>cdpK3ZuMOJ%cAMRpuHR)}S$~SdEVD6VVY_Xu{P){C z+#h5DZI!qhoY%andQ;Prwr z_T?wnWsnV2!62`Xb9m0ByahO?;eO^41q%%J*eZY=cq{e~d}A;gehy$6qd7|HYjdek ze!aX1Kv9_r3N%nD`r-L64^Rs2lf>!;z!Gt^RjcK9fVH?NEiYd%{;@Jl(gxD>i0Gz% zErO{6ypD;1=C{B_j%i;*VsJDar2yGx2`f6T3L(1)v^PNfnLSr+$PJ!BR|`3XzV22M**|okiKn%GA{(68sAzNDa zN_1w~BpqV_bwk(8nb2^x0Yp$3+uO;9OPLJ~Vg;-4m%!!t6aff~u=ggKCr*T5Z#v%q zh%zpK9Pz>t^fcB0Px}9UAX#`F(|;dm($^3h_COl22LcSmYJ}{({~lEWn-F1ePJo-7lDCQ}I!8(V7q!bJhXW z8h*H;06SV7Fwzgvx|6y#6&@gS0j>`(o?v_=3=wRF@i}!U06NI}UuX!1{(<$e|D4!Q zq_8T9&j>O;2HUy;3fvtq69DuZoJdFKFTlY>10<;(umK#QCmNq6F>IpK-=BoTBtXfL zuc-?H>UfsdN4{QDiOQGnqw zuKLWMf1siM+eZvJyaK=SPccn(#|+4hR|mJinp6!`;XA;`NE0ks%*6s2Yymiy>VPK0 zu*?RH~X1hCF2dq$F#Z)L14iHrNxh!z{HnE%!k8|$b?Phs@VvTg}U(N4qrt; z)Z-cz{eE-+E8m~}-{m{1R987>@t~3^vX25h02hD^qolN%vrPO4BNo{l0gpN0C*6cA z!WgUf;M>v`g9un@i(~%#Skt)!{3_t%qkaZYj3OtZOiJ-D$OG~4k#kD>ACxBu{5WLA zy$8%Ji+}{64z$)K28|VJVSwbJ0X#f*0J$s=n?{!C-ni3Gsmk&aFc$@VZ@58_iH4a4 zFsbKd0X~;H0EMERreS9@z|+(S%q7xn8?xOXu*;YKe_uXu1w^M(pm^Hil>bJKX*uVS z1pH$?Fjt!{bNVr?hUgE7+HKqiXd*LsI(R zOBV8)@WYFLP9N;(CWA}3$T83MLY+ysfladr3vilZK&fWOii-sSG#uFBgAE)^e_j9} z1K}6OvuAl=!_GM1B+A@@r32vJMehLH)^!gXGx|XpK&1j?3pH>mWynpm_*nU2RmdI? zu>PM_2zbQok>3SX2se!Xo)q-S6%s)W=H?vYo#B3umdmZBEm*j6okBkafSGaS{=OaSgT$_AgfkzSq zo^-76+$sdq*YF||B!CI3D(9>PD{(;v`3K6IgaX zRQ8e@;iq4Z+C^k|I5<*dsF`dv57%ukGud9tATxjCPMb{WxZWl=^7qWNZ}*XYnln(~ zQXQv$XI-7HJc=!)6X;z@sc|I5B~8~)U@zyCb0c7sjjwYtc0>B4xXPc`Hl_aK$+DMMP=W!4jAE zPNjgzPWN>XL8@ixT;SiSLn+RUYlBY*WQ(6(zR#2rV0O=z9G27j6pH`Fg1lxtE-g^A zZITtE1+uPP|NPfo>=#SMbaCw6}0C+o7_i^3KOITBd?RTz|Ow-od!Z&u{K{B4FfttLCxLfM0E=m3RWeb zZ1&IgM2fdbXSHMSr+VR&zjHnn*J`W-X9&eu!PNe7w)O7b1ko5`pDErG75l{3Q0;^E z40THjei_?dnDz#|XV^-WPasiP`4IsP1DfNq<5?=sYx;cGWP13vTAXMd1wMT%b%o3aC zgXSO}1M=pZ zwFdE?@*3EW61^7j{IbG@lWqbWDgEE{<&|C~g8CdmSwQ1V<*c4JGUc|C059SR{1Ym>WB!gh}9-kn0 zV`Dgq8h7$pZyF)JpO&AH_=6r=>Qyk|>P4ozgY{c8|6F>y)?c}A=tz>SyZL7DJwDLH zXkT))IgtEnky3l-lQC73@zEDd>%h16S11tw_~pMR^}ON|VKxyT6%)+_2X!X?p9aDi z5cHI*kf9*pMQcA}W?`Q5n6gnw-cyVmv`?9f8u{~$?XI(eFTSH>W{7%Zvv=Qm_?Wqe z^4QAo(dBGQ25WftYxG+&Z*eWJvVv#VECzYbeZ7QKDmn}MjEBQqt=4*vU#az5^(62_ zw0+X#fx(G9E=eEu8qbY=KDU74V$}Yd0QR%K?#&?X)eFMV;pj|Zu7rJ#q^}k?gVYr) zzErq~P2>i%aJX6r^`9rUOBsW%68_2cOR!YRXVXr-0jpI&Ragv4HEypn>!iIlutxI+ zz?C+ahfA7uMcaJgfZG-a2#HFyV39ajmD{ArCqlD`NFuCO0qDAWXMdIPxpw!Jr!Iz$ zzD1PE<$WOao=h|dEw-vS+MPvU`=}*df_%P{f^t&9yqMV`AIqTYiOk0dC*iP*=nWxv zaS=TiDud`wiI3AvGw4Y#d2S;m7_KN?5ssI6*%xy}-Q|3*3fqQIBxNiWyirVzsinI5 znZ*)sCu0|9+5Z_Q?yZjpWWBK(ip89{aF&v_JMuUlQR-dnU7$W-8XbU15^n`iRG-E$nsq_i6g0GXc5YlyN{ofTLZMsI1dh3l3(|w*iYR zw>o1DYdp~h%CW7_w8*NaJw^!|@I8DE@Yo(-6o!qNpEx%>dvCz}oKpjo-&_(`;3#gu zmOZt?Xe#eT=GVBm^VhaN;iBh++^{9{rA*9grG z`2q}<)%Bl(>3{j0XDlaz_{l)y=)^&-_ij(1h3un(QIh(WWaf4o)~W*Kk0_$11chUm z;mfByaFasv7EEi)Kq?%Mz-O@ro!U#i*rh5{M6e||g#JykIH*U?JvM;pp=3ZXC`;r( zn|tB$aA;|bY3<0T!jleOE7I_S^@(|iD@~sN!vhaFdW$q7Pt4!$v_fjdfcR`1&(rQS zhIrbLgJ@&h)&rw~6fGIJ&uN30`5%h^E=HDkC!?WyNm0(>e5Y_k|8cfoZ}e%)xL-xe zo8?Qv)ws{b_X&Bc8TDJ=jbgjcsoXU&Ot0-K@W;~G6M1vdQ!O-`Vv!9r=Hss!4esh( zwq3FAJ#UFz=lHr&SC%U}lfT~5aa(G5FH-3j=si75Z>^~MX!i^?FmjA_F=4AXvyd}* zL7j6`XjnM2uKGUcT=dyd*8y01!K6&qD{J5kamobMM+BhsqXLmvs^lN=T|!`GW3Ei3 zLUp|c(2DrT16-7k_xmV2eP0+wIt8)_?~Puo3HaO0;BSLs(f|F5OyKrQk2;xfT)Mn_ zfARv%J_zouuBQGNcW{6WuEh_<&09zg(aBfcsg33N`?>}l?6pUk`9zZV+v}zja3k!A z4O1!}+dsoCEQ>ybj^!+$?c=dH*`l}4^=g8WOzC`8Xd6r+W<1OJ=~=J{{_B@m&p2iS zK}^vEXHRQ-)lR#s`oFVRG(GrYb9do{ExukCk$GkOjBze>R%N2izFCQR#qR%Rn|TZ9Z+)bW~!1hxDTTS!T{<()%@vRovL_{%haB#+h=# zaf98oy7B!W+^I?2Ev`fo(`5v2kHg!a8B2GOXWtrxpz{!*(ZhWWS+~7r+Nbc@x1QGz=ZE+)>+&ko+c<>4V z+JK>9G@M`xyk7z`&{Y7~Wi}Ktv2yB9fKhU{FRGAQUp3r+&r`^du6s?|JqXG5#AH&( z>&15Z3}g|ZGvoE0+LOJCp*)ezUzpTdgyR{_;4CVq29(g-!{TMZZ_d-(oreN`1`SXI-&zVrvysqK6-G}D;v%_f(g^YHj{6T}y6NJSw zLxSeH419>i9))`Gn`!g}o{Og*_rEEI9p3SWWbK7X)p<*zd-)vD`c8ZBZ&ob#T281? zK4#Y%6pR}kFiO`^zLY3=A75aiHE39aEfZzlTsoi5{ezFzrQ>3j#PozeABEhCRr|}x zJ!kru)t8s#*-cC}suADv8Iua+ep_>@(RukjGLt8d2QPPe$-1i?;rSIKGOHt%FFA1! zi3g{C!STC#VmDYg`=xM^p<%psahs{cSXd#3_lX7DqJsDcHnlWI|7PSd40l>9tZdHj z$OeQQV$hXsi1d^L+LJsu@V>=-&1^4VKR^PNR_uAM&FnYIr{bn*yO(cLz08*w7kC;; z;T3$mE_2{8OV13Yh!I37jc&Em43ej417GXFtco%#zjA(YrLn`#SW{MdZvMZ$0MPx# zVsHw7zPQVTwoA8eyUq@t7EZ7+jHjg6?)DcSxa|M2S9|h!c3mWXp2_rie#=O%i*0pv za?xrcsB~cGXZmS8)n-z>bei!`y%v1Bv5bLofvJP5t?<XM$9&n&bnU4gbqv1^d2gX8^gf{f=6 z%?RFt2=?%S8FyxAOK4CfclL*TJz8aPc`hW?t)6kRg`$-Nso1<)9tDYBACK{trC)B6r}S@q@vcS(|wZ>QShn#iIUM z_Khg>xH(?>0&jFh`c)9{VN#UYd!8-4DKy6{dnE+y5qYFYlf)I*jNlo(Wp>ABY1#M?0#tbQ^;c45r~7({P$H+?GV- z{YCiYo^lW6!-sQCUJ^&x%?OnvhCTY+yv7|Z%O-bM9t(UDcxKVYeWny4Jf(_=Wqf~{ z=qJb>ha>w%iYwyLn$`CAPm8+kLz|MgY^3R*x)VEJ&~;PEJU)wd5*5yyRlTeTbr3{Hcfhq zwx!?mc(2H!_4DL$&FrtXFnM9ej#x;?_k=- z^wrk}WR;6vnLg6CJgkelj%r0l&<@+jJ|1rz3b@gg7>sT!J6K=R;?=@*9VtV%M>W$FXSwA_qrSN!8pcT zd478nWcRCZx}F}F7msCUMyZlHBUOHpqiAJHh=#K5Ykq?oNgWD*gPZ!r+6d{NRN!U~ zu&^Jh=j=E!DMI6??jrvZh__$gn%o|2)U9n9*PYK`n;v-C>~<(8_&%QF+O`i=VY?Mv zq$p+ix($=x{Fx4IIa)rw#iXh}d@0LQ()s?+`dhg>=UE^b0p-(uM z+Af}Fv1j53Jf?TF^(4eETc|*$Ta^84r+S*B zj!d6rYNHsG=8CHqNyiQ~R{}EAtH!$(pF3eZI1UH~9>@-vC(x zL2f#N@y_miMWVO{pKvz7AnBZ4rW&Upk3EtvM~WqsA%0B+6NW47h^(HYG zt(r3^=|fr&Z4Z)3IcA(S{ag^wf=a`+ zdQsoF2vT-2iL$`a@)@p9Y}>qPP&?&5Zj~r>v$W!kGluyUij2-L z5bL5GuSF$|>Bh65b_2Y`arnhtVQ5nv?=$$kQjPe51JQhm>B{(YF6npghUs|H{%?l6 zh$&%#2E|C7FjD?&80P%CWZ2^RBZ3zK#@GOE7vxK)U*TiAF0=Sd+BqSKMd$h77t<4; zo5ikH%f?mOcVbIp&liZx*y;G%r6Y?|Bj?$b{JxjKeRW`}Ht zvo@RB6N8~rq@9K{hK2^Wvz!K6BszKRoUeT;xhKU(QnvX>dll$LmHf4DGT~~;6Uz0w zJB<7}=`Izmf62Yotz~Z4Ks;2eIHK>+k;S)#oH`3jOcu8nByo*^Sm^oI;lWdm{6dLi zTs#^v%-=JmLsLBHEWh>%G>82-9eHOSnxJxypC6HsT#&wG0*K=k2X+3`_kQ-dp0Au9 z%NxQ?$N9v!F^5@qDSBV}#z3W&jVV7JQB7iEKCt z&Y$hHbSHGQcm`R^8mVK!qie}zT!ay5Hd?tmZ9c?4VLc|W6-~vl_`#B;qr2Hocy-;~ zMULJ$#PfrY0CGA_E`GgtmYam>FwsL$EaR#5cu7e2^DZISjr2At*I=Ll^-;L~);iH` zXwqPK@8`LcT{PA!7p8fO49;>P8%cGmr_e#P-X4cR!~ES`UMjK1b9b{=H12E4&5{|V z+OyMG3cEze$BK+Bqm5^g{wo+uY&SycQ$%=T32PFjkfV1wU&h>x8&mT1^dC~+igZX> z@u_4-3Sr!6l3w%C&9Ktcq8r1+4;?pY2K)B_(8@4fow;41gd%8n&4N%kGwT(c9~7(eFkYH|;y2HQNvJ#@Kb z-h}7aWA8r<3)-biWNs5+byGO9aQ#qg$%k{uwPxrx6su0SVCDGLo;R$KQDV1R;4(v{ z@@Yx1H8k;pi`Bdr$Dy0Vm(l*K%h}m7-9qPYLbMiq#v1G6MQqa(?X5;%S%%@310<)k zc1^B9{ko0@&Y3UvnTt}b+kOpE7WUV(>3=ne@R21;Kl0puHEuJu~k{ol>yo-00mFhZ-g|bs1FZlM3l+wX1Z7I?({pk_^rHC`{TZps8N70 z9j#S0L%0QzHi+Q4i@xLfJ-gtR`Pt_B=LZE|Qmc1?1lnH<8&34Jfv~@~hf_88xx>pshO^jm^N>7m@i5Cx7H+P+3O{0yJZ( zHh?#pD`1R#yOXv}XAOi*y{G@bMQ>Hp(=L~ldoBdYCH)hf+&`PV7X@sM&m+CXon+#+ zvSvw|crVVF^?l||G_7S)jElTlDx+-#ZB-YMhFjRks5((nI$nqkzuL+0F8oxlNQ`}4 zPP2M3f2)J%;HDLeG-G@FyIe(pXDG9f(l}Q%)M|2Eju83Jb=CN*2m&T%c#pfQBZk4o zn)KIP9ga_iy|$9p1+6}w0h0zYrZpbDFAc_ih4n)0GSPT4x-D!g>tNm`VcK_HH4uqm{Zh8=y<6*tKFE~gfMe{^ zBz-B9y=HG}!!KjWe&!g1_Yj>E3aK=D-=)}&nKJklPkd>Ok%~f3eLqKkoixTWt|1?? zb~h0YnOc*UkM#cci1pVsUvqbQ)NKmrl%lZsSOptL^ka{gc^dUgEZwfJ$$Pxp@0U*y z>_fGtKF?zudF!?YZ))i-4%g6Fp9 zsM3z-0xhbyBgu4a$LUl28hWOEB#HKFm;nn{$}Q?vFRyJ9tJVMjm|1s}d{-(Mc0~Do zKeG}WKHm58M1*asgAjf}!ODK^Vs<04_%fTAx=Hafi6*-lQ$&&8+qeGrS#ziXaJq}+ z22JU|de+AA(CFidJ#4#G=vIF$(Rmau94k_zN#%2(a6N?1_uP~R z^ZqkjhsmG7MCxx^6#lUj@|mGW4Knmyps6LKS4yIol2E<>o$HeNJP9zPt(s?X&FNtq zNd1iwSuiB%!*qwRhgr~8kC7+0blU|L~pi)Ily;l_b5 ztZ#+i#J1!tkk4)?Rj2k4mzp=IlQDRC+eUhLQm;{W7y6Alwb|m`*=SVixU}w?_6C!8 z->48PwwvS3m$SD9-xQ4V8mh`zht_A0{~<`^W;Q2uyL2k&Ie8GOmP_xr^g(!1()Fi1l(3a4m8s1MM!%xsccs8hl zSwWVcM|`RQ{8f2~CaUH_P~nsa&(N|M++V7e{K+qxVGjvjEWE57`}G_}u>(G#)h?jW z^g+VB!0>yzS9CA^3dIWNf2=0>;#tLD#EmC#4_FSZ_ z)WkHp&8ns82ByVC?*9%mFtn@9DSIEiF%p%t1G`ELD)oxntNe=t z%F=9RzR*ZVF@7vR4_=U!wtYn(gOhjFlf1-m5H=6M^cTtjE5S&%!XJmdALyZ zh278p#ppWHORt?!9L90@&tINe1;1%ntpz{9Mx;+Sk&CbbuF=DP!}oci{#)(atfexl zhzdxK`)@Fz%)<(;1$6@j8b5;lIb+5jRCW80p~)(a#Ido)fMa3 zUeNc`;)@PEs|5BAo8y|&h(ubK?Ut@?#g@JVSSx*kwLI3W)JC3uNv~M#X>(j>yE;~W zm36M~oL4^9QtUr-Y*nm{(UYu=dFr0iueqUi-t+`%?(+D(;RL%Usd|4C(|4W+z1jvQ zL@i*5`SY!&anRAP^iPW84MVQmsYpX-0Z&G!UJ36fOLMe3A)zkpBbwtIt`cOO#O}o* zy=N_LxIL6-?l_cl+DA=Hu*swU!S0X~#eLhOjXfnG=SpH!R32q{vNv+O(|0?IXVuWX zzMG>irj{N>7kyn~S~~PRi`fP}4lNO(<}l{IwqEnoy@w;Si0|W9TRVb}or)Sil9O^H z!HDoFdO_0Ouk2?|UxgxG_B1XDDp>GdaEGI#5@~;cx6polpHTI~4ri^C^eN8eh*46A z-}En9wAE451uOgtgAx6Bo{sL<_=lMt-ts5gn!R-QmEtUWiKU56+OFNV=SQ}iJcbLiH4Yp@87Ay%CF{}Pm}l_ zIM?k=L$(K6D}xxX?*yrTkXZ&7+6s6$ifh~mIEY}+5;(T*?Y%8|7=XhbxVwKk3ZII9 z@Q{iR;RkB>-b8@w@mo^-9aIDHMLx=s%wHCWN3 z&bb*y1oi-<{So+z!_yw=YzDlhO4?pmx3`mka%K&f!2uv55 z4)XuX5J^krg)rC50go(v;5`83L`)_I9u#7J-#%=<`qtBCIZP7EE)E4o-Kv1gZ@o8F zT;uU|v(mUTgIT-G`fM8}m8&WTC|GiW#Q;FWV3M_-IDlkdFAdc-MVrDGtam};sgpLP zzHvnZ6V$i!jZqEvmPC0x-<&hweOG)JJDnk4zWXQ9CZ1ozuY`9!2GyOg$!JOtvAxMX z_=DzQj$R|Vh1yIIdZ@MQB|^`N)~a?-_0x&1yi_w4qEpe!foBUM*~s0@b};<;>j%Tt z4jb~_Um;IPzTMJIlerHzS<~P?o*rT>@wdH&(vPY|;(>WpXg`!4 z3D3w7vG~+RyuMke!;>14IX?cqr3MY!kn9q@PW#Xn0LfThXlLmG6#2Y1$hqr*(;2PIz{Ii>ic{~aM&*My) zP)`kw;j(m!wSNLpNe!hOdN4t8ngJJTrpIdLoWj$7k8pVYqMV=0~Rz;H>aK9Ht zx2^k#BmKoJ9))t6?PoyY{M%v1*qVn0 zzmBW1EyY4!!_)#VhG}o(M{z(_sc%3VsEkIKm!nh7uV->nu?rHg{bm9rB7dZYBH5P* z&)1UekKCeKa4%hp!Jn6CzhCQo6VzsBSH(xAZ8J|qAV+g=Z*5k7)@LnSO{vtSoaa2< zjj&Isn5MSX#I$>Ni853)vK3edH%}M;KBGcuMggHHnsV3?A?jIDCWc*Cd6e0{7Q!)k zjaK$aDvvFQ4@SBreAClq#S0()2}^eNPYq_wax5`ggDmk$52Yf9pNp;RZOd<&9^fAZ z<>%im zo)529opqZ(XXzDbEtO(AFs7hft+#3++b7wrc-Pk*fnCo*B$Zi=*kTT;GB^IBzIjN_ zC6O+B+v*677ag@zfBWj61QclX<^vR#aZz zt!!R8@w7Z7x;|<}5sb}W1nQ=BK#JR0YUK;TAf;EJVrc^Q`-C>Y_2KkZ#X>1Vm>957 zaW?7Yzan*acT{nb*l(jOwtiX456tA z_G0b+(E`!jkwdRK*<{6^4n3jh*Ef6CB+|Z)NtU@ndJ|IuR^`||)rGYGPC)(Y=cHjS z-TPB#dK{ecg|fQ%8=f;R%c*Hy!QwG1wmbA0j@NQxDwB3H1P={xjpo_rru*?8lz)kW z7o%iHQdgeKine)$cnX2Kr|^s4&`-sY>Wh4Xf3XM%0b#7H}5DXM~E_^k`U> zR3O=FY`y$a62z?%S(4^-I;QZ4NKK`Bt`z-uDxy8peMk6#qs5{NL|c#9RXpNPehjO@ z(<|DlLnbB2yN+W)EOZ&!@Ew zc(AKm zFukaVJ`Zk*=J7WUIzxVTnZa01hMOQXDwX(kSo~JOjMV0$%-WDnK1nV<`{7i02d#o^ ztP8)B^(ISrjNHiPk%E=7NFd;_0rWR5TC?D5><%2LE=oe7cM$zs_A2B<*sCdDKsnc{ zai#@HGK>nm=V+?6X5B{Zt`uiyJD>+dc>ZISOa!kq<*(KrUSm)Hqv`E^992=&Dv$5w z!;suFv36aLqf${4y06<~`fi$1b~n59Muwr8n4cTbn(}q(whhPM!d1j$!dtPuN|ZXu zo5zoAoyTHm`Qmr6zD%;(P-86dzN8GkEy_aO2ckpf7&6QG@H@sk zCh3zPTu-2WsP{-Dp@eUt{ik0lv2t_~>CqcWk0|hGJe1%Y( z;uRasaC9^Btb5k=AvQvY@3dEWSPsh3bQfeEL!@fIo7iPY4Kp{wdaokWs=OSr>SE*t z`D!B7pSJ^+5wHAoSOZ9%H`pt%3H+xM-RK7&<;8)uUBLfM z6DZC1AYvHe3m?kVgX847mWy&O0nTyic$d zDIb8b!N=3>Q5wJrjY<3frYBz@i_i4XTs?h;LCv)SP_o3pMTgwLN?mwTe8;Wz89YZt zt#2#T#R2l@4Oh6$`xkZ9GpRfM0gLx>{ym#)8Ziapu9|;ZN31(8M-O`X{YXk%*a$ns zpRIUQJ!$ei{Y^noKdpOHB(lek^W-<5{_;fTs~6Iq!#QkSkg;9J9JlHz93f5MY(5E3A7>>tqBRULd;;03}2%9X&f zjSPK3q)dD)!-H3ekYM3+FB*Ha;YpJ{j*bf-SU|cH-6HTx{4XHsnFSm4qIpDsfaIm1 z@c4Nn=2ypnI4z;m>F7Vks&7fEA*9^X?B!M>8r@S~C$Pw0pKzd3It#r(fF(WgqO z*&w^$PCe)EG$VPV=a%m>`=#vrjoP_ufPwdrMsJbQgK&uXF25GV zN1<8`I7y17ye)kf+o9IP00Rw3o}{@@Bo9S|q^sA)`J{L9g9b_D<`AkFGeNQ$OJZ^_ zZd1FLBNOju2y4lh=Yt&^6iD#@;6K1*06H*rhR)H8icA*f)nCoc^<8Z33L+{!XZoJ~ zEQxd~BJD4`W(}gZN!x5i@7DoL`i4DzL;Bl&z~1us9sbwUY;xgS!0TzEOqq zY)aBp?d##Ry=n)+&bM}gGqzxTL}+R$O#wv0713P{)nI*3yDBBnvCNn#Wi~n^9Ohm(P!oB+O5fHyV=}Z3#7sPK|9E++LIsePAfwT8Lfk_z4swdLI6k>ct*sbeZzcPN`q65d zz}`Y6ihk^r*2L#SxbdgTyCqH?|MuSjhyjb+qnR{*K2mmFC>Bf<;D&*1edzo3V1;gf zWv3rkRe`b?*ctnbj9*o^8-P)HsK6HQ4@al+tqkBls+DLm{aJ1&?G42w z>|zgW27bIUfO(7TB4j(o2)|cyx@`w?2nVe90Bigx$jN{?i)vR&q=9qSLCae@Y#$r3 zyT4kpn-41)b+xKS=_Y1f2jMdJ$igYK8m3b>`&G(5o;2mz6TXXD*%8x8j38VXSXI}Q zZk_u~^c-woI&ieAy^n=eSss~H(dY#1^j}d>?#xSF zcqQD(nEFSS&vHqa)b8zX8RvYOV&_8MUgSMhNiXgnL9ov!pkHD&mZZ*V?C6UAXx z0N3`@8MwwMc`y#V$yChrw#5;w1a4 z_PcKryeULtn+r-3BYzK$uX_!m94h8(nbrN_aPoQmP4+VjYj(Dek?i^IC*SDKMd!Db z7xhM&%;S->^d@FmrR)IGK#4!e09GRoT$1VCKTbRWwXl(g-r$Fhj56@_TQdlaH;xMu zeSa-aTuD%EJpy@m^5Md5bYb74d>UR$IiszIlC+CLKslnDrRm{3DGK zQF$iC9P5iPy`gU8NGQE726XTZ>dhj7i@Gklk^goWfgtUE3E{rVY_;1y>S|(HNPnh* z0iJ)!i1}}MysUb()-pq58Ny*wKJ)uGzNv^vZ0GQsHcy+%YavwHE260NT2m^mJ$a-!ubtd=$_Y4GPPE8)Omu|Jf$CzldW zRI21owm6RPQjoiE;MqaC5E1^ucKLZ@%(f6e{g}f;OJFaqLOz|suoWJpf^jW9=vNM-m(uZLibY&yuA9;H4 z_5>`xo*ayHdtV_;mT-p_wl9J?l5-Za^8Gw*X5WR?dPvsT*Ap`(sUEwLyTaNh#d)hk zrC{QxlcsLkbH{!^!$+9Ss~^8OZ!UXbs%d`(-G(-v@#|+a+Mp zZ(!SGXE*rW-GqDJx6?1_c-J^qcxq69*Q)2C{=k6%Efa^wu}SXm!9+fK{})R3vKjk@ zyfsVfOh&yLb1=N9u6hR~PH$cI06p#}on1517T`rtg5lzKz?-P60wNHrSS~B&+)W_j z1I{L3WX*=y7?S(ZR~Me;pL9>==>2XS4moQ24Kpizbl`2$>aol4q#_2r5k7%Uu_uU1 zcCFi{qjQO27e?>vk{_i#$urh|8~3E0+}Gqhe2SDT?(&VSw$sFotvLUxgR-|IQjKj8 zqKW%})09tYQ{3p7HXb3P*IW2?S=2uuxLhN`1)NJH{}Bj@ao*2akC=e3ebIZPI-69c zOOFvxGuO%KU)XJCem`G+3UPA1eUtagh(hZLvA+>qJ{_TeEqCkWr^b<*Q8LJyHfq-8 z_DZF()8%ja_vHFUpUjJ=;OYEQ%LpSKM2r9nPNY4w**BvATm>$W{1>d(E~*eRU;uW; z_!nrzv6{)o4EbCeBuNTgF@>7=Pz*JMr>p#v{06;Jp?GmHvWafVwDs@u1+7A5p~AKQLSu8|bEDPOj^0}B6SH+7 zL2fCm4!7{Vsm=cd@0UqkdRx8&QJ)P4zSoU6U-p_@ZF8SH+BtYuph4}^=THbQe@PU) zi&m}Qr$)qh7GUtfR9MA7(toA;FEs&+cIM5NhhrDWzt zZE#~<0P_YvLQ{SlE%z+D0~hye9UKAeI$W7HNbPbLbrq|@<0KB1bp<9PaAHwrdO%;W zn*KIhGW4UdB)3YF>}^-M=o_U2mi7leGM_vF_hr3v_IUXeIRhE*{@6D@o0~@FdIg?X zrxv9=){PF&5|^NnV(1MrqfiVB?zl|j$NLDS2>j(egWGU^+tO@$TqgL54-UiJGSvm^ zRL*LyJ@m}lx$MH7(FoyO*-Bdqf~I?E4c>BQThqe`FSUAywgL=nZ_ilL#H$XL=+TkQ zOGj!$CS(!D(@obd4$}r+*A^8s9!j?F{z&XHHsXHk;}ebKypJlT(RHwvx}nN%Ly+#` zQhPH4KQ&)5K9_owkbe{>0Ut5YX16&0VboZ%m4PjhMmBy2Wt?`Z1Z7Z3uL)A^jkIOF z0mFo>`MQ2%yUOYf(Qc^?b>2YsrVBz;I1CzMRXeD%B2N>z6z5yZT$@3v?vIy zgRSaPf&2D%pw0|NHmv!?0uuWH2aw?aKLuo9Wzq-W3W-Dq=ifg9E73-=*xw4b`Q4Ks z&41;A0xxwce*QUIrD8IL{f&(vV6diFW|WzoosED1HdIH$1s@DbC+q+kH`RWR=U<;& zaxLUjI+j%qP(B0CX49Z>uD_zl-dZt-jA${D0D|$N%9*Oc~nO|M&u(5?!B;aMQBlm`342 zSm`_6P{F>pT}ID);RAwq4Ck|nQiR_9_5Jnf&Yv<#nwA9H2oA}NN_CT!KGJg?k-&Ax zSw4n1+sTH*!iG-5hYRM-SPg?pe2NmW3AC4b#&p&xP<-Tur9$z>-?q`hA+*HYDx*&^ zH%H5RORMfxhV95nl$$>{{Y3nufV(WXhyh)04!}415VkdYzs-tss9v}s%)N{Xf&g5qPu+ND82Y0t}TPNB&CFQEM5SOY6VDe}Q} zqnJ*ICOfKjjgOVH0r&YYM;sj~mC7szpF09R4N7&{x}W|=DZ8!>nTdp3qQqOBNp|LS zyggTBq_0;FQyEIeGMK(itSR-ew&STr_ELN+_1$^xZSr!ris3fnCC%VHKXELz z+)P2cs~49xW+n6Cw6@Z}1qYV_gXwIPa!z`G)~=4q;rd>7KDDqxaUz0f0jXjao6SY< z_cRoOP)ydtNVC$A$h)bm(~xltr-S1U-&JC<*<{n@;vXs62(S~xE-T5t2bG56J?@~v zRd|kx2nQH^gz!b%g~Z75VHn}gB4t`IBV1%+T>SJ6u@

      *e&sd^i4^XcYhMy5OCUV;gGgxHZK@-?(p46jfV3-$mGQBJmIl9K;9ee~VX4 zV9UDsklc(`0EU=f$aWXobU#MLGyZfxIWD^X5S#Jv8q3}BA+hHJ?KL@CM_BEs1GS%v zF*h2c(p!Bw4vRK{`r!OUwcy2EgAuO<4iIx#XNbvbeGTkXkqlPrArbjg5oum8jQ;%2 z;(g99fO$}(**AsLf{AU5&ildiDHiwalX&v(GV|uM&^HO38@Kj?bVcPsvY-dXNAo&G z(o1kUyEzqt$NhRfk0(kp2cU~Q`@A}Og)XO1#K*9##b`pR=y&j%Ekc!)rjzYvVR?76 z)Mf&RMEd&h6{#&)KPGDFE`;q!?TGx3)W@L2NI&>bsi|ECS2dm1D>{pGv#~j1zl#(mwzfmzqZvKb}w2X9Mj$(AlnZo zls6;`ce52-2}@EX0&N~i#sM*pgXWO_u!y^QXJc2Gt97bdISTXWW>W-Go}I}2}Y zAXnwPi)pS==B}~+<|9GF>9^}{r~lJfrip3wf)e@S$V=C(Y7i`Nei$*Gnp-gbJI>kQAi}YnSN;0&9aHlO>=@C55X8CK7$WQn=I_?TyL|n{mV*u4oFB zCac(A`8#KVwuo@X5wtha`t`QN(IiAfVax42m}$U-1xM?D@%5HrRdsFGFd!R{ZWJj& zx|9Z`q@=q`N=mwp8Ngx{p8piSZl_a;~b-i_>P%^ zvDvua11rMAj{&m$=YUTP$hB!y`A=u;&|{xh1Lvjv+QlNCiRZXQwLHowQSGSV!nMeq|#=NjTY; zanh$)r6D}3NY-M7uLwFgZ-AkTz1w@yZ|6CP&>*^{zd@y2frN_k1bpv-SQ1EWLd&~G zZK#}a`xzh4H=z(xu)xmOio%szeyLJScc7?Zb`6w030pzC4CXkNz?cLbd(zxn1o!YyQ~51~D7y|#-fcB=bcni3`9AnMcv z9X=~X;PAe<7GAAiDMLcwQqw-Grp4godF50?R7d^R-AlUPklk`EvS+~&#qic8_-J|F zglYdP@8U0oLf%lPL^@2j&5Zq}fTrK45>}b2OA}Nv-_%@&yRW<5p?t#qGD&;;F)ELP z06>$PhT{N5^hI+3y4o@4@7;Zf1tWPlH;pi>G^2)D5d3nZChT1yysFdpht{b>%QOBx z^^7j!U$~O|Rh(WmICI%bo1`r8;?3k;ze(uP&qhWa-}Qe~vApPi2zTP!>1k^{gO8(D zGNWY7bhtZYeAlMO)BNruigZE?UnN7U^)na?O0(VT9eH1i#rVBldMMo*BwsK(W&Lun zu8EDC+Z)QDOGITy+=&oj|NHpQJgoSMrh02GqH68!1}de*FbN$f*GT5!e+kPR8FavA z)pW!DC94*5);~(3vmNy%&xQ4^o=d-f_n3sqj9iC{9WMRW{7NYs+2m~wuR@<klV{?jr+YwgASyS6|<`LIf@hu}7UV8c4 zjpI-;mT{lRMk@);>3_Z{_a?TSw^z;GMFhYxF;dlyX^DzPlJTA=6^@jD|7kU;L3|?w zly+bSUmo6cZz%v)mt!H-_r=k(d7i^qK02P|ufQ=C8;ey$MlGsLLF2lokt6GL##YLLxdH(JzXwEQIxIBa0rNU+_cY9Q7VNibvSoIp~!S z>o8QOlk5$sUU}UqC41?g4AaHv7#)c3n6I}H3k|7|E7Z(k%Ku0_VibE=#E32$!6AmI z;dZG>0Xjz^4ye&GER??54Eh+#MAAvJLYZUgr;${>pJvCTpHyWq&*25veVblzEO1KD zpH=nIk9f*JY=fxP9Z7~Z=Iu_NCbDbw04Bp*Y5US~@WKisuU}~YwH5&vQqqptcs>6k z5BSbW^SAxscFOdNAC%#Hat~#hmSZ~SOM_^PiV*BSX{&m{S>!RZlx_`{p>{~dC;yBQ z`~6yy&63&q^c5eecd9N;+k`rapOhD@!zGeJt}@AOd&>#u9jmQn>HA&{uRNuTXIhsgzGSF`d)7cufCm$WL@y5>t&G9&xkpM-dwlf{cna8J86e-A{+jA6`;5rigfb( z+uBq3n8aI|@qn!A+g_NkGf-@?VBI~LZ*qrfMRxLPYJfkh41?VzhQnM5$YwmU@QD)| z0SZJEbaW^{n4%4kgu>oR2S3rQ2I3%@Z$5Easu@_RA>^qH0KJ1~Iz>vW7{QxkJQ~@{ znlzf88oeePEKP;^ZFj5JctlRyV>l+{JhrW7=#^R0d4HF!j6tXcM%As2RXC$``cW|{XvInrZ{CiIUQqll&?QrcjB$}37%DruPq%T32q65}DrkkZuam_lht?o6}aB3^~u`M<+&7p09P2{l!$AwjzHL7>h;nbZb z+*U;_-Flh}YG1&k7g#akhjkAU^mUI=_bZ`u-i^tSP**Xx^TYhtB`yJB?$wwCfx`l_UDlRBTJadd;^spP(}wd*u~ z-?rnh(az!kWo*B9KMk3AZ<;AS)DA~KI0#9X`Pe5Yp@#k=Gv~o7Gs;J5Yz@9jFKzEu z7MPCg(?$|dM!lBxRN_aek^S^7MHrvc))G5^<0 zNI@B)6_Lv1A!f`_f|6bXnDw}tIpY;UM{aL>73YHeJ`aP{&EVntN`B7Z)cA~GsCD_ecfhz6qr99a_ry)H$~;_snMdXhYa&x zcg7zd)T;adJ)h-4c4<-F?~H^&5)AP{Kd0CuMPIKCe#0t@Hq+B}Wqd2?iB^RFW@vTR za;ECkpvyc6}K(ujN)VTJecCW1abng~CwoTvs_B%-n#;P8aEY+f(yc({aX zGU>TrVOv;T)dXf%{-k8pTyG-7eFpbIlYIMX|1-Dq&{<3=+OvURU95rMR!b8)Q!49) z+QVg+zj-cm=jrJFOS452>tl3!3 zb+#vNW;?=86nPUOodsN@v-83~S53j}imzQ0(k&K;Jb?TN;Q|q%u|GR$XfO%AV+gU@)fa zuh6r86%9d@E86PrwUW{3?5;ApL;pR4aZnhyb+nf69NG0CJ>aklM39=TcoW}g+lE`H zan4h39E}P0=Mx9%fpdG-2FdC$do250j=l@vVze4BI&OlFh=S@mLp(3%_M zm$%kF?zG%!mfs&sak85QO^aBaOlt6M*ExFHYMJWH^1!PM=Cbdb`!CRy(Z1rT#@i#& zFFVN&;|Q?Gdi!mujkr|K$KFUj>0snytTK})vvtZGRYjt+dFQwY(|lK5A35~=@K!ZN zk4q*T)VN9t6&Q{)=n1f-q;ZOM`|XwIk!6cIfF z0f{!*6CHQ8R%PfSD!a$e5I_jThH8LC^Vs1ayiSwnD3e=YJ{VN}VWvFz{!6efJLkk} zz5&^XV2x3R%CGXyaQEe@w#3dlhIv-%WIA z?Ixq9TRMrXpfX-m=*M)Oy8-P)RI%yXrTCGdnaKC_gT#x@!h_czJdW@gT+)J=LaTM9 zPm|a#@z&`vU_!bQlDcewQW2T60O`P zytC@K!UPb;kgI*py`8r9BxkJ(QyMt^m;S(JhPX~cp$RfdqP zvSy_qDCU+Us6m~OaV0xZHKC&W^c$FB>MN4;fTcX5uuHQ17f7A4CX*94+kNhvAKs?; zTvVm?!kSLg-l|tRn*SWJ!z%>u_a0?Usd@9pWrH582x#+xE5U}ZD zh}mK*NbRa~7Sq8tz8^7fg7RcE{rzM?s{76?2JD#E91B z1cP_R>%wcw(597O+{q~}1vJZMi)uBEGSvj>N#lO!*?{r3&`JUPTlZ3=&CKg`x_3G^ z#z<#)EX86QB6vdP;`o=t6tl!pCoY)T`+s@)-qy)T9PBP$GY>!aq|ZLs?+CMub1weD z2`i_Tn0Q}AZxlCM(XBqTwTNiIto4D;yC>=3L+2&?kK!?jQ?0t3>tAuQOGjn9*lIb{ zBvR#O)GgPET3L*!Wm}Zn?@{Y+&f94m1=$GttoO$Kx{pb7FHZ;N9x2{_i z&6R3b;B^vq7d7xMOkIJMp|)9V)^-{ejlux7C!)!e=d>A-}u zerORvGHGfV*i0U+H++r!49 zIXzcrmp#E(T8yTNmfL_+_0nek)mDFcv5yF_FY&(GL6~#{zrN!`a0RVJHHO>2{nCwf zE;#%80^-GpKXG1$2pVo_u1DKhU3gqw!@nj#V{8r?rI4!HB>aT?@#6BYm1qdDh~$dt zi)OyI?+H<&niX;WMQ?hGuqda8cTn{Oo2d(zlIg1Bc5C@D2(Z)mX0jPI5ox4f4jWz) zZwlRod!V@bxv=`5$!m0gCU`q?? zs!n-;{Ieko!63le3I@bYA879!|FuGyZ}!O7cr8m`Tr{1e*CkkQfPOl#%feJrlWec< z_QZp)@Rff!RjdE$7d@l}Y@5NSH(BCQ=1$DVzB9&KoX98ppZUYFY|^OoD&eRX=+xHE zE>>PDMkO{sT*PCgZ|U!580W#gHx;>%VXoo=&ELfP2nkd?lus(U(|yDdhI(F`^=gD* zD_4}7M?G<{rfwkpf>255URJO)^HgR{at*n~J#vFwpDIV5@|lC_`u_iM0fZNz=|7g1 zFh?;9BjaW8$nrF03KeUa3msRed?UH%*3OF(Y)OLoEivW+WuwBh+=T6e<*!xR-pDFc zGMc~HBc)1r0&h?o=h#4ri9TlwO*t;ZVUU(wkHKgy;1Lz*LX`K~7yc?6$<_N!?1=EP z=r(|j{^*TOvS7>Y6@d#uQK9iL$N3G~vl|wHk#ic~^urcv#_wZ+>b-S2gCAaaVD!eX zP^2PMc86Nr5cg3~QIW;><{kv~o<%pSKmNS`di70A#A?>x>7zv^DVuZI+3OkW?_BdG z>R33k7jhtLEIvWo4@0&|Un((l;)$?P5{<%Tmg&UnkzVMls`xbZnaJFAe;2Ru=34kd zRyvqx*t1OqE49NJp_b2;=X^b^%^Lfc6a|Ck#|VBDf>fWb8jDQC60S}~yTaF+H zsZrAg_i9!m$br7l5nzl+{cV>5(JlXmpaIU(-48Y4OArivt($P_#!*ez{mAT7=Qz=t z1HE2H+V3h955GpqS{{UK5TBBGt1P4qK- zyfa$q78BDCHCbJhCkz-))eLSPo?LWlQALasQ9ntGIN@Qj#`apt<{n*Xx+1H0&HduF z0ZFMe(Gic65v;9#1!m7=`=9|3DM$OTIZ7GT(Bx;;S%})M@B7W=2_B&t7Ac=GVI5%2 zqX&Y-{(u>hSY;gG2+4nv*lK@$gG0h=FACRN`u2}p%bv&nEx6EqttD4chStI#=@)-> zg5D|4M2QY0>HSd=l)l^PC}>S#ZJGd6WC~t;V_af6NCbOf6W)# zwql) zICeJq$bVTXk&&-*Rk|!yzpOPaFHMg~^_7NE@ejrg-HN?5r958sTEqQzheQXfWHY5s zm5Yj;UUE6B`L6F0ilFm1CZmjR$$)8Zp*bJT3*Py6A7Hp6xC0ecpw$5bRat;pHr?rP zy}9H>KtNdB*$IOnW}wFV9CIEPGi{xTJ$ohjDRCsLFlz2Vp^LRZ3& zd~j+H){0IK3v?cpA~^HMhnu-|XR^__irL*`fq!B5hNM`i1Dbp9*dEOJ zo`*0n+wQ=*81ELmZvS#Wy^98>*LcJCD7`tbZIJdwWtV)mPmKwVp!oZQy`I+SD+irtLrr4-7!GHluaBS(_^uMhD4xt;iY9@GcO^_eN)q;yRm znl-Fd&$wyuo@>UKh1-GF)(zs0T15SCaT)*PjyeV(sp;c@rb1h(5AzVP4+fLT4)>h2 z(21Lc`eSoV$o024nb3)oL8w*klMq#|m$^TX8omcA88^=DBaiAh$3*`=<>3O-X!$zz zY(UfgYs5D&Cl1ImB;0MbmwRHU=v4BfQ3e28Ef^1v0`#trBgnwT0`uf;(|bW!16s9QY*L1(kwS@Z8}Pa14333AF0SO@gL!W5YAU^);u8`v$U zih=cQ$ksqUf()hD#{s{bumLoJc`pG;D%`(q_jw8Bd@oN3C&yJm;6(-m=t@WWbp8=| zQwo9iw8EVm9F*^9aoJDfBJ~XdfYagmKD0`fmxdiE92R3J0F;6#Tn@+)0lzC&G@FUk zuOv>i67AafVJCrh)LGnLS6idB`8x&5a0_6L17d0h2A1a|Pdzt4c|oRk{#E6xvR#1X z&`VFU!~t?WV@uD~T2H{!cytjio_cP&&w6?i3EPlU2#22^M12x>p5Ndxl~q0B98trvbbdD~=yitZR_yYDQ*LOR}Jjr_neiFKynmS!w=Y> zYAJEx7{PIa4%UY%2$<`5X1|j1^}h=uXMtwg_wVz?WmFkv(@HirC&Z+^b%lGRWNg|(;kno?g*W*g8t1tFJ zhK@e66AgDKZe{8mm{;=K5@pFdw~qBM8#y?z+SEo zFBC4g?8ug~{=0W@jEf&2r`MR9lDz>g0{<(3Z1TRgMY}&v<&aC0?G>9adVqkSP@=^N zUzHSYM!5*wF;pij|M2qt@8@_GZR>NOMO&=jLgwr18w}{8f3vNO75hBAw-gf{LvKNW ztMZ?zu+)U8Cdv^?A%3dTDOMduwbsuNm^$%+wfW;%BRf4Eta_HhQ}tm%1r}9JW7%jJ z*1SN+-j(~1leY`AhkH?{6POCHE__UQ12&s3W*p}|%v#XvBDim`?9r;enb?b^$rd4U z6Qs3Do=Z(q6sV|D4-!Fh}hlM#k4miV1LbI~qX|TWT(&jAPpZ+ttX&g#*%=dSP2Qs?-p^rc@6R?Y9=+xWiE9XT* z?+d8SI{*Ri3xhU9(I_%qL7rb{fQPpeG=N@!KDlTFG3T!fJEUSC`hWXB_WP~3T5HyS z`>*H~2}PbP(5tgdztCZZmiFKNb1zK!X(exmXpxqa?NVjazzH+?ikxaj>R)LLwiEQ-h_l~;B?Rc)6KYb1re^1}3$mo&@z8h`r znig8~b4+$M$EH`~&tv^{Vp+4lPHLo4^buM80rU$iNuR_Ufa#)!1{ ztlL9d<9KjA&|hSC!F84;H*<}2$)UB>n~RNw$qrCbSi3o~6_u61TSp1-1wJM+T{<3R z|8TsAqjdRIH1gxrFsC|^v2^0NnWp>RetT8esNLQc?4yTU!5Ax?NnAti;4Kv{qgzob z@0@rlnSc8a2^?M}V|3P6JUUE!g*#o70}xy4hIt?FH-s+yp&%%9%f-F=pP1u3gkqQ< zUzpYEru%0WNJk}7(C)1U8AK0AHX1jJt=6jfFNyiqMYyp8`@b+7ox+-uaWNB$4Kqpm z`VTdrF#84aY$5Zk^RIa_BdPF8$(1V`vW%(IcpiL@-)4LWrnM8lQ5MXaDRnSr!F2e|>}0MgTIbU$lZbGEfMj_b;nWH^7UiMgWwX?&i`r^gQ(NH=}IB$!&R z6tXg$$F(;eegk2oM+rAG4l*fusGwZr&}9K@52f8ss#QP&yYGzHWV~6QVghR!k!oTd zTx)}Tl(IH$S~^qqrU&k9f4UF{+d z8-v2Py{RA_2rqvh!nMXgAHU(`WwlZK=f~ap=$4)D{ruY;U~jbO@gT3Xc%7rQ-!{$TI?E^;Xt; zKB_GjN!z_C*JG8%$?pAh6u481(Xe0wW%YTooJ9JcAx?&=_bgqT-mE zcLwCgm9Bf!`{)H-86JPBSZ)>;;;&Nj>E{_XG`eelKq(_WR%^Rs29#Nqvxm+$;S_Ze zQc{QLL>?GaIE|+EKl1QMJh?h8tTi7K^ai>J%qqXV3*^yseZ=?xiKb6yysnKy~!E=p^V+J8qmiY#=P8>8l}_G%u#8 zRVYTO{W*;)X++)mSAzE7XrARmiH1~ZQZA~RswPbl7MM%OFcNujy_!xrFsAhBbF*b; z#30fC5WT2p%0jP!$7s-Bu#32Nj?f-TKqc~Qg0<^LVF*b9RA(@#f@gZ5_`(MR?5?H1 z1_=;1ko#u|UrGqnPCxzcl87_}vxBOJFA4~YXHc+Hfw)E+G*-Y4YG;Lq0~vGqmCX%u zyAQL9xAh;d5%g5XB6QMRvc$;o%)PJwj={-o!IV6}z)mU)S{)&y8*jYBU-4_5!>Sts zIzmm9!8VrfPBSn%F^v@NypA{e`I@DE_sltK8VTdg_wN(V__BJU=Y4{*wbiYmPl}>h z!!>g3ohGd!ikna;SQ^fb0{m2pY!gsKz;y z>duX-F!mu=eRVs}oGsYbh?S_aJ1?;xYhrdFg28_Oz3h~Q^!$8j=IyFRibQMC=OIl{ zX+qL-a3D1l5Aj_R3v8oJiprTnsWz3hdG?dZPO zMm_6|9sWp+1Iw#UpRum%|56P&Mr<{(9~eb`Df7@w8kB3y^JLZa-+v)du@%AAl7<=? z;>RMQe{O%xkyqv1M%T}qs?6r1kQ;+Pf2xnX);R@)JMWXa7ANZsCpUY4C{AX_KL8pl z;eoawreFnk`sgvhNJ@I_u5n&_T5zoE>b_O6Lr_B|BKA24{0r^ga|@)OSY*WF&%f9e zF1=uWMNid;<%w0fC{?P`yC3uX-D|{VbkUm5`hbNA;$-~0*k!HTOcTXl^c9`EeuoZ< zf*GZC@g`f^;&EF8{QOY}eVo|VZ;u!cj${K&Ce<@8BGo8+cL{yp?0u3EpY)oTR>4Ay z|b5{&-%}>^QpdTg3jnhK8DBYv&8q;(`XO7qns;78njhhp5DNe zd`24n#@b8Oo2vPaILX8!OPNs9y(GE0MmXsVjEyaiEwt&sPV-K?Mtcy6K}cvQ&%t9D z9r%hSCHdnXvbPI^?bTU<;-6J7pKag<{y4*H1)wPw;BZ9umQUb?Xsng(IXJ7222n7Wd zu)6WG*#g?U;g!WZ+r=eeoG}o+AOBpC)-lyge88`rAWwK1cQSOS0ZaUbMQK<25`avL}9urd^Lp{Et;0)ULW5{-r+_+gaw8_)-%PJ<^a<>t3=vgL2QaJ;Bl@cLoZBnQufaPfbEW zPS#+`ZC~;~4-rJydKH8j6T|-Z_5C3RMMz9KYqtA!rNJ-fQ2&N+O{skfB^g-CK3-@b z=_r?5TQ5gg%7J6OkIjR?v7Qx!*E6n{mbc^A^tFMCM0kXY@fPQMM=$Yp^kg(rnG*`p zxzzM&8T8zoTuD#`!WWKi13?&yDk$y!2WBl@%HW?J75Q+d=45n|Q(LC_*+n#8O*(=H zCa#*z&$jJmzVG3=UtG<(ps0)8_T@zzhvVD=#zkBuCKNPj`(^hrGK)u4jRy$A7kQ_U z_@djf)A3;pb#Xe!(8v+5%BCRC?C*+JV{nRnCbA-@QmfKH8ZK+B^V5+&MDsRI3J&o2K7aZv|`S=V+P~U+OZ$ zk4j+`X#X**P-M-(e5aqr=!b;A88&}$N1OdOF9^z-gPiENyVnR5+G|uaLGiV@ug>rP z%)E~>!QzcbUT@zQ_j0I^XtX%tkBrG3aUXjVOsZt#k#v$j1g9ftUY+Us44x#R1OPhJ)%>Vp1*`T}TWW{O!M@?ap1+{LN2u?TI5 zB7&DE?Wj|ye^nPme=2sqvx?%eJrIvNzh+g^cKCDG2Da66~WKY(EU z@z)*Cy7cl(3k=(r`@IO)b>IE-yFZbWQ7CUqLchUAsQo?$l?5SD`bD!%H9wAZpP95EHzQDLLqKX8 zTP2C@ka|DlQ3-ndnonmvoTN1pbyWUy5Jb&&EZt%X71ej#@^?a!unUh-vk$CT6&E zqrLXWK{^pd=_ikbM`!qS>U@=Nq~pyCQqUp>DL{J1hC<%rA!^-O$+TsF@xNNm*K~br zOk(5wy#6p2fsbC;w)=Ty=?V;MXKiiFaWVEaf_mOwR`_hUm;37Yx{A1Y>1jBwlAca% zHHS3A;j39GUrcf{HFIgERqk%DSPkVunD>wg{{-n>xLLGs8ipBG)U0>$waEi&iG~Vd z`FTOH(~naMOs5uUEzf? z5nj)q%yw3=@E(9{EFtQo`zysG4L>jF7+;xEmdDs?8k;uXJ}YqVigiTb zr5!k>mr93GOQ9k@kM_UIG{xX>TkI3W&>E(VwX0!G2tES6K-S7X@sW6y2souaRGHcj zM?l>Ni~m*lh$WbYG!0IMZ#p^?mF!G12Trzae><$`T(&~00c0$8Eyc@}V>0R@I-gFa zUrD1ayY)C3JarbnaHT7SizjdPX!Q*W8d9lfmTJwPW+-iH-Mtz*>uIK|Ew7QfV5SpP zhf9UBd$G>fHti*{h;Y(Ae=fT6a5(K%6uUvu!Qd#BdD%_v%T_+Q0?{y~M0>yn(eMXL z2SpduF=Xq>IjtxFrU`T8KROjkzrGU*r+blMlQT}d7|&+j+(Zx$E5&|$^rv!EvA?CT z+|hks7Tas??#aZ$JVmckd&mF9O?M!v%C@=H3&!KeBx`bKT3i|Do(z6|xq`kJf5_a} zSm)y=nO?%l_0-ajX*J@c7IY@fyzy_O&ny;e)*`ty>^&d58o8A0(!~~+n^_)wmw06B zh`p}!h4z>xnim*T$}|C6>9kt?Ih+i(h^NHK$lH5haGW@-ffDD=&K<3jc%d^+-#s12El|~PJrr{^y~N73i5DO69}~~dJAGXPO30`8P|@;+zJxu z=LL>bq39Bmv%0IyJ-wC}PH}e2eltbbs^_A}H79E7uqP&yziXJQ;H6Pfgc2 z1P_`m)w%u%6KKyU+WrL)WCjEqe!!km=n!NqAb^UVsyz$fi6nu2u)Dw1Q1iT-t~HFQ zd$Xs$908}mhbjYHJum}Wkov^Nrp?F5-vIqN^?8lAZ*v=8aTQ6?#QNTj`({JSORo8; zuczWpcNUM7%-|}oO$p)!wkr4VBe56Eq4Yf3mI`1($1lr?ibD z6wg8VEK%msf>u<^_waKv7V7Nu&Kvz-EtLw%ftT5`@oJlC8|oh1)RAxOtGC3?yCt*J zXA7@Dp){=VzeMNpS4~i1^%6W5B(3{$oThL{9t~Rp!P1sST@Jb#2?nnKiKR`+=+CI> z=`v7PmeLjOUP!TC8ITjg%JH!G#(&IkJSq8$+qwwa#~CLbJ8p$m-1pM5|MoFMq(1b2 z`-q1R_7Or!xCKD_NHF&+;{NVYwEYW5$d)h`A#*EK_b-AD3>(uyVO(@YJy@PNy8NsS z^)(E@Wz#emjZ*%GP?{yA0hv&Z2eV4a5NZW+aNg5_C~BTxt+<&+c>A{($OK_V870kf zkm)O#tPOCn&=&+q6J5d3_Pw77yZ!3iIMhliUymhy6BUiLeqDj;Xx-6eq|f`6u3*a- z&EZ1v?`#;iVy~XDqoVYEnDBz6+Uw3}Q1)LhPzETS@eFeg71tlLVVsDdrmwDN@ll8O zdY`jADia8xps@B)UGZf&6gcMJYw`3MDoc-%dMwdA?2)P@I55T!H9h&SA}n_=Q9lL- z8lGNL^SCd?PWAS>B0Q*lXR<7GZ;`+uZ#9BWf7Gs)b>b%iV3lampgit=O;P>@58uMU zPm84gB8U0m$yq72)+K1omSXJ#p^tzZJ7pi#y&eSZD-<+GMqy$=a->>uuc}<^GYUP+ z7On%lUOwE98s&Eb?QxdAgxahd4?zj;b12n+4iHRZ76AL`W?XBZ-6jk#@Ch9`rXJzAN3P}STfm#LOq>eNEtvkKnMc_ z@E-QoLQjbc`C#0+*0=)-*n3~Af+_nns4s+pU=0c0-#^4#e}qPFv-_Ho0zGiT3@^@O z@8emZUy6GF2rgQkJVxM|Z0TW}wIDx9*v2hIXIvD3mc#Qh)DqGLS;_`pxJ|;8C4c}$ z9`?uAn)*$9tJQ~7{De;M=>%w0l~haFy@Gl+HElJYvmr-esi}Y8x4B>U4_V+bHba_v ztx&OG=Q3=sRMy%4b0PPM;5R4;|Gy2XId!_~uE||IFZPjO82af_JUZQpEHC#do*l}0 zXhC?uL>tif zUy%URqQRcXsN0JGoD491nzk&F_e;X6+B%}suT+=N+tvRL)+qNcD4DP}U7S$sdin2=6CQCfx03CkQfwno+}aJ z*Dd1Pm=juGKtJOBJ1$nclAy<}8ouJ54<+Sh-S*$0Ppx4eVoYisQ=%bo$|)I7_*&7V zc5xB3O4W1(61G&3SI-`(Q~>jX%qSf{ihW?PHiQ|aiTlF?%j8Y`_g{hdtpXH-i@c0a zUUP(gsi8yX|9bCP_uk!>Fa~_LQRKgcYJT_szfiS`t;GKhaD!~Ey;up<-DecF|3n8e zU`Yu(PF*G6^0t~Wy8B3y`gcp67-vvXJNUMo z(tSc)tqLUQ{#%-PRG_7L{E*#rpd(Wx=wR{310W@i4m$prlX~;DHstRH(;`#~lni>J zpDt-}5kXzHTo-MFaVHs&)t+NLU{0CxY^VFnM|TWN<>#A>C3j6ZPcS% z6e3^7x8D%JG=lg-v!^2H&7u=?^lTqj)qFh}1tYG1H`2W+!GwZZ-dgZp!M_bYdtZH_ zHFI_IBHgkh$oh9VJRtJHbLXir>}&(tb8Svo^veW`#2=yH4v-C9o_F{~vE}ygdmXB1 z%gpjrfW|Jm$IT^yd^-Q+<&M70BTk)#zO_9ndb~<+t5SjowOrC&4__(!1|wMCU2Kpa z?@SH~jqNvI$&nBm52ldiM$jH@^kj zv3zh0SPuAN%*l;fec;cx^3sKZXa}4D@tFuv9u<2*`qCLuxVCf|$g2ARdEl_7ub{DO zffWM~k^z7&A*3nYVPink$w%g`9nj}HSpA7-JdpAj40)iPy(E&23LFd=hNBsqZ6 zXNCYI)zFAz7agEP)}8cKl$v z#dxL$fRb3qN&@oq9oH8}isf&G!|X~TY_HGlth{8CID`Ri1-81gv0-XOh#6uE>MYm^ zn51TYZ_#CHY7jW;GxLu1TD+KJqvQLNIKOe#t9MhOF*+`aL>5zAU0%9Xlg*EPa0p|v z8S$OzMg0(lkPAh;;Ak*|SoJ4rT>>z&4eH)@R#bZM62MFm^U4EoVXr3^U%8;`p>app zVjCxgHYz}J!tZ`cbfA{{+zQm90|*{E{B0vX{WHZ5Up12X2Xw(9x#;qD^u=|7PEpWE zI50f^v;0a_&bRc8T}Fa*_OqTmxGhjcsUTde<)p2Rg-}Xv$EUf z^sjdW$3g-qA^j2y0X)BQGezpG_;dB*ZGAlhO>>e}>veSJMQ& z_g)YV?cUs?Je9eAS~LvwlDKgScVriIm-Twyq)?IUo=BF*d*N-mFnZr!8wz&gTsV-; zXTseOg5beY|672zHo?j{S)q{VgIdHf7R^f0A{J5$oo0{6S7-a(U?jBq)=`#_m1K#K zNy7)+%CKUfM^0cssNWA?d;Ixn^%okl zymF1QF6w4w^^v#>#54N&*C0UVtQB~r|>M3X1$~Nku?BK8tY4f14d^^D)u)kd>RAn5RQOt4w zy9_gHVgsYE*ojh+#XW=!DsRN?3gq2HB(g+9umLSh(M~5c+~X=E3W_%lOKD)XXJh*4 z<^?z1SnKZZ3M0izV@aIU(`D<~x~KDpGFX$n3xsZTsb2ce=qy=mqz%S`jKva2ZeGe^ z#RL7}_o_Z!05Vro*wtE65^CpxrAmV!O!%btEvIoCnsDj|0QR1SH7krN3j{I#D9sl+x-JK_{D{vZb^Fg(@a+F8b(?)3X0rY;Ez@GSV-PV9(al&E#!h%ni23@{tB zozV1vn`p6sEs5nm{6Khqu??^8B+#|xTX*=Y6-+c+X`A+pTEoqkm8)N}&AT6eHR11zr!|G!>ioOX zZFhNW{@1O^ zq-|q`s?zVD12EBe#(VcsnN&UkAm4_!rqFD>o_^`4M_phO(y5mkgh|S9m?!Wip6N^C zFMz<4ZuE<(%IW_ICOs|EKQ=n;5PIF5s1Nx@d5}_R{?5Eq^bRNE*P8K4qEJd7=4o;} zDdeHZdNosRN!wMzEU#|Cz7~d}-a1Rk*v8m>A2{bRWCQ~6g;U{J3NOgQ{s+rHV}Ma^ zD|iEIzq!yN_}=q(!o*}vah!=MaM>!w>gIyJr>{Uv6$qw~{Pb|7u{iLAgcN8p@$WsXqPfw?|f(U%Mzh;8Z04}zz617^rErre3 zE#2qT%&hDkh^aCj5LeoYU*R0bQ*WbfOVqPwTfaQPX-W;*mUc(SPvD@nR1^y%j1&72 z&yQq9Nks%=Ua=$&bJ5@zmdapU4@5E*)^mJRyylG!PCGQ1^~Q+Gt;}&^Ryns%b$_~9 zgK38VF{Y8 z2WHC+L=2eKN!2~Ac3+(USF|jP_1PJ)RZ@C82{_JGnJYJXUa7tE5OZL&-{xfymT_#Z zwVL4~;jtBJ6#k@F;R$eh6`1FjCyZdI;OW43rc{X$kL2~aRUo)bvF^JpeiAf5wx-Qz zI*=0b@gZK}YYf(Qw*5R;{>S*+!`VTJE;}1?o)VUs;t|9lcl0_X5!FX7U&`G2g;q=e zF0`#2CskzhG6TeX%YP=viiXWSX$DKp$ z3i1d4nD;Yu6O}Noxz_v&5->*xguF^0hTSH*yCuSRB|p)G1R)1uJjsn@Ddo1A56_WK z2(1vBNa>4X3<731>_}IuJ(fz20_Y^_^a)N>BH^b`cpa8B9(!h=PnvoRLe`!5m_M8UVWnXzkDXy^Wxm|yLV9_mDd@%*BHlcaZb=4s zTYRUiCZe1Drs}%^-0vdp#9bPZAQLhIAs63nZWHB5$Zh}S!IJ+ubM6Atve&WeXE00{ zdTjhFa{jsKdz=>x$1mlkakWKTGC@`|Lho;F<`E6^WT2&^dvm>qHzRU~Sw#LpjrMDW z$VpBUlLgVuOJSpcIznZ*7vn)*+*<~e+YZFaD*BaPr3)L|mFLrS2*=tWN42w(xdO!N zT2Cv9I7llQ6~Wr}4^4;z2Co@>xzKi+=ckSob7`}OB=R+)Udz_QjI7JP!^ z8_`IbXH{^|*8saJ6DFqdxgQK|sL|EIAS8eg>oSs%sNQ}JcfLv?PYjipAqulOzZgsn zp$aAiLxMp%J9n86p4UIkAbyzE%&6j_)jyMUlnlTrC>m@n=W%}hjpVb}n!MECA|1qG28PIUv%E_$gqEbW3;G&@rg89d7tft>rxx+6EZ4WhaFgzA%;7??;f+j~ZDY-dkw?_$Ni=69b`%570 zB@~|6d-14GVpqal>`>th;N6D=e-HFU!eQX(mW6(j@|ZH=c9e-}jf-r6A1n-1pvV@3r>Y5Tzdrk2CMsN5Aj;gq6ki zEBqPhbX_ye-e$(fp2YBmn_Xd;(bcqP=KL_))m9wHZiSm6Jt46MU&OQtU zfoD>!_7Pkv+Dg}U_5Fx*a7`CH;fG$W$Jmo6I@(_;6Z4VG3=Qw+%onQ=zo8 zO0M#bldkj$k8Y3$H#?YVvi3%c3YcczPAeuVm02@OXDQWOG7&FThjxv6dwAV;xI!-^ zIOaj4bFKmBh}I46%i~IkWkcqRx_pnfbCmAkEufhGfo8hvdrJPT`ePg}|Do@XVL|-+ zelw#cZ$G4xNCL-=ZM^gM11>Q?G?GVNvSITB2yV^hHJy#Hzu2pD>31P3{X^U)xq>}T zV-wM9UG8X9ux9NCB#pj0p5F4s>&DMMrWYCc+k!219qGOUoY8bsL59zn~-=_NMGeBL-C^n{o~@FR!VwiK?$aD??Q z*XSr^igyF}eH|>HGcHQ+9oJSOHw!-etyeyLc)2VC`e}}BqV-C+-Z;*qCeVyLkiLdiOg~)N`K(P3&G?PUEf-neD8&oxWTYmk;62f)-JkN%eLsi9EW=r@NT9o+}^Ne}Q}0i=s$m*!gjd$^vS9{UiDV@6ZE91Z;;EH_mzd&jnG2 ztY=tb{nJL1&hd{|-@)NfDBcAE0j<73=ygY2heCP^w@EN#$)CmQJA6kQD09k4^rCLs&8PbE*eCPX z^TF#8xN?dD0LV?OM;E3t+5GC%iaV4eSPo`l7sh+7jG7zDkd8@Q9v&{OgJ+8&(B)u9RLlEMbanth#G;Kd~ zMF<;;Z24;@x!b^S5DJHtBq|1o?G4&(Tg9VRzs^r8%Ef_%@z&R4c(~{D-^bLVhByds zVZ$v_Fr$QyO|!V$A_Es|nIi6{ya?{HKXA4WD|IHqFM_GCPf)v^UR}8bgV8GT+3k8| zzB<;@hgO>jujpgh>!*W0Mcya=4z13d;BtG$Q~zcirCvs~0Ym<3_cxt$?bvF&deK8HgId^Es@?^k+L<`xr4q;3T>JWZ8iq~^VkL;w9{Jh_+s!~;>I)%!A0 zDQkzRrFwVS(yygX)`%t_KOE*PX9Vh8X@?|9E~fFoNBs{xt=BTk9xj%;pkh2FmJ zn{iEz&i>?h*~l7TNL*~saNgk_;>p_j6^^K>x2AUEY*B7@E_+1lqF%FX(Q;ed1Bxtbk;AOA?4D$R?JU)M zo3En3pIj(=@VeHFH~p?TJ}__H@Lj?!qT!`gUJd#zF}85BHD7mS1{yhe%v;=FC5bZq z6f(CA|BS~@=kna%Wx6K2Ms`4gp_XNUNK})S**cIH!u%OiNymF{F(BxaqnW&ESx~!X z+3zf=m08FY&n@|v*g*gM0WVbcr&u^qQ}X;o7TLgud8U4%*^LuctB>*?*QBlz2fHcB zV6L*UxwKHDPqImumVK_=WZYSs8Q8`&L=0!N{BB7n^x4#rxkua0P7m1;f}u-ExY?$m zm@)h~ZcQfyoCR79S6Vosi`e2Is1w6z5|9uhncLAZ1Z`$4M&a$^^`2Nlp4sa*kMf$^ z-Vwh$iGTR)YIl2Hns*IWA*Yc_(T6k7uV(ou?PuGPl&-vJi&gp8lxa5wq^MoGY?gN1 z%MS)0-oNS`#P7&360x$rhueaNM0#58VbzbVf{7{GzlsP!@dw{{^Zj~NC9l^`!NcAX zv3D3M?DYaI)$!4NRc95Y&8x*_@y?&g`-qb~Qc_k}p`!2Oe_j9#>K5~EwR?=Gm$5>r z>2OHtGFH&z`5m+8l{c~SqD)`l3M@nMf&(on!AG~mB%*Dk@LI&y{chJBdX|>B+`B2m zs4gjjMVUG&*_E3-lEynfU_XiqRace#ViQs^SVcI5uDKFKnMsB((A>+Ohu@MUdCOf4 z`xG%9x{K?}!PD|g_NKu;B?|5eo`1oh=xD=BtZ#6@@1t6lr`>k$x3I#@+J}wG$@l@Z zQ9OdlLgx2Q>9N|yM&)HuQY`lQw(~a(!TyjTUF_g+RU?s_EVeUl_VEDbz&}y=z)~a( z-;xVMHxZ-}XltA;Y>k%aZYF#Z*UC}v!#FMi!}x?SxV1AVH-#LCFzv1>3REsq)bFD2 zk}0wZNif{-e?A#hk{^|z5Anfwq&kLG<(PphJ!4LgK}4C2cr!pJ zT$?gq>YdJ+;tRP+!PSj=c26h_2E%e zwxz2)#D>AO*}XN5b&x!6v4SwD>e>u`$%Vglz?B7tNaq)0l1r(SgzR#@c^bVH(YCBX z)H)MB^xevnt`h`eOe(z7r)Y_Rr)|ixo%5lM`)|75WpPXQGv3TeFC$@+^N|4)TJ?M>s$AtRPZATa;p2i)yyV~3hu@Zrb1Cr^Dkel9 zKk~rjS`M&j-;GjelX^lW^BisrvrfLFzt>!dUw+G}ZQ;Voo3Eb0Rxv!odZz||m)1VB za6L@5jO3j^Dmp&psf1?hLUeT4P8PmdP?5%WMDvsQP&Q5r6&MVnM1otD`%L*m=nxaQ zsj$lfihx1sF0W)2CyV3Ub<-~sUhl@oXUpF7#!QY}3y~DY>SslbkGG$?dHd@ZW>Spr z#NoOqorc-XH0Lo3+!Br=*`Xs5Wm>)!J<02VYi!#37-Al)m&F^XXF4}>WszuX3Fh6o zg$DM)!la!ODP-1iL8+C-S6$Dn%?VB&)oLVsMHc-_BGC=b6CZ~}T`fN79zEaelj>7r zXNVT*o8Tr3`4}IUm2lk(8OG5W1ah zyGVydq06&zNlSGB6}*2w93^D)Ae>`J+aU}Ndj^F#I`<*w_3@lw!2x~RR=jv?iQfz~ zTK7G?Ef&A8G&O#|ziVNQj;*VG+MUQh%0lXH7MBD+J!66B$gkZ~z4)#E4nNrJ4O|h= z{?i*ds(tyAtMk)cSpN=kdV7K}63dlyKF(s4smtni{iBMHsY<-jo^+XvM>$>YHs1SQ z0qLG;lH>ND)o{u6D&6+q;uaWH?DHoQD{-(`1d$RB2||vnoH$Vva<)>3oVSw%1xhn@ z3C?~K<%uGbQC6%$_r<{eL>0G#jL?R;^*q@&aNQ26Ex;7<2icfsx6WRA^7!SBj91E9 z%(?=eZ2^ptuN{tCu0B~3N5Lx6KA5y`K(xG3rd7utnX*1KO)XBjf|+h-9f7(y>Xw3M zGsj2ft-pHZF_Vn5y&S$Wy^RWb0htX~r$1(D@*Yl|XQrI@<+vF7(p|6;&cc6gH2HN! zlEF9g&3QkIVa96s8GYa-`-8vK2Y&6o>~#G>lmU$>-%^>wiJi0W`%oacSl(o0_w^C}6@raHjpEVf;gRge; z_pBz*UTU!+gF-96Ya=-bS{b91;|i&q4++XGcx8Vf^sHpjEl*yDof)6B_>q(Fe4`c6 zzsqJiaU0h8%^t~N^|?z)cXOfjLp8v_@H5J|?T06^*$4l3Z@B+WWy^=3s~wj?iJJ)w z+zUX;R=dx7|7Okx$~3Q?$7oT_T#miG)iWf{*=dwGKVA2DC7)UB*6bE_ru=+90ih7` zR*?Mz^9u6tKAZ(j_Jex=Uc&3=2b?jBx;!B{O^;Ahz&EKdx+^_X!BdxefL+u9t<%~3 zYbIdb!XY}-BrZI96+Vp)B(S|js=6aUqD)G%VQRG*c1(T5z1WumF=vQUm!iBfUcw&Y zOom2T%yhl?qh9g-DSsH`b8yWExZ zlsYVPBO(X4mI#G__797?tn^y=`nVdlW?HA>EcVFKZqsJUtV8%4gk;dySB4(tOqn!r zOy>w5B^D;+dgQ!LB|=o)WN58VJ?3)JC$66DoAc?lvJ)>gDrXDo>RFPW@sfLS;h)?a z?E9xy815W&b_H`RL|Qe3~J7Z86lf1 zPYic6Va~mcB>nQgOZJemU}a9hu|6S6cYg5jTEyaZqvSS|5cRv0hQJVUr>N$)tW7Qx zo6=8z+<2q?M^5x_!Wr|#?b!Y>tJ7Gfmm9V)g=K+RKDXD)e3Kcf>xVasEJ!6j;g}!B z7D(^PfJCOHWoh$0+*^M3{3|)ZwqX4*Qs|ORe==KN>nn`DCjY$7(*zV2!=}&6EgI6( zdF9A5>FX^Iyt!u0C!+d-=j>qadPFz7#l2rGE)R?UgCp&Y&y%&F)qkuxj4GKfQx7^r zwoWVDh>FFwVB2v2Ax=D-f-|hH9qRQZ81+s4cFG&}Zj|ZGq^y~{q|MZ&LdM3*70Bk@ zK*9QrD|KfgMf)l_uRApe$2JxT>bHm^$O2L{tmr@LdF0aZB%~k|kvZ#S@&~k;M)g;x z7ar3JhFPmf$X^q&LA$=RWl=#>;C@i0^R=aCe=e6qM}mim4)o`3^*hTu3=aHzx`Gi| zl+Yx-IaBoY^75Hd^Pq&u2dUAY4SykXi*#z*2Yul7U-w5sPm_c#b#_Xw)cXJWxcB6V zy%RVY^% zq|9ss{QFU+=DG#!MLlbq@|d+Kxn`tIUez_-1%kg>@&;Z`B=iRQ-g9kLxUsvtjBI5K z)M8QOMTpfb85JpNb#1+4g~IRK{$Iq#N9AlCyO_W^5h7GhY!%+>zz8fbDiu5Ae>|Cu zovz=)`~rJ!W*n-*CK9vw z+!v*Go>}XjA0TI8&Lt<13aKH$}DfHigJiP{>p3K7Gy@2F#rg7^Vh*d z1ac3-eoYi|BRJ}uY?eT&=5yyaiBOoc`EFdDaU?Wp!}_k_cvP|hQ%nd4v<|{i-#kp8o8C85AnXJ3eXiFMmYU!8mlJ7Q4Y1_U zP@ST5p20X(YaG4-<#dO$D9dj=TUxrH9jjKntI?^)b}`BQ11gvBif*bs{84$HK``RG zDxxt#)Y~cF{=btSr~v!tE^+TDE1)BszX*wyop#?V3VKIt9n=dZR%_-!>y)c-AOn}@W;(mgig-h#AhLpU%gpH7(EI9mY zL{_uVn+_aEu!Q6>MEbjZrq2rFa<RtnqwjZiO#PB6 zXY@V5W{=%@6o4XX1#}62fgU_)&D|z0`*MqPQuN+xe|e_(OxpEvd)2SX)`mBohr2%^ zEX1t>0zbn^GOuO!xTjncEk6E2IP!F(Vy;TgLRgu%o~Z%-vGmuJOH)3u+9{;I17uqt zB0hH{-0Ou_*S}W`*jn!_s;R%Z7@ghtj11-aA=U|NG1WU-vJj$JbGTw2vdy7W732&F zo@0Zl>@o*S$mqCq{3fQ-LYbyNLiIMs5mWO>O?5Si&Ytz21 zEsyMu0)Jk^B=xkrhk8?Ga>Qj%Ixrsy3{bXAm0t9rUBWNYzAx|a&KAt~Fc7qvI=$}v z&FGGo1bR1Avi*_B7@Q7m(DYfPjTcjaR)5fS$#VN$pf~m~6D(^mEhfJRUI`+A>zf<@)?|-p}<($5n5t__#+}8j{32TrQ;~{{hr(X>p$q{zN0lvE+fv+2Zu1E)FQTa>b#MMCmr_bAf zNXC8b1auWrk^2c`WT$G@GPWP8QBy!YDBVyPyp$?xt7dz3$$?w>lX5Rd^cHw z5=TDT-LBTC?7jW&&z>wRuNzut`Q?e2Zs;8`^%$07qMu-skAX;4!pkB#dO!R+wGm{zw24|+P6c7P9PqNIz(8(MA=p0YK& z7Ut`+xXK>(cWa1h>E`6x7AJL*g))2_zc|knYwT#W+NjlxO3HoR9{{pLZM<3*G|JR$ zAL-L70YhJpBMGRytWtLIj0Rj81`zCx4W>-Zd{_R z_Bo7?2pQ=5r5|bqk zskU`}lJzbKJMmz-v(5>q9JIy>Gw$j`Y;lEGW-~9M{3mvBbsJl#{;5w+c~Dc)_SJWn zRVfudH5sNU=Ccbso2;KTCEXpS{b}&Ffo$v^9g)MBDdRSL>WlFqF0FRPJFjue(vOyP z-Wm6zV^b2BbmBwEo3?7h!)~e5>t*C$=Tm;|;qfK)L#MXO6wjJ15#D75Gf6l503%AH z5QdzrtR{&f-~QUxM+Fuye#bIgL;AOCB1S|iLT@~Rsr`C zdDCu@gf41=AeTg!3bw+JNh0H)_|~crlsvTP3U#056-jYY<~*9hxat}SPcwuBMZQ>5Jnfky1oR%El7x?p-?F9+G<-gC9 zk00d5IvWP}>M(QxSdNp1&;Tks7VP23^R*HGX{T=hP}m+UCFm9}DTk9^E!p-AiV1sj z1O$rr9~!hxtr5qCMT=sEH~bG8n~r`sLN+~dvuQHDv-^iMnKW$kZ3lW>y~*&&>OUeR zaalw4CXi*+FgAJr!unc7IpH}~)OQ#|8dyJ$&NBl6^Lbk|vr+rvt*`=Cb1O*r1!)eo zbDD&s+Q1?roQU-Su#`G<(vmzLHL|Qtw`wPLEfI9F7@O+c-Q&M}42VJwkUsA+Q#$C@ zz(H~410*BRebw*x5gwvkNr4O@w|M$9CTxUt-!wk8G`vt<8B9Y zv6JOWk@U-cCyRdOmAml@#Fy=V&yT_@qZNL5L{{JSA9b|O*z1G#L&9pEakbTXPNYta zhkDJS*F~Qr;fSr*+pGP#l;za+lU`&lVMq(B+_6yNTxe@mN7|KI`OC8Hx0C>DzgP!B zK^#&bD!U0Z9Q8Z7ol4Yq&zSOoo&rK-(7X&7f1$xg{mE`}?TicxGchlYx6D1?UfVo= z)P|J0jrR)%v4Bq1xb-eBlZ_+(lzrto$#IIG=lt8{qaei4J@z>*`vnku26Nz`VZDOK z;2|O#QPU9c`wJ(*qBjFxf0edUdxLOORhPYL&8Vk^wudTP67WUkD|mh)AF|ocOyJKk z9UKdhBTHYvu;!7>D!A^1A5(9X&d&=0NvOd0jQyLRegUP@6LDoA$T5iDF(b)fUJ=+K zEsK0k^@*`xUAJfa%+H1!t5gswivCSz8{T_${(*I))lnLSU;?*hj!qWZ;env*GpHO* z_w6?Vw3sCxZ1RaW#adQpnwZ@c%!Zv1QtPluv^4UQp$Oj*VVfdDs1h*@mzTC-b5${E<$&>UW%e~@Dp$Y z;umkTC5F#jPvN#Y+f|Otb+Q^zlsl;;G+{Wjde&^A>))O#>Q=4csa~VXTv0_CZ0lzA z&<0)o`~XU-HNhI)ex2@3%7o1Veu?V{af}}gvG8Sn$G$Z8M;;nJxCTWj;O%9Q{t-=N z`!~Bo@q$#~#%cjP(`eW^Kx(x=Icd6${Xnkoc)%o$&xht1;0-(=#?=heOsWByzQ#V7 zyUd!V{VO}6HA7!~QY>$qe`LecwY>WyPia8Z=%UD%IgpA2OYg1)kbB&GOcKTZm|2!h z(IW%0HA%u)W-W;G4c8Zfb*Y$LmB*^_$jIS#+i>Asb|zJs7}OBKp?b@}?z$UC)N@^5 zrHJbcIV`qS>OmS&O^q#dU8idMo+ixP?}@%Xgsw``Q5icliLlQJ)TvRG@`EZ%#qclL zvaj~06=X7FW#IrB91r1b+cQWaze)pLqBXUo$2Hg@u_2&fn8L1mqipgh|KSW0VK8$Q zzUZ(|SJVG;2JT8c1%bvyE`jjP7Bx_f(#>il3!3C?iF#WHlQ_k6;iu892Q^@$o$XV z+m<<$=}3;uWAt0{JOQUY{M4faU3oo6iM-))iW+;L^TY8`Z;~&D^Xq-e6^s}dr|>YqF-poZ>pZ zslneZetNuPZtP(m@s|=5ui>n(v;u-}$TK-elljS02nE5mVm&j*Nom`$4zJPasf?p) zjjH*nAHgZ{#SG5cA3&{hVI|?GkC-e0ACk1^FwLbNqd)FS1Dzq8{ax=s)OH`c4QCL) zkZa!NpG|9~v?b}IcJUv}7_L;7Te7V4Djhn}m~8mVdru&Cnu2Dlc+_fsAHi6jzw_(NK+>txZT|0jM9E$BPYm@}-c!oAbV9SPi}A z)n%i7`sKcQf5G-qE5%J$)O;tSg%)zKY!&0kqW8_h)xWpOX;KWWG@OC6(H==J6OBsm zqfh@yS5&VNu1C)1?xCpQ6Cbk!6ng?uu4Ic`U890`{jm;}I~`T%Zdx7QciFLlqnsqA z)sYnEY+57)K`Ei2FJ(K1)N=Vt4qOr-FSuZWxs7_3m@>-&#byzTUC&a|030ap>D$DO z5bp;JR@n!g(sa^vbPSAH2=(W5C7qrbI5$(o^r#%N9*1Ys*}Q*!80t#G^%#tjm>t~W zV@DC*?4Dm0a;BkYkH>?Z-+Edf26$b>ggu9 zMg5|B={@7Wzgs_gSN{kK!O$&9Pki<)i8}8%#XEXt;kfqnhP@KU2ZOBbyIF+Ia+sBGB|_O|EdPqNztX%+e}!8W*_Upcc$k7^cg5q z=g2x;C*S7ZgHfdGJ=-M!%JR~+`d#0s-_Z%iN(<-i-vGDTsLV`{h06Se-BL8xpXC$o zwsu^CPc8-eK(tNHhFS01E3VJ%$@?VzC)D^B$XVAlJjO8Mi%Z~FH-#tM&H9EPM6 zyEpT=%edm+A?a(lrg^jyhs_U=Lw{(J-!o1_fZAo|VI?UYy7a0n zl|wKBbRu`rVb?s)VAe!@?C$nM{J)mbx52P|?=UK1rS zkA&0Xn05JA3bq;uM#v^1?;l>7Ik;DZN%_fPQ;!gH}L-Pq4-nFPNJM*~b(6Mqg^!2?Ut3XfD`hbcdHq3-;RD$<}sSq0e!KmDe z>QZR4nStjpNPk`^g{q~7Q4vzGX&cw25sz)|OjsMToyJHZ4TgRPO2|gtlD>s!_fOf; zJdr}00fVTyErnWfiR*mA#Uy&-4Jat~<5K9T;Y0R}*BD?fyi%dW9n>Qvxp6|%yg+8) zFuzN}9MyYZbs2}lZOF?~Talu?=`Ozl0Syb6lD~Sz8kR`lo@rS2Pm`J!qC!t8z{T+sDtXzbvro4=##?K5%4O=RhKDq}^Cy@}vCE4liqv@Az)7c{TDY7|~^6A`vrZEDo;Px5kJ-_YUKu zORu{be@Zz4Kg+VPP~{Fr+U2a)a)+GsIA;i@yE1N{(Q7@ zCMyrq)>v@8XmbztOt~nrZV0@uR$(~OAj3(~zdAE1R%_;OL$2UDkN7O#BDWcD>Ay=L zbUk!qC&_i=n|RnO%sGADwTU~PtHvkJ)(v5m?z|PXXrZXjL}N^@N_ITPxp+oWo_OS6 z=SLV0$Q;=(F0!1RlvJh42N7odsp18h1_1@K%S=FWL+~}O;ctTh5OY{5WNYD!H!kmK zuw}3}{=1=8oZTPH+a5bo#{L20^FHB?_-8b9^|m{5t$uNur2uYh{-z#XH921|l6WZXh&+ti#%p77nQKmjlyn3j0MVMwFhvcY$>s19?CN2RzLI_E5}86l3I z60DzZI$i(JT_+p9&+8W`vFDgIjuRWETd{J`oCWrt>XcWr#ONZsiJFN1cs7vi1ujC) zU+*3>HSst29eX+BtnLl4%aW*_(|0l}D3-LllaZS2l(b$GksU(ct`RzOvIMi4KAbl? zLnA6%DkeAl#-nYO2VT!4&fP9_yVJzz z8&YZo8&aD%p5AH-Sr>eY*@;Sv>AM-JJ@3x1;S9kg!fWB2CdBg>G_%&%0&A;%_0q0K zG!)S*2&AB_#GH@tpBmE9L6H2de%fFF^!sZhE#V?9kNL^cw{#-{6%NtoOO@Eb`Odgl z{0f1gaam)eH3#AGt{R2Nqr+d!_EpjcA`C+!dbhVGT5Q^IZ9_C^5+Nc?*1Yk&0RuhB z8v{x>bJmMCrY_m$_5WNd_ztwoTWp8nHram-eS{Pj%qh3Ae8M{5=g$X|=H?>sKrVXG>Uwfw@egic@yB*9XlAU+6QZ+a zf+!(`^tx?YomOwy)roDzZ$t?X7^xa;+ZoVzX1@c5);tVFUrvAF*!sRx;c>YyVco=`}@~cJP4PpqjCSd$$mkW93Oj|G*7~5)mdR; z=pp_XsHuJy(!|^Wn{9=aDNyXv)Su?7tZ?R zkP;Gep4o;SXOi;v`2jdZjiJ<`=J949L5nDd#^kIsA?8f)ysZuhT4!@6w$i6qa=l`6 zy~jKab|p>O^7D4hQ+EnnGV;GCaCsH=7E2|quasc~Km1&e#nuHRWE`KW0+j9Gm|>SF zX&_`@A%lJz-G0XbQ<*73%K@GJc%-HB*{qJs4l;&#yZ zjx%394QO`=aa|B!vFe*G_(CyHsCUV5y$Sv1wD#rcNhL+@&ZBr)B%`Q<(dJfBEt*C< zLpCedC8vM${-g&KPf8>Z0N89zX!YYoBDCM75z#fwCy{fK>g3`0P(9?-Wu+yk8r4f} zN{gQlo}@1_1;0c6U)3i4w)xY>f+X+g?FmhtIasrU%8o24Mbl1=GtbF$D|`vrn_%Al z_=&BoY%H^9%+AX6m#3zyggiW}Xc=KYx$&OPHB+fjQ+hAoaIzJ^YL4dSEHeer0!Vk) z6z1GNBd;5)>#OzVG4}{(9C0mtAoJ;$$k%PUIYVMTbdr~CmnX|5TAB-2vn_Q?@;GGF z1`mHr7HW;rJGgyz5RkiY%?vKuAKp6s!`d((j#8NERo0>JMN`na$Jt-9~|7fmmT;iScU1s$@b2h^?6Ofh>A-ENQF9L9Xzc|Mi|Jc zn1fQBN5UmZkcREM?jp|@Q%w2#Fd0`Yo?aIHgir^>lZWN{*>X>^C%+alY@UyDvDii~ zo{MBk=}g@3e{fMeH@6(cDr3m{*}>DPq-i5@@9%%SLj08^ z+MT9*Vp%~DaDE22pB`YH8_4V-;(ON`@^rjl&O2-|r$32f#IMJS)~o6BVpn<1?&xPp z)Kr3`?)@=--4FgQa=!?peJ|XH%r%7-YQronjCI>dForGg7qXYya<)KjP4Hach8$Ma zT^}Q34XiZn34&koTpPX64* ze@m*(N?f$x*Q!#-Su%k=F)A@u1mYr*Uf0bDQPsQ|V2RQDPT}3k_tab+UcAaA&1&zh zX}z>&Fid$HjI8P}Z_YNPW%>%BYu5k)h^<}CbWdt>#V8f)W8(8HasQh2izHN7dzG| z)CvF0EqL_C=$p>XNuAULJNlB&yWKz5g=FFwYh3gCh zKY`hb+ZY^ro9lR9k%Dz6#w6(;W-ut#We1OH=U(YQIuG#Zc%W@`xfegDs);QGZaPgM zcy-dVYTOp7BEIZ+k=Q({VQ5$WRS7;89R?{Yg~0j3`EO#aq{kgpZJVu3&QvE0nh=wW zWzxz{VBWW6q0aylxy8nnIeYT-(xp`{njjm24mxK^| z+WU?N$Mr)Iyor-(FnRr16ijjdU~&3I+^`VEC=O*d=}wNFm%BKca(Ut$n2@6N=GFXN zFxGC+ODp!U3t``%>B&#c>ydvaEvd}1Nr!@6Uf=h&&fUVh9ACjJ$dhGZ@6!E;A41^KXc@^m9H4?#dZqtHn(wTVeR#M$q`vixnTyid8U;LB*-2_q?EcZDB>FXPM|78lO z_$5SmgwNAU#t3=n%qFJHLH19xQSGk`H!^l`USrip0uK-{_cEV?kv}lp>-o&aZD(Hb zL4&Wv8$iemIcNdfj{-mk=#7_|JIpr+3FrbzH8#zqF&j)j)H?0yri$gix}2G>a%${K z;HAh=c##R(uPzww%S{Ev&vls1LCp)Wxap^-&}zP|bI%!vwyo`=dr5l-j)#oJVQ0hd za`BBQ?*Dl`gH5oP_b56X=@ma1`_Xr>KiBjX#q0teRb#`7EmMOx-ai0U?3;1P*FS4r zc*WHvZ(z=M2ICRp5R|K9*eetjjbEf`$dYm;HQ zD?a4Mm#4SEej+!ek6@S;=o3;-n;eFDz#i*N@v=v~Zw~;=HH;n1Edqf_Ko+<#bXWZZ z97V>O>mZmQK0O%LbpZ6yNS-FO{WLJ0SbJk+kqrjphrvW*I;Jz0yOPo?!GdBVoxnJ3uUNC+BKlbvcV0p*F`%gO) z_ts5wNDc+Z^g_M=*y4~)+)UT9=hI<+a{bx+QQ^iZnbaR;zcj#r2;Z}(F9QMC0p0}s zCPR4w+qL`j>2`TqslilNwZJY4xf~LD;ajb}LedT6NzYckJJ4OV{(I+9f`3B^vcVQK zVzL1-Up(^w*kTxLx8?n5G(GgF>ENd7Y+88C6M*+bo4)V3&g*9mfWgIFDUD})J+51? z9HxFBZm5S-u)hbR<;5Au_b+8hW!+au!RE0$`GCxm+KoX_RCN|VoCR$^T9F}>|858Z zb{86dNk-1n?qXAFK_l=hrY~j3;bAj3Pux^ZrLUL-CTp+nu9gd-=b64#8yyqzZ~6 zOOsBqIVkXZ@3QE>^7jbxf1uOgpjwggr5K)!`DPyQzZr;TmgF<}_^|I0a6O6#TT)ek zKZ|!5CI=*w8(_iCG9&%5D<`3D_15M%$VT`2+7YvMxYqPX`}7vbppX&!KNsgk>alE} zY&*#X%xWrbn|Vyno5Mk)H2x^iHIh@|k2}P3W+e7i{xzjlXUi;VN!`Jkz1FqfvuLv? zBMq1`Ur(WixT2`r{^N7M2Un-m3q>r6t4)PBvlgnZ6^V5uGAliO=d^MUz-N2@{Us<5 zGK_l-TN09ZjT1V-0e+4QireBcUo-!6$+VS#5)OlB3M`1QKvB>qGQB-rJA6x26$NON zofC zkP3;pa6-I?z!bV(zSf&WZv&R(3ab`8+OQLw_E&=-Ubz+lC07(`qX5u_QM^l&z)ngJ zxDsU$_`L2+mAXQ&R1=Md)a!b3m=UE^`P$&WOb*^C6whWPmII%E=HDX>t|1g)C)9wI z#(ne^+|;!2QCCgde_8|o76#T+ZVol@c@8{RHn5k`u-zbnU7<0&Ho|$X@eUB!U7c8P z`{AMw;T=W$3F#CAa2o8w_-4=lTjXEtuiB@KzWyq}N74Mj^CzXn*(QyrH+I|O-+%sW zIThMCDL%`XEMf9!nUWs&v%6vLtryqtx#@9CZ`Ibn)9No(8{eLD9m}<>H!Y-%o|a1j z%DP<6aYHD80asXGQiF^;5ph}P3S4ZIH@)|s3ovT&I@z&C??TlaroLPcIG*tqV6f2M zU;36?2Fhd=frVL(nx8}YBxJx^O}3JYrtatb44s9w2|C_2@@B{+h*mqWmZ5^Brma z;D(-1<030U$r{0aOGx;=%qulypfoBdGp|!i<(?|gW!Fj-y9z8dT87upGs(B{IHr9` zKG374z7g5$Rncx2G9?+NY0_3TT0NM`Ao6}Za6~y`-vhIkjVQmqFZteCw@J6CL!HI0 zgxdLq?2R-g;TLIF-uLO&ZIpYhe5lQ1JU=@wzmc`XJMuG?A{|pB<+Fd|v&lK-`Li=g zd*ru+{=5A)tTcmkD6_bLSjowisALkwW>!3<8qe@36v-t9QoY1Lw6WhVXB2e6z&o5J z!RiawCLp#i0~uPB7=*g_1)08Dilx-fn2bYUCt6_e!EliM#aT8_$(w6Nh6%F(vZyn? z1v9yWz@7GiD>jPKr4D4fMn@n~xRLOS>A?W6(l z{a7%ILL+P;`-W|46!?OC@HzvQrHMRum<054AQDa!aRY4PJ|{aI(Tw6@;AXu4kvZ;0 z(-tY*sDWjdJsm5$AO0^gm*`>R|E^I(@TDt_Tl2Ms1EmO95)DjDl5VFnVvbruh>9~n zcKY{-fGu+bgKbrv1w35vY1Te984kTB)%uy1^gpD_sn&%P{UmClmhf$OR*sDFHff z=198o9|;*`9Ddn*nTfj{evSeW@*I*!^RM91>g7KX@}uizE(>A^!TAgSyrdf7)4rw$ zA?g&^ZDw9Rq4sPues^Tr%;Lc@`%FPo8M_hp6o_`d>AF-`@T9?E7#)mr{Clz^KRcwl)ncs0{S{^G=T+2JNImSRx> zt?jFE>hwZpSkgrjWJWvr=UDmEE?)Fc$MS~vr{p>OKcalULzaxzsz zwwwOE2X#h#U1N}n43J&`b#}sSTK`X>x96KA;XT1MPTbQAKHuJ4OV;uPX{sAYKl3&x z8obX>Jx>AQO5;OM3`Up1Y0U?P=2ztIC`pE>Z5We`+-3-cd{%kmsTRdEix8Y>d&m;j zmFC0tL#ZS6AODlAfuVL)MAYeJ0T05{KfN9ZuHSjK6*q_(E6}d#X%>27+JF9OM;On` zi>nU#=Zo6qR|nly#rYcnWTbJqr+uerG=-rMYS2_7qz?GoG`ox}s!0ZCAbJ$KV$glg z0jFyPuO>{g5V-a!btF8~oNN|mM5GK^5uc8?W^#d(-5`*=>l-2^E+b(^JN6f%P|%<_ zaj%SIXag7v8hix{X7xbgOZQ1}jl>xVtpU3d-y*&cRMK)k;3?xI>*hBqV*%a4$S?}_ zvWR@>AK<8%*!jRr8G&Y%MOJ(z%>E26`#K*Kxvt6*Da_`~eB*JJY!}`ojJ>vZJ-PE8 zd`y0~je4DK)&sLkYr{Q#iM~Ji|9VCnz9=wXN}uTyGzrqN0TPI=9DpUvI@1f_IPjCZ z2TvTyPngQc{R1FbCCZdrm0Lhi7zxn+27obcU$}toZsG!>@h3nPVERT*-e3Q|&U(d5>X?4}j`?dtkXh06xPKA$&l6B> zo3?QWkgCE5P*V(7(mZZoVkjv*AXxR7Qm#{FfTq3k-+OucIgIOaxVo!kC-Vx$N43G1 zRXa8$_lkso#Yp|05-6EHA5>Tcy*dRUm&S(*j46!)>#TmI^wrDy4tN^eTJ%8w1RE`B ztcMxbYEHnQUJ+o51)#I~AZC3~zYh$?h%NL7h2uDvNfTHEKQk{!HL}?8V)(P8(dpTK|K-rp4X_hYD^s@i)evztd~~c(PdT*z zt;B7gSIcK7EDFzMKR+H+A}FjHh^6 zcq@ij2+&>LG58pVm4s1;+K~L??dnR)@Y!Ie@g5SwKwax&0qdyt3DHeC3BxP)kfRS7=EhFPY%Oa@Y;-2 zL8IgqFl&1#Xc&J_5ebGxWCBh-z>In3Udd%8bb7i`p5fX2Td4jE+H?c>$rb?s_#S1t z#aut^JX=2*N)v^iU!y~^f;Hrn1;3ADPp2wp%GFDd`Srqy#~_1QevZMWo@O zI|KwlP`bN21nCX|>F)0C?z0}wRTnd$0b0JH^?YXg*9%~#6d!<)0dKDf0=+OH2Aj=N zRnV=ILQ-ewZJ@kJ;&)LDGyZh5$GwJy_fbANTP6X3cM+G-vDO7{v$|jpgnDmlY2X;g60NmQ>~w}ChA0`PZJ+PkHc*TD^gh9;#5`pOu8`ZVP`m|L7WrXV zH@RID1H$yp`H&>}P$;FCvhGR>$Z^>94e1Amt8NeX9#Y^%RVglLm7(!7n;o^KhmHSE z^j4%=zSr|X?16$ug^f+P&f%DaYEhsD{J!0G zHeKN~Nrpr{C^2qUjS)-3bf!7~f~KG~!tfR*0!*TvCY$i^e{+tvwHWkLKs>_EQDBGs zgef-GL03?$5b65o3nUD9K&nwCvu?}qAC>}9FMtvD2Rq{+<~?sLi3D6Z zYfb`#ZiVhnBaY>Xaa);xw^O9I!ZB}yWSnHC8TY~vNga3)htxV9$O7*(PMTTUh1oMw zzq73oe^;P#LMqa#v`7Q3wi3uBD&W!EBg80r1yLR1haVSH!dQ?qM}i%$I>~D=+sLPP zKDh$~aGWqrxu8oR=KKb{@t#)x($Z^+;6=A({$J(Kj{kRYiS1H|x8nX?^!NT=QTKx^ zCBIN%OL3vc-p`s?D}`~Z>dy!3&=dYQ&3iup{F_-j(1qzg!7^s6YOeoGOybQCD+ zBGi_aD)igFM60)oG5*e_s6i)S6LyiC`=S5YG#QvQ2Lo`C_$#MH{N;jhsEFIyc2@lj z$gMhl!NAyH{?mg8qxuhuJuob&w47N#Jx4jH1XZ1*boE*zxI7Wp=X>UwFS{j3o9%|u z#qC!*(4@ks{G?Fd0fRl0cvi#iNZ(RGvmmCEB~h7YZMqc&o2)WnLKGeg`_lHLWw`W#)i+@RmCDXeaE83$Ou~T!n%e*GW$b`lbGMn}0$|v-zJO(^@pq zMoIYJNhbIV7MrcZUXhmy>5}m8YVT~cgfIU+$#&4wxeiC)hYz0)1F9vIrSWTaY>cY$ z%U{Rpl(QYjh{Cn3U_-N^@nkOS27r5Sz*H*}2;&&6(x6G#bPA~#WW!_I0=J*w9`PA= zW~Jzp*EXV)WP z2%{gy5E&iy#~74ZluWr9Xw)&0grJ+@X+X;i(yw>(v-eqSRa6(a%$kvoyOScU4X00; zHOhRK0XCgiO7Y3(5h~$JGn|II^O@~w{MJ1XMRP$Z$M^tVd8Y@eS5OUt-US zrt97k-k$45l9RFq6t)G~kgum5As}wo^87pZygd9g_+N^^)>Va<CApmTR70Fg3z$A>w#&dSP z4PAE!AP)6=q$6MJnN$(DcpkfKA|*^`Z0a}7;&}rAVIKOQE(hyG&AAw=RXz?dr}nX0 zXiQ4>yf%$;0xd9nNc$44>Ozws#aZjtraT1+pyMyXvBIX@l#vODnTNtu-sr zg_w{-dpwlS8vdkYN5$jMWOed5lK%8uSiII=+Zw0Qgh@{_I<&on%V-(9%jDNX`^4=;V^^ z!{t3djy2KDkU&!zhlUPvk5jBte+})=Y$!+LZF`_ER!IiyDGz3@rqku7frZGdjTA1> z&VCRP(*{_hA5i0EFu(Ie2rCESFc1@T1G4#gO@gGr9JHd7+;;{jfa^lVhB|?_k3!-r z8)Z^JlLHug8qnr3V6;J}2CFKV7VJsBYFg!lWUfP2p$c)FXfMn_C9FI}q5N4n0dyRq z0>BGA2PzDEbvp#q1O93=09wY}h7$xego5wp)yW2S#~s+$H|tnSc$c7QRnJ1qrjX2$ zjtOQn0!4Awgsz)Rdxhmpw6OaZ!1eM4l}LW^64oUc(JH-4;<1ycAfErqPD_vio;%31 zUpnms?Z50@XyyND|KDRGWh&^Ml6ezyF#Lz=AtAySp878hdYWcXU_OC|<>AI}wPce} z{yV9num}E0mYc!f%im!l;X-exaO+-Pf-!whWIBt1M@BoAR5V4LbnI;Gvrt=YvRcoF z$9KowA<8djq}RVvbLJxbOEaaGlbx`dO$Flyo|)L^8j4cOuV`=o&`h1c=G*=Q80G$R zh%W9;>fb=yR|dMfKaZ9uy8f^r&FC#nl(b(P<9o zlq|aSvAQm6xY~>`l-RG8bySPB--2N0^w?WD@SM$ilo25ekwE=perD0`ZO^FAQcVlZnG?W8Cmrap=b7yRcq{CBl>RB*8 zNZ1}P+Id%?N3j4vrLov8khtW2Hw$=NpY~hqp2fhOvP%;D?mRqC0HcT~_+R>?Z7V+a zAnSF#^^%}+{s0RY2z3O- z*!O>mvHhXQ>%S??61p$bE6<9s;YFb->~W|ypG7CZc6BK}R2RrHTk{5r^ONfl$$UQ^ zNB1kmxZ*-u;#&0&0Cc>&AzOC-D>!imF%TnsyuG4YXM<-EG4jEC7XscmrqsFVtbjm} zdVhB#NoChcykE88DGi;eur__$l}UMKaoW?+C@APrEB(}Y$YbR@xAG*|)ud!!tW<0W7?Ky(A8p4i zrQyTB57l;nc}ti%{amALvjyzf_q~adl!(zM$Bc(wFtDQF2D*#!D^x{K;YE@E?xL2-I%@gGvFCM}y&kW}&2zN*`dqDneLUBwcQ&5HNi`n9$x=FAy1$jb2s-DZ2}J+C&DGUA-mR|o@7Pa~nqk?^yi>za zXz4s2;n+$}ca-DGxeXBy<*ZIKwo1xzH0RBmA@6<&8K!omfl#D(9an9w-)TYFV~pXI zsZws6+X~y|rQ8C^oB|#vxA>f%51iL~qePk>uFnkLga-%aFo_BTI;8G){mehT9C1~V z6qirFxcGpp$}48$%Kz5axU!4&d;02wE0QPBuE_|#3d$x;maZdxC6?^|ocs@MbE8P? z>k6H!{xO|3C=C#AZ;ieffG>n;HrsBNp93ya@{qBC9}7`+${B+qR*j4o`>0(@zZ z%Q;;J$bI#K{5Nzlg+UEp5|I0qG`W9o6`b4t^Gqp2!HZI+XS~bgKxg^;Cv-AQ!ec8x zTWuqd532p2fujjbYAk`+bitA?Y=+<-m%EZd>5n!#s(uEu>|EgC6a{$mZ(&i*OfTLH z5s>pobdk>Qw(0QS$$oJY%DVgC)-MvndUI}rPN<4KO#9z|7JerTy};PlbRL-Su-<v-IhQn#SFE*(=Z`HbXg)VLABU$r7qL( z3{?;6E6z<1emO5?Y?YD&9kSkF%iL!^?|LEL?YPlGy8R;!|NA^2r6LI|bmB^^tM$fj z7{|KfCLA$Na-T^0py=V3M(`1A<}}`wp3~z8hdY9`>(b0xp{b92hO*H^gq`?CWTtA# znv$$6xndd-hS}?Kqd7pzV`m#PpmV0mbA!7v)2Xw3njmepn*;n?Gj=W@K&p&pvQoqB zT7FWi-7$>*;UpxI(^JtnR{N419Oi3sB?c%Zq?H`BEH$Awt)JYp5ZO@yt+1o;D02Qk z5#BwhJtROzzjiCn>CscTEi@B*W=>7T2FIz$BP*_RBTW z+Z%ZA#b=<}e1rvA8gtkTwnF+fF!pi-E5GZXxiuQYT!J9uv18`Y!|edpsDqLauC9=i zjG0y{VS5O12p+kfNXGd$@aI^`0|JeS+MP-ywdd2Q{uq99l6gbD%d3}BO|fll7GUhb zpcc3bZ<<>7G`9Ol1qGm*^o?ek!%V!+U z%g+Be!@8gC|G=LK9j4x34WOlNypRa>2+CyGY^D}Gn|l!{=unP(ES{&U+!yvh-r0nJ ze$YI}b*8p-_66|w9By_|C9B-mpwSRjo2~-YW$NEEMM)R>!A^)~N zFrTRY*6epYii*&t@y}9&i6^vX|6{UBagB+zI;)LTHN+jP81d(eC1{P;rXLAnny@vr z0CfmlX0 zA$wf3%EvtWg3lX}`4UeulB4AKb$;AWl&f&WIcD~p7nTh_J_B;d7u5#d&bRa8pCPkN zc>%?U#bntrFNEZp#xCDhjDYg%0;M9mq+23Xzvkqw5{KA`-ez^dZ6JGMGqc&`|!Ub&s{vGs7&1xByFV!5t$@I#E^Upw2clIq|5z zc3%5NjWM|~_kWoC0ln0B`j;27t`tb{kN-(*vFs6we-oP;bTx{f(e2^E zr(-}9o0s*BwT4!_%}26-nN)_HK?B8^^*xUCv%!teM3_ z+pRJDJN*{v8yijefen-Hik1NGN*+kU$hN$LA7XkskKDcToPWTTs&O^W(FDDr@s?TTR>*Q7Ue)emNk@vGt1i%hwVD@sA_-BK z!)Lc!X=k$?!C`jX>HZv{n=LOi@ZyVg&=Zc3-W;+|PtpOkt>E@H2Sn!4s$ZSTly(~E z;RBBVS!3oA40wqRtbjVS^ad-Sj#0!Z_!znZ1g~<3Y5rS*kbhP{2t5*q=D!sngsuSF zP9UcmW&qbe%|kg_hBEXlfu9Kw^O+w6w5FL9n99%#XxzGYaYL(=Fh=genJdIszc6m? z+~RjS|04F4xZL`W>bjP;zpiPa@KNnIuiZ%l1%!NMgnyhDyCk7aIWw?i{1SNY2_ znM?Kelf9MvLOtCp1($?&84Bbo`iGVb#PZ!$Gfg|AXUq<#-;w(Qh&3E38kBNrSj1s{ zp&=7sk4)ef)Bh)A>I;+)UlIgB5BXxMRLp-NQ|RB2`AS|9%6j~}oko8`W+BtCwg|=a zzaf+Bn_}3XFZ8{kA@f6QW|)t#JO~9vDacg=18z}(1NXXwH=tY~Wy^%O`k>@MmUzH2 z?YhQ%_*>vY9%lqbf4ULVyut*xCP~^y;@zj9vLEQhkXpzGZP9m_Ih zb^jAFOfp?n6E&q-nR5$T2VTy|Y>_6rhRnSZ;mO8R)34huN*6Unsa_osxRIb+8qdNC zPO!vxR8&F?c4IlnnPspYT$F`KT^goDS9L%Rj651+u+fOk- z>M!q0dS$+194ut$NmeOXI_HhOkxI$TDUXS>lNaos4aWf2HuPKL+^H)m>$(n$!^j799!CgG=XKgVlW|Pex zhW+W_<674>oV9MP==_Oo8OJM8nEnMkj5HxG*{uAM^VFQ6o_a2vj@Q$Rq_9h`t3kIy zPAcdgt66FBcCA~yUJsp=_ccKFGr+)S7>u=I)aM_#iw4?h%IkXA6N-u`=^&V=4wW<>cQ$$Ulcm-^43lb|} zy)*NBCh9(=I!!nzi9D1G6iC)IK&lIiTJ5BhvT%eTzEAImghBuTYl_o#0DjuW6obYF z(`L!L+UZDEnd)vN+t8A~&ab<-K%&R|_BE?fFoB%FQnO{7=}fy$B)zUE{w_O9)_S9; zi_&`f7H-qnPv29AA4pYN_~ALl{@l+DfT6J_NhzaDCmlJ@acAJJ*PU~ILsFM^=b??hllRBq;KZG$2f;h!Sb z5GO0C6aiYqMu$av{)euV;0`6}Rxq4F_ zMqG!-eoAV)2FrA3?Odd%M=fN-f2B$}T??PY;QnO!5M^{xkT1oknI+IL>zYX}btZ=; zS;d^q1DCHbU5Jo36)J>_<#O(|ZEv=q=?}^CHc)c%H9#`3WTJC_UFT_MaVZ-gsQI1$ z-O(}~8*SP%Exh6MrSB@vK_%$)W#;xfB@i6}$qX%H`$|fO?E0{2!fhCECuJ6@2C}#& znt0sFY2=a^MiZXzLDM`r7AU~4)iXb0!+-db=-foB8=RL|uN_(*O)pXi6RmZLM&(H) zc}6lzvd84w8Dl6m?aSr=fN7IeI>y=3SzeX;V9b4AMJ&L(t z>%0%AheYMZ8=vT&ZS?3R&+pt4Pp#Q8P$O|WLG&_07Nj%GWD^9rJ$Mg=F*PYwP+%3r zn$=qO0KS$7K-fs?w@-O(e=V7?YkZUpQZUz8o&AUFNnf@CIOTaypAfKl)jEYt9s+Ru zNxq)Y^(A$f76C6M@cYREjejf`J(xAaKQB7H4n7xz-&#j)pCJZY-@yBPac};-A@G26%DCI6uh~|PO(w*tJ&AS$j{IvtZ=1eI#PHD4+B&9o1E`sQs@%wPi3f*Q4M z<{AD{^bS)}S~XS9x=fVx%QYaIjC7I0;&r-#6$oR*xKs7OGn64?$9im21H@zSz4^u^ zuTk@5*VpUreAQ+@{A3y)Hsi?qFpi(NReL`lBDg@tUh2UtsWQDof73kH#(00B*);f* zP#a$+V9|I{w!k2)NbMGbFqq>om|y&w>9S;*Roe!PbT)RnA+vu7nfA@?uxJO z?cke=`isIJZbw{Xnd`~@QE4E{dn(eUvn){KVts&qcX*F& zzp{+%Cl*YFt5OLf(@2MgM^x}u60+K8o|&slv(vkTclkm{R-;zThW!tT$**-v;wR%O zUj;08jTmKBW`yMZ*c{huhi_%}nqkYpu#BDZN8w+H&G&d;GNbywha8&a_@I!k{sf`v z4+=~f=tKr0SuNn=j_5JpImVJmZ-Y|nwoxm6uyFkz2KPBh=@kmr#sF#hfFMKauU-iT391m{i=?4DvOc9wGMR zP+)Q)T}oB!RG8tajTq9Ln;gAaS( zR^*B9S2Uc;mG}Bhxv^pnzr-7u+3?z&;53}A5}(S{uu^3W!I`m`N(epNF?qkMO;i1~ zdeB>BcUty2v<8570(m`W7p(4Yi%>XizJR8edP=jYF|U5oR)hk%ZHHMpgTKObTY90I zUc;DN=Z!;*gmdMp{jCOzfhn)+UF>#K6H*l^_i4I5U#B(h_Q^2u4TD2^r^)O+dEQz+ zMv_g9(rPL(288h`3+zye2iiE#*RFnFT6}__g#pVfB^gKg`syR)z<)$oSlx3PpJ-^l zrzrdVywJw9-cbEYLAxW4m!k94mU=+yCsWAC=dF&rgznEr4U!l12H{V-4T{68dtQHV z9y;@--&GU|h4=v9#k9(6V1eU?kCkl zi6Xy$7(K7R<$Se$V54Qs7(&GbtxgX7SGXpQo~&WE2Er+R+_^fBB(qOt0k#4sDXlc` z>Ynvg0+dXjWmOP$ky;892^OmFg56Zi`mX|)_@@PV;71yKcz#)y#`s*VbXz%7QL9_? zN4=O{xNkqnZIUAkxwMg&L8s5jUMb9Pba3IP;Vg zR95P+OBihn#m}-8ZpQC74~1u5V||$Ub{(|*>wCd)(&W#0BX>;^ou;cMfk;|ucuHT? z8s`rsRG23oagQ7FzO@oYAN`udnR~%u=G92x68DtvcUwz%Zn-$!Z2Dbt zsBz5mO*zz!`;F1A2>$!#4nP{UEp@DRyLe0^vtH|XY0!of&v}lfQZYqP)3Xs$>8jW< z9hG6)vFgO&)*n8a*ZFwlImOeQH*qbTvakr=@{$y@$W_f3VBi@^uRztwCuk$T2pLR; z=}Y8^00c*g!)jubR^J)AWM|PZ?;05>unGpGLtvb(l7OXK1<{FrX^ux1CPxgqKXbUy zn4!`@>$)zH$>%S*Th|@}iGJpZt_SGo@3SSid=z}CJ}x2taCU9f9Y&Q<+jzE!=kQ=a z@qLba% zHHz!<6PI>p^Dl|2_n3$(j1zwf0!pOky`FULz&K@h0`tDcV${XR2Xcip&SI1g!4pCl zx&oqd?^wnDwO}KxIPX0ewc24byZC4a_`vZTB$log?t-n(79~}!guy{0RsD+VUE;sr z1WIVChK0( z^I?)iWOoa{>Ss|Hj->oK1PC75T>9781tY<(?>MJR!i`Bpb1D7 z*>}5xX>fN3pB|KKfWRgTkbmQ|Z-m^8VerLI{Es>(AXr-LKTuKY_)1Gl>rN`_v`Rhp z_V@AXh*1@U+2yftwH_X>`gnWhZAh$bZJT>HR_1nPcY8V9oVictj91_4AW&Nu6m+JL zi8Cyo%eB8yo}YO@KvYETkiq2mh#sCDNf{9NeyIFN@tJ<%V%4`)x+{7ip5>=F*K(Zg zSS|A8t;-}l$HNsL?y!LXe^Yqx)A|ERX-4N4nOn{PTmjVp*1CxkHZxKa@2f1@4C&(W zmgt$Q)kk)S5Wgjan-Aaagp+Q~$spb%N037kM})1oo+6|ekK&BO^L&bl#WP&|^zL~H z5!k9AZMC$MEtuJ*N~7!Ubd(^Es*j7&uTQF7;I%qcm#z`kJ{(`&nQPAo;j@zIe2^tk zs~(Y*ni2i2SqSrDU8&m)aq)KC#`$U!1!a8K@71np8y}t8($QGMlXaOVGolrtIUn4p ze@OLtjdE9eSP<4j$lD4!Cqg4d@~7039HaP_Qa0JkRgN!D5I1a24nNepyW^(JH!SYG zNuEddBe|y1xaQ}*5~@FMJz8rx5_;UvcREuzo@1$XOP#m4UG_!q0d9tcP2;-$x9%)f zO?SnxP4Rf%tJu#`9>LW0b9yqzGA`{QeMX(A^^$ z<05FDF#B7v8r?R^GOtoc%bUS4_co)a?r3vZmMc1D>cfCm=5OUkoY4qorymWXUb`V@ z_tjqMgGp958z#9S1P^2zjEFf?#{ z*p;Y1uWcJC8d-mR9{&BR;yycpy{X!rT?57dd;RG?hlZ+#JmY&jgjM6==VjeeS+I&Q zd0xuGjF_f4Y#Zr~JYHJ&Zr6uY{0(k_507)M{39#Re{|{K)$~*uHnl`0C7mJ$tV?WC zY8@bM97f;m%SAL$4{sDTcb6~OkvYi~88}3)*il{^ik)c9Uepk4t70rRePwcp4dJ6x zZ9W-iAJ@f4ZyUC{Oh5CdQaBE^a-dIC`H7R~KMhy8%^gDCWL@_wb(WN0H*@~|nN#)e zcNmsRynSdxiQg(@$kxNP;``_ZXG8YgeH`~`T)(MTI~hIWhmibIdvMyU-XxrGzOa`Z zRF5>_f852fx)w8Z-e8;K=l*S$#loL1f%}@gCxKS-?W&O-muXoHW}nYOPv@)BGS)`V z<2EI(3t?|%Jrp&PwTI*-qySvyKyFL@WIwS;@` znYJ@0REIn;bw?y%MDp>s*4G0I@%ZN!DS;d5hzCWAI}kLIVIE?kcrq zZbFB6QEH9@&0Q*YSGVsw{gQbnVi3Vb3$MyIPu}XUZl>+}DO2p?vTZoo88q)DCEWb@ zUBh)S*z}BrQpdHOP<2L3lTWDZ6H24|mDjttAWFGLO@57qrSrH6nc3P#RE&Mn&Wi)R z(Bzg#-28K~FYo*+#`2CrdT%?{Ci$HOYv5T!3f_E(LWh69&N}K{jO&TFvypy=* z_p~QN2;!8WJU{q8up(a}o}=G{aq2xY*_-Ed`^4(khdLbsl+1x}ms$*eLRiSBvV#p{ zS(c6r{~Yy&k{_hD2Fb1Ty+~j1UzF|FoF+0T-LeoU9z*@nnNPIcW&giMj ztDUl6?{ALROZrYt`x0z-7oTJ=m^##7z3uDSBX+YsnUtXhNf$K)0 z%Rjg9KC?Yo=HW%vY^2HP2Qrpqov$~&8rMUgm1ad^1hG}j&_xt?LLY)hImIQiU?1Zm znJ5>Ipl*8msG+R?EC7%K8O z$1|!hg4Y4ylK7k?u8zAGNIdlWQ-nf*K4A$Io6g|9deGV-^6~Kj$}Wb>G5l>3uu4Zi zn5nVbINTm%nw*}dveGq#d;}CddZ3chJPRQga!$%@1I!Q?zP-IYmj^&#?YY<8x^EcU zeg!*`KQnKaAk0Y&&bC~Jc(ZaqLR$!`T{g+t)k>3KD?l8_LLl8LS^WCRqP=7AKU zQrk5t5`Je)U_T-J!l*PsgAsUNA{Uua4R83UFPqvfH&Jh+$Gi(Hu=X*+`gVw#GnM@=p#w3Sv1!GOke zXa}g%D;J(!;oeO_hfnk`Ma_Fh)}N!d5y9n$H(Pq)y)a5c={16sHN+L{wh$33(CF}d zE~-Dj#?y6o^%EPAwcc1-wJEfzUN@RFn|026e`26xeb+}iYh$mlL#ZB{7}E9jLVxAt z4Iyid!s7XFC4A-ijR1}I&UCf;U^9VeqEh?CXnSl_IOM_+kxxGH!d(p<3D!BPVniDy z^Kgb*vSOzM>|?9npLH)2YE?7Nn^2n^Cy>}zcxyZDpwIe|Mwp)zotB&83~1#&Gtn0( zMk<>X%E>y9l&x1?_-?V(tRNtXD!%iWDd<_l_$QSax@iennpI)ZezI#yIX}nT;WeSV zkrpy+&ieHQQGPvt1hT^mx33PLBU!~r@mwj>9HxaG+?`LJxEa4(LTB`TI)!X2Zu)9D zw_h}d!Laeu-M5t<*Fyv}v5B-&IyQ~ERBBE-#6+&22MCPoD>f096R{~N6OajK$O%E> z3}+y#sE6}P7K^hfQ!204yPA$vtu@5EC!L?lyLgX^dln9vX}1KYd5amfp7WMOu%HjG zKksWXV*brEyjr)$@ZO?TyVWC_TenPHK?~+8?%VVVs~anBD9RgzOjt$lMQHx@REMiN z@Zg`cI?NWiFMikQHAU1ge(djCad+-w3pYc@v-r$ST}^26hriTT)oJ@4HsObVEBQ|}Vv4nx8 z!b{z>Ig-_q@$cm38?>WOnx1vNm`qzM-?`2~BNO6p!i9%X+AQtRODe&P^9y3$!_0Dc zMC*~5z=VOrP2}NIQG=CYp3Z~kDzD=^vh(HG?e)SPSMC*)(z@!VCVW}q+^eVflWm7z zM9;_yMz3CaEOM3Gc`c`%99tS^JW3$PS-Qdh)N3R48v|{xUi`$3bK|3076%ezjxa`_ zo&kmjF-oS(N@)&UOACCT)d#y!99|YryiGgvToxBuMhe^jbrgaGp>OH}VMS3Ww*m;g zS97xj)&&mL%t~p*L|h4^%d+O)GqlY3AKLQ!ANN%5m36HBbMASA_SR8w=|chL{3Zf7qYA6 zls?*1y0^@-M@~MHF} zQJq_m7iXJ46PGG~9aPzE_2SN!YJqRTxbUuTaoT8gCmsN+x339rb4}e zGgZc{^&r6UolbCHXS9RB+0Vn3K$V+};1y~zx;IIS+S_g~{q@c6tri4NjyL33)dozT z!ADi?m0=ND!jV1A9B56uSQh^BGUJnGz#$GSY$GsK@Q(J-Z=hdzB7Q7fx#*e*Mg=GSERP7`D z{QQH!0tIu_lpa&L9x}(9DNA~Ip}I*=Vd(Q(oPZlb@&%og5go13AHMqR>`WYphg@80 zJpsXbtQIMn*5e5RY!LD-HIfEAQA*e|NuY+qqfl3GDgke@`~otD>I{~ajB83DEvW{^ zLvEqe(ebBOC&rlS^%fe=_0#yi%Jb45yLNVj3DC)gW0+7Ha3V+TG_ zIO(rxfEO4*Zx4ULF~}lm=Q$tSR+O+{@NrK4+XP2W=8`yKg)M5pYxu?U{k)3FgTmX5 z1%p1xF_*~7x@S%pu%xCiS=u{svseJsCZFXm53rJa^VA%lcT@d&p?qRe)i&~RZ*n+MR^by^j0yQaIVWc^FYf=aZ~T7Z!4;MqmF~RfLR@go@URuGWzoo} z6Ur8cR)3J9(j$NKn}$YJd#zJW9u;r8a>!ReM~Kj_>+I7-qF6fYI_IiUE3v`q+G;+` z6Sib@SRvvNo-TZz=(FG5v#PTS*=x#^e5a_&t}~b0&bD_HLVD#bY#$lr(K1x|8TIo#9JA93O!s;C#@Z~ONZ&D7GfivN zwo|WPDEW?3#ilQ6f*55|$=Wc04QIIRj?}3k_#CB5#f0{H3 zkS%;AVC-17{a;$wx!BV*_Mn}WIASy`Om~s=NWW~#P z$s`|B3?9SSVK&&9zzE5)UN;vpG_@nxGcxvR<-t9m$zjB}&c6DUB*wsO;JuwI^s(f( z(P@$+DsP!O4E|=-r!HCpeRDnHBQOBh41UVG7h9+sL1v$QK4@hh-;>Hi7SBPIGaNl) zl^2@txbL@ajxuqD-^H*)S#R=;iw>K^(OnSVFo`86w|}#)XWQF7hRTCN6~}dDEilUC z); zJEvrsfud!gkJrl6T|v1>ez^G`IzGSARBsk*D#^2ZVZwu$=g6;92#XR}D>6ntSpBL} z)OIk9(^v2xMTwmK#8ie?)aj&7g~l*wOmCHS9?Y~mL*J!&Gq`9vN&PGLejgTfFTEF4cPsbtP8A2=dJV?ImTEKsX zIK9kd*GuC+@>s^m8d2W1o(6F&VZ!lHn$u$a+Y4OSW^$O>z?~SziMX~Z_R0PyT!bi; zBCQ_}JzXQ(ip^uHR;G}CeQ$5n>-cD%l&8qFz&bbA|6x4y1-}5UodnIr7`3YDlH-D3 zO$kd|K@5iTbn4KA%EibaY}Kh24Yehf2m2|D*9@#5Y0YP*mJUu95C25;$h)x~e*$jh ztp%?oe0GPz4~&@@v;9e`aeSCc2rsw4y$;rnI@#`71=a z{JQ*1>U3((UsAoaU~rYZ^DDmikT`BN)_53j!>?*qtJ}S*(CgZv#$S2+3>Pjvv8EtZ z`HJO-RD3W@-Ns}?rM$xwDR*CxSS`rk8~c@CreoOjQK9S$!7Ur+^RwrU2;j` zu{sTdD|N}#CO7mcnl`ph*gh}EajV-YgV3WUoEvE%6ov6vvL+DP48U?1WfB^Vc2GM zj@=K~@TMsK)4++sc5$?$O_duiGDOp8%i1KDbg ztY(f*nB)!FQ*eA0yTYPjTe@hZA{TA8ORQzGcEWE8D=J?8K8n7UihpV$jo#cEr}n5y z*_%MfmYOz3YdE<(KzP43Gb$&C&Z!-jt<+JQ;Q+kq!b2c!1M9LSSXNfHEL#Ql_{RZm zp)728mj}1!?d9xREQuX*Zq|K7L>ZUK0j{l7e;fy$DBrqr%0KyV2)4@poxzI_zmU+4 zlklHldc6n>1ntr~M;ZUw2~2>mDPhC4lqy=iy)=yc5f(W%d$ zCdW^4zQF($#0#QNd1xdrlv|4P3&yUQUp~e1((-vXfuYjzdM9+b%m|a^Ah9*el6!#k ztI|hh!)zf`|MjXBE#l$jw>MXE)u;@Hn5azlje8{ANtO$~2`po2!tkbU4;t-SQw*cze8J z4qD2c3>8`+MbSlseQ#GMw;Q|5A;a!{D5JWhNk9E8&W30TtiI3o2fmiYe z-2jxzWC#4WBSsUdJu59RRq!*z{1|=AUk|U^w75Qn1+~S;p^U$7XsHu_>dp^gXX7Oo z8sBftFhZggh16p7TS~~+k(r7p?2+_uowZe?+5{{1#qu2!;X2d&(0H|E)-u>(pgs9{ zx_cJ?B?D-Cn61q>J#p=*r)#1fN-f#c9<(q^rh;F?&u|&`w@vGKZ6<3EF(IZnrJ0+1 zYbmWi60jmQw6l%6B5=^TS8c$TE8O)jut@&W5qvFMJj5f#0O4*NAphVZx8{k-NA$IZ zqg(DokNrb?+WOJqY@^jHg(??Vw_2#OLkHC6`wO z8jVuqqvo0A9OcbLxdZB2uai@0!fG-8^#Yi$00HwZ_>%kC0I&5bZf1o-qfk&8ydl|? zkRROdy*kTwFGzQrjOJoAi3T!G*8ATMv78e=-Elt|nhGi{H~q0CBNw=)uXB^hdw=+E z*B`k0qGOR*_i&Wr`{-~NZK2y{?g{NCzA9=YhK1-@kv6x2gY_}UkxAaSWoep%Gt~~; zNYMDg!ggQOZDreW-IEZpf>>6OQmy-Bao?slsaV(;WXmC&B(!3WFJ4;AvD%d%FgQ(k zBUm!N;13*pXg#dItu|_4&(*X;3IW@0>j;@tc4EFdNnYSXR*R>$zR2hK4h!u8GiT$s2rgXmmo*@=+ z+Rr*S@rJ&Wm@evvV#Wb%$b;|iaN)RpB)Yz;!rOY%5G26P0r7F~q7Adx+)rb<-sGa& zg*NOd)CwVB6gS&!|qzts?Mh)oREEFQoq-J~Nx zwgek&*HAwE3P{uS*^dG5xE!wl>2R8Q=?61SbxCS#>6CASkGHIeHQS$aed<}6E4^Ma zs<*HGj$;#nI3o-D!Ezk8xnQ8=DD6An(_hN>9E1*rj1qcr*>L-nfB#3mbCF3FX+26v`bYkq8RLr|=~c(%jwf$pLSNWXRsn2c&_Kat=JYgqWX1SkQ1g5I|)tmk%<={%wCw+Lay!c^=cxhgx$S0m!q7M~qRJ=6A zl(+%EPzY{%C6*yQ#c!bq8O&#tcUngyi!LsTjF>98&bHDTyKIsVZBMIln{rHp+^#)j zSqi3w?Vk3y8E({#;^YazXT=Avbot|zZ}3%Q_N#t_`!@Xohb~8JnlvC$tild0`yOus zwn~#iQ9CA4TMa`V@1F1Z;UeFoubc)4qfIlN(PfCL#)mazclD>K)`U5Ezk3s3i#uCG zP!r@#eqr#jxCX+%#l2L`9O3KpcYinz+arsN@vh);4v%#ka&j4qMn$i7*lhBvNg1EO zTe4x#5k_p_c3*+i;XEiUs#cRDzC@ImcvYW^oxpb`huE#tJ{y8;T{Lg^(l#2>zmem+ zV^$F7G?^$T>paWvQ)EyekGom1kLs4nj~6l`Eq|g0TaDH?+wDK0ds!m=Sl4OqQ`Iw6 zJM3|cn5q7EVB$rKGJVq%$s-(J6+a>xci|B4NLnt2<(D=0^Kd|+9sR`Sw5ix)gO;w+ zE@By-w)vcsM=HH*Qi=aztl?)YhqWFVozn-Hx)bb{`a*p^;Bna0t&`9Wx7vae)&)%z z@QT9y;;&O%!euH55L&UTX|Qw~s|UPgd|1%@07%u6cK-_3GmBqSZEXK8ghDIWmRB5E zX>&|uYQ4^((}7<7^_3?t#Dry^N~?7G(WvPwg`6j(^)7et8HfynDieY?Vb7{y#ZeZy zzN+wki@T!a3em2kXe$Jxr|E-a>X!wLC?5OC+Os zr}@489ss&HnjKliryA7Bjn|M^GfqD`JI&vB9R zVAtUxXDu3L*eyjsCce@4%wNeiG%FNHi}#iD{a9RD5Ab2B5mt#nW&Q~22xE;eZ`(75 zVZVop&vMvAeg+08r%v)hLU&0Notm~PbLFPkB&4{>e#eAx5MyJ6zT33326lB6zT2`rCUMz(xr4r*SoLI_xJuW&oeVJ!#?Ni zz4lt`6RRDVYUS+Snx6^-o&CBWIj1>_hg-g2eOGx{7_!H1{wXB}M3{DF5~!n#dyB{c z*n$*PONGq>t;#*|P(}}XGGgoCz+O{)_+KY$H0#`!xrM8Ed<}qPfs~ z=gnAV*q+upbrQVH4!G-EX+T$rfN-pq!y8|LXV~F8m}z?zw3QFM4t3f*IqDvjr>7GG ze*2IMjw5r9{xz9oO#gw$DO+VoDab9q6jrY))7C)O5{ z7rDBAstuYeDo@=WTP4^3>r5+Jg z5~PoAgw~O`x=*cv*P6k2kBgWGFRnfDFSY@PCcDBbj!u+-76-vWY|;!+uJwwjvF-S# z!e5sIAEx%(#4yb)r^>|B%5zz$+g+XL{lqB!Q>H$0XWA|;bZFYOo<8`-L26DW<-27B zDR{rXwoh^&rWaOt?sz{Tu_cFNuI;7qOXCArv0j~+)g%7mGj8A2Tct2gw5MaAOc3popeaF=$G~0(CTjkys>XEyWCX5f~w|oG81;|@0maMs~A54*hSWoNQff!(8*5l z#3604`V6P+r*};O_vV-?!X&IDZeAgOmCRj$I=Bm8{FG@aD8YsO`=wMzDp64aF?F;%)@3mocM6mn{aWjI&A4Z7-C=hz2$S8k0XsSKN5E&96?k*b%vB-~~!H-*ZFE1OREl}630T#*59E(F?fb>t-i^cCUk zvG&v7i!6jvDhdiAAsF$@(r{>PP>6hLW>*KXfs3#@?Dlj2cgCBgL&VTCby2<0K>f^- z6Yw@A5l2v={tx#C{qYHDf7W`@zbIv6ThlJNRR2f?J zN4bzXP_jzgAvl&U^X+pq7kqT7m?na`i%}5jqEWwyGOkz|x(#h0Y5w*Ro~?QIV>&A$ z9CW(uHLlP3ulr7gIA<_L+*1_d2lGK*U$X$C?NWrjI6a2(yI@Z45|3)8gLF0s4{fH) zf)WyNQJBC(wev>AT?alRX7vHbioAavJ$0g;C}B?@?ZFK{W}>fCuq)q9Pks zAuKcgbalT?@RLDbI9pN*v++q2MyU_y-Yy3OTH&z}`li3d*dPS)Z5nOYYtylP+FxGo z4A*mRU+YZse)9TVAEOp)ZTE&9k~_7o%55m6!7tsj$GO{yvM>vw+tu)Cp4tbrVfimZ z?gKx(|1gtz+;xbPl$;sOeXO4Qs>PWKl^EKP_q%#bN8MjE&C)I>tMR9-^dk^sYDKgH z#7Fp#bKQF1^8Th$v(TbjKXb#>@kC3RB|vAkAkxDtT;4QTps4L-{=YvL*DhIVue$D7SOc9*UCtx<~YczdrglIwD3XrpT{Me?wO0Wq-v4 z3yZXf@tH{=EPk$oJZXxa=w=sk5DyB6KubCcF-A1Q?Q!tr9BG1bS^G;pePdh|=Vo z_+=lwgFV8U+|5oUKYv^a)RXcntl6MxtMX$qR9xp^lTEM1iw(nf)cYtvOlX1GANuZm zet%mm=pwjwmajB*%w7T%d`D=D@5%5N#-%z+(0)8)fZSi9Vmkz$*QYT9#fS~nDu1cC09O4wH}@SR&? zSFAZ2<&DW|xTv@ffzu7@?3eG}51vILL+t&Qy-hYchcMIb!ZIzDvO{N{qejs3H>jNj zsI~^39A!MR|J$>03r6dsm|-U5Gu>RaQR7AnA5hpH@Gi_+iM~qO zA6O7DlVlWj5{pec>&vkorM$eJTBdMh&afWLPl8%wgxt0E1>VP_AAnvr&cyK(<9dN0 zy&v~2(FLC+@fUe)rTlVT#Qc4`mq@9d{sgWf^T{+rwOzDTGq6%p=?b*1=W-?YzC_z-TPWA#i|<+Hvz-krP=wcco+;f9ucxOc z?ENP^8^5bOI2ayyFXbn2ed%Hqm#{~hMhD^w zRtVX^4KAs5;o~qX;yVviUs!Jdpt#@0e?&5xk->Ix2dM9JLNkI zE)~I($E+_>A<(QvezfhzsMX|x5AM!sa$^llQJGz6)pN1oqj^K8bw?0;E0dig$xY5cLxg_77y)iTgLvlv;`+MwLVpN~17Yo9zaN9TaNEpS~Wqdpn(7}o5Xecy~=&*}j+ zAO2hc=@YG0)yAK5ft{WbCW@eiBEgfIWeG-X)xd=_DfyMF;8PL^&C~BH*ekYukSW!G z0mCed$s#mQ?`?!AIKS2c-oS<4eL>7dP!2yVbd`T!9XrP7=kH_{v*kSCo-k+66|DWJ z#|Zb45~FV`M4A*dM%RKIlN9^U}bG!dPo#M#bn5PT>I#y z-4&-hY!4gOIdhf>-lszg66_u0i&brwy#7#&IUAO@rA^s&|2nSPr>Zn8K@0SJm?jHN z)@}D>HlkE-_B;h=J_qwDADUWZLvPz2H9UZvDhgS|e910^efdYYD7qqj#><^D8ArE6 zmJFRA$*tpWEKa>P{7c>1rW{t#k(Rs{MUg6n=#Mw%{dojzs*xOjHNF-hh}X2;&Y!VG zrZdZ_8(>}r9N3`n!oZBka8ENjJ(7Dg9VSQlAz!oI81=qcm&S#?W~N-dWqAGP>VbMC zr2%}s#}#_Z!2?A?bW_e8)(V1HxdgLY$P@!ng8?DPt zie7spezkWnacixzK_OhNG!iuxzn~GWtUiABeG$#5(>D-=95|ERRutmBfy0Cw_n57* z0oRlsCQ^?B#RN8X7vu)hDjQRNWzB<5u&#@Pry;>UeUy229Dhii=Z$MCjOIcu&=dD3 zELrb|GKBKLEtR8o@}(KS3ZVPIJ_nkgc-YHHQw>n+h>6aMLAoP5+F1B zEr2GNr^~a+=kBN*Ln81|s9sGJqDe|h+T308=@WjK!0;#L{!$cBy0m#Z9U#faF-sJO zN&&6}U)x>`obKHywQBDg(7^t0gNna9X`bv;$%q^gVWoL4u zK%YeUEL@Ofakob`ajYR}hV*7M0%9CN`r98LB!ixbsCJC9XbPdBAvm3^IPtnlzGvJw~g)S>?>O0RR}2rHqR9b z{nl14PYiuclv`QzXG=JP4J^2y`m2~vc@^4eF`y7)sSh<}>4(6(=$#@)kAZI9i;-Eu znH>0P&0Mz@{kJ@)yvm&(-XiCt_G801Dy8Jm%DvtgxuN8UPE_blOTN?+b|rJ!OHd_wqqd!NGd2*GNMAitV9qe|$bZT?^TILE!NU-8o`P5LVj> zmj&r{CdWEi&1ft^*DzjEbbMOFWS(bVy8Ex&sWNgLp6T$*T;&nV=RLVzTD;_1ztH|GYEY zAHwObvl8@v(AIS*++BO`Ir&wI>$F_LUkY}QHmq-U%aJH@d4u+z&~ewKd?q$m(1Vn5r# zWR#v?l?4{(~`7+=T+cYJx;I>M4h38iSPa zK5$iaJ5e`;%ML{XUBChil<(YIKXnTfh%$gfw$O^&17iwq6L1t{Lc>>6zya3P;lNn7 z*w4+yMQXZi=plLoGo3m4B(N@xGF%prFu^D?N$?kcxMIaXwHfjovmTz}=x>8s+~a`d z3yQ6;Fz8wwbiBrQz3;AhfU7obP4R`?+dg3cOBMTlVCb^Dy*$Rw{yKwac-5v=ub9C= zNzUiI8F05%?rkW>>2Zy4r%vF(5~LSN{IPR6hxTGRCs@9dg4B9&|9lXcy(g9kD;3v5 z`d!M9I{D9u!_JOwZwt&n1CyBR=)_AOS-*&!Twgx^J%is9U{R3g7eheFN>FjdLexY% z>z?g`e%bE2ov^yUCGrCLUQV<9EhLL>ZBVmek%Uh=mgtBa#R7-~kd!KR#!nm5Z%{s{ zzgcqv(I*$6BIv^-FNSbwY15)m5$Z(W*b@RF!^R8-){54y?q|2kO^k`Qw+4=bi|<`K z+*}!5`u4kAemms9q$f9=?IVa!q_^pz3TL$NO_}Vs-nx{?b>4o6Ycv%iBV=Fhyfjno z=k|?fVAs1Xf?DAyd++SLQ=}d~_H6Y!kjTQacoiPwsiT3f!P+5VhwC#-SaZZEc7j7b!mw(ApP4yX0A6etkP+-wXhU|*%FSPtQ z0#;!$QM29$Ld+?|l!70btA zY8un3oCDvV#r45XR{iE#0Br`CGud?4{x+6FN_R;OtHbdNYE`HcjYH{uE!quKMfv`8U4$oqaXHh0=*K{m(6t}1~|P3-HmN(U%A2@iai02&C>XCfUJ6ct5J#X-^?dD+3EQx19|#iGW^;*1o{(^?iaw!JGgh)Y z9Q@?IR&?vRzCK1OiK_I)n8~pfbjtNx+d_n5Vp1*xC6rriQu;ARdtwyfFL_=l`J(J@ z3_U9d#0OPfNQ{X4k*gH@(zw0Zgsg>~-O50ztPSqb-A9UH9QX;Bl^GQgSSdF0A)jAZ z?~Am2-P_hEqj!O_5bDTe>&Sv~!d?CI&B&XlVk~@Og@+y1Wvqgqp7Qfo`H-CNljOrs zs`0{QZ8ekz3Gv};OTUvtWy;6KbCfqeDBxN2%E~o!pti7HT-GFuWjDFLToZ1$xY4X) zpN{H(NY^8WwdF4QehtRL2Yp#1`#b`=_~V(np=ZoOC%k9G-Z2tu5w+}MUk&Z`7i02I zNv~FqP%q+Gyx#oT!A>BbDHD38X@j_DD?$GcXC4|W2nt$|Q7E;)b>W!1sz)GFu?Ojq zrfz&SQtMI+TmS-IQ=ny#ji*8s77>AmO9EM4|DWGOQd5+0_K1#hY!wK*bh2^cFMj|X z$Je>JRHH*6uNaaV=-fsac{E z7Y7Ch4JC>*f`6V+%(pdj##$(?BvmNSylzxVb#V0Xcv+w@^ia9n$;CD@pC*I~a9g6E z{&(VIjR;(pgC7ykcBa+`A^toF1PRO>&A94KK==U6uR$j)B=8sTRECWxnQd~S7E=T& zh~fTq;CU_4>fT}-)!8YgR;V<(FqbQZ%wkw}^HA-$L;E!Opd65Le?1!2;0QQ^zUROK z6bx%45E~Y9lrUxqRr;)tiaz*`{L1$mE*P*)$MHWDGoFZQ-toE%2LKE{$cBo$8nc(< zT+|tVj_KfYMaE)i5|6hvg{!ratgKbx=Bp#S7oaFw_>D(*jnN}JHvX{ciKw{gX5>D* z9c^31fIeYa@QjL_-()9WUfWmK_T-v9@B13~!GHf-_yCJO!><&59n@)sL}3ws-y4Xt zwLnc1*LYf|u7}3kZI+1QnCGDx3X~^NKx!z26&v_cg~R_ucubzLjI?wyc2swMN?yw`*0m1g zk^JHE$aR@->g}0zgc5=qo_%438?WkRzyT?}!5lr7M+q%qIv^W;WpX3%|6n8*;M||1 z>|bg8iH`VL4F9|LdrJl4=z$0^lkZdu-tnk99NGIDcIY(x!x3!e%;@z9dGMc~r$(nm z3>eCTNTT{04i)-h^GC8D-xqOD_{O?P)VmjtnR>$U2>~;8!-Z(r`%QO0pYm03FQy+K zrDhV9@5kFYk!y@4gg@yC{=v9aaxvw2Z=d+x#hFq({|ISbE*LCep_r5!`lF1%>L|ah za0Q4(f*2wy*Ms9>&G7{r$v+_pfcdo47*mcGn;z!%(QhAaK);Ds&4O)Y8_^#a9cw2~ z?ZAJX7eHa6aG%fh%#T5jE45{=7?nRKzTGJC-|>~~mr-R|NgtR)sXhu-Gw#ZA8^2F-@O zSFi5{tiAht$K$$~>b=_>+|k|iiDN}VxaZ^@3n|i)1#3;7+LP<`ZI8~6bi~dcNHGtNS&ul|3I}kVYXj;vyxD4xGoB ztw1_17hl=?&^^ZQqQ=n(ehb%bDFokcd6v8%YkbXOz>QB?6#2e=yLg+Y%wUOZN!j6q z8^}+Z8j7Mhu~E^Q&U~GTCi@V}7ABi8NIhOI)>AR8B>f>3qCsA|65XtF(L+)y9M^bn za1}5zbB5-~9_io_CZbWb}X&~ABQ8ub3YUrAo@G_&?^2V|L4BQD; znQm(XzMf|%aA5&@TrZbLUdtcfgw88dT+FbOyXvQeoIVfQSiB*9u~RoBcs6R&dMP4) z#rO-p5i}Hyk19;dewLjDRI$%1AanB~K-EM_lk2|apV}~@6}mGEuqcWP_-ReE*&tuH zsXpbo!kJWgJ^87NHCejj)&h|Q5tuj~Q$-N44*3}6N+M!wq>K7_W9tZj0UVD>pFJ7^ zl7}h5dIDyx$6&VERv^RIdKfR1ayCoE=j8hLw~gyp2bBnSWJ2zbn_ZX#fU7ZGU~-o# z8l++qc`qOI3Q~CFuL4$q)qWef=|v8^QHNu{4n$)zUp@?&s^`h#Sdc~P+o4X=S{gy5 z9H33PE&FN2O@4oV;mibI{}p9OGef?Xf+;s^VPFm6LVQ5yN|K^y)XWYX~;K_ zEl%_zaw|GL6N5MpW+wH45rfnGE-$Wxt~Um8%?EOBN%PzA2I5ml;^p+-Raot@8FiEi z-Y_*Q5W|`RuB__UR6%+iuT~$}NbS1=9HsD(2as*@-z z_<_usUqYVttM&_oGjbBSaB_e*9`J_xe9W4uWIJIGD6zKo0VZ*1BnqK zkT;rX-0g|xZft%>Da&SFZ<);v#Ml~eBwP}$3)sRz+t=OWlXa)!;sqy<$e3nWjiV+vgo10f6i;d2C5Sh&bcCniooh|TfF2K?nW>j z)jJrTi-y^cVA3IsHCn|FJY%W91ws z=XH>K#0N5JUXRP4$o7g?toE2INyfwV!Dy#f=yo?&O4}Gd40;GV0SQi)ple3vgoYqu zPoyqKpA8WA&zF^OsFzm-w#XOJ(#30zipVdI!P0` z*+=yWiNZVohI7N&!4e9LvhAm~YpSw?1U%KhA(|-|Zi0cf$M`VNHsG-Z)_n(L6%neY z97~oFlbMdZ<2oix+YntE4JstdIvm=cpBVL`swCnZYVhXSsX{$OAbu-JCr@o6 zi@Lx20JiyNCT|75aJK$hFG>3Ns&RD@H3)SRhplA2ZA6+f)8dCeliAuYINR~Mw9IE~ zI{5Tsp1GF{XVi0d_?>Q7bb)wQ%!)A0ma(7XQW?%0aS=pa`CQw~!tQ*hS5fC{pDqH# zp|je}8e%v3rPj>8i@e#TR@Cuk?1IQeavHI@&Wspj*B2j7e@3(^IVs-x$Op91I5H=G zJPc5WlZUe}9!KaLOT|6PDbxxB@?e+Cq`=uYKr>I;`79`dy^_yA2Asj!^qT@{zA^1r`L?M`!dcfY(mrUt4H@+Mk}WPOc#lfQD`S~@Ye4U`+PT<5Otws~K? zLU%Cv;SudCgxhu=K1cZ(AX;XBGp3OebGkiV+Qs#?q~3b!8<_XVNQ{Mmj?2v=3BpsA z#V`RrHZQW{F3>zXZw@()_PU+*J1(_(F$uGtgkOLkHv_t{+qk}K;73j+=f`I;0`P0a z-;oIRQzmE^AiwPPLotV^ssZzZp#@c}1C3VlV-42B>eV71Ezb+8x693dS3%|2XT;{w zEtd5jQYq8Em{N7${~GxUPE7`4bqLGP;`G(`n3$D2RW^YeL$4f?8CuiFF$?B{@CZ_Z z=Y-L^ZBYbGe!zIcNa3^ZJnL0dee_978PWS;p+X9VuqQ**-%i5_n};z-g<=Ge(xIEu zAHRAyx9756GrY|-U%v6=Y>Xu%>6;?>f=J`+T-`93FEYAbka%@|MXgj$+LK|gT^jjR z<8=v32xxSUh@(d&p5N_SW-N2QSR_jr!}+49XG2i56x=+S3bOaqs4`*K;?N#TC904pKlMQF( zbw@eZf+B7Cn3t0{Mc(d*PbB8P7biGsZyH{N^LUX`)`J;2dUDr-3r#{#ohEr(85beBC$jwx4JtygvZ!{BEW#JK%$!ap{ zYQZNJ$84v0mmp zYF|}cL-OVp0=6an@0zh>)B-muaxE<#SD^?u*uo z#PuV$e{N={>h5`KT0dU`;HvAx{T+0_4v@mzV!#})uBD}{ zepD4;a8NKtJ1EoOakvC+)=C$z`VD3{8QYbQjE2|M+srs)f67pm$=PMsZ;FGjLnzpR zZ%mBsQns|T6!ts{BwT3s;S1A}A^kZ6giELAkuHA>D-A_3krIeYc@YZpcq?-+foU!W zPzT|$=wN?|&lUGmNadterlPn6GncFzvTe85fXenXK$jIol8pN;_F<%!&9hp-n(zMl z6|U8NUu`!RrFod{RbqH{D!b2t z&^X!@Q&TVCQ{thpuS}DyeSd%FLypzpr}w0TG*6(yq)h4Bbo1~gL%{M9l;B!!J}=EI zsMO}!&o{ddr_7c%qz5NX%SnT6I)Qc3Sgb=kk-~1Q^dRT^BSA5pg{-4;r6+W?s1>gR zGVXV`u{s#=G8LtJqHx7j{1CQ4Zz8H*gjerzJ*p}>M3YMSed&MnzX~a8b~gOy05Tdc z`wBVv0&*Y_iF;s?_z70UUYZ;X@UT%c;|ck7@u$C0S)z4@=2aGDoL&i?O_geOp5oWE z_Br_S&>*c6n!3*3;Pxt1qF<|8Vo0PnSHi3LR`-;u5egELdDqD~qP`}P_1xLm%=VDG z4KcxKz~i2sJ=`?A#igdZxvLcZLkyMi_k9?0?>T;1#*Zq=VBl6B z*rD|4+l`uAEO^}~G>W(xwt~M`d5~qX{3m_KE3=oce3ex$W^F2kbf&al-|p1SrVFeU zOjvaa!$eC|VGw6FD(9%Yz20R_inbuV9ae$P>yESchs0QIz<%QW2X#(yCXtUc7B&LU zzVnuSy1KtZ4`vX-=Cgl7V> z^N8g0JClqL^AB6~HM};x2kL&}x;_He{&!1<0xso$%+`~5G%im0&au}o$c<+2Qd6w( zE>|V?-TtimAGW1NR)~G%^oy=n?#vKQLQBzuQxDQ}Y1{?PKIo66Kqx@&?v6J*{O{2C z`1oj)GM<8QC>+-wG51Qs0rw>S{{91LJj^#EOjwT*W>D@gHt&4Cw?2wH8^#`Z^_=5Q zES*wn;9+TJ=9DjXxy=jS!NK9nt50ZPBqe&n@$>wIxSe=Qq-~=qKeHb z%Bi`XT+V5^_ff12fijHr$^3W5z{PsPg)TeuXM}TvFdWkNUmCD*L`v-C zRvbtPg8?u$leb}_fnsrUEpbR=yqBxRvVtnbXGkOE{%&n+VYQF9R95?|Dt>I5wyCV1TLVkWZSmBj_0)ir1;cTp6bBy+VB6b6t;5p|B@SZ%}<+OAY1BPvzF7o+Mjq}%`i2% zVGZz9Ndjy&nyZE4=E(K|_m?pbf(t7N%gkH9(y*^e++|)ZytBQ?ym0KSL5^kH-&mtJ zJ}6}^Tolhh&|2ktigP;z8j>G<$H_DLuXAa|*XQ1x`}IVXw<059dD{P;EFU}zhCGjjfm+Z&aUg;{ zNN}mQ+bMi#@lom_TenWct(TW7jV}rQ3ICFE{zI0(p$ziMBD%u5eN&^1vH!l>hBoZ0 z1w>h3N&S63x#*d!#%c=%TFk{~YV=O8^nSjHDH`NrQfdr68F2Z^Y>e8)T7LqVD@Q(O z2y^n>@9GsRR*2bLZZ#2seO%Z~W`b;XBV=Ne=~TOtm7NYCM7IWr8~Q!VQ+kH1K%+gz zGq~5>_X0ECoc-?tz*kfN&u5o1z`z`jCT$IT`Iv(iWc`AN$5OT7T<&2X&8uH&8iqBc zDF1_@c(M;_-V_HG!*nZYx`izCe{m?P5*Q9uL`}b7$ApC@Bu?Kk~>30IQRAUWOHS@9u!l8Dllw zYH;O{yN25dvY{qKCYUV^q>+H%xJFLZ5Y8-nj)6S}@9%GOhW!tRFq-!qpQB0Rukb!4 zGOzjXQ^TMglQKY=K{1oCa8s3pbE%MfwZi)fDp`{N&K!7oe}jIH+F+Dg5JM^03xFJM z;ov`aET-L+AqM{GW_z95COiZDis_U7sego~fLn9)ysW>3CS{DjmIo9i%rHWeKk~r+ zF8Dh=KbZ{}8~T6RQIlNQ643E2NL3a8TSCdAVom4YC3H1`_s&xhtMCbg>_@23S1Vfn zm|q}t%*JEnfa1#IrDOh8wgN1TH6SorF(nMC>2B=-^Uz47ukb=tHiet?N&Y~1O7(iG zOd!~LPB*ihZD$?hyX?E%_|v@2BhIX^i#56?@W8IEuWJ}O|Lfud=K@=$3p2}Z>|5B| z`y8EOTls$rrV54K8>UeSw)qzSeLvl4o#E-f|7p+>EKaS8Ku)f~>4xq8Cr$OYtr`vA zO@U8a>_SeUUL?L0ufpGlzXdAI_g=DrdWScbPTqIVh1*@I;tF7g{>Qac9EDYyxK%+` z&aT~4tyhIjz{Lkx_-SotfXho-3liu(*yCNhfC=jA!MX zqk>AmF=T`e(m1XZ$?e^uN;jrq1}(m*B*+d0Il2aq`>*pV=T9Xmh{@QA7G z`g&#ORuYBJN7>kjp zM)ax&q8locZ|{Zg0M)YyDE8yLMnA3W>_hE1jNPQ)ig7HxGUIxS|EZR z6eN*e`v4tpKZpkpOZ-F3u!k}MwK6Kq`Y()6`PgXtPaB7pRZXt!qJ*r2c53Tf$8ifh zD99bX7qPRlzBN$jDs+(0VHk~6T*Vu-dgjG59Po3hWb$FMb^V}SjAN2F;ZFCYRA~_g zqP<^#MSFib2G9TAQ$gREu%E0%_4)!Ac9FMMXD7(oIvQLS<7o2ja$2z1ci!v0yjMRN@d~FY=0qOC zoyT?2quau4ISbvBDS%AD1ERehh1|vm*#cO@f@Zg5FXnHEK+y^Utt?>eEk61J7k=st zIDM#xZS?hDREn$Eue-~`Z(gO-(>UJnO~tg$0B^SqQoT8@|9d6x3t_=Ucq(}&rU)&? zMNtjXh;vpEw+|zmgY-ca1eC2Gn$t}9;R>)L4?LPf-j8rx!@JbnU!SGV?*l>$rF{m! zCybynrUIkmYQ%#KDqi;AWoJjzqH3-UU^s>Uo?P7qd3_>gFdQ7Y7Pf%kfY1FXU!dC; zl};9iEP*2IiFq38H1gRm>0@L26``UHk1NTHf-5ilXcUvt89DI-4f11T(|B9cE&@9J zO=jwlZZCm~=T^k6!8AOXpEg$8RxEbL3AmuP`P^eWWVM{Q&uyqSn2iDW%{j?B=FTPK z=(L|N(OQrU#NwaVjFNX=H+y893qlmiAq|37v22H1`wAmDYcMU86_C|Bu78&lb`wGE zOg;!te@;|3VZOa-hd!los@n6PO{pE*j5iW|JmLCaboWt*$1~d3K4=<;6%x(djlMuDQmRX$ z%y!UAc)8yXt2|2NsbPh&?5oB7nlufs!d!{asVe>8&BxURRQ#RRnr9UCU0=soX3eag zu8FD@41VDLjh>^^j42y0xFUqPx!l%9{Y%iJVt=i7(vmIo{Rg!p&&illY$2tAh8O6g zJOTH&K~tyCj%~PY!3-FW*!6>GKTpT)=eD)ULFzLY!mLHfVopsMibC}>oi1*K_6BpI z^jPCm1d}v22d}DXD`WpO$W%MWoQPCsP3rT$u&V2AYRDz(rf%(9|DC|hV31Gvq~4h4!Hlj2EneRaQ@5WpYa@8x+O&% zX{KWgTIl2oJz@HH7kp+g2BJt%wpW9hn))5SL|}5UOb`Uo*ufzdfJ;UPT z0gFx`F`xYknEnVWGMKb0qACnpsk}}$+C~6R^+%yH`Q_EsDiFim>W`-J)T4i&`kxm7 z7~A?7*hHFwiPlKFN%SzD?;}Lu+yU3D5Gl7Z&An*O2tdmJT`MN`@N+7#jRpm zZoBf1^tf_QsrIyJazkKd+@E~*m{a{zg?xOWFL4&AjFm^MpKuMd*=3M-t@lYxIcbaK z0g#wsotudHW@Gia{Z&IP(Mn0vsoK(^(JeNI14u~*{yA|LbA zYaaM*y!LB$JF&t#sl8^d+6`ZE+eUyH`UNiFQ3Rd?KMN{U+Vm)yA4pPH)sDY3ad~hc z{x(>%p&LYr`)b^BoXals>6{9l21Y#+2`;9nR4Mujc)) zCAqTK-xGyao_%aJ&p&W{D~$ic?3e#bf$m3(q&7Z8Okk{(bt^)Me52MRavkdJ_m8q9 zA~VRxYkD8LDVC*tM#=Z!zI-KJJHAFswhxvsOe%G=9DGfdc`s5%MjVlX1`TbT>W1<;!>xz`TD-GLM_DHJy+IcyEk14PMeOzNc_%5B#feKia&YSbt zTUz#;7@WQT%UD8!Wi<~eG8vCy8&&SVn^W=Glh?8!&8Y$#NHK*N-rmS(sjtKzZpG56 zKYqZlhQp;`6vwvme^NkSgeJh(eGF`0zO@qC^S3(Dgqbo{_a-t!kCWCa+YeSipwtoi zo`tCjy3l}P|8;$OgeW<~rua4!m)Xhhfn0=<#frxx_|NSUoC>FS(N?tdxy|lN23{8+uF<`UK^XZE4Gm~N%hSOub*?7Ge4I7YN8$?yfhf^)bhK za!K==BOa7mA~zUoOCtPFE_&bJH^A<8mlVbD`O!BNcGtI;0~v3}$&KDGXnP#Bx#{t9 z=`@z=j%9vrMSt2OPiYtWu1Ld&;UnE}_)I0)>i2V1&)@q)lisl{Jrn3hO^w?aNT2R| z_I}7*IxTM1##72Wkty4mh5bTu$65K%X{69xK+u$LU6#N_`0(t`VnHDI3 zA;g^;`jgk|_3e5uqrv;)6rsP zq##gWh6XqhHJBve|4WHbiedZ}5WD)TOuC!gS#|5g0oByl!lF0R9{KUpKrqla@R6>E zheuB=dGp>U%{U1~1zm%a= zvXoxyyn9N7>&ok$uFW6aNRs@tlbU}XHWs_vz)+P!3Br6S>d~D~n&9b88RlQ5M0g~1 z5c$yhQ0qZptVH7XG(Zo!Sg+$$*wiZ2ySTVW8bQE#z-q{V=MjO=j0yhD-OYKX>o>Y& z`2%M{{)78dVVc(Un}av0?N|FkDf(h1uZFcPX=;*o%Nj{_T4RqN*P@GHfNhCeSg zJMHd?VmFk}nqhQYo$F;r`Dn+O_-{v9cWT@$$8k0y3Rl00i>Am6tX;N^!;!$$z{5tA z4tl^lLIw0d-s6BryASslIOADMz2!Fj8W`1U1-uz{0WWGa5N){)YQG>iRNlz-o?ZTK zd-ui-={~#NT+56E%A@_YN#v!023uVexfq3zy}m#c!m@=_v2(z@2-eBA25)#{BtWSX?ekOrsL$by`LQ=?Z<+2)9BbODGMeD*pFb#ft)OS*ftIGz4g3nO6n{L-a$i;*v%ulG#}KE$fR~eS)zU=L%QgLp$rsg{F>r{dShy`;G4iT;vH>tmp^K>&wRp2gBA{f z6Nj@5c`!TH@tq`rucIDH0v3Kt)~rHCva?8YWwznK8cThH%jo`(@;H@?vd%iqm3~cJbO+e zy@E#W49ndd^Ymt>{f!2J+2_raYXu|GJHhvAP8Fi}BzmNl7c3HePs&w`;w>2Qz`OT6 zv5=06|6Y)`9cyo*JL$<(v2}D8p80ca!)B~*r*MeBGXQad&?biJg%K@+B4Wnfo8ST} z=bxVg8L$)a!Oq)NAQv2XGird`99dWG^pVs`JPW}LJ#p{d#8jwP@!IO$@Y8A9)CdQt z6={dE9-cDUV$VuU(!(-wgHebE(JL>;i}4PbOFL^je6h>qex#}!tEhEM$6fpMH!BTq zY7qw#yFJ)XE(x048ndwu411338Est~2;Ih~jjBxjiSg}_>=y;X%B0~NU!VT$j*WgZ z&llE=Tfz{wo`IO2tF|a-IMM0)o<3+{%r4FUcXz_M%zt|cPIU#HF%HbTWdB*i&5Y*T zj^^pCq}I1(bm&GYLI}R0Y8NgVKbWIibIRt|A4AHZk`q|jYK~-|%w`Y)2D%js9zdJ( zGHmymznJZVVTp09dc1qfokp~=#C#xXx~eR=mIB66r5^|T4Fu{PFHI#4N6t*q1$KpK zhYn31gK=dbJ-Iz%Q@yqxY*8yVs$E2F+qf%Qk37h>eaba%fK^F1t@@k6&%TLnt~^fvbCrJt`(tkw^~ z&BUKp`Wen)wW0Cfj3O=NB~j!4eTUT$Q8@d_Hx+?aB)e}2?6 zWqIw?zbU;m43p!6tZU%R&JW&|vuRJ)s+|XkE>7ScWtnoS)wQwo4JLDcYIL z8N|X7RFG!B%hNkf=}6UV1Di(V@1~(;#(I&q z+`!W6v|3j#M z`zrfJwX5vkPU2x^T>#5G;sLXUmrgMpZA7W8Rg``yxoe=1n19D# z>w_~LQ(C-65>%+*`EY>YUt#t7-P{u5Ol8-8JVrvb+Y6g71F!Kd1ljtIM<=VTthqL> zogO)B{0`2Ck64-iP+r7y`^c1b^c`cg+4^QeYmva71L9^$3^BQD$0BcQCWcPgd@MX#RAwIQG z)SWGx+JQhO))Y#a*{SYicXJ^1?y#+8jLYdG+>9YF#lpM%md_efx%?*=rniE?vVTWMbdQd9qkU^?fw@;rsp{3FN_Xv{zi~DFO3hm{jN87k?LbBTMB~oJjN-R ze{|W+?c~K(diwYcOdo2Z3$0g1uOl?oGf@%$-$!S_p2Y{B9pT(8c^wz=_H!WpHVtCa z*>Gxn&EKCvU_;c8p32Bi4_W}GXjHEf8U7zzZy8l(_kDp12qIESNq09$w@M@3jR;5| zx*G`*P)X_TM!G>jNoj!t96-9e;qHU)??1-9<9?D4AcyDKd&OLH&Nct>==#D5d4MYj z9LCQboe2e42t2jEi2=U^@jA`CLO zJ9B%f4(&8PvUk4!gE~a$p**6UE%iYkHCKmZ@woa1He-Q^}CsjqkxaZys-C@u@ZXTm=6wv4*k>y!r_r zG(tK=-9eAwiR|K~>s!16PUrNIAuRr8bCTNOjj-mL5XuIGmC>7c54|DZF#8~6H6Jc= zq_MB&#s24ohZNrz-w`nBzuVRmeK@6L7i#Z6+b_+xbk;$uev>wKS@nAkHX4%o?|Nmq#F5 z3=U&}xG?<0!qvDBHR2YDZvNFDh~eG3-*TVW^C_|9Q3Is9-LzMlRPCi-M;AjCHicp( zss5K70>sPxxn-z-lQ)xOFu)!m3k%RQnmUQ4JZEHr#{h8(we|_^L7hgw2X#JIry39z zQY*0CVM}=qj4!i+UlG#|kTvv>6qvPYSkSr4Gq?fmsWzwvqNKnIhf14oW*S^l;04A> z@xDed`j-@1Ti@sSGh~2(0xukN%`WgkZCCyV!D2tnt$n8#i@d_rklx$<4!`hl{IxI= z?+KfNb((Sm)SPV$0eLgBXL*)@qxg+uoI%sinS>VCx5hi z>=}QXL6eoR!+Li}O}YQ9bls4tt6u*o<4I47`1gl}gBpFc48|Jm)Ao}|vfz&aR~nTH z?fel$sM#7#xZdrlz!TnAxs5TgjzpcTTBa`!@vYY+2l>j=v)!Kb-`$bJJ{r$uV|wm@~b8q z4bKVtCPYiFxRb1ns1wuuwWTs9L!>&W11Kv~07b9E;j^qyZ=+1ff06tD?-HBY>?Uwi zo87;7RDHC1qGAF0Gc1@Z;L#NT=Xb}p7T{P2oB>xPVF5^wvW(h%;bQ~EG~o@}ITDAX z)i=)TzY%~4L}dg7c*($rkH>3`0%m~$;1bXW{!9_5Zjd#yAIm)h{wp#GY^0qbCsr&g z1|NbWu}B4jb7W(vJdfAs&0^eD+Nsg@4LPhjUqp|KI2N`I_$6-W?62<+7gV{8 zK@Ism;JqyqhimPSO$7B8J(WjPAAg;_fGR;j=(AFDy=qGeKFiv}dI$_F)<%fD@K85C z%sg))G`?rWZ<5kC39(?(uegSUFHNkuP~XSHyVaq7WptqJ#iuf7S)&qxk1xL2sIj}j zi(3n@O3!ioolIIwR)TXlD$#xIfPws%;r?};=lFw1*}rybJo?+as1vQmPinW5b>j5; z*M!4%JJ;)vMC5bQDU$mzN--WQn;j?zeldZIii3z$+N<&B3yVRVJsVSkDD%y}Ap-)| znNnj)>|5)d)je@t8`;(xEiKYUlOvmYNOgEy3gTriS#3s}XC3|*HNe<|XtzekVQYr- zhwNuERxcarbq@S96RX4Z4vkN{sS=h$KHQM4A%SA_@p2%&KISWlqe07NFvkuR_q}#tFI2Gk~^; z7qJb{yd0K(bW~dm!};h6$>s>R>-zHI3BRq*LUzrLSq|B?aJY;(5mI&0cc+0@;An}P|119W<*=f=y=~)X4O{5Zv}40 zc~PqW33I=>e(K7){lOIFMZa?1@>@`vXxMIHX|?Y(v}qZi6!bB9RpN7h9(`aI6k6ev ze7KYe7UH-I7|_bq8HMdR-Myb%5G*E*DoHk;vlrY!>68vPom*(g5W>9WRNc{9Z$%5| zj#q9!5J3{32MyD%p>WBlHxjg}z4FaitT}YZzz4hFO$9b(9Gf(sLeH+GPvT$X2by0F zpT4`#Vq8=|1MaifemcC^_4_%6-OY^g-RgA2{nyI$*et)FCvj~FnfV7EugJ#WpCc@G zkKOE2It%9G#s1{Us6EsmQg{{n{xMi=WKA+7Lf*fo>;DJ(K`-;=&cS5k*6Y{+yP8n(~H($h)yy~vi?yrSB4m8utqfHyqYh8EF)fka&^?B#yOz zIe#6qcbhp@g2nqo`i^N^c1(ZBIE-r#r21Bkf(qPp^$%Ck?ej{t4CBHwR07IIN80&) zFR`r)QxtHvcLi`^nzB3lufWmnqx$lHM?2&GXs=@#Vk+bA2mN=n$rV50{yW;A|L_N!LeUp5OUGL_bq{q*rp&`GDZ5x#xi`Fp*z2vwQnoj0n0NefuZX8 zYO*~9Y~MKEoOn`gKKODVkuxrag;G1D$!(8Hvqamf2~Ysx6;hT|WYMXCk3tInQ`?#E z9bKVVPif_F<5JHJfWZr=$KksP&7l+lhs$Hj3G-mor{dBEb4E@#K(+Vke1Eahbw?NP zP4BE~t{kH=AHZm3;+XJi?dFOomcas#x4`>K4$FML%IpbP*c%A`Yih82d)3NJ4|l%+ z@%kpbt5ljczE3isz4%|{jnO<6N%HMqe%TX1vfEH^@^sc%d0;)spnE+Y@??u=WxQy4 zTL3JF-bqTkX>Lx z?<4Onbwc*PuB{k;kXzypiPY*&RCD^@ZjrUQ45F6kP4*`VsIQ~)LM%$^3rCt~@q?qE zcO``?mO0U@tFqM!j<)LeY>Q=qzTL2gzZl=O$B4Lho%IqJ(TO z=^@seAG-zxSqZ3pYWw;S{utQ0mJmmZB{(0ciq+6I3p;%>gPNn*eVa~oVrVZV_*VLq ztI$5~<-ZC8j(Sn#!V5H+$CQtl(au#7l!j#c{y-DxUsc_AYS>|T5FSmZ_+2AlgK0gb zoFR^&-~67_Bn$dbbHl2*3nX4~8O=w6%ms62^|2AqO9;*M{@A4=gDgs zkivJ1AvO&mroIPCpa?WPCgb^LCFXLg^BS-#OuN;)VWQL()*i4vRi2LM?00)%kzDk6 z>e(S}`)rX0bKGQ`pC8!iF5a;84AC4Mxu8v<4!y<;%`zL#h_}LEv&y{K-L=|E9F_{q zi2>jO{7~PhErl7>95naCMNR)%anF&TCgF$@06N-F;|7X|X1^<<-nxPIh5kp(f5r{V z&Mna>lp;IAu6)?8Xs(B~sm{X|XFS^>A9;{+;SJZRoXD42+$|Xsc-SMqK`jj&Ny_{zZ}u+@mPr_^ z-Ew}}=;*Z9-Mo0>veGGKed`$8lG5r4Sps2W0#^QNUz0{5{;x=?+vY@3Z%cJjk!!y*4V^_Cwe$& ziP(xbL=ow~;I)y-u)hLu!IYd&gKbccxcGlH=lg#(ryD{2T!T}7pxK}`2S>8v=tLy{wK!^<5Yr7+3 zH*8kUfB(jw{~3+$M3xXN5uJIFaHl_eJ27mXfVs35AfR67 zb?c0vlBE})TP=p^Hk|1rg5YE1KkM%slH>QkMA$x+4+olkV09o{vir#<9>AdkKn+GI5%>_5T(r5L%YMFD z#g?PIm=_f>nnXYqp%oNtYA$1z;B&$Q)&J_Y%qOy#8n~$M;B}if8We>~_Alghz=KjaWaGbE@2m)a)CgD% z`wjkjSk4AT$C-#A@^=71EjGJ})VO^e;9;(2MdVHOW{Nx!Ut1J4Ehl7qmge!R4{9zx zj}POeNGIJ${$D$`@4~cCOA%SF#<)?#U<^_z98;;8&^`UvNA|&QMuQv{+KfhlGJ@ar z!K3v~ptRz5`3X#zUV?ek2v{ysWdn>YXWcK&YFqmzJ!EB zj1mS20WShC@hE!t%HZ`CE@*kHsaF0y6z~5YiuXr%ku3Pd1+7XCSZG-i?wmOYjQ3}v zu_+OWUcAp}pSGSV%LM2ISj5hzS*9Nj>V-a|l`8-ooZjMVXgIl; zDA*VC0TCI^7`QX^9mF4ic2;Ak1!~UkcPsprUa8D@0T>x*Q?01s?pOS~{fqJnMOXv> z-Trp(m7kU1_UplK|AV@KD`@|SPb$2u@J*GbX#rpc0Mvazui#?TRGv$7hhFQcVsTyL z&|GIQq*o%+cg;Tvsk@n+6_%it@Sn|a%v<6AKQLxE-(Q?4UCG*#5j0NsLm#B68Y*e( zdpOnz7oO?kb`xsb;;RR{B{O}UkRaaU~Fj+U-fYYMxKeblycuaWo$B&U$BC6$nnwOEBBl}`^CCZ!6kORLW zrg?+@h?l`Y*0Cf@90teg=-X{!f>Vw!0$#xnP`g90BkuhHI@d=4kZ#$;RNB#LWDI|! zA0rvG#b1k^jM6(tI}D%tG1t5Dkmr?O{dPjv>~9EQlM6YqAOA};;2)S6GCyZBzr)*+ zSKyj@7ygG)uKfDE{VyWD{TGoQy|pX}1p;f9*U@C8!8R`LhkqYaNk@H3Qfk~q&BT$XKf2rbKyJh2GT@kiH0Np>tGGrXS~jK z3thLy3xhn4R;OdXkgBw+{R=YrWvqpKs0{xB812Y3p$upbRsRDpvWvsKw8iU51X-`1 zV>eRzoDbZen$v{20BmK4Tae){qAn~fHo%p0SP4o z@Q8TL-bv%`$Nsw)h1T+$7>NJf3knFrFUpUI0qXzm1;SO%69{p|aCE-s+BV--A#bkX zzbc^!{4B~iH}%b>DtKmBxv>eZ|9AdDmmy9Ra0c!B;-LwzbV25wcA~GjuXN#HKm2dJ zu@=;HyP7G{;Z{iI#Q=SjL}&2h(g}1De(ameldeGIC(6Z|tk%~ck*HL?lZ|CFAOaO@ z{zs!)8^R*Z(vJXbpz?5>ou~z2BDC%HvR_^oNL4v){&0LE;z0w`iK@xA_aju}1u9+g zO_S(VlxXha;Isk^yxoje0|gIR_yVL8Tjhq2fB8XQ1ahOh63Cc7t;qElf7W`{TAWUk zPt=oD%kSSDf(H0mq|I+%e0><Oz%bVsSho8G z)JJh`0AMM)2EcpC%1IA6-=Brt>|TdqBLusHLyYmV39RFg1SVQ>PwYUw?&6A0^g>2p z7BI%N1m<*c-hsL&fFcNh1&Jxei zgroALkgFOrN1L%1P{Agw$72LiMa}8+>esr_(w94aXx?w`$_1_lFVm@1WA2}eQ7B^i zlX{=KTh{nNyN{t~LcKs4E>PYTbAKP{_MI~3GD`ix3ku}N;E7>rjDYNrnZSMQHK-b7j|)qO?m-)n z6h)i8FP;I&NwbU(3@y&y@c0h(%ZdwbL1cdc^6*uIXyN^=9^p>e|4eG0fEGS8+q*B1 z@_Saf@DJt$PKTjz?j2~VCfsBDHfL0s>#6h!^j=em@{9KLX{J z#@^BRgaL^vAw zN>`CH)w?JNt-AIcu#Pswsx#Nx4-Hgg?r^QgP! z0-uL-Q|Vr-12~kcQ#x{sb|E25TdWX4(KbC|z)Ubhyk*2F>xo3!U|o5diEj0ItKjZu z6Y9)^9QkuzZ4RTjBYE??bH73MovXZ(>V*>f%`eUW;ywy8z~G#G%Yu*c>oNg`#GqXi zk&bz`fRoH&>MW}v4bV^Yb=Sb?O{cn)?7lrPPyaHfR+!_vY)|R^8ZnPV2uZf8V%vg}aV#=VQfx8t?@Ny--*=u>^#d60 zzr*S3_$dCAeO(o|^B4>f(6HMa5bO-n*zyT^6|BOX{Me-@9aFz#%aP}MxKQmK;cV&B zMY^OYwa&78T7y1l_)TB=UHQe|#B1hga2Wk+C{N&lfMLIe0ft_m%9X{zmNFfHNZXX* zT%+WlDb#zqbb<6~GY)e&eO~gWmiaTCnvOM3gavQsK~Njbvr3?Grs|8o4CWH-hD7s&k)4 za`*SbBTLZrb~9k{{O6BLIju$# zJ)n2eNm$5c4)+Kbb!tLznQa4_AT}E3nh*z=3GYm#=*GhBhXHD~;#5 zTaFe}F4Gqv=c8>ejn4i02_zqN_|VN8mg964Z+fy` zH2E@olt6Mtl(^)oYOw|Jtc;}hdI;Yl3owH4I-m@Ka{N9Rtb_f=FvezVW^UI7LIvF)0t*jzAPuYmagI3Pya}gb4+7;?|g; z&FcZ*tx{{FQ^WN^Aaa(F+xJqh#4lQMd-m{0D`EW{5Hr1SRv=xcskfQt8b}v2;(3FC zxG9Idy$86;6ICm%BeMQ_3k9?u_az!&sT3c#=ZBq1zi{2whNpF4S9&NK6NFnvcYJ%} zwQrB)`?$Hc&VGRm1S6?mU*jjnuT|5*5X(FJA0J`W6P{xt|MfVNQdS8<%+j&F-9g0? zzfb!r-!SkWPB5i@82n^bXWEPH{xneASz6IJCs$&X+sRtz0YynkG`dF^Wt z?OL|JGs7mE99tvX+}22>T$OS^ej~N>(Tnz5I|CH81zS0vd1h>7f4$RvfEM&+{%QqN zsu?CQ`!6L+cPa-^S>Fi{oT=@)ok;L#7W~Cj293^Eva*O3z##A!}@mcD#$cZD&7tFhyz7F~8NzbjyOL2fR`e42bXNfu?Z(&T9=FWu~UiY-0)roHs&3d4O5yHhGEvfx0K>eYz3%;(92 zs#9{Y=HAM|u}{l0;X)xH=-{_YRN1V25%e<%?T;(wO3qul+-OrLWV0k=mer(@i6OT{ z<9*ThaLhn;0l?Wmx?lM%H7U@3o?nmffdNYqGnA}uCEI1x2Kx)+?AupA^&3e$340x_ z)(}@t&$l~VUMnSHF07S&97o>NF(^udHU#fD2`vrw)7SetHd(DU4dhO6zWx~Z5Rf8j zd2axScy0RL<>VY+xbcGhCE*m>mV#DJcwmZHzI9HGTGdlyynPx-e~|CRUpDg^*(gw3 zQMy*y6mY&{hjVa=MH1K2U2q~7ejq?wj{ z%=g^Ot!CGn!*?x+S{QZXcZ6*h^^8u`kq5Kk0H9BHggPKYFOSojEFAoxO^&z+sw)zc zRjJM2yTZW7FTAo`Lht^Z>Hef^@uX#9y6Js&VZF<)eah99+lf%*7Y3x(e*I?~XnYbC zFv@+{3}edt2{9YFPWiE^XP&BUdm{<*!n(ymv{%nf!krP|4TAZoWijg#q2Q)*L%L0O zX|PDeeoyi6Ate>0TaZtfp;MC>R5l1 zYv|Uf3GhfR#lEgx4@UHEUMj@4qH^I{Tk3~$I^(79%ud^%R=d0;dIraKDEt{yWO&8vr|!Vd3;%i+_{G~vc5{)17f8!U}4JZ=VC{QBgZ&9W2YcWYo!DxPw_ zQDJ@bIz_AoPm67vo5XyNO7{~@7^zrkpJ9Q58;!!-i@TB5l(OgrmL~fvXK4K)R+>md zq>RcEwPK+2Pow6b8n)C0q0m`BC7Vt#5}?p*e!-yQ@wrctZ~nvB*3wNAUt@jOo_jb~ z*87WAUQ5xPF~9&gIEx}QZrg>4VS3wLQqpdwnS zK@n0H`%m9e`7RAG=-1L`y?)Zj?&xa?(`<4a#f#{#0X^kZ|Dk)CKY*BD?E+%S{;=2` z1yC4)-I-5xYi+^-vUh9)*%+mTyuARfqX4&PYW%*g+LsH7p^*&)0H*Q5Qnz+JB-3$w zbD^#6;;;*JY$N4HVtCSZ%+=g%ch|br=5LxkPvlq$&%3bFdzyf~=}=1HWzPy~!?rab zqs0mpHTabz?$QH#zltpY4c;_-EY+z-0m>(J#UfDh27sAU88hhoJ4^NIumv370V5OS z%vYhBCmv^<|9H|`8-Ac{-K!G#WYprx0|yy{9$^J$AVxC-!|M05wWU@IDwzOkV=nb5 zQ%V*505V`UWU=!-Skd8L0zd|4G<=pYun_3p{7u%zYotT@)9T*+`a1oWRM@>@ zG~SL^pVtvciT_lXAd!jreu4{c5)aPk8dtF&6dJZPUiPB7NB)ju1LNdGL6;&q3%?Cj zX#@9xU<=2UDjyU8&U3o^)~nOL0(%D3Nuh=n#sLYYCe8m!HWGLbL9Icfhzlu&Lu?|* zP(h-IKha(F&)NZaQVD#yAn2M!>WpB?_Cv~-!OF`LQFoK&Mp#i>--asRRlbe7E87{X zY-6tRL4=NqXtK|VI4r&XZZ#pN(O>zD@^6-8L>73|R>`I>TE%}>=3VHt=PzrCTI_oS zEiduf&hT%G&bB!$qcEu#Wb`-={IGbmImjtubj=kCm>~f}pPctsp2wQD1I|(=fIF;G z1nr>w8qw4lNy|Eom%9sXEZ-^v1Xb2l--gW}CkGOa) zEK5y|T1kZAe*oHCb;~{eLXiOt=6gGF!rn#^p%ka{m56 zrFKje$+6Ea=K6NW8rh7D8>S;o`7RN)K=d6}7V+;wOsul>9w=t|sY~wAlk#bqT{*1&nBX8;<1GdxywQj;&zaUZ!0;wA<%sIRpW16);|-O49%C z{{h)D_$_N*F;(!;s@qUO#H_cpQY@K^G^vV%aQYLkRb@!_o4h;MDk5bkQ6#%~3bgld zY%?|fM#Y%fYKOA6N^E&q$s&l)k)cfn!gM z@o2n)aaHeT;D+HHl+VM@5m)YenssxcvNUZenE~F~DXUv723})1S5*0@t``~eaI;oc4l0k5jUHUE2ptRI!BGE**|n;=C@ zs@cl5{KFyCk)a57^jORV4~7B1)ATI<7g~IcSS$G<&+7@4F`KNW7pP^Y$!>tdtQ`2g z7fTT3JJI(mq(bg^&5ND>4LL00jJ?i{ljE|4y??ZqCk4H)0W&?7xaaLj7F&_hHgQ+- z)bL2thcou~MG8R1Y#EX1kYD3T(7J(Bqt}p83W(*|;=hI%39h?3mDKI=w#(uGrUIeL^DkLF(((E(6(_?cQ6IC$VA)}| z4}MB;dRxNc#mVVI1#|{~H@Vr@*ozVj`Og9(OQG2b|G_Q;wsNWN#G#Ei>?_WB)Js6m zns~@ZAHVTdE;0TAqlrE#3MR>WWV^fTBPHy~i2$4)MzuWkrvLE>dFfYMk~u6wbgIo6 zf2*7EimrbqVp3tb(79~K z#GHh{a7U|u-+b8aijU#t!{BFSMs0ROWwjpO17ZN!WyiVO{cbVo2=H!A@y^yofZAs& zlJ+}&@=3aBb*(oOP9R!!xTM4OwViKnsFOsknJm)iPfBA4x`6)4G6Ow?a?p_nJwPp2 z+LTrPHf516>Z6X2xDp&cEf)CKxxfi`0ERl2DuFpK&?Zo%we)XLA@iyX41z@NdtFA@ zsz^G0zepZ1UG5mwykB(J!p8{SAd+CEc zLmuZ^>2y(Kn?@QQC298P^OIhO-KK+b-2mTKhEH2>F`&0C-l(qZRo5mWK;6+7$>Utl zQ15h*vAF$5BS8D157C=uf9%XI9i`s^an$=$*wn%lmb{f-m0K8KS-u`P9jiAQ@?4iU$g3RSK@e)R|= z5#?svDrT3aXk0B#-&iNkQ+;7lFfaMk<) zXV(1Hg8jEVlO@y<9HN6QhxK93$t&L@!n$vg$Zp5gdyhy1oYXf=`E7eSQ(TmcuTn74 zd{;$s03~wsIoU#M2DAnUI7)ZlSfY(f_k6`yPG}Tz(x39FxpPH^jyAZ5AG}3G+Pe_= zbmg9txUhJzbM&XWp8Wg{H|R#-bf-Z*?m2nXtxbzE;snT+X5neQxweqOk= zL6BayDqiw~9eyu^K|+38>W#U`TOB|1Hzyrqj)l_=06L=~iq?CPxf0v8alXx0_Ge+vD-$L|0a>7sI)cfYL@|ZGZ!w~*@?p(mEgUNjA$&cdw{;Q> z0mi6E(b1USfl{Hmv3-712tFQ$WOFW7#RL7C_Ql|Ib6(WJy&1tBiMJ|{7ZiMttkk$A3 z+xM31M+TYlpq#!DlP*AA4r;9M@uHY|3hDQ?=#PIRVo@QiwM)TpwK_=5{rW%c+vKe6OS%BGYxmTZgqard#)4w;?GMJ_NYQEZFq~M^%u5DiS9j_ zxyS(PMMb?w>}|#QaYi4hz?ko;(zlPHqI|Go%Qwr6AGrU)q0w^-^Bg94Q&l2()6JL79S(jIm5>-}<|gblj{3Ls1;|&EYg>LB z7$VwJc zE$WP=n3i2NRMx6wmu!mE*rODu)qV8{E+eIV{mCRCN@rthEgGGlvof#&Ku7@qLMo^| zci8K5=-QZES{n15$3gDec+D-NRk1ky^OzjF*Ew&*)mShYG4&UWFI{y=<1%}Ds1S7gwNU6cRv#>=R3vid|d%`N<5g`B1oJQjSI9GgG*H3 z&=nt=!%Lz}=gv$)fLr~B>?oFIjO=kGNOhAHyL^2Gs5D+>t@hup@`y)aUaMTBu}|2S z2iu0-dv3CI?`+R|&X@6#40Q5&!%KaSpyi`()d;i%OL=Jj80;($!dopkJ4iv%4D+cz z4GY@rMwgdwKT#8^%rQc!(d&Y|j*g)URaCX>1iH;`EIcm?r9sL`cQ;-zfb(wKp4y#; zoGqEGU>btZeeyNTZf&P{P0CaAq)I06`v>Kk1@pMSyAAJ5r0>di^mt`DTAEu6y!Jn5 zx)4BqJ;)s1z8pM9GJ|x5dxxCp>vFq8x{iv@Be-gQ@s2qz>Gn?QAkdcu%ueAjWjNMdF$X6^Cw!qSH-R` ziP%RrfF&$1wv-vit2PjjT?|eagj+d%xEI3@9B~$5Xfv*4ac*u)Rvvl>aPhO`Gia$aS#$>$gaC{Rpzz&om!aru)&Mt8Al0cvjP* z%=U&n4~aF8)mEeiyiKpgNC)!fGb(TZM2namthYhdE$jBO7}%+(=fj7JpeD}1!KF{# zNX(JY!S_5^`rw#Ct1ct0!aX3H@nxT)3(PKB{Nn+DqVl_Z`sQf9#jA)^5gX@$G5O=e zP31Z}10EFximx%_B&LQ=qXIU6DjE|n zYaiKxDP1(s^am&-v;9aLe!i?VNOV)ac2X% zzHUNBfj}bt*&ryaYb_?fu3dpbl((J1#Ciu&YCYMmzYHVND19@&_S+%=p2ny|*i>Hg7ZWmaTfE(P8dQ_k6c?9LyU*WGc!wfckOu)V0 zE!c|t6DEgsRG-4`JaVD+DDNo^o${atA@E)EkSUD>@jneduZrA&$4zluILV^V1CY)F+Lm{DoW%S57#%4nH&1Ih|w}U$?L(10j)Tij|{hQ43~R zIB`d2b0fXY{>s6#Y^1dc;@FdDIFv-rgo2EdM855p#>KOlUEABP3(Ej`KhIQE`deu7 zP2r3gIK2N@DrJdkYGm~-zbxb$+A~7%N*pGHT!}5enW_{+(VF$}Qkag*KkZw5~)U7NeV zl%F)`_jsUUxee29xg6ikEb=U)_bx;g=?H$@B48c3Ie#`gXkEBiz;h1z0&D1Y>_f}`S<-}o6(?7MRBlA-~^EVO_3!x@a3nJK-sF-(#$-Uw%+=V z9JpEM&^c}3cGGIRK#-x1jtxMQP@vzy1?+|LK8^&$;Y>J7&ec0)J6h7RBnx{u#tnsA zDk=lsFd-l`q0A*Mbyqh(f0Ot{Iok*Jmyb02IVuTu`wJy0Azi5i4=^YPBRpJX1&*&3 ztQ`o|%eGlL?!E**A*UR2@PM~&^H0udCOfcv1qHO!ca99a5Le+Mbm4u@7Q z$N7cQb<=E`jyzjTzu-<#YXU#w)9s^8AHjA&Ay<>AY)09B1;jG3NJ)hF9Ipt#(6b3K zXQ%%uDqVfMwX9H*C9KwREDsL1`aG@K11p7*0=cS>h!S#e%9}4E%oWJa3Uq6V20d&5JI|9cioMc7xY$JBd?~_hW+#32 zQj*QB_m&qU*>#|ubqt8-eBzrU`1;>PA2Y1>dTpHeAF z#{o||J>bUW75#nA2^@y4W}Ar+sgK>`Gs=9weNtvw)NXZl{rmH&HJL`hK}P~k!zNO? z1i#d(_P2mxQDH6bGQiFbIOr@lyM0MZL_QuOSefE+y)B1Tt;Vsnrk!L9Hv7hio!^$5zB-qyb z?>v1?HoOOuTp?rjw~b=cIUA%HQ_sw4IeIgew|Pd*qHGdBm2&IOwvQ-`VJ13<(=?lt z*A7{M;6q2@65z=&(s$@TAPk0~dG<*&1OAoyPHM=AO^;RA9+C2pO8gN__kLsmhedCZ zp-CqDossmEuMY4zn&#n{z+1Xse^+RPn|-Ak!niW$?8~3Byp~A}n8mN&Wi*~|&6s}E zH1gvKN`O&2;V;y&Jo!c`=Pu-B1B_m`VLfqZgY_I5q5aq|_;K?$m28$MI^V zMs5&zA(($CDJ2vg3#ne%w%81OanDB(_g4Wev@M7Z7>Q$(iyt1<{_~ljs#-0JASd?o zF$ATY4X@A)!7(9bn$6XE4wQY~PA^HaJ23YA z^_>>B>n`Ze07HlI=Qr$Aa=&Yn7&8E}zK7OVe&ja7I@?>2{{DW%=Fqb)J76~5_wsS7 zke{P6-x~1Y@tm3mHh`ZggUonns$UUq;ln0NDs145s1RCxAV0KFtq&0KCH@ON@k6)H z7Cetyp*@^ri}HvKtL+DFu?+ETnbxpLc2hs6xm8xm0^N0A+*5wLaS5b6{YB%Q znHs^F%Nu&SVp5{Rhu)EFS;J1}k`qFj_GqqKyekr% zunNGxG`SGX7>b|tlihL$i_ z=LCH3ZBz)QEb|Q@H;!yASAILEAAJ*%D%?jfH2o@CyC1|-60&{n@Yd}80d(48%kw)K3W6;J{i*jhv~=NH+I zm=b@@sZcoHa6R8qOxGSFg}J&<;r6vmHaWF>@=z!cKu>R2qms;Fr}@)+-v;S~{XDUd zX1Y}z0PRI4sBcA{(wgqcr>X2a4(qqejXa-U$i5Z!xJ2*jRruZ`Gy~x+ET>fRs#8GzA%L4H45TGX$w3;*_IT{Q2*ntO;f25{(IMxuZ{5I)@ zC45?3Gkp5E*6}bIGY?qJ1-fQsMX=7<5CT9Zn25)!z;>@08x$QgsmQg1`6BB zlG@=112!mj8jE+LJ(0wrU@-hG+xvUz@Q3Wj-qLvQds%$0qYfc~={Ps&fa$GzNh|aD z!Bn|Xs9V&Jf&LXIfpGh@bGJH?^!LA<;Jtm^ac1kJynLSIsgjYhF+{+*;I!~^gw}MD$W%I5~8Yyo+G87aTRgv&jr?=M^ zR%RH1wdfDyFKjseoAY*WV1au-2f26|SIwDI?NC=XJIxoM)9MfJl2#WZ!u3r8hRI0y zl976Eo9T`>DOX4b~ey@4`P5X?dm|W04-Ei(UT`++u_f`J%R6ie--NvK?`@hJXW5#GGb=1>f`)N z8hwFU!v05iYC5k%!u@lmnV!p=uSu-$t32)VcRyn#58Oh5u9CO!%pBB|D#n#vPI~u{ z21nu|1xwS9W0qHGZ8zXAm{mP!D(hqCN_lEegc;tdbLwqUu3zusN)ERU(ig*o{0VkV zeUnm1!*rsbeOUj{4&&TqYk=2qC?e$Wnz(*~G@p7kj+z*9b8J-a{jLS^vx{!&(??JH z{X+nc{GOQ#6uk$m+!dB`YP9ZMkJqpTTveOBZV+)cwd0BUbZW@KKw;}Rc;AhHDwdPb z9?@=gz%K*@HsCY1-_w>jHedC($~D-GP8zt0oas;I?`1aojfS7ZA$a`$l`MhOY1MlU zL2kSRZb4dNS~tdiZ2&WNF*BNBaW5MZsvBJF&Yn%28DAREGF><9;^Y^)1~(na&L#Pw zeR=91D}6s9$VIw~Aki-;b*X7Z`O>R&QvlMOI(=uiy{Erof5tu64VcAXMln7rl920@ zQCX(;nPdu!p-4p_lag4k_`+cpjBIm+1&bf5U%s?}4>Xm_dfxwKU40I7%2yJ80CN80 zpd;Ak2Ol`U|D)D+xpT$cZ^bUgu{iPUDExI5e?70b=G{jxLiJ8RgXNGzeETfci3H zak_z-scOtT(BiA&{M08)F!@h1H#6y@DU=rt$a2NG`h>Z2HU=G!2dq)-Hn@m^w#a7Y zoyW8_5Z`I?fAjEp=KTcv|FHI!QB`kW*r;@gG}4{YC5<#FA)&D81|>HsA>G|6jf8Y} zgQS4c(jX}f(gJsF&N=^gjCb5|Kiw}U#s>D@zcts4XFl_p=lk=TN(u8l;pAR%e-5h@j(UHdw`O znLJt#W(45J6k=(Tl2>+gHz(+wZV?(iAM`6uuOI&f+!-3Pp@ibBIZ2{lHngdg_@?wPetW$& zhtI5LxcxmxsHDe^og;%@fiQ9N6_z8C6X#N;k-r0`euq~ZyuY*1q6c}IZtlbe47Bnzd1{a=5r+H<`_eXe?)TeM)|A69dJd32W%hE6CFaJ|I&g<9D*>(`_fM5;P< z*hw6&2QArXVsbMmXd;G2lP_VXQvPe|3m5k7D1YyWzk8i!O<4CgmpI9HTH!#Ypj=}o zoKG&6A$~;5R2Y>7reTJ)ay}By7^LnjxzR`_s_NcDejVff(kISpph|v%S>9k0e!W?U z06@MR^t~@*dlX_Fy(>C@t0ul}C7yLcTxj+fGuvprz^=^CW6$uQTo#LF3sP`fi}qHth1y z1aRdw1d{q;ve%c0xO@l=e|z{>A1N14V5U$p>bc>O;;lTurgeE7^MCyj!#xW7NI|f&xxExUx}XU!nqIKJ3jV5vaWh z*zw;zrNQqa5wk?v~c`WB1bC zjGnTVUz+tj$x~oBr7+X65gjgzUdUM%Nm0sb#)cAEp0ho$==Dj#;-irM9-<*;g>2G<7}Se2>eND@8Yd zT+*`-%j=CCq^9bT^Q?s~mZMy{BHuSwOh4C!5CfpWiuGr^xI~vy;Sy&%TRHzdL0A3H z{o}E@EKIqDly_pk>cfCQPr+)zPidQp{p9kFP3XblGA7a3+UWSoR!s;lBXQJ2Hyn~= z_vOU_er{ilfd94w5RK@x6Rj>;jI-IIO{|I#=xN{Zud+}zfDv^u`|hof&{F&8$F^ML z^A^nZGlKbAcXfj2Z!}*U>KFbgrEr!dmw1d|IJvsh#scFKL@-)>9yOQ=XIU@KdiD#* z)m^eXzJIe%8Moe0ZQn)D(DOXSQVe(B(ukVcOvX*w zMs0My$SfgUtgGZdzZb(t{OLwnz~Ty{m6=ft$JGdBv3#E*UzsMq)jjjSJtJ%+*U^(G zV0O@uNsS6W%V|0*yU8pN_r$m38!mX__br}OTK)e1^N=Pf{rtC@ms_J@MrM&WizETj zgp^8!x^H*91e2qD<^jUZJhQfqHbI@adT09tHa_u}J@rjO-o3>)w_6Vw#j0aI?)m{b zN8N^vDY$fT@IjsK)jp4DAUSKhd%{&HAPg(`f?n{fL+N;3&PIO68UYFsdqtbIshFd+ zsCg7y-Wuo~v8QWb1z+5SLG0D@l(Ixo3FgkVUh(hQW%Uxj>a*k>pb`n}w8JGM zO-vOZYW*5o1uC9HgGo{Kk4eTiT#|Dbv3a8QYi8;cP>xPJ(-mbS3r=GMEtKlmfXZIi zj+{7>?a%jZ5oK48z8PjK7b4&-R!9a^{#ADJ@{0s(S|kQysDG3%G8UR|PDM2W*Z>Jm z>U94Q4d8sI@T>!H6rdlVcJBcIjIlpa{TgIXO`9Dl-qrz!sU< zjekZfQ2JCbj)n@xWK?a`v3?sr0ZCAU&~n=U@k~G~7%o>Xy1W^1@Vv2`o$+~#I(g4C zX3~h$p@?FY6;5hmA1^sUvVbz(wL;lhMl0Zd0TntN*ZTQbrbIRp3vBRa! zy_zg0>`6v*&)nE`93((3?JT4loDk1wJov9)nv0tIyb9l4zz7&jj!PTKkHg_7 zzztyQGp3$Ve=E`R8`;pP(2sQ3U^N$Bifnnxt{Vd0{!{qs+3w75Gr1@|41#B-o?pI$ zh0Gg61W41>6#>5cS?YhDJpu-En^@yVxns1 z{GnE1S~2)uW(S&csenpzuF-+aMMb zw8X6MxNtvPWCf8yG$dhnMsn8|sqKRrv6akC4tJiWSTrc*tZkcW<(`Qk4Ya#{MA^cG zYJgPZRh>*1@~<~y%`>CB2~VPJGv89#zVC5+u0PZo)U$4-`{MTLbi}QyudX@K;qClP zidn4`zaG4wBXG4F5qQ7Bib-A5;oZONo_Fbx8$Cp+! zVK$i)vc#$9FUa5;B0gMX4p(1PWc0R1)hjFsIS_w9YHkKXxp`S7UPmdd2(}GC)w9Qn z^+Kx|qhC35vEQz*M&A*Nyuh7x^)<9~qnXNMLm!pkISrUL3DCpvSe=y}J`+Czt6rWQ zWGaB-$qOyO`Ced~qxV)US!n5Lw5`cS?vg;2bJF#TAP$`X^rtUBbp2X}Wk7biBrwqs zFd@K;aVh*9Wp$uMe$} zxMaRiimwijfKHv|+YNCAs*|Y_&Dq-b@eaPmf1;~-2rvv-20hJVqTg?3rDi8_oO<+zs-if1E z=)B_rDV8(hLNzO6A(|sM5I9k9Lfl1jCD<7W7JDkv$EIUVUOOTK#{NyFA`f~3qKHw) zaKS2uZ|(NunUy>U_ncWwu^VVUr8%0 zKWf;Mt1|vNS@+c@Q@y*?Nqn=aM$|HAtVwjBnA#?3gHQ0|C3NGnEW{mXuuSg)l+h*g z3>2*UKiDFM;T_#JVT}Jrw++jzW1XM?MCh`2{N8+YF=#SwJF+PPCZ1rGFwXo z-3%jgO3ikkvrmsDkGoP_s!`nVSWYrI{hkc{NeBBp!4HCAi3h6(FVA3U8NlWKNy`QTnHEvW zfTXF@F6qj2qNS6oHRoN#(D~jSAM1{RieTPv2Qb=Q>1P$eV%nKNjJYySh6=|<3PA)c zcW$|P>rZ-)l#4tv`o3Tl7jQT37p(88W@i8&bdV*tv}Lu72%coh7QKa>49R2l9Z& zQ#4u2LOBre(%gQ<$iHI~PHQjZ)3q%I1N|rrM13M@he;XK$G+&#F=R?>j>o1rn=Su! zEeT18Y*KvXeVDFGTe=rVAieV$Rj`uKmigY{D|~f*yJ>28t}hKTEhAFkn)H?YXGrH% zfl@i-X_@e!>}NztJD1z7VC~06DZzqvu4eO;)B3Yz)usa)Bzbr99`NSEZ!j6VgwdAs z^A0~O<^=aDz~dJXEEI4+)FCzn(4J+aYA>C(8ChwS`lAG8uNNm8`%!8mjKhYAXZ)Ik z;vH}&NP&B1+Ib&?1G!&`YU4H|%Rm(ZQIfLqT~tyF5F0MW?7r5c39)D-MCnF)&Bs1B zAXt1!CB}wkyVKxYqV`m)DsdDVv2&4FiZ&c5|LW;v6)!_0Jxje+aDvKxl*(-tZev)o zpy?+|%sKzbCdK>3m>tQJcL&0xac591MISUyI1egA3_l&*LG}zS1uRXL3!8zsl4?{Q zhQ_v!F64Kag*9`pLgig|FK$b)=b8(?g&r=8{aXAK{2kqPxwSbM?Y26EJ6QSR%?Tah zory=G@lD!Nw>!Jm5BiJ63k>A?`!jA-tt`IHar0+SELobeYeP@mJVg78D1_iBGU8d( z^C_QA5!3(eLu|meKkSoWO?e~nnd@A_=B}h)`Sa+}?ov2XL!bOka4PPCY&ao-y>WkE z;aJw{?v36EK8uE8ZwLjs-Ex~|kD{9&OJlyn#r}LSI)PVYiw0ETSdI0Sm%|_NtDiLn z7s#f!=YSa3tzE_*c%aTwkRJnvR?v4<=Xilm4$g);1i-VLZYLEtaOkwd4W_XPWLlv# z;dR<_STTd>1fr8kQ53Ah!SndC8hP@UOk0K1A<{}{wqHc9DnI?jV^o#~h|>Vr(#_4A zm;#9tNFWo1a=b0Zrx5#C#K6DziEFngA(Ns=fx0G5>o|rFwkpO5};x9_Rm=)xe z5zJjmXUv@wop!jNp#!$}OiLdVd8pM(B5Lv~s@BK7T7Vq3(P7sK zVU+v{7d&etA6p~+K+vg%)z)1fGE*&5gG6eF<@`%{t!it9a-hUSRZ`cN-Wm-Knt5@q z&I$oilz0V3xoB7?%e874I$J-L{)ju%791De1->z1cMW zqnvEc!w(dszW}KygiNqnv0ILz6HzkOC%-8z|5C-8SaQj9o9wDf#6A%t~;LTgTspl&eY zs`y;IOZ%39rGlMXUexR3DPnL!yJ%~r9wsdo+VKEQfx=L!`>K;9{Hhd%-cg6Q%kJ0M z%8J@A%vi@PiG z^tbhug;xG#Q&Wmn%?eS{miK#UzNb2jsH?T8e-CNzvpl6g4frt$Gf<(W;2k2pg(?uX z#TSe)wwt7e^AT!%G4t$;icUBry;UY^XBF?B_2aunXUXNx(tys}O!0qp|G=>z+NRvL zWYVXQ+e-Hx4aw>WD%H{Aiw@Cpa>yg8F1AGS$z|Ok54SPv;}(g#=AI|iX7y_8Q;tai z1H(!jyfBSnns$^p9xm-2`4k8$M{4;<@lHOL3-z;s2 z5`?{jvCe;Lul{^RrRnYt#$SjFT&uR(BvQJqI7zzOXmjj6Ow|Zbn$e{Gn(KPbT^6y4 zF$77wZjmKieqBLYj^1Jx_^09W!o3InuTtW1jvMbq2Ih!+lQpoV6dyL+N?E8*vjgRu za$#AUyVhfGpMXzOB#M%u=m(aKfA(}|DCJyUOLyUxsWfcB6F+87-xpY68aHJs4vODe z?-CSnGbCJUoxJt5{%ONfy*b?$WBhD6f1(6G$C|@v@GW6djX3$F?Q;~0iQ->_{ygq} z^9>c0h932z9!B2%~oG8>auxr$};Z5|ESNtQ^__^+>kq7sUGw)M8WfROv2 zcSd!gYumnufNb+8jvNpS=v?XK2pvHhRPvOAl2tvsp`oEtza&{)keWpes77>wD(*}= z%@orT2#LO%dgbk987cn<%yJg4&v|x*NgcI;@q!HI~TaFYcZnKlb*Vg8~_?q>Ijwe$-Snyw4g)MFY>Mt^===#mAce zF0J$f-}_u|N|RY{x4RS22Q<$FVmOb-g@O33c7#nDFP!)5fuTddiQxoN2XA}DQ+G(f zHj|>tD1~WPSfHFG*!W%9L-rGNTJ8!zw_1lgZJ$4gF3SEo#LDXi*V?anD&j z^Sw5F@PTYfe3GXF*nKn+P~>wm7-DqU<{j7dlqF#Rx2QzFfbHATAU8NL~s zUOUDXmf#lMO)Qu@JMG7E?eL<@{l(x=6Gpvp_4kfg{)m9z{#nUy>MEWosr}sjeW`gI zj1D^kY(DqBN1nMTFAQF^cO_$SB-S@F**Me{W92NGvoD{c0{@nZw-6-zdRzF<>IT9_ znoB9ev4($oMTxuGZqS;z%=0zPpnILrVB!1p)7h%Y z&8h3#j~!thu`j$YnP(uc!o9(|GpRW{kT{Jy+q*p^PCAT+%23j2o5GH0I;X&s3ohAj zml|(hyNNyXUT*h1lg<51jGy!7QpX!j`BOWKqo8+(T}b&tiA)5M${#cIp|Px?TarbO z+Z()NJvF4t(Ra@%gHh|V9bKd$Z)IDoALfS-7mo-v>dXS)c+PPn z>@pt1Y2D=pW34YNEQr(0Umlm;h!*ayfYY=~mBvZRHcM%u zMWZds;w=EB6?byNuarmNBDf=_-*%N!JQg#8_oXsa@S7Ls71oVIHannX$Goi=KT7Y2 zJGuY~jBzed9!x6Q{+FmpTfh#Q!q#m>ao*L1UbOp zoyMu;)vUp{(_>2ygJq?RD|;PCtc`USEGhGLHHd!CnlV|r%0~Qt1#!VK7+%0q@@{RY z6{e!PpN`c@kSqzV6Z^YDysISZ=V({OXQ+{ujfxD}xSSUmZ}F;v!Cz!pp+mHO3Eia| zX!`VAxic2A;d#{D&L=sI2FsapHUU=sR-(7X+okRboB+4NOA6Xaum1!({HYOZCLqq@ zE+AJEDUTw8XMoBL^8}=((DWZWXq79|I~;JxAQFKW@Zgg+EtA%IKF8{!fv>cx-1*ZR z0|F&INT%ZNj739~aT@m1k!z=Ev{UR9gxPl0%Jd(;qd(V1BCWL;4N+x2(HB-m&Sw=( z(LLYRN_LX$Bl7UTH*o&b?s)(3^n(x~P%HU>v5bsI7`7R==%_7sH&<6^!^O3MtTuRx z^Yfd-$yk&xybx{Pw>a-={73VSN0 zU&XNpym}e!BX~@KVXI`o5KQ=?XJe5^#xLbKE<5bT^7A+SIVa>OBY0}*&V>)p1BzFS zAHIf*ln+va3(uQ{@0>K9e)F90BU7mGfEUpZ7*TMzizJSKcli|nn=ve!>?S|R%<16> z7qrpB;=$2lTfz*`y2y9Kk317R1ahyCCjW=~_=(E!eYrXF5`$1zB={ColV}1rc5oQB zQn$Fj&{G~&THG7$&DJbG!v|J{j>l*We0mTpf%=)dGCekfV$dq$i;9E&;{6CV8kG_|}H-;LWd|8Ny$KBPkj4ACt`L1mBM%g%`j^#w;<9T(Wg_N`=C*~2pL zN#mc{5&(Z{SHNUY)ChJ6v)phBj(iHo^$YyAq~QIi<^DA%hZ)@DUc_&>0`6hQ9<_DgeNs5mc_&mQ)S9oB_-NVPAx_mhBBQyuJ z(O2M2Mukom>|n2o&*DC~49fbljXChMs2u-T>HJaiNuz!tz2QsPbt`P+CCmL~#Ek8T zYWQRh?cpN`ZD%_+NT!QJ?lRMEMuS}Y8^s@T$w<6P4d~6U;1{iJnO(d4Ceji3#O$FH zG|H{Zz2^%?Q!?K7hqINR*_K#rihepF>#DD#mJ~NpFv31NBZ>9FGuUH;ohc{H!D$KAQnX|9hY{}|T!#HEw>0aMtsu2u*$B04v0 zsJgrUS!qZOT^0lMoWA0CoQ%zNbd8u!X6e4Lv%~I#xlTni+n&ZyU2^b&N#HlzYtl^j z%wV5S00|DbbdbTWuKT76v|7=8?C=~niMwowD0*YTTfJ3=!+??cq5QBvcQ8?!G%R5! zJH*!FcU|!76mfZMkWR>}taJZ!Y%pkn4dy6I%(}c7u!%syiTRjKdHA1Gm7s^+Rrb5d zFX}~*DjMV75MS65Dxhv5VG}fU1*+R1KwvNi{Ao}s2M+L?eHp1q z@nH0ZsXl^T`$ADvUNd*ktC~*)NUtZ49df=meDd+`l7y|Sb z%1>{vWQ(86@r|nL=*pMZIBf2FhRK6Sv;4rq=PoYocOSe6%qVCcQp<3YZkuW>@SN(R z?bkH8;ebi*Wx)J!(mVlKc4X99EVLR)p6ZRYS%(w*t9(MSzZyyFW`<){t8ZDsOY_X0N5iC9Vxa-SA6 zGyZfD0Ui9etsnW<2Q=|)-(#%ae4rF*_8>#~5YZElVj=zUUqGpD3R!Rw%lm~{c;#3K zF^fdZ@OSe+A6+ojk+*OpXt!Lc-5+nw+A0nE-2UfJ|7S+NE5L@wQN4C_;qjol;Q2T& zRBdE}P|%5J9s2NmTy=03a9`Wm*-3{Jjuf!9fQ58V$%S2{f%+oQhHnx#KnARWEzNv9qFmzLDj>3LQxQp58X z(hK5pjD}3jW?f}@(E=CIXaZvYxH6%;OGm8zXrHFT(%Z8joo^3G00kT*94E|l0iNb%bI(r06;Tkp2^9H=%`L`xnm>Yt5 zy(s0*borhiH>0;E@Lkj(M6P`Q)e3VhAopQ|xe&+Wdb-BC`i|99b^*V60FR>&H%{IG zsWlUzFAA_02cH8)puGtBksksIyIi2V4mS=J-v(~nX1faWFis0fxL=itlWQV zq9lZzpKAcUJg3Fk3`h>m`4vX9uf$&{{7n)e1<+rV@kTQZNRKTYa4*YK^j@dWyywEY zup>v_X!9`Xh-*hobJ3+;OJaHN_3S;%B*~K*d_id!h^%kz~E#< z2se|>@5eGR9q)MT6A0S9Pf_PJE_xd(mRzAXMW_rIZGhJy+ui$KwQZFy6<^Gt6?)Ri zy3pc=YNx-1vwz1XtUiDymIGE973nmv0}qEBW>9U4rd|7v`s9V@H9kyqaV+ZvEP;3% z0(_iCY*c9%kl}oL2`1RWVcXq1eG!--mD$=a(C8a%<{4PWyl&2wYO4SXMsk6KS&fb_ zWBL?m;DPlsQtM5w$249y`~0S(>BK-BR}PTpralXQIOqkG7?>>ok8{vK&IY1AGT@?O#y_75n%0xb%2DkDWC_q+Oj8U|D-D>xK*q;`IU%u^+UddY$8$)fqs7iwK%d(rdk;XD2Y>=Sgp{6`IQytewFAm?i4LP>MWL zqKO4$u=$(Ml|1R6IALbI@TLG_t4}@icVo-_frxzQ?qARYb9bJ*32j=2_c;8-w{Ou^ z#+M*~iHC{+uLkbNJg3jdTVMp(#jxlJE^G026O;j)4i-Blp2hGyc%!`(*cAa|MB!p( zxgnYKN=XEwvicgmML1;#U$U0@tu+zL3bDrc(-^h?2yBaN2Vk$L!Gn}ydzqm?UMJgC zA^kGebvuy()Ry!0Bj;W3;2Glzp5~JW2ZYcjQz+<;)VS zWLc7nnIHSd(6L~d?xK2T48 zR!r~$97C!uwouNOip=Dp-k@fEf;$rz5|3EbryGb)Q0abVNhcp8&T$PKvn1rDq>4#7 z&{=^A6o%xQ0JtTRUJ5Aaasiwt&z}4H%*<1OJ3TF=m5ahRHY2v!lh^&y0n|?>@CwDe z{t{u5@OGy1SVWlN<<5gWrd?B0ZzGc*f8u=)kE=$yNe{;vYF?=Hi2Aqz6j0sG(naFvSHb3zL3R5-=jVhP{x79%wzu8E$8W*DjH^sX zY6uG0y8-_?7xh|jN1+wZomaOQ`*jtb9CCj14rQ181FUMbpf*%)?f28MXhLtyI)_zJ z)0x*@HV?^K04V(Zbe`QDx<%Sw?P;q<>NIyVsW)M9GZE_L$xfh|j7)jE&LHk-zYwPz z)XIK>&N6LCD;pLeJafJ_nbRcM`8yX9w=eh`Jy$w1hp{nV5nr>|frCyyLAHt;`z^st z8s5Utd5n1D#}T7f#P9LLYd=((=oz?n%&;-EUq{Artm@?ZsovV-4}|Urm+gX z3r-9igXD_7j5otEa_md$qy1{kjuv3Wmk~Hg9KMz}gOM&+{pjiIGW_?=PXzrF-k%Kr zzIwL>!mZU7!oY~dL;4J2oIki`yw;UX3v>*IJg`@Jq`EL4sv-g2f5Kl9VgoLj7Aw6~ z4v?0^pH{s&+hxoJ4BY^5QiG;PfBr~Un-2C0hSCA@U>I1Cg&tl`_ln;4vy(PP1NdF; z*MP|%aGBJbWjd9}dK3jVAe#mzl7-Tf@>$Y7=7=$a;O@rJN*w&znF!1h8~DwxwMEax zRObkkhjKH3=O^%6xxI1j!;>$4nL7d&TA)`w)4I+89dY@9S2X$#bl>Q53IydOXC4!C zhtM%9r;7t^w-I`NV#cy{H9xTP1cQrR%ZmPZd$vj_51r0s3H0B!gYXyBe8}*sxfL~R zzbtD@uxg#tvsAp!6v3H>$?LKW{fJ5geXUs2)nw^@-g9tyg1$-F_XbKg^`>)-9mn4N))(kaX-HozNQ4r z$W+tgT~qt`frec6A^g{u7PGR%wqtUR9Z2U399HwA0AG1&FT{W?i)g#p6#Nq-38ak? zu8w>l9SIQmClLw~v114LMl#5Rtf9l3e;+ax4_c5T?(UzF@yHRp{aRdYms*`HS3pJ( zBdBRcr(CSFonY_ucl#EXcF{TfGm=8BWCr2sS$$?R$RG$`m#|mYZZ{MEJb5#Lw-9HT zBwgAU&<4&eq2V+;K7@icYK|^z?2yae&;^!pYb88ya9A$ra}#R`V)j1`IgNE}{d4lZ z>|pwx2)WF#i`uE`LKI)y@zfTA13_tcX;VqD{a%$Fd=6Vkz37ZOhG-O)Vl<>S44~E|Vbr3_#-QUg`3eN$Kc#0ag{# z{iSoISNO6H1TbdS_^|H#8>-z}x@LMgKXqorI}Q@i z!9xgj8WjC_i4D*`953AMIF)3WrhP03aI1w_zp=DN>2ny+1S)i!a{ERygf$^{Y%1B0 zK%QF|q;o zdgcr7^02&@x*`^%WNps(Qo&DrrAO8wP!>*sNfdzHSPC@p{FBxGuiF2J_V@1daV9&k5K$<778D#0!`0vW&YJdc94-aF#%XJtmmbnRu+hPZJIW5u$1 zq8&Iao0Cts{0l@RS`mdx9$UhHb-ejaae3_(WEHk2zm}%;8aiLJ_-dVbLHv{MnGWv4 z^W9bo!IP;s6AEL4{*IMqW}5awwmZDi0UKXTy-gP|3oq&jrC#ddD)oukJ?KEJBanVyrhf^Lf$ zSTm`Po3lBZq2rWRngdiV)h;LU6&M4`w0#RgE)V^si^u2Q86q~AGM|AQWiB@$E1=MM zcbXtcXSvNIm`OEvJD>X48c=2eA0@Dk$H}NW&{ej9eK`w@i-83CZHhx^XFFhXtE9X( zSf24Vf%r|=K9G0}3^Xhbmi_{wC4cGonjl)1#Yh@G>oJfSldy^ZCZA+Gc*2erj`Enu z2mDAl6LVvJBS;np*4K&%vdbY=@JeaCKf-~bh=B@&vGHYiyLK1bR~+xM-PtPI5WGm@ z(C~bs(fVr-Or8e7hBVZZ^c)9nZ1qG__Td{B)`Z6lUUb^6ckZ-FW073j5Rz z<|8CPiCpE1*g36J>6XE_x>9wvJcMaTeO^pWe58P?HTc0h!TC z8h7Cld%d24ufK28Rmg} zC)K>)`ghCC&Md{673}dP{a|&ACV?R`=yQHiqu-mWQ(%*G|NM0lmcfH*4sOVyfa9iO z4By-8Az|o>IAlV(4W5@#f?(m`XAR0EiUS=P1DBc$|5$=2MT%@`aV z9bwZzaC_q7{pLaJGz1ll`_%wE7{s!dnFT2^ShV`2&9(Zuu-9MLc+gg)f659`;lK*@ z9Gv4svo|9(^#kj6sK7?BwaJu~B*Z#82CwryVy6B6Xv)CL)PU;s2sB%uy@XH=vEFWW z*+(Y+K$$pg zhCtg`2A1~J+h8;*&x2;*w@>_Im2R?Q`T6QL!h>tJ0Lq9c;3p({)5WHhGy;}1Gl9)^ z@l0x;L#ozBf?n=+fo-2~TG-DwfzoUg*tdqp()g4^AOGd&m1!a=;GWNZPxSzFQN|6V zKYe{awY&BK)i#z*=ea6_)~EdApFpj*%Jz#9;NcXw0(?XY!T}!Z#+h+MV5uos6;Y&K z_(Z2MQJidhz)uH-MDYOqU#RoJz5(`%1+QJjHZ|rqe?){-4yzcfP$BM(lyADqN^9_aY@*EVOSYl#gAp{Bycg-Fbwy>Q9y3gAhv(ark zJa2-4T6#z|gEDC7x4G{mT8#{Xd9ElRUhH$NNTY3{tnECdjacv8#fH}WQ1H;i)57th z8BctENn5(wuIaLE4cbg0809NTtYj0;YK>5%bTONci{4<_3s59x!>~oN@4p5XXA;Ty z4;1-dumlMhGn`Zv+uKo4ppwIvM*!$q9J}%lbU9(=eDv(L(f&O~ZhuJdkh2m;y}r;H zzXpdjyEd;=Gox|8(qo$xX1Kj*$}oEEIe0cTQ|S#d)}1~~LE6q*kn1w^8AyvGxOOP`WI zF!_y>0vXnpMGwM47k0p)LLG!0OC44C%xCDP1 zw%zYHar({&sn&Mu&c%I=N2C;?pV(eIgEabOMOkg9u$7a&h#M3clx8v&KQzHy-B`KF z$;!f7Yk!CWR4G+Gk~Zfzn+!z3Z{?#*8Zveh`zI}w83I*@2k$Aml4NZuaqsrIvB51l zav)QaaXRt6t-+%IDPs~%s1@OxBEdJvyX07hX(4*MH&S6Kl#8OicqryO`LT?l-opW5 zbwS}1q{;P0JKwaoxlSk>pBd}9Y{IYz5z45CYW5*i!oLQ0R^*7@;R(YE87#*l`}M8O z^r3SC4+l`*=^|AGAlgS@{1vPvp#s>MyX!#pE-(ifh&-w-AmN4SHaUczz=jKuF-f+k z_uaz`G(y1KjB=-$lr3HXFexC(_9v4+kkKxwIGu z2ZtG(V4S{~BO`2gIoKX29S1Uc6A(BWLcs57{IrN%8>mxYn#n9`N zo&Hm=N~-|;@aXpxi%sp~O~!3|6mV(YXpSiVS2Uc(FnL(rmRs>w^${|+GFWe`H3>;kavqF!Ke&X`_mnZ1SQ=sYX<{f*c9Nt zo3oE35%W-d*&7v4G}2^V$j4f%-~_3w%f^h_Dbq<;L!UCC4C9 zdb-;IGBG4A7Jw=>0m%_6pfcI*eSha^I*`p%qyk*JN;`lOFnl*aSNnUFiCipJuR+b1OAhv6a!@V1fbybt^H=T3sN_BM#UnX zv2w6Kmyi`gb-lN{%Q6etvYIl)x}c)^Ozsb29EL4meslp83?@If(B`2z36Lj(mL6Ad z5jmv>$^R>M{*6CIQl06uN!p-0QAvza9teU@C*D87C&|+NbBOU4lcZ7^twO#1ua>nD zg~e{-ud#1uqi&GVC;>#{-V5nBQD#T9C z?+S_(Xy9#ZXd(`pGS4QgOmBrh1v-SKAzl{Q+my{nyLzO^Ye%EUL@nRtv>ruSmb(L> z7JrxUKCoO$nZ+6-MQL{r^w6BoS$uB(LshBPVJUy`$4FfoSXU9&QnX*!fADd8zCLBB zwxI-}Z-AEGdwd-bJpwP2SR;c#&<4Jt+kGGC_{n6@y`jI@i66yAxEf5e26TeK5+O_4 zy0=0@g(LA`-aY1Q3J~#z>8QFGL-p#)fvpkom`6Mx_u}@z}`{x z9G)vFNhqKfD;Y^Zgs0!sJHfX308|$q!k=_}{?Y0DMhLX8PN#-#{=@D5GYrMfxY?w% z9*~t#;Fm{%Y_J3kqK(K6FveH%y3KaOsBe3V%Tf@_@>woqe^h4>RN3g-Bpi8PoONX? z`3L6flpQ5Xmn7~+NNlDPOo{jsEV#TW?JZCZs9FacCETn771nKi!47>$MZRnGBL$i% z?zcBA#`8Y&32o=C{!+qyYinN;6Le8SJR%zD{+f=Q|I^IQ)y@o25qtIaciG>=P>4P5 zAXR)nABIlINwA^^SoRSY=5%38*6a6@;Cto1!}@JoEH)m1yY<^D(OAr9qz<|GV|w}G z2VR@$chnN(ZMvtHYRbwhw3~iukoc6(of0hzBT%5?KY3{MKb*9m3@n;K0v*j6RytwP ztkZv353un-%a_O(Bo9s-l2Gyxz3+;}QFFtcF!*Jea`o-SZ-oaq!F=m*J$Q!UY<(+6qGb-%&I0kK$@ z)H;cJiju$FR_`ys2*ASL8hw4^*Cyg7^)CC`IC8&e%dSDaqfgGC8r!J43C>=pJ?f{+4P!giTnZE zAsY-$TZ-*a2l2AQ29f}m-?UO&`O|ZoKSbkolDGNpgTJ{#y#`-Z(+XO2RG4&?(dvyX zJpEq?cxa?zhavvGy{$6+N}}6jJ10r|7E~`PWQgpbsPi?%sjNjceFhtQUO|`?(?JdI*pqJ|^Wur@2Z$ z*PGv&nF7;*ee(BmHCX!PM0l-f+f2fW%WYh}D|8q2TIteE%k?h6;qv4v!?^DJv3^G* zQpJbYF`V|6bV^B6MU}29!HBQ)h*!k+()H&rrL#c%J99fC{$Kiu{SnaA*1IZv6+oZ) zB`p34mM^gU6aR2gi&vi4-kg9G#OOy7ViOLHH0u6uajR^)xW6YG;nY0gZ_@LODzNce(fs;wFo^93z`|otP9Z%*)|wg*|mJ> z^MvU}BZ;_j^I4x$z8>QpH0C<{s?tkN5_xfYim zu=u7n48FlB@Q2xVw0OQW+=cPn!+`_lm_n%38#@85krz4M8XxZu{8OrM(G_~R{iItW z=gLs2cryiyi84h5{L#X1yG?!d>-(3YKr^@j=hyiIH3Ph3r6=q`)-NO2Qsbdg0w0e_ zd7#VkP+$_H%@(gr6ZiYwd_%NO1iQ#*0M$>ULeci=|Bm6oS61S{`{K;2#cM&WXc78H zKy6C(2u>kf9Q-XG)?NfLucJ4JHO#Rc5XVWoeWU7+pgP!!zVE6vLi*m^uWUN1DlzhU zXV7d&p8`qYE-)*sZb3bGbM?pKFZtvqy1DbE3X4>uf6DL2{)J*P3zy}Vf_pz0K}q6C z@eyzU|9z&2Sw8uKZbw!txG6p+FmS^pisb@E!(=cF2Y$;cJg?iv7`|Sn^Pf}EnW1fX z;Kcmv?_mxN-?uZ&=F2g7L|>@a`@nBzQyad=2|;Qgf#j@vUT?#jM=(X4@CD^AWce#i z8^3~j{L`9xl(*$6J^7AH<_>Tss@!BOj27!b!wFCrinZCb+C5KC*qbp$!|}hIep$U~ zi0W-;>-q6dZeW0E5&i$h7K0^s1_;TWh-C3FsLfHgN%Nu5)S&}kTZfFm77wqI4Sv+i z03 z+eC3BuD0UnYy|MIAh%Xy!YKk&q+!X2LBBB>Q5261LO?HgkBc7Ak;uMw?>~umtHS~L zHwbW2|AiNlIvZyWvSohEw*Cci+!;kn0gpeRBGSl0$$ID~Kb%e%qv3mHioYa{hzu(! zuo#l^YpCrXE*TAsNVHZ2{gmQk17>I*qVe?EK-qt3+RAstbkDVo@BYIXH430p9WOyJ zkBbU^XJex?(i~n{qI2Pp0uGAURaS=exg(3?x*;;~o8YrFf)NtDh3k)A(K&i?+2#|e zOlk%Gb8qb`o;EtU)5kS!NEGaCOhQlo8?88HCyf<7%(6`HPbhBmw883Qzw{eW&Hb|a z|F5C>NZ~=xLzAVj*guT2qorIcBg>0FY zE4t#xhri@>ui}(Pc*I(GSdxx)N(><(r5hFYq{aNbs z#cEcjr{yx|`w`QVeX5p4*)RzgEZ+xYE|ct516*#Gu%WAGUhaoo_u`|-`RZy?Ws3C3 z&x6%820s`=vc7}Mz}|~Me|wlepQBOp(~`ofY_FI&eYOWs6Dd9(2>t7Kd{t;*_VjAX zp-Qpy09Jn=1jh*fV7mu6%s3r;oIwqV>-3 zLCb?N*z;;xfJxLCYfxzj2X?(if(Q=d8u<>Bp??9qyeI$$G+3mM*ZPn&@ejAl0Z{;y zcEs}ALO=%!dT0xfhU4oqD{G*Y%V#->dT|a#02E8y?{^2pEXiObvMAsqQK(7(*>FH< zQ}MP|CZFa+&AndlpVh!4&9TLSgtqj-&jy~Y#|LK!I9W{ZkpU?L+T}iRGTP{7hH@R* z;ty_UDr-2c&k6>?CJ6WNgOR$7cV}IV~7Y9`rltvP~ljekF!PkL4NYT5OZCU`Yn>EQg=g=_g=Z2*w5QV zNiO$|;19!f`&jd{PMV|thpDT8s%q=Hf*0jd(jg$-r6?iNAte&hASEE3(jp-sp`?I< zNGQ_XNQZ|IIHUu99F4KKe4pI@lDDY?nbqE>d| zUS`cBC(@#OcsLVE}x=yIsO% z4^SHBT*2pktGZ3Z`2#Mp5JGzlh>~h0W^#FBwSYGQI8j?}d1QhWpr|N?ozfPE0E&gA z!}2SPKReK1w!XB0yq{)V;QhDL#blVh;y+5`ou}O|Vkk;JV3X0XQ?@YRs(x}_AlIrJ zicD&mN@SzlS=T};rYkMpCyZ1(GkO19djja+v(r6+DISdlwY{;m;V&|@XhuHg)IZN9sDxC;uP68Pm;p(FUKCaJc}d`5 z#BBR&T&HF^Ms9TxPSZ^5`?Iz8>;yi zf?Si|(d*4;pzaQQ-Ee@E=?xA6;3FOWrJY&PAv^!Fl}7wNCD;&Af<5#r z350}%e7-YQjdp=C{@%Gm+@>%8(pAC)#G#QTesCI^ z$>q8~K8oGi*vgVn(h+ow@6eEfYHMrjwT_Luv(}-cVLY$&zmiP`j>BA%@I+bjYktRv zVUR_cK#%ULBULakP^hT|?V=Tbb^aHljR*tq#f92YTqp`1L>&Nj`*KtmCyR8YTs{7a zj0n$xKQFcT67jzi)|4)Kt2WmI4CUq9;a-G@U5vU;t-g1KR`Z8ih>< zs>Q$wzzRl&b)FyDn~~BjfS?)Ipt;Qo!*(yb{?DfoIv_r+wZPQy5=pT$<_t@bZt+C3(#b~j9Zv#PZ{AaOv1LU>L)4r$~G8r zE{ue)&nGCIN<3Fnm&9E>{62#!vJ z_S@?&1aQzFBXP?w%9kiDe_8UMn9UebF&OX|MAs2Z?@_!xK)e zZ3+pPe;Eu2kuY&yU_QaHAiVx5KuFI5xDpxuYh`QW0)_T=;H4vjx zDohEdo(P)4BmS-)fhtYFD*+sf+R2+WKpr&FG>tVz4M}eP{MiBY&$fx#7OXD`FGou) zWWe|K=j&Yt+D*Sc|J-v4KXLHGXS!vqHy8T&Dz)tfbK}iSp~621mpX;t`qKIafF|Ui z>hbeys^75`z-83|2c%hKbo<*V)I}=oMlr*)TtJoxl_X={xnav?oSV8C{i+fWrrNr= zZ)zk94QteDTrA41Kb=8}s8EFa0aVaCP`ERTl>7lcip-Tz-M_g5#3!Y;aFX)+CqmtC zbSCnpW=GBQgz#2xakg&$`U@ENo($<&jqlG$gFcjW6ynt@T3R=0#iHx)DObdeRcl^- zKl5YoNZ~0bTarp`{u_qAAB|_H4-=d*z8-s6&=r19!A*QRx-DC4uJv>9VMMrRNit*a z5x!7V0dk*iEPc7m?D9U~M&q#DkVel={#X4{V6!R~t))iYt%~HbFqV|H=!ko5y~Siv z8QZB{8}CvmA(2Syx%DeI))7N=Jtbg0@to5BfI`Y!QGQN);d%#Qqmy-h7oG1x@Xflp zzfz9uXCHNFZ(sl5si ze|yZke7KUMnJ4oEwx`5h0bN(^t6}c=cKWIro0C=q4%p(2f4117;iPOUlBZKd{$+Kz zi0<2E+|d&_wV?voB6Naw&nCyt7Ci5FrO{7KyDL{NC}qnG+9s?83ui2!JbH;%NfoCB zZY71SK&i^6!j^t67qDEArol!2J3X$?K;b0=46NJ1NTR(^C1gdZZjBMW^)cb^J!QYQ z{H^j|7U*;li7;G>XTGfopMq;@EO~ktDY7LAJ~0x1~+$0h@t^~WmcFnlbxzSaNrti7N4qE+$=SUb>WD81F03#~zM)#%x- zIiRrVV?YzkNjW1C4(lwG|3H}}HdunVTPd%JpYftw%%bJ&J7aQrbEy_sWi?WqKK7;Q&{y;F^Ns$)bQnA? z?4|MZ)Zj%ugr@;hdD|js4W48qK0JTL>XbLT`GW~2%&ZHgTJ(vFV#$E< z@&?tZbk5N#@l;YOrR#QV)cukLfa9ClN-N1*>@0p{l1uT!K9-~>667WHZ`ES(&j2h zY4G~k$#C*AHS_M3d(6e$Q>N+X?UcSLqQx7$9;bXd-?CNsWAEyqan1OYx3prn$HBMr z-;;(y>o5!h&L3^;&&Vj&>9g$AMWZdPpUeTLYdNB)p`oEgp&PX5 z)YGN0e&Df52VrC4Q(2_D;ophGOM|>dPoS9b6UrS-Wv>4`o)~Ve>p~>=buoZYXw`kb zfdQR%*%!jjZSOl1UbaR{>YkTO-=X%V(ibuEh++O^wet5etb7pca`3N=B}|BMH`ViM zznY5DMkL#IA(4WxKDw)gmHdCrjW=xe@+z32&Z2c(5%$Zflncq>vs z-G4Y*%*TBuG0;FH9qTzDkwbTH-3E~aBHvfS-k0H#dcTqJ7Q4l;NCGJU|?MUM5k^>RfuYf%!%gp7uppY8|eHyi`&0%3Z9h5-kqfbCEl zv>by{#TNr`&<>eQD_efYdu+V7YnkUyU73n0^!)L)B^Ouk)))+)25=TzMv{N87A9Ahec=N07{jfv-KYih#wNcWZkbf8x)`4&q-o^b)VX<@=iWynbG z4?Ur0D*`T9#v}{aCOmWOyszQJ)mM4FWQiMSjTOtzJjfLQag^u>P+1_*u zq476}4?Oiu84?d0 zhp9t8*K~7fWBE;g%)BjJr6(kzYFx~k`}24wLnO?S!tHZ?o2otg$9owAA>V%;9%J#^ zr9QqJE~zad(`>J{9A~DfXBk;)AG9H;RQ@bnYsfb|e)^b^)9s~Fwtz|24a;3h%91Q7 z{0X(^u4fSBY#gnywJ9fQJ1IQlCK0dqd!zep^vaFWhHPacyxwoRER>g3$y+Av(PC zRt=X@)eF{vene75!sf9s`^H^5=9?+hAX*S+s~x_}KG~0T-AUPtqTJ(j#nI1NnRr{f zY<)u{ZihtkPuvd3%;hY1o=14OoeSi^GbFdYRDMS4oo?qqzNt6yR{%%RL3_w7k>2}Q z%JzJDGDAU*l?Nrx_w%Z1sH!2+N0)$I>_%~^?$DI&uSvSQq`O@H$88kG{B4pglrD5M z5r0fl*?>nmMhU{eXpot9lSGJ7DD*vYymCg}e09L*xtQT@toYJvztcGk1306B9?5tCD@IeNcQ!nl=gyxf+nQg z{kuxv0`)28Sn|A(?s$Y6^P0dtsOB=aEC9E0z%U5mHjYgsM$?<*1sZsFN+*nV?W4ow zmQ2s+1)S@hlD|`@@KhgyI--jEdz+^cEUfcnh@)beB8tE-kZ0&y3rvpC1foiS_Co4~ zgqOs9v9G*>Nhb!#!_2LX5$g}T8X}tIrCR6t<692lHjFYi{vZJ<5<^P`z$qSfXYmkp z`5x_)ZU1~Z&-@KwX8_QCfTn{uoNXRW%61@k43sJ}=)-+$hpmYgakBw5xY-o+#29{M zo;5X})9LMjj_92mk9+by2adM>Nfrs@k@S8>Na!oOhWW>yKF~7D(!VtruE;UdM|V6TlKzHqWDso(`DWTs7Iah#KVwgl$=?3bTtJ7*NFZTmuD+}#(7yD89F&uazEr&? z1Uf`d)}-uXVf5hl2U86uVLs#xS9w7GR>zhXA+#2V!-WI7xB;1KMCOSy4;=hS6v|!p?a8-ncLK{iu zl>06-%17Fjca^hBy(O{!0wliROT;*@_P&C6cJx(O%NTROW}2}vh@|hF<*$~0ixV@F z@UpLShah}dKV=Z4kbYa*=QA!)+W;Ag&Dw}aTEDTg7=QYjzJ^&7O8@FQ1dvv<84+9x zoj^Zgl$=uZA)e3=R2`>=Ij1*u16XW}zx}@H&g;9!*(02)>_^}^uzX_^_bXd)i4#}I~@C+W%Jz9PRd=3~=Cau&%3i|L-^6U12VkxKpx zjFBRx6Gi<1Wj?p#<7S=5Hu8BlfV=G+OncRRz=pduaCEqL3tMbyChXoev0{pdTbs4o z3Hkd{yeM<^;QWe#h%4qPMhB-J4a7QWHQ>nvYL&iW+=AKI6bNV`pI5G*D}npVfOZfw zIV)GCc|kD3Qs7(ayc+!B1@CQ<7z7{RV$*<^#U%FH2BO$$IRnbrPdEX~0N5m^( zH7+;yAO`iGIdX9KiR{|}Vu`(+lW)L8D!yl2 zDQOy9)nea1k|qB9ARSxo_0e-;@6^^-YWLxN#i|=E{Ep4~r`7Uj*wx9NgtIx!)Ep#vAF<=KXYvGpc&O+9uaT5wWQ&)qCDy)A(-9 z-K+U5ecD~I>cfV&vyLuRZfK2$$9QrMZ%O#JbI^$9t<}0lS#hmfVj+Ua97^zrO_SlJFogcWHW%u$!+{vL%8{ zWl;I+%1Q(z@;J@hR3hmD6#8803siuU()wgG{6L{PNy6^|q&0wWU~!*GuOQYxpl2Jl z#VmVAG8AY4VIfneybt}KzD32Oyr<*;YG+MSzq>6`Au(@fBvFgktfRo&mpzx|Llj3K zb(mRQ#V_5yK7J+6GZTEa*^0$^PPmCsRgem`f&<2Uybm5ZxLTfzhJmZx{7J$Dq{mgIOVTvST9Q<1Qwk{Lh4uL^YnnC8YzmG5!5Qq(v-Gs7TT%pAgk+-w!( zGVEsMqG;t8rnG-%G+vS_6fD?QF1ZWoOwgPbmBV+1jG>dGGHM{Ip!Ko@LOElz zK$DY*X9d+bcDSDU<=rYto~&Ax))XO!lBS%Kk1>(NT~bs1A7zzMwB(KIpeJkDpttB)e({Tt$TS*tVcpF!6u*CD{pPE#7vdNX3;c*w z7U(+?i+>Ufoqe}dc_Th>yy-)pxz~T$1XGi%O9%C>HT4lf?4Ft$0U+luRGN&p>4&by zV%jf=H3tOKI=fAYS{1Yqqlsr?DXYxO6k9M?Kd_cyrM-zOq<79WX5_>vXRhWMz0dzx zPfM&cpN)6*nN9rk5TqWa^+TF^pCh4eHoILr(}Lp=_k&{NM-K`2^0TCjeyfSAhY7rC zJF?+%L%#!=&+-=5?b%{OC$H(n7G{smY#l3cwqQaX`1*G*vmN>u<5#Y$Ivp&n-s1iq ztyDxie{+m|SdM0HA4Cjo^P@Bc^~hLPTD~nu35R^s3(px&!Y~eKoUM5^;PhF^1Q5{xbccXV8l;d4&n_~2?TCs3Q5$rLk_lFoOWpz; zqgSAIka3uXEwiX%U9&2nm-tFhe>RY@8sFyj=L>+`xyFzm(>@?xmaDTK0eG);^%O$C%gX(tBq_qULA@TDBka5_`in)#kNA<~FbX zX>1A;V7!dG)~oBH+LF-JTYt9LXDXer;0iE}HV)gBb(yM!CaKmC zBtF%1cIhE}@kJO19cv+567s5|>-4W#)|*dWFKvcx6cbN0_;{1N_g);){9Z?@r!07D zy#3!ff3Os-Am}*BE!#u-E)p$_gJC<*7&)M` zc9sMijR{+VOnKRy`y?hgsIQ)Rd}d+&)g>dpqa6z9fVAOCY)f`L+uGV9X?DSFg(0|s z+?&az^GadLPuT-zJECxLs|RZ9fkl$@#U=8h+p;Do_1ubn30fOv`z!-cd$Cv{S+wPn}g z>kIBYqY)8|(f8%jdjt`muMCio2aea58O*$k$y7*gJa4o8g)?vHnv$vIWbPMrrIK7_ zhk$`ceM-igTB`xEJ#0&vStNgJd_;w0;PAx_fR4VkugCnQ%CN3+v?I zZdG<|&qPOP9DC*%9{EHr`^cTUs1{|X@d5)O=(L{(^@X6UtgMkGCzz*^mJ;~-EvRAf zn|IRRbeyOT0L*bWds#8A?-_}X z(7m;qtb;CO;q=hd6dh9iH`BVqNNt0wSI?AAIH=g@_3e-M(=%&hNNx64Pwq;P6a&g^o^cmM->#8h<0EG-^MRnl1SQNQB)-j>$A&P(kEaiP5j-Zl zjJ|Uw3DiVRQ@Oxu$Uq@I$oPTXSUI}FcICpEDd@*RqwcJ|hXNl?EC>Q7JWK7|zV})G z5`!|wX9|~H`s#ST)z{GUhMrn~*+m&&`X5dR)SN5-W2ZA@v63xxe*%jQI`ENOnN6rb zd3t8KD!7MU8cASg4ddUs7M){tTGM&B=l!50jC0m;sPnzAg`b=Mx-0*+z&-GP^`#!X z1iZ`4xek|BS&3Qu@`oQM{_Nu#^2QA-R=TZ2ul(a=e&N0M*MZ2KlexE<-`>BT-`d(~ zo-fh*@%6K{oCFWauq0#b+(J|g3@DW`7 ze`|&j+ncjfekbioQgXp^W{ISFAMY=_5$#;BNzi5oZJ|5Eu_r$rt84wlAN=xzp>zDE zmNP?rKe=ue&;~|~yD_e2;9t*BTMfua*?fpq6^o)fGT_u&MM6{cRUv51SplVIF3EhTKT3tOlrwq zE%1}(`ddL}o(T=Ax;1Iikx|^g_i(*o&cx0C?qSKMiM9xb`xYQTLs0o*P{P*fxn13b~xI0CYH7CS|67s~6->LM^+(zkrCS zEPtuF0bpF99ZH3WSD5({mm(SRlBhwYUA5O1s{)O*Bh4p4S?11BNKXmhDyjQHB~CMO z!YuUAJjMg~z-DE} zNiW2tnJ30{Ascw{ax@iv6MU?MG?)M9;2~j>e6#>r?Og_WXLIY|HAkzp62N4X zsL+dvvgTE8HwANd-MTR59X-$g?Yoqd@)k#uPRuKx3cyx1_w=Z2KQ}T1I!#LGz+Rkyw^xwSfbAMx1+ zt&-PC=A#;O_Fl7bqpFzS8BPeiD%Pfk=1lI6?xU#z3RF*D>Xdk7$}MW}1I!zCB1`;? z*9Us~8a?aV4l8R@b~{ULW@=@kn*^8|e7zqPjwKWG1$JD+1 z6TVYRd%YKKif&Pd**--}xqMz+&-OS<$EsRSuws`J_dOCyZ{7JherZ;D`JY&V|K1Gq=y z$A_~iGNtcakM`Y~k4b5Uo;*1GA+PvCxJ2~9q3$Z27wy&WSXG6)rZ3PAHES8xo8uJN zzYgjm0}YIS#g|4hOJX8Fgi_em=RKvI9zD?$wo6;F9qmyW9`0&ArxRlS;n_zTnm2u< z6CoT%mTL@{zmm7lG#9*`m&ryHM*`-Ax$~{gMhvglZAIz_HD5;k0Ld>r=4t_h)KAts zLb8{IpW~_Du)=l#+(u@QM0T0`ZbB_!gtEykL3ZSIMv$fxb!@5HG$1fvU&nuMR$a(M zAaH;Cqx^Dwpn*#86j2O}bXSnI;~SU7bX00Gz^by+0lNR(xFZjFmOISECWvm5U_S8+ z($cn@Z!(R$PPfqvYKr57&Gf#KXCLe$Ev9Jbr0LcR*^Q*3aJE!`MoHoFlpkpJR~vGp|T)b)l4?gaQHL$z7Ah) z1xC-C<2kjBpTkRE_>1lmk@2aIO$>ArmWsHfLq&|~@|dMo`;}C88M8KDu?zK{o(~U2 zi|bx-vP)pw*zOqeaFpsV=QA;WDZ;3j+lzZN_J03%$x%OX=QyC-fPk6j)Q!*i9pE`K&Z2WBe*;0Lyi+fRf3(v1)s@8q` zie3rj*Hx3H2|s=oM3iRxQF%Gd)@{n17j~^BesW!@IX8h?h>%=A(BRu#x0JBqVOhF% zbNdtg?$AHr01|u%%#qN<~eEO2P(y(Q2xrd&SfKwfORG z00^tRifxTXI|v4~j;TmW`g?~+LEk&K6Uh35*Tm_k+r^{YA;?W^kDxG+tKT@+bzT*+ z`ELj7JbtMnjz>qMcT@EoO-d;yYR4WqvsTMB7bK1O~37c(+0E1E^SCgaSBQ2kiXbNqkBK-(zLud&%a2&dmxs5_s2+7|t^mYUW zxr2X?2flYVV3o{4BrgC}6)NPjYiA7@pHk^Z9)~=w(!9rOI2643+{4c)Je@dUuH&Qz zOh2+fQ&@i>I1x0FIvXJjBu~M!IdQ|nruZcU$F%(f5putTaCL4WF`iFe+(>AVs)NDl zW1s%OnSOTVg(oruy3B#?;=;Ok*L|i<>}hasOBfBteC7)MioqDCCiE=%1b-Us zyQ|L{O}Il&t6TnLo#k{Dzt8&Tuu!6eS)(YAI<-B|1_+UTIiuqgq0L99XMkpjv*2V- z#s4x(h|2fBX%(v$#(+Dx$lAVg&Y5!E-;~3B>qBI$pvTpmF9#J?N)e*~153$G;pEV+yigzrSS^dzXXz@|Z=O&+yHN`e}0OhX#}J zvj!HXQ?a=tkr75Yj$0j{f={pRedWg zK7Le;Ij#wUZDj!kxkeYO?NbKZZ9Zycy?5O1^ATvcgz8l+PZVCkEt{_VqN-}~KEKz+ zdsy1Slrk(velon^TYZuko^oqU!QRrNyCZ!Y25|1h}UsIA(io1GMy+u#ON?npbv z@%oX7_dU(ocVqFenAMkG#ESc|D5ku6eRX7BZ@Bs0r)FH?gewo$outSnS~y*29iv1# zpBOQ3%p*AKw>E>E76RJq6=_2wLIv7AyN*;Vc#y}aKM5Q(oCw5uRR0O`qMVcB>#u2t z*oqe(3p~$Oe`Vvi;^8#x`BK!2@#x^Ej?ah)$@js}MaIU^gRs3lRYEbrSXkyuSuRub z$>iu=!%J`-ulH7a{<;pK6A?Y3f3Cv>aUCDX9V!Igr(L0=o~SN8o%|jWee@NM8u!&C zx6(V6(~HZpjI4L6waJG+C#_f*)A_9EjNugeiq^H7@wM4jcN<-^U&?`b$lYdq+^)}Q z$I2n(bK^myPVW*Vh)2;}HDj76i)!^Cc9J{g7x$8QqBd7Yt;I>8AKc&IR6@h`&f6lP zI>-Afd@QxWO~*WO@hA^#ne)ff&8M3&2?}YIp0cYel%X|%%ZhbD7u6!vejp|NL4n90 zx%g047n0!yy4eH_s(w2KwUZO<6?Uh65gB>6CQAbD+15-M|B!}!?xO1N6$uEH^S`qhI+$wrWC2|lwkXIPXwX;ntH)-e zn=)0R)<^F6?&H2$=9{*6p>$94(qQ;^=`KSuV z4yCkw>PE7wO3}8aaD<pK~ybuF8-VknPI}d`dCIPdC}X&G+)?j_#le$HzOm+@@zZ zE-}TNLZiYY6`&s8J;6&nbf?%IGwU2d@~dgb3mKZil>8rs&L+*8_)#7-gNpL4gNu=0 zpUuu*t+o}-W_wqX&Ga|{HCW#zjyHTeQ0e&(QK_b>1vk0^bUxAKJlz|UIO8(6aY$E_P)sBR+suF;y5W9FBViI+>Tx4x^OcfUPV|pu|*&c zP^hH3b%WXh43%OqI8yd_{az*c1S9_PBQ9rGsFdfs&gheFRa5}DlHxO2iDRM4MKGaKtB8{C#9L zN}98FM;?G3ey1BxM7oPJu4!a+JZ7u#DbV_A=sNZ)*|M`1ZOmE3_wHqkXBU6c!@ckR z{+F8z9%gSdVi0d!4A_7btIpwmiBg~s`eQZr*nYw{uK)Wipjxh-F{&OQ)k#jGZ7T;Q zUhUzoL~gx-^mZsID0Kng1}j4o+peb&L{CfY#|4w~#&&j?2y4D3#Z*l_7*B$DRv?f| z%XHKRrg>=NYU)=Eq%~p`(BQpctDjdC@a((+8+A5E6fc#&GY)saj82OOML@r4H2? zxza={_OOBZgtt1Xoi$T_@wRLp*=^4!^EkAw@wr<$fAm^Arjl+h@Y}s+u$qj5>SoV_ zI|YjLqUhgY^!UbMMG5y`ceCM&DMjUJKT<3O;KcO&!LivuN%9OsY}<->-L~fdEV|+_ zp{p0xUcsRLO25#hWrqP^ftsU-#|P^gz;xab1zA#-ruO#$lFWqabobQYBd%ti!fe$T z#$cre$0>0R-C~ope58{Io$nGNEL*su=Uw<#EMg;bsg^h1l$C)=M?EkKD! zsVN?;^013fEMyeuNwL+OsBs9NWBpyTXn%Z+ z$S!-QjbM~?yrh#{73oCnJ3p6>`+5TNm$PC9=6TuZ+zja*skNP!CP>nzhs2oP(PKC= zNJ8MYjareyoK*g6m+Ovk0!+UzX8HhZd3xc~eAqV`LW1XXu$Ae=?_14b{NRwy9uxE2 zko?+S#%)tz+-L+)w!FY{g(0JU@A(f@0jci6xD@2rW~Ped#HdJpl$(>Bw$?XF_1&&9F?<;^Jd-~z_*)eLin>0IMpc5wXEuRSONsZx`I;`%rV&AAR^ys%2 z^G7iP%#5J!_~@r`fJp^F1waCvOwJ1G7aF;rSFj4MKRM4q#G5}QO@pfghzF$pfkL4a zKsNMg>al#kXM}9E6YIg;Vitumj zTVb!pAL#^OhDRj6-Vb&T~gNCGhx)-$zR3VBZnN8YHg7 zX}G^vDygv2Ddma#V-1{=1wc}U*rD~8fTSH$x6uwDyw66)sj23?(352rnU#*_?b zOS}dzw)_MJgNWQe=lJIV>vGCOVY^j{JwKI%vaR%%DmIZI){b&ZQ2gr`iIPusd?R}6 zH!8BuKuC(XlF3iT`DnywJW0Us)aMB4QV?(4#5@)+dNn8ico^5>lR_;FCL?p*x%s^EtS76s-wv{gCtD!`WG$$9kI8IWFQ z{trVj!?*4#(d(dutyK;>p6Kp}t}NAZdLR|7{R7^W6`JHaeQVd6?6}98{t>O%J%_D|*UE{#>V!wXZ%-!FizjlT z8dT&;nBtQDfd+Jo%-S)3cliEeSOD=M)BHkJ5+}CW%;}-5w~6s=VBY~3nIxO-pQT&8 zV;>$@Tv6TrdXM#&P%<1%0zni$X496S&5aouEy1=L2-qA!izeOypX|4&5!z#xQ zu{!j$^jf=(?v@+L@LiF=?wO)D0UXl^<+W09$CFuQPaO&e}K;C8dgB>)* zp$uV_^!O4~FejB@l^j>8h9ds0QX;HU!?;I&jU%xW3$jW=2Tv=I^aO^cz$)pISROM^ zAN&nh*H1!5G5_5kRG5Wlj9NqRHNfhBa;AjMORQ5(VJb6C>+^+-@ zD0X86E2URm=gWT}X;Rx`s!#8V0HBV^z&innYo8zJ3Ei zA7UW~Lo!DQurxqzb4L_Jf-J%)w8bluVM19h-Q-#P^UQ$Hj{)`*hcjB{|krb`gF9OynO zsU-^Zzl<0SQHIYbHu6_&H%uriiD+0VU=l_CaR*PFB&-EP|1M-*qJLh%F!W2gU=BhI z^w&qP(8KI>0h`!66@x>Ou2gs~mq~ja%D#yl_phL7^*jmvB-U)lHjn@(F#Qt7MSAFy$)^XSWsF_c6u$d|L;m5c}GEv%?UxPh7+}>{$qJ4 z9TH(zQ%A@K36|nB6DEPj#8*lB@Xr(!PC+)lu?}W1W6_eM?;+};!>My3nzPTaUTUL>bmp2Q6bh6#9yapqmIiW#zD z%o?v19JVY_#Mt2Xsne$g|MUCU%erlGZsw!R(<+GHe=})v`>*q&HzS;WCTh0LWH9p< z^&!Im4tN!vp6l-;40CfQLRfCkt6&m6{Ck8c8}C#G{__QalDg;W=s~BBKhq3DxeUg8 zY@>PenbDr%zoW4oQr`q+2=39CrefqjWRrDS(LpS5R9a(sxBe6~=rK;1n=aM-4nJ?B z%HdQQtS?gx{l0YTf{_zAK$3qJ?aB8ygs5*+8G8Kp(-~<3iqCsOdZUO)$HBCX1h`q0 zkXv*hQ<)f647(#5pE02Sk2TB0v2P*yfjg$D0Qrwy_p%4fgc``>J*D{sVfLS$5oUrf zbD4jeEntJ?)W_9cv4d~R6)VI?51VHUgq8nO2nS0!Q}94n^&ndqZE?J?_FQ@1kt}p5s#PqR#)%e<56KA*Iin`zO&cy(Q)@> zF5d!|5yy(`$)7@~lOlaSs)`raf*u~~7Ob&|T-i0nB!ly9C#R-(xdHSuJS zy?RbH7^NTy2C5x5E%bNaVIg7WmPcIqMeZbI*@WpK*gwsVB$S~WU@uQLZhtrv!iab| zBG$71zOovsTD+4E6YZJcPdHKTPB#qz$psO6_AZMvN$k zyNB*9>RtTzq5cx^cf~C>ayu@x=V^HJ`g982v+&3p$VKW&a@VT?p54HBO>8LT-=z_E zYWQq@nXxX{3B3vVct$(v#J+rES^V!d2MuJ3Hl#4ii*+_uvJH8Uwl(9*$iFXDXi~H$tj=;qmt_C#I2DL}v#33sSGH04&~-OMxp-%`Q% zg(pb$PPX?&_NReE>J1Vd{r)LtBYd$Vbx?jEeuI4#!>5GDC1YCfo9Odc| z1+zz30HvSHNyTp-4au{YOa&~K6B3_fSy3Wwo&Yo?dI8rGRdD}z_5L}G4^-*dR~|k% z7j{a4{wZ3Rcsv6ewvy^f8Di1_*pf|Obf3T>>+iC|LpYu=qnzG+O3`-l(nmxm`0&-cjh^4S$9H z^BZXPw%M+9gva=^PAfT4i+NuOqvc8vy}zvhYOIBE3V;#$mQpp9@H^IiAqL<0G2Rh; zq^Kh7iR!@J(T3~D@m;wzl=$!XruygYNUax%*(zW*$Th`}kn^NZ4^{2QRj?o%u|YrW zkbfPH{x;@&dWaq619H1#`wvEU8w$DY} zayKP>cJraBcS()L8?ozdw_QcNcchr|t{D7d-zc@@-Jc`E zJiUrCEI8-w^95Qn8!VV>ZIxEISXB+5U*&TlTM%^a&k=6TqSM7e|H4GvVtS&k{C{U8 z6&zkH)HZ~uKqd`gO+vq%3s}eK&y#>meh-x+u9JhQlW%2x;&A{P9&5Ymxse86RR&^N zHqcv3gqBPv9CALW2qjiK&yKYPn?ND1Hx@*8;};O#RCC0*FB!cK)c~^Q#lMKR;67zIX)!WzcQhIyYbuy>yGniIZyacP zvuSYO1Hv`BX&f=gWyw>KCf&Z2!&RLK<17bQUpq~H~2 zx*bT*qP(uU5T0iOTX)fY$WREYS}>SfBrx6h2#1Wb69Ada0AL$R13teJfQ>AG+N&+G zB?AhQ7EmZ8X1b17CX{;g6e$jj{eVHJzpldBIXXPsG=DY%e%aj8-ud?kN@7aUPuuuj z#O|VkJE{pEBh;QvC6$FuHPwwIj@;o3rWp!3ZW}Ux9R2=GRGD*{h!@klR)l^<6&OKF07F^0+K7gE@lXo-3Z34)QoPKu$ z4RqIo$&9O^DXrT87HQE=@pTy9KU+ka5|04sp@&18`r;r0*1%mUcdXw@$k#2AZaPa4 zII-Sva8qpdw6rm;AWSLBF{~*q#eRHc8dC^nVaKO>&pa|lLh7QosZZE28d;EY~*|3u)viRkIM%l<@Gs3O1-xp!!pxiS&P4avt{KXPn7H#U>8e zhm;J{KOXk?e}gU{K>#EdN}yz7hZBTNmho|UFpq1-7Ls|pmXn{2CyH<%J(bf5wbUul z&y>v(8GyMlEKuZKCL1z=%p~t+PoP1lF+}b8ak`CFcB2{HK^?|^M=X$zmW4Dk@-Aa} zEcDVUM$-p)yE9kUgEcaPP-Ac_=NeFSSs;F2rll(mjkxCoGrHoS7TN`Mbryh^b)PdV z*G00p;-}*oa=1I*Anl--Dqim$GH6s@0H=BLJzwME;_|_`W208aEO?l1p{e_KAf-7$ zObCgvRWOflfq#Aa$0Ue&wg~w2oCwwO9)Lz*c0I+VF zrQb#RxF<1x zSi@ajkYK|Q6fCD-4U@(dK}h0sW*)$lxb;e9Gn0j#GjN1(9Uxw3hsQ)eT?1>41+5Y| zy5Yp%q@U%bR6aQ9VoU7=4oZ0yaj&!_u5uYjLTDdD{X<*Z{)fxXvX-rHLD=K7*q(G^ z-mmiyTXKtTJ`|Mchp|DLuJ@WTIb|D)i*3n?W%3Vz$AJ^nO^63`QMy@ajTM@Z2@6tS6MI?5PR$mVfgRG%rG7o;)f4dQqPbPa(k;)Q|3tVS~s_q`id1jWG>o8|EzKW zhFPJA-!PuS9091dG9Y5K9&B93bueWae*Vy@(s8Om&>9(_24qKVH~kW`U<6Gv^evKm z!sdNFxV{9?%GR5$^`-V?FuIX2_++U!S ztbVB*1~2Z;3!&M;oHidJ89)@0Bz73xO_qW9YCJmjj>v!a++9>)nfN02xqVo&I#xmr zi1gB?cLn6d|720RkTB<|JH0o?fu({Nw1BnQ@xRv+V}t8rweAgnm%$)ghFs!9mPC%f ztG=2Xpa;_MIZvlgPlMV|*H;WK_f6c~>D|8twD@^AQ^;MY2Wkz#w^j@@T`lMnA)ctT z`Y6q+lJq*LhH&vr`_dJuFx-g7F&DnCeEQ`Ipw7wycUq+)Xq7r!cvV53EO>nXhcR;Z zJ5H6&F;Dj)Pr5L9cl@C;Jn1y?o%{cNTMv|Ut@t9ZaY&rM1hFSc36Ccfv7;K#S3XCM zy&=h;drCkeB=&!iF%rl8{@I`eS8~OJ48{yTH3#y9+{3{U=+$+>33v@qyl%Lmya+%} z<^G+v(Da~E&vUuc?HLCe1zT(`>%DR{e(Skyp;X4itV%@<_4OW+bb3r&iMug0H4?Gi zg9qL|Zh8`DVc3)?7p`SRH0W|F)%Rs}k2`j_6Gj*jg@HdH$`Kk(fWgW5fd&)TL2nMf zxq1!=^)}y=Syj$Mz@elol)8uHMSol^Mu5<5I=qLRmz0S&6fqq+E9G86|7N_hk();5e@DsOdUR6}e^i z(=Ko7biS%bZa*FWn&i~_oz~4}mxUoO4$VW?uIS8aOs9i)dV6~vIZggmKhzEqdmi01s0GJ}-v6aWKqE{KAwpT#aLhC^ z_-g<-K4j}4fJA)R@<#F%&t^=HHWVQN}8ht(U$7R4a#Gk$wpat6eD)R*qjVTDgO%|hL{TZC`qI!s@c!t)L$hqBh0 z$0@}6qgdT+wz~lVhu_84CXR0n6;Lw1tvoTIV_u(U=hL#mkNs@DbrxrfJnExNcvtFz zN8U0XUNy7xZ01HnZr5JfHH)v$q5?Hj$yarhLT<rA#fz;_z#b zWGkJ(nz0n7wE+($Nwq?}aKY;2C@I$8*B3x~!gaKcoqjrqEqEd9ykAwI^N?QgA?qNb zQnvqG@a90wWCQ8A>EV)+FZmH zw={0Ur)lb5G z{=4;0ej2p@J;guXKLl;_1$qfjI%GM&n8_JJ1Ko1WV z2R0liw5bssvwS+*<)(53&&gVukiPNwVsRUFKBWl=1P$|g9_vzYkE0c7xAQp{RTXP% zF>Pz-2LmuQ^n&Uhl$2_hKEmf2Z3dHVOT!01?J6M3rQlt!eo#jWV0d0M|

      LEjBj7pG`e4wJl(gguOXW&VZPeg z6ib%iwyhQ|TQ6g*m_~AK?YmNKU!Bl%mq~IA%rg2yel)IS>n2jjsLJDE8R{ui_C9iJ zc_7Sx^bvQ|m7}!TP4cmDljUi-u~&74+|I}=?!KCjWq$Lz=Xb#`McO#H7Ck??f-@uB z)vFg0NRFU@24hpZT?%Cxog7!)E}8l=Lsp`gPmYy90CtK-T|jC9CM?^(?Plhy2}-pc zNP1UUwzobpDzJ4X3SIs^56Gdc_le)aY5F%W|2uh#P-`?P9AhI4z*_)8%%G_fhXMVO zWhN@v(j&hJqE9cve0EuO>^7Xd1|Fe2DfKaM21bOkznx}h*t=#>osKJh*u4J%7soiW z0o}@ax=$RlP95sm6VWAbQU3wMXVk37smsQekXir{TGTwxP*GsOb?f5Mjdv_L8|DhK zzhdS0OLO8ubtbs0WPvW*Xu!0#>Z(aSO$ab@(s+i(LjyMTHINs)w*pDzm@SL=czPyi zR3uZeQG_kCZ0l;I3My7L8OCiMff^q;fU3bBaR!hI3t<3r35ShDaLt3b4! z0^1C@eIAXB7xw=wwR0yvT!h<`VZ4PR1t>z=KxDjoE-N%C5Lt%@RZupTK0D2yTCfoC zZV%`z(~-X24!AkTf@M7aWDQ%=Pb;8Zv`BCm*pFUX%+{3Rm9)t)Bh`SzS#c_1#)R1c z%=r(6nw%z^XQ0XL4`|5M03{GI4tuk_G?N{<@D#;nfS};f8u_Ax^22ckzVFguhkl2W zIj!px5Rx9?u<2(=@iX=>{^AWNg#%G>McJs`K_lQkXukcew2H@jyK#dPzwp&F= zaK1eO9y2P5A7kt|7^K0?(%?^rF5EThSha5LWg#DyzeYtfN%BgkQ3ngu_{hnpPtt{Y zTUrs!yC}#<`fW|X?M4`csxvEPHj&eXJ;!~Z^l^(7roNZFSO9Se(_CaHxHAWm*@%C7HbuZACNm;`l%FkL2 zgbOCxDT5&MN#}^7)wET$0OXLJoBk}6S{*xc)x>D92gytUA)w{#Ycv%ha7>cLMh|4hys(6Fs{SmbCI)Bx$J{Dux2KKmA8 zHk3Y1k00E~6^$Fi(bPQ_zr7;`#LIBKj(87F$1Qo#+zmHo{=cjKLNox{NFW&7qq#-| zQCng9(hx-DMpR^<5Cw48|CWjRM|1=OJetlfoc#9 zvtmg11ES+Kfel^_o==$DiY4x={USUEtMPi8{$NkaLCV)O4#S^=n?eu}5dP#Uzp^4> zq-`Zhcz}i?ftD0VCvGB9epQRq@}VQ@p^}sk5rL+q*j3=s%mVuXJw*z~L(yC+ItCwl#n=bt$^P>!cC5y}^wCta#vf`)O}hj+93 zE`Ttcv9IdK1zQ%mQU(PY4=s3#Y`|SK#z{2{#ek~Ux)s9db$3%+XMg|++v$o*d)DY) zX5IC6V-`d?{R`hcz`RutI9-rU56JxROcpi|wGr_L^1)jK6DA~s2Zt(OUOxyM)>%U*kX=onsD*o*Pjc%*S+Ay=zC(>-2z58vh_ zFcuehfI7cqn6>`zQMh~8GWT*9+}?XN3AlU=vd8|4EC9$)ACxqQcty6V02;tFmXg_{+>@t=#7!b6b<0Nj_?pra8IC`CZ6lCsl@W?K#p&(f2fDP@g1&QMbW zUkr#h1K>j=iqh<28IUT0Pp$%YdI_Blx+m^-1_PH&OC^+X>j5k^3t$+?mmf_AYKZ0D z7pP=FX38+{b)L%Ei$dW^2`=dBulh=PLh5+S;UFDK&27K&JVu!07N17uS?nvM=CzR% zo<(db_JG=ME&hx7Ca)QZko@)w&_^!ty5_C3YwY{Gzem@*(`M;eGGAE~GY_h34Ng(r zu1+$thM-XUwOm8|_0?t;@}90ReU zd8B^`A1)pq>?fBwExXn_8l-F2-UQ>alxJ~4eteF#WCm?qP6?e+W>QGilGueYw;t>H zJH4t~^shgxmi1f>InM&2m z8;s>TzEJadlFMck*14-0o)-hUwVsC`K@ZY

      f11E@VxsQ5IYAsmW>vTjGx4rAN_c ziHiv?1J_nt%k^=KXhw18TurM;^mOiHtL5LVHoQk&_NQsgVg{LEFSlxk)yrRA&6KYE zo$EU~Zouli$I$H|WP*^OJpG;nzdhVow2}3>sZ|(b)4fs26FP$AkZ-sIaagH8<+}1{ zj$xdTU-~6Yf9*V=+FX5oUPL6|Ak*YWLArD(!F7+dRdzux2yQu;6oZU3hByZ?3su6t zh+C#XK(W!w(tNXovj+TMF?58!Z{1IDpf+u-tYPVP-56NQ&S4^Us5U_6-iu8^G-K2+ zU^ULjYqu0I+w7yq>f9mlczFh3idxG{2;8#zBaq}a9{pf5vNLe7Cg_(F9r}OZf;F^g zBP@G+i3Qhw1B^v4z{QY*u?FJ4!$Z43hhGtF@*$x!j~kZJf{6!EqUfcL(0o?tBdk1! zmo*)QWJEsO$sE8~zzD>{sv1jGk)T^nqul3kDR5y8%Q|E^QWu!=vp^Hr(dN%|dIsI` zkj}@h%WxVp*eelFZ4nF%y&4!H3MuF<$y>8ZAk$YBjyOSKvp^DBfg0qYL~Q9Wpm(VOcGDi!Puis*FV4%-r>38EJdfmFSK>3a-Vd1Mss#TKL+HtaH? zmE1njbY_46jv<(=_9rTX6`2Y^Rpq$o+ZQ?cYmfZt0U9_gazl%dP6h6o5U`t&%vBA+ zq*MPM&L7NU7xlHA#U=A`Qi6-6M>R`tk=)nS6a!3v+8=Lqw*KlV>-L~&igY<{;EKyS zZaLp2H8a_swq5;m>2=fsP5xq4u>G?~QR;Jy#p|9AYpjx$f)w{g*<^pKyQRw2zl(pN z(Qr_WY}of=ln%c*{=pGVIFv3m5VRcD@F9o8qxz1r>mEuqWv?F7M)P=IBZa3z=FB>g zRyzD`sEiY%2V}f0EI6MKySHgqsCN~kIo~;({Y>SLv8TdkVh@ZnZoKbr86b|a(9Sfm zO83k#&!4@UncJ&viR2%0&nQ86Vr(yohe6lzi`)cu%S3j5D`@0*npZ%3l+p<0g&j_u$l(>3v?Gq(5 zv=d|Ad53w_qf-($?6TkY#mFkZW=*g}x<4NN3c#c_FU)-Z@5}?|cm-RXF08(vNL~6!IM~HI4R|@IJOL$&WyC(X=@d6-EUM zT3zJt{I2@2u8N)8s3B}Mv!wNucwerpg^wJ;B98tv+{yrIWjcMmQr%G9;qr>uj@0KZ zcVyt)v6)Nv2^s~1Z)t?p9kXs;pr^J^!5GHUl+KI~j#)DyYC7S7P3G2I?F4gd(XM(i zH&p@g?fJKB9K=N>e<8)Dd3ks0sLTez6uY%iNFr}-+6Z49-H4{8x4<9T0he}J;@cWI zdi8y?kkVH?@2^ElS+f4F8=P00&8s!d-~oOn4rTs9Ckxh-%0R7AOrv+Rx{HIYc+9^N zBgn97TBl>20Toh-SGDDG%nb`@S#t$d+Xa6?y0jw7M9DC=Z_yT9uq`^wQw@H|`QDPmoS+^o<^@ydOSA0;JW{;kTkB#}LCpup9L| zlEJMM=nR?^)pMs6%D8}oXIM{O^c$T;#{BG>BHI5#$~|bHWA}m__5&O;&}LtA@V{!pU~|WML7)-CPr=G=S&e1wSR{9mQ@l3UMC5+B^~I21-l~ z?B_|#2Z=!a2beNV5GFZ1A5r)&C-{sx`dsKnX3KN$!q#FW54X%x30pdiulij$M2wmE zi4eF+a~GwuBBfUaiS$1Wjk96m-1@@i(Uaj7YBCs5$K|~iKQzM}MRuu6;o73Rx|QzH z^CPx>V7Optpspys=S6SsxouEt%sXi&D~V83Pa9MjpUCefn$qDcM$`L1m0 z*)dmhcYkT+XnrlWBTw^NF|ZB{!Oe32HyXVqz-Sy8g1b677>rc`D8AP|{*BdR_tL?r zKrQH+UnIiMrb<;tNz8F|bA!WPYp17n*C(4Va1dLr5Fm{kqUj%BAy?yAVC_W7>7U{k z{YJrjnx8F)43SFJ5aYy8xUezdwX;q=$~&Gqk7jdVTXsA&n!1^R@|L*x9^IF%Qulmq z{^8Dr0bBG%4lN_#Cxw`ekWwF*NB7|Lx8ZH>Y=*1eL@iSgwM8ZXAg_g*r6335+MLD# zl}*0BvUIGiZk zD0g1P(WuS(VnD!EbwcK9LG}<1tp06As${UQ@|XMsKrD*W`b~0?#QPP zm!ZZ`tHNk#ooQ>lZie1&UdufhqsTGZt;@ue?RP_l*jC%7F$QBZt2+JKFMhW<(Pqh1 zBTiYcIezm}SOdM&!t3BS^&6&nNyxN$Ld z4qz2^#?~kykmgLTfZ~`>h}dk_KO_7nA)1~7!S@D<(x z5*e9)<A zr~M6p0FHocdJ^?9Wl?9tqquLBL@jTARbG&TWQoT;v2V_MLU3Qi#A;hdwr(XgSs+=k z4SoBM29o(fb60eyZ{r#K&s4;nwG_iA>Jmu^IixShSyDqsB{E=phGis8#xsJ2C=QJc zY`4KEN&0+91rzz0^T+dG02FjsxM{*ek68cyy1-r54O6yLP7$09w1rMMty5O@gRa8L zG@w9GIVP!~u{Z9j7D_zk_)>0HPmc6cKgi#Sh`aqEu0jJiYap{r#8}5fF`r0z^c#@I zp&+!$PfJ!t$;jNrAq*&Ja!JL1o9Q22uBT%JjKEo&a38$OsUx;01hB4;?XDCyT>LhR zkY-XSAAm_K(77lcjUF0c@&G62XYLFA=bHfVac`?*ngw_7;w!w%)(uo|e|U}WL9%U= z($K|kQC)%M5~?#kR*JR^L9&=%wxl+K?k72_`k^)O5;%rzb;7ZJ(F2$OCIFNPv|Wd2 zzWPF!pEU0?TPXa5SO1ff`NaF97S^Jp9>NjhY6G-!UHJ9Qlo9br@weGJZ_VAr7*Guz zOq57pTnz`KMcBy9><2@$49e43Tekp@n-Huvod zs<_+C0^UB^+%HXR1!uG|`SEv(h&nsCA^}hB3jVT;_-WmGh}PW%<#3wr{KDhbweLV4 zwJAFUi<@`)d~SE2UBv4IXzVn}j7 zM*JDUc&HP&A>c5#d@i11kN0x-YQ%%Qu|sAIKsWu_fg^wh`+-+Cl=f`)JI&9Cd)j45 z^%9F`v?sjBDoPNQ^7XuzrG_(i%s7`TrKjwRGcxo#*D$S@Vn4ofx%IO$MnC5$y7e`$ zJYV?QTUMq4$3U=NPpf~dqw#pVNJpzn-7T@B?%?A^nHGPaD*wPtVdPFNV`%Hcr{fVu zqWzBfwpKw=?dNm;aO4!|IG?C6e~pWLWsOpvCyH1k?}xy`i|pzGEl!nB93Dh|;|Xj` zp+l&iXFC+cvkbv_bcDAhiJsH&22LREF>SSpn2p86QX-QGx6u|+sUCip%&J4^dPeFk zPZ=q32`^F8T4+=ld&78mwv!u z&*7ToK;jWIUD74N!?io`(6{^G8CXR&@P#BKb)>-YUa}^khxWAvTiY--G}8 ztCmxdFD?i`Y=I=e$%XxC0b<0;#PLhc98BQy4_!&UgnFJCSZxLc-iJ%#pD2Wy^syfG z{RCXII>?X4IAubU^1ME?F_BZz>gO!h3eFN(u>j+4o_1E^XQ~E>XWKZe!g4ulG-!X~ z#4|(|;rw8A3(o|WK{9i4GCQ_238GmL)D;6)YrHx4t;Klv4eqWTcF5Y<0mlgd6=NE2 zlZ8%5n%-bkhmg+lK6y6`E$`y-0-DOTrCGsbTUrr4F;**Qkd**C0D7e4vLGv#K?xEs zS&9qMmpb4kE$pXt^H-mWaDL;l4V6axCsHo`ImmIpYCa<(2NAAxnn3MmM2s$0X2Ud( zEqh#q@A~~Z1M)-Hl%s)xx_o#CoDVELpti75;OY`*-5I~iI7vKhp}t-=6^QTU$uwz% z!g7C%Ph5x9Qh$|HLj`&%ujK;ko1v|pU;=)bKhO3x?F8ALCY)H9ObM}vau2kPMm)xv zgnnxDxK_}(meq@utlesi%~pr1k(HtcJi8TRkG&$H?(uRF}VCI1zi12Hs) zE-=}IxDLQ>%MgNArx1FrCM$l9Cu7DBZ5u;lZ{;tOXP#j1-uLi&iI<>uU%$JvC%RyzTJ7M zTm}$a8tn?q(gqQ2&B}4g`~=*lP#?=zTHF!pZL`HQ(1Ng}k+!_egFECH^?O{xm)?G( zmImL9j){7U?M8Te(eru3z0>%YWmV&Eg1((Nh(Ys!hzlb$`>}*>8M6cr-mD<2Jkt4| zH81XsNnb}$>>LRn>GpZH(0O0#3}H+SmolVJdQIeQIYVDHrx2!MoMB3m9I-(@=n8!O*h)c{Ux!23?0WZZFlCzh65WeY zE@_~=^LF_>eKlA*Jx{#Uzz8O@LZ?({;MyXJ7SIa~W5;lE(vpp{c~!X;Q6}vlU+==) z(}Cd;o2?Cf-TB?w6$9o({tqm${S;HB3shNa-@_7PeEP8RX|%BVVn1lYuf2ymKQ#B8 z2ygxfFU~Ajexk}lPWRZofeoBZ^F&l{4qhOpO^>1&LN!wbz3S>rArs-#^*{hem+_iQ zZeTEVV~lL#jySl5@=rj!Q&9;z@=xUIk|HNy23uXvcx|P^2XWm<*ubtpepU{x;t_0ih2Xszv+EwMV3Bepbwj)%6 zT(rE$=HOmv#{v5U9#zcw#D#HHx4|_cTk4uQU;|!?aOW%2v;sr$(JE-cK|X%fe-8$k z#S70saorHT(_OboTe$J!c-p5+a%z(klq1RJRwh8P@tLs=VGL|iMtTD;;Yx3;>?gkg z15L7UZ$EfS1d=CsjljN(T_ZCsvl78LSt>s=7#KI=HD8z7)q@_ zrO%PB&yId;8!J4_RY*dW4>?u5GcA1}7)(RUY_50WMmI5@(C>GZI<0K@W*>>}P+jyj=za`L}HmpE%To^Axu2&kC@#H}!l^Yu>8REL*GCsZ7A%pXE`~ zxDQOP#qPJeAiH}&{C(CK|LcgAYQcW6Wn5C>72DVYLHX#IN=+33#GIV>pXt&;9W5xg zw~@z`!qwGd$M}8vCue-Qoi}|>2=5P&)yG=0@F@&FNw>aRpZV&@05!D zF)3jLK-}#){A$INm{7lVjZXh&e*9~{a_4wtX0V#nl#EWc=I%rsDH$4UD1DB~D99_v zo{VoTs1CimiR{`1Rhgf|L(6S_P+jZ;sruPu{kBgk;C2`dCx*X1Ck1)cQ<9}_K#3|; zBs5-vZn$WM-{blT!W6XP)N(jImdRdVt83*L67KPo$8aR=G(V`XxcNlIZ>CJXpi-0! zQ?`a;jEs^%aEprN-iwMnsX6n=X4?JJO0N||Oc})d{Gn3C!AE!$GruoFJDqtmX3XG# z2_STzzav+xKFx5w?5&E!$2B-?I4e7?wmZ^|lK8U_N;B z0UU$N$LigN%LL=91|r=%`ZlPdYP++abe#mOQ|>_6!q(L=$WLdms=)~v1kwg^HroQr z*21Z+sKKtA-J%_C0`TpeR6>g!Fxgt?bK2?#Djvp?77m+fj@{i8{w%PcP>mPs6&Ik+ zV3;Wp{c4`>9Rs!oWQffG1a`hNm01MkRDY_Dj7`p`Vq-a@^-*-*oXSrF4iv1~PN_wM zC~+`5awf*TweBb}kK^Qj6v8bSXmGFJ82o{%M`(y?B*`f1U@xi!{!A?6<&SZ<2)vl2 zDCHp0=-aM?p87ykh7EbMa8%E;vvTIfF<_E|7Zciz z!b8|$T99Jx$>KBSG?J7wK{vYdecfoGGe$+b$_0oA=UkHJnWdm@{X6>=j0Sc8`)0@6 zwxj#g1yor13LS$Se=(X$b$jzYb$OQ$wW-M76n?Vt5o%~RBra{~fi+uRR7fJ-wFioqlT-+zl1(ZkRJ7y|`gu6jja(vMwR>mq z3s8yBh_TZ3Ixhc5bNZV5qL`WE{+`L^%-9(^C;8fjM@xthOY1GF`}7N z<#U+)&!WUotUwYLZ%C7z=x@@xqgG}lyRf}wO?`X*ovAKqW;%DBSvt8XGIPWCrcD`c zRg{@Oj}b7215FN`)P!&Me_->TNFM(JEW3)>!RaW#-`SN!b18_RV6#!1qDrqDnNBV>q%oQrA>~kPJ*WbAS z8F;z+W=q3Bc`SRh(xXbo^nmzuzXL_R;pJ@W7iTlJVvIGa1e{*No}cXak<#EG4l5qW z-*e2~4n7BKUBWsa{qG)05YCrcNiNQpY}5d@Cy0eXA_U8DvpecVzS*q-OHH5;sK7J^ z*$962gp4I29l*E4VdpWsLc%4L<=eG_1;XRu0(~)#w zl04j$MEv^?EW_icRk0hdQD{8zqbGX3@k_P{MyN;>XY)zyyf-H5~H z)T=jmjZ8oU5*E_W=3BmZu~z9nJj0tlR9IVWd!xO}ad@S1=8%G>5jFoU!a`N;-(!C5 zXlL8>9#(}&3haRX9urUhGOb=vFzl37`vg~2$l*Jk6+QSf)?J2EX~fbe8Q zZZ|Axf; z$#_VL0%!MYNU?R5?!pb=y0gF!6>EFrJv@}5f%4CT##OEkNUQU=TT3F*w=03~q8hE* zXBb24VlGS0DzSUIYwEW)s@p-zwwKm$>ujCO5uuy*_FA&8;&Z+qz3TRh9_2O1X9HXDZ_UK> zPj&Kt&b23_!&-gJn;W(Qc*=sr4MG$K;+)i(cNu`P0Z5n1Q5oy%?9uRka0Uz_BV9Vf zOnAlr0>Z2(t=uo)c$^i;kP1m(buXn)lbAeX->U6P!ot?k>{7?DkLay;HAoL5x$*sc zznk?6k5@(|nXhWAMy<@W8VW7#8FeKdeN%tsrFQRH6O;Q}8X3IC3O(0t?lyh19c_-d+Q6`1kcj{d9u6VL0mxB!)-=!T4+7xvkRV64wsvJ7q#yt3bhiuA(Nk2=)&uCTzD2yQ(+C z7Umc*CEBfI7CphSGZ0mit0k~djNAmbj=;f-DRBziMnc zRb2Po-&T+4&G{QQ^Ju_O0X$Lv-54y}H>73+7-a*ol46wq_|&j9f*AJ48L`dQHE+g@PMO1Fv(LLC+se6O@X1) zZD&+NqY<{8Y+@YGXY$$D{&d<&ENcUb?Ur*H%Z<=|P39Cx z_E_d_&!>Bc@ko z%#-;E!6bM$h{KPfIvMI70MdAxQYXV~e}D5e^mXe3ez2X)gMYIFTG~Na!Nww%{-L03 z3+RG>lmfg|Ac^Hi8P*KA0SNa4>)gvyBQ30)?a~Iff+p)J_EycZM*maw5QoKz1;`N9 zYwXPv9{viTNfi#(B4$my2cmby0I{F8P2Fj4>p`&k`;K96Q`{mi!;tjF?-Jp8O=4mo z{+PEj85P$03P@Y??$!iVo)h z;cZ?!_Ru!W=w#$cNvb^Pr26j=dhdt&%TQ08apegwE zWA%e43k(Iw?wH}UOeKo6-!I~)p=If>F@82m=%_ql?YHayKG^Xlxi5`rWb{sKNQp3} zd%WMa(}go8avUHHWQ0M&RfYHR57vz1fJx5%>-64%X8E4(=W(~+oW0Ja=-bUh8sBJT zbB4YJoU*~FZC?1PuETUJMt$Gf*b9KMRNJP+F3y$Zn&aHk$|cUF{Msznh}r5!-)Wp7 zG?9uAqxT9-y3Mk#)a7#1X*#I)6#7Jc zwAt_FFvV(obo(fj>Z^e=Q_y=Hi`z2aGMI&r*bb>91}N(C`Rn{?rCVJ!*6ePw%(S8a z`dig4@w$bqYxp=dd408K`C6iR&E*-HvC!yYx@0x^ouIafA1Q~eo)FXPKWpV|rpxr< zEP=q=CfnFi_kSb`;{%D3ZUaRsxcK@?A%=*`Y%oP$!2qNMsDULcAJSUFgNA~D5P$?# zlmn66n8eqCuabqAktg0*Q0)O7&kNwSwx^dUQRq95#Qp8_HG}B~+UEu5&9Zp!$EkCK@^B)*}Cwv zjI-39XBC}gw&&Vo_x^~?r1PcyJ?}!j4(o{ou9DFGX>_2Y9h@?aDCs5WvA7rep=Rtg z3d|e;IIcU9j20TmSa$3hv_8y|dz_vQR0^+5j z+5(x9F($jmjG*Kh{|O8{CBXx+DrHfxiv$8GA)<=VV|KmttDUJgtwH=)CA|2v)Y#f$ zq50ASz~$rg0W=4%W+P*)!6k=8aA!qXf0voaCa>VrzAw=X4@@AiVXFs#qeiit4RB3N zBVpULGC?!$^@xMx^;6L&_LEYpo;?+^_WMufjw>NTBVGUA7NcT7Gvx_HPmNa2YijmE)VeqW$!C7W$pYAV$$mX^U( z6G%k#T|eX#a3SP(w$XL%=r2P2lq*Q9B^b5MHQG}E@G9(x5j?|uA|jl67O&?W1@gS} z)#uKBpQV&ZNi{EZ5sKUcXQa$kVi0LZ?ucTyORe{iW$YoWqeQfHV}txjU?$Mi^V zhQDi<=Qvz#(Ayt%lk_C)idozZ*mAj2A_Xc!)U3cw=|Q4r)!8Ke6vQeaRhkChPXPap zVs@^kOBNODF6CtVZ-~pWkD}g|*KH>6r^EZ7@x7w^dJ<`H)6(^zRezIRyuLK?2?O7A zMnrebGe(dntao=UdQ~O;ee2*qKxFdKfj#`(6Ogu_U&=&F+e1poSY2L$-W}K%Dr@Gv zBgj9+hxj(q)Fj^i)MSAUf{ZQb_8h0-W^_q8F?R{Fa)x70mYZSe&GadDU&NuW@ATEOu^A%c( zpDTTnyG&}l#Um@Q0#x_!2!_Ujfh{QeTsQLuNj_6dg@o7s8NuBo&n|zBx-$(CvuaV} z=naSPC)G~mnAkTztLQ}F6N1gM6&q|SH;KwyeZGwt&+>!x?&xZd)Kufh_vRWI9~dLa zJ802TV#jbbEG^deE#uFc5feH_%;u!mpTavbn<-`^+fm}X+jt?eZ4_}9Mo`F|TDFiU zJn=oL?G%(wueM&LU|N>x?!naLt?|1DM}y_VA(->QCp}CP#pHwz8uVp{i(sFsAm)?YkpG?(vk1s|u)ukZbd32D{qdCWC>7cwuN5ehL~) z1c6#cTL>d~;34KAAJfcwRIGs)#MEz_R!q@9TUuTqWYlgIVMI5u@I#8bNBLXtGISN@ zugk+2M=g%-`|%irq2NOk#+U&;qHgkH9z;LN3?#+fr=NqEcN;8#rs%+#EJ1`wLGo@9 z;9vAR*SNTXN~sX!L0I#_BSuO^Rtz^M572lE6qA+OAzxehlz+S*U*Smz9x#VSi@E_= zQQglMq_fal>DCMqEFoA6r}H_ z3EcLBY^*MzWh%_F9sG|K;1I($UR6cryZr5^5@JG?#K{lFZoe4o(3|@wtgjwIQ8{Y? zN(U@Fh2M3_)^d<;pypm@yiZsYr6DY0??F`HxUhsHrJxfajP=d@I$+CIqgdY2hVSlz< zF?lrY@-_Y6xUo#*4$;0O#oS(+95snP92YVM#3NrSld6dR)40+!x z?r&=ZxgNhE7)k{}``1-fM56B83MRR8uFFSMQo7Fxf(R8~{}B>3Sk_MXrF&DSa)J9*zpEoK_6yzlX5ZuQh9IJJn+ zONOPU(Pf)Rj?8*8o6RkW`h&_g?YKyj_a!Bn@BJ8=Z*58@QnmJZtb>;M8Be<`QR&i; zmrYo>9aocm>(%DlTXz!Y5qBhT4cWzoh@J{(I}Z|`&06hr<;yxQu7W^ub|WNEJTn&a zGI7zwD>i*URj}~8QY}e)Zb^+A*~Rk|wz>*O6laAfg`2xiQtB*3<8MOawna?xFqJw2 zm-i|88azl&$=t-W)JO1iZXWq*5jKC^5Jdg>=$~I7t#C?CBiBeWQ3V@U0`0uNCW}`z zR7MxJeAUIJeiu2Y1JXpQV&@F`nl;iuB;@97hi%9Uo`{c|^TxuTEOu~bk8+%0W81U_xPm8Gh1g{EcaR1?F4KwRW%L=HwQlAs>Nxu zKPX%{YY$c*Ex%=%n4>N9K{GnFf#S`UJuUUll*rftlAZZ&*u(r za(n{rho8@A*+K(@&)68_o-s{*q8}rAE!*tw7Ec?&O!Z2T$FHkLM957o_ezRhGw*Ad zI)#UeJf3_N`DiXJObu6HT)q+elaKoM9y({N=bSvR-nzr(P1vpm>1UlZF0AC?^`>rw z(~WZ_IN#7Q)AbXKOJCNkdd_f%f5Xi8x%Du0$J96&IM>MP4*JB%{J51#8NT0R_u1t)aXYjFSfaLhOc%;wmdl^H!$n z_93(@8+VO`zL~~6?}NtHB`wGr^}o*!4NQ!-{; z1(JX8`91SmnuksdrSEKpnu+CHq(}Ip^U7`pRxdl=obs!%)T}x-R}lX8)7lHJy-U7R zTlEAHa#5njf@;3$8qnVb>sfzB&q3zi$}v{@n`TfN)csPHpP!D~0CETN!?aX0Yp<_X ziH*R;TP61cO(C=3?|ogf82z;@pdda0x6}{A-^IOlia@z<-`K(JFAx&L>!RZTnwQHL z2+>Z5^l!@2Hs5^9T>t?jU`(5y+`J|o_bQ1@Db5r;;55$Q2nI)h@@!3KefH+@5)o2L z?8m}+OKU3e)~;^RnjlFaDoupnwX@bwH8*m$X; z#=ROk_(NMAX$_`q2Kw@ub*iK{16cKD5zK_Q{USc+`~@_2wYAIlqew|9II0Q54Fs?p z`mDaAS7Wy2qHknMX=+yO^9d_r+vHV)n+8wXey_FVR*W@iT^R#aoe2zWi7M(ueqF(cmj%c;`|?k=4vs@Cw4?;L0*i7wn=yGtqex zHs)2J9c!{id1N39zrMRgA>q5yv#F3H9sObae9!TI@kJ85LleZ-oz1oE8lcH6?f=MK)HzFIimBc5{PSZ!9yg~x-WPHH2N$# z!>jLBxmU)V>($=87}i7TzmGpDl8=Hf--?`VVI;#aeK<$9wRRl*cUQJ*pHU z_wsf=PX8EzFr{H%C~g04N~|#IGnWhNJ!HgU*2!R5ef|4gQ)R#16fs2-Et}gOLKX5Y)PqT!gL$U-gcbcFp7-^Wz`xe{eQiZPEI3 zWcwa#2d5*n!u=HuB&^K!D=&e+%uq#w0Bq8L~P0b zx=X&Pq471wGe$I6B64#=r+h=hZZ0|_T^g^$kE-3=&(&u(a&Tbf)w%+C4(7cvucr;0 zb>V%dM?4x04OSD(nWnCb^`Pg^{yhk4Xthb@b20}Bba@FkrnpR@3_RL3a1jTYWe14R zv6FH9Yp(^t5|3DW)sdfzL`cGqkc24@&=QhEQEzlJP$(B}khDeMef)d}d(Y?(Y{i|$ z#zM(2t6f0)&8qyfo9hYfh53h;vu^+vlJQ6Jjtcb&l?)?N!e>oFht)oxuj(>Xg%lp` zTkrj}SeT!CAsNBJ5WzW+FSOotY-@O1qskX*dl@MBH`|X~S*{%%zFEgC6B*e3PLm}D z67{Vh|4_lBXCQjTe|^f$dWWOICb`w^%l24k`0Y_x>oziDl8K})*6jSzD&}ASds{Dx zo*tyjet~f98%%TRv?6pUWRYFtev@j zjh$4vmB|bwl4N?WrM&g1I@A7jcyrS^6eDvpU`G#XIs!Yxh{dvHVyV5Aa1oHSqyCwU zpeN1M-CyEFiYcmMqbhY$PW9nKbVN-ZjgLf6`a11?KXbf4vtx=N7iSnFXFfIkWwLbbSR-m0R1kAdMnOi8M%;Al)G#A>9pvG;CVB1SABJZfOBG z-Hm`C-QC?C(*N3e&Y9P5=AU60hsV9wv(~yht~=>V%;J4#c9Y0#`-V}PQuO^FtF!OX z_b99%`XUy%hL&f2%McRdtLxs$F_L#+u4X)7(y4tB@YoU=oo4)iym~dn>-Jj2y(%o* zQ@cYdJ?EQ_2ZVHTHb&QdGC@5+Tm5`+WHHeDT%z};Fymumljjwfn@eeaRV$*!KOUDU z{Dxkuuns5D-cRpAJ{!s83x8*;Cpp1huDW3XgSgvanc~V8gSaI&s&$hdEg6N3N5bC< zWS^L6s1pbtkJomEpNg4pC*DSLI=C)MTVejn=lpebH2Ioc^25gj>oiuE6RD$Ld%cw3 z6(>STLN3LEf`v))(3PfSR|8&Hy?i=C?%VUm?V*PX1x5INnk2&-dp44_0G(K6mlhtC z7j(>wca`4wdgy)Z&lMlUpQaJeFJ8-}()Wq?mb1t&=;R~uRI*!)GiT0iNMiUv@0hwM z?}LK2!G;$@LFX)A@7_z&)4%f2emn!xVu2KrAus2Q^!B^sil#IuCBlRkTLUujS@g~A z)-cGbIV2J7$nL@a`Duyufd-Wupd;N!_7$cu*t8vLGI~0XV&l58gLHK{D&WSHtTf-? zDIJ;l18Z7heaP2$;Yz3dNN+L z7rNUhq)={#%I=~w>?Ygaw zZqnvHP%CFF{fNhu$X|7KxY~_xEz|$p@cR=Jld4Gox6^gE7LUFA)a0x+xT3O#SFgUo z^QzL(K(((VHgS+8kb&HXz90Q8_B~qcRvA|+0ju}hjwK`q-{YBjSLG1IcYNazqoHdT zWIU8I;Y58*Spb5yv%kN0f9gIQ<~=yf;xwP^8k8$bVL42cR0Mb#2q9+qMK;&%Zg10~ z=EBA}WT_4H!v1O8y0;7f_BX1`_p#`=T6LB<@}LPdb)C6pBacYB>TXi+MYVoiaC5jE zfBM+x-H!#=W&myR^Fr7?wg1FZh0k9$iSwgYxmmir{RFF!*r8`@ z#(q5OZc>_Ris9fMC{$SG2z!R`at&UH@bCpz=!Z$fco&S9_u$l@HG9(l{|K+n<~78! zMB&~ukL!cPxdyLSg8_;%@x@p>`H|!I>*od2<&7j;X>CwFo_NF;yuY({zqpQlZh%^Z zNdQ!N?~ zNi8=$rrl!y#ojIxFCsq7WC;I4wVI&p33s|Xr`x3hH#z#;j*g|py-c)+SVr3;1YHUh z63Qkcd#^LiqD>u*IO$>(MSqCP!;cd0N)bk!+>tH+n}PF zuafSM{74C;&{k}aawvuYnro*nqsH@}@SQ@p2Xtm7RnUc0mf|#4egT0zFg<37Dc0p1 z3fj0mKnH3&hkyyWs~8MtCa&v z33-v2t$~ko=q`(`-coJ~_JlWhcFb}ySd6Zxo!jEpzH<|Jm~y68yPRKM)}b!lq368N z;P^H(Bz9hvP%e8WAc>$|z|%27;=E57;MrxJOw#{kch(WCc3|V!t=HszQuZ?xZKqME zZjzr=bRBAm^onck>?Q&=y~uF=mFka}Ch}^h)qIZPzkIb20U^?O;_@TgQ zdq;WU4ui9NX@mLTK7t=D9Ey$qMnHS97a!amK=@o3yOqJ42wglo$KeqHsvZ0^bHZsm zU{zWQW58I=&ws%g=(faZbKpF{MqUk>M2c544y>fGaD$}0&f(iieO4r|jtnyx(}4b40LH!bLd{dkT-@?JUf1tJ z@oPcZB0GSyU9`dYCC*(`mOv&{4aee3Pj0U8 zEhas4Lo&pbEr%!Hq(;+wN?8p33>AHklAisM^ivecoB-9Vt#UR?di#8RX zk2!wX5B&6*1_K@eHM1BRRQMm+{^LQ%`q;L!W6toNxqWd4V*d^c5UBUH!czoU)L*AA z@Ca2o&zRDVoojaDaRl5P?HwG-lCkLi(aj6+2v)(|ItC~k6etL2z6)g4ss;c6=~Z_e zOD-7pFa$(49hl|;Mv1WHYnD-ikuahrtyMxO3k0pC2MT~&xM7U$m$`7(5wU-AxvGms zK=DjGB8L6LJe)6IJdR@;6Hxssy;#mt?C}911>N%_&+~E*b}9mT-GzC zvxUx9zP_ z=GYIdaiipXCO5n*^*={{df=iHf-MB49%}G##_lD!qj7rb z7_vmw^>tOC)&&omJpMVKJzmx|qPFc&_Ow5_7m+v2teF5a5CU!UtY_uEeuY(HDDHo>aQ88zb z$_No!5&xW)?;Xm-W4n7efKgrHF=rCj{WN}`qOT8?!FJVCgetgh!itL&9}W;Ic7<+i z%q5Iio-o;mMrv3ZA9o3scUyADKn24>qIYxJ8L+I+t{>*TjhbZh0=B!T@V3;=51}le zh0R=r(AH-Sb@^$vPF{|9HM61-^Cru_p)tn0oU8HrG<7QQGFZUg!bFY5Obke+T)j-2 z&)PlDwCW2;g(2Hp>X}AAAX}Xo`w>p$%p02!cCUt+DA>Itjo{hI>dPElz}~-6$Lf# zkAB0%H;+d&h&@30q!sKHmhB8JwZo+Pr8Rt zBN!OM2~6Sl3hlY+9A;F>TRHfILj z-Dx-S)+`%+0``(cg3bvnHrxQ&;QX5sg%>c3sdIc6I3b0oT7b%mBfv|Z*@-e^9z23` z_o4w8O8T7^{U3j!PzJ_kPLhGC{yuL|!847R^hPQ_sk|gu4 zJ`{ZS<$SMLGF3tOcIaL2-vb>P46mE%e~A^pR!+21w>$~hH?pj z&K5oaZ~GW8k30HgJ7t9lNTh7pKtd*i*4JOh!~lrNtiB3w%~kHK`;4eFEje~kliRKQNv8^r_Gm=JDY zOb~}ZdH6?oqx@0kq0?=uDE#goF%qZJlK+@A7x~jKB;%;@R)H>_RbQ2TQAXzSy*W9W zObRc5(zw#Rv^z}A})0fm6{BStt0yzkj#um?S*PGtC78iQS! zLbzQIefkfbHRJw%x25<2Q_Nq)FqR>X9z^W*?zODJtiKG`;5Euw=B3t14%}0XV2r>vzLLo+UySM`#)-+(P^DUH1TXCGvk{4lwW@CfY*70RzvaGZ^%fsg+@Yoz%j*&9tm z9+P3J0Hz~UDPsJA`1iU8)2KR)ZYk9L@#rnPwlon)Fw!Rnq%RQt2^oP%Qus#B0AN%7 z%lpCy&p_IXgdaH^T#*n8H>kspC`_mQ{a6^2(qI>+OGI{z-f)vGJOb~1d7mW2?_Z<* zUvGut;CNkrs`L#2YN?H)Zn*oJarhASR()aym+wM7H|vkQ@rFO$gKvp!j<+E9TP|jO z``5)lc;UlAZ$$5lk4wMRt5be@7@}4Nlq!FyL50@}?T+;1Pd9d6+Yc$^@B{HiOV!3Zpz2Wb7)@;wRfLpV!xM!8`rM})t` zxgQ+Ng=i7~feE9vW+~u+Ju+&6avLHGUf$fJ^;2 z;ixJF+!r5HeIUj6oBrZi!^(>Zu?ELgdv+?e@67;PvZ;d7?7`nl^1zn7c<8eTW58zH zX9m`SC_op!BOky);bsL77a`kiRW!AKlUAR+FiYj?oG4`bdi;R^g0I1AK}a=GR5$|Eq{@MFc~&5#y+v!ON42CUxSy; zQy!Rrfj1qQoUY@?}TdLqDefS14nX2HCP8QfnB`8|P? zG14ZX{+FIHM_{66q>%QqPt3r^2$-dASSo?~nJ?i+w(f|Dp z2X_E{bCCga4#3Ij|Jl%0D0a9o8Taq~OfPucz1jKi1Hbpp0AJZwsRQzHjiMnv;4lA) zUk5|jestbxZ1Dce=f7FDnh4y1?%wD0*598m{pZ|D<8X??}hCW1`{l^;q=hot=!7<9{3p$d(E?y_(&vof;DP@$AEj$NQ1$d@7 z2_5$@eJ89ywm?|I6aiyg$S5lkCdzkkT@SzGVGlJ&nez&~0N zeDvEYd(eUG^B6bSAp;I1ICJ07_sqQLuxsiYl05m>Tl#ZNe)nO5s8#jHli#wB2PXUc z7RGoAvE1O`eSvrZ^?3KMNM2t3?=oZyjtJNEm8-r$Z92wb69Z8^07z9${(c9UK@5y> z3lJkg%svha^<}~LB*B-^kFOK6;sjpIH}Or%|>F! zjw|BVefsa&UPf%LZ@*jKCA28<#&1W#4}Xi#C>PoK{?I|UPzN$H8CAYns1g>Og2OJ7_G`K&E_RubWJlL&>SY|zW_!qZwbAek)xw?$s zo~>d@>%3~$J@UHn`7RzJr}%~jciv{Ll$UYuY_r!9qN#t>sg-&(Mzm1ue64iYeHFLS zb~%VcRmr!SH`mXi`YXTZ&?$4{=(asNS4&?yvM#@<>yqmDl(JxBOo}BWjsB4d?OYFw zDuP8qno#3#pQbh4%g#?KUt7%3h&e^SoFRX_(}S_DU&z84sODz}==>l?ky-Ml!@@`M z<5N(k%9H_mRTM|_1@E8})pnF%%6DqK*n1Q#v(>H`9C{U6sE2|eKwd^77W9Y@!Do>J z)2^L59?$N8Eo2WM2arGP1VH2mK^1 zyH#mIv_Gy1K08T}n+YhC)auUkH+YC#jJtQ$Lx)Gf!mB|R;!C3#Kt-Si+jiHvf=ty3?%v^5uL zmgVDd0*M5fs>8@2%GgsTVV1qrOxf%y1>f4%jc!T9Zv)R0dk8tgkvS3^Tdit*!e(9+ zVW%8DmET0;%22XiLogm~f)?sJObsXWV$+$frbajQ4a|=*KSlF^k*t0 zG|}4X4_Y?ON7}#~?L5ozLJ2!C1}1wTU5v1uXUTXpUv;F~?u}+eTpT_w?ZMTZ`^;BG z%0wY=L8qOG!B<&39}ao*kBLKGH3gyCU}{GtV%6@DNrv|^ zZtNQdCWIdCfKN5Vnqwm@^i%kOMx{Uy6`ABVk21h+RZ)YEF-~f0vU6+933` zQYXv=Vk)i{y&IJLOQfODBfu*|_|lyEwpE0kxtAGQ%t6m3x^WOA;+F%RR46q4Aq!~jx-r=uQY934ys1q^fO0mSGQkM zCC~GOR?1t-9V)M9Ci^#2!x7d0?_eeGmX{<02a|Jd=1N1*j%-E!>Py>GJ$qhNa2R{#_r&F5kRT0N2?E_KBrNwkU-ZdYeahaAjm-{J?ko%iQn z1L+sjSGi-K%x!0sc`|Rev~yDy2mA!!GrJd&k^UvpL3s-tU8RXIC@$iZPKaH@V>XN_ znxl((!7B~vb}GBSe`P!0$z;VXc&h%6fe6eAzxMx*7-<~fOD9NOY!Xs;E3zDuY+P=nvR! zXejWYaL2*819#orzhS*-b2Yv%0tt+RbN%Md7=wn zQSOH1$E7H*7m1lnvkWbbw&b9mZglxlZADKpo#YHGQdq2eK(@2+p~QM3KRA+{(6j4_P)EG4g&RdN??RtFk(9ZqCQqkDL}Ewd>Je{H#evB&r^9_$bho)(aXvA5WxCG|vs}jJ+z~JS@}S5%u~5uPnC>5iF2r^V*bXFXWSP_T z)O+|Q?$75@@hL$HIQ;IDB7ob~&aq;rQ1>F;YzzjGAg=OHT+JxIlp#qCMqKn7`*C%? zTjT5JMXTSRvdmQpo4b364-kn@#bV z?koJ^HSg_i{_N?#%<_Pzzba~k8P@e%c4r;<%tj4b3r(Qw4H*!uO!GH9jm`+W`ZLNQ zM%q0dR?i;aUM%yyHYXCpW^_oW_pJO>hsm*hKW^P^W+^x82X^5`l-IVM0@lnNUsIGC z2HO*p^3!4AuED@d#%!yxKDGyZ&~B@02BPW z;#o6g-Hz8Dihs0#tZ>G0eF1&Egp#0o=d(>M$aH-2TL5YU3>v9`FV9<`0QRGq*Vmrd zg|SDfNYYp^sr@jT@X^P=Tv4AFm=lebEV{Ku5M7k7w{0N={usmpB2jbRv*)$c5KSV zqsyX^IZd1g;05%7g|tg3{@9Fwp|N;n$Tbyy6NVx<6Ot1c4g@& ztZXKs1WEa>&vHMbMs?PnlIo1>?z@bre$YK`|5zmdxr4GV`Ae%jsWQ}G=9MPid{ zt}&f;U2c$daLoVFTq!iUWJzJ#F@aY1g8|c!GmVnGoF_>yv2iwY!3J3U%a)| z?j%${HFT_+H1$a4dFo>H=9*|Lg=XXql~zWM=J-o|Z9=Z)ZBoDV@9Qh>WNFfdOLBH8 zo!MrJfA#Oa91L||r+e*N8_g!q0p%w>fS;>qWuUXz$x^8v)W|I7lD8R}L)10aNpMD| zll}GTC?2sjmrMSc-YeIe4f+6FbUjvVQ%nr%-j_`>PnhiU&@^>C+>W2QxgB#0)OjXm zw9AlRCFU73grqkAn*TB$VLQ+mpxd6INi>;z%=dO6rEGe0Fy?-A(V0S*QVuj9Z(a@r zDd0n~ov?M`{@3;QC6jN)MXXAjYxvY3CjTqpa7-!$hceyctt>E}A4O)}!XLdj0rvCe z;Hdxi2KLV$)UWBf+FnP7jz#2Cl;K(OCQyiTr4k-nyGyD)#Og1jp|h+x!(r9ZsV%pS zgrv`k&l#OR^&*jr$>q&vni<$RE^chv(%Ao|WxFDE!Cy2q!X@)U6G=wCy$IP7Xo}pmh7!o*uM5mYLqMos?f8xL3fY0ZCgDJ+CH5Ah zQr=dIpJpL7`+@4_s!6o}x@hdl^PWid+jIJwU{@sE)ERC$8Mn31x%~S_3ri$jYUwX< zEuKr8M9wD%9lyORW5E3;Br3yKV)#Iy-or;}wLmKGnBb*Fk9%wU7Mpx9-tgwdtb^n7 zgcd7Tso0Np&`H(T@$6NKe1W8Qvjbgj{g2^R2IO|4enjAwkWxwOzaPT47DbLbi#3nc z>#B6QUEgY1bzEIw3)xLgI2zd~vQ5=k@ic3{N6XR)(mF)U2yTkK%fjUhEFugSW-Qf~JHps&O z0q;9js4GJwm;413PAh_f3*!dwyBjX?&@-9pqM{v8FU;7Yy0<1G+hC4B)8S?ys(PClHCWLE=$ynM|6Zhv3#LR!Grn3YC9+@ddkqE}MRvd(LU1O7 z0L>&1R-~=`?HH<4qogO9u-FsUyd3A`-hkG0#?-X!(dU|fb+wP$3P9m}vmsXL_etze*TG!Yn|N_}DZ@y6x3aVO>l zS8Eth8#3U_VMCnpK2dwEF?bhMhc(88Z$&;Me#xNwqkW77=P z)(O=2U)Oo0@>57=Z&y53>ck}X(D4_OCsAxXO=Y_+QZYC08E_G{zMj^Y>QEg&0x1L;!!%9M-0srfSrmnjS{^Qw zEf}vK&uH?zJmZ~a{@$VGcg>iBk~i3{bG32;FHCa{dAwgEI1uG(qHRm7eG!@!V5A~! zzY>RNdv)_3)w%>Bne@N*EPG1*qecn5AF}9I9o>`j513Pl=sSgcI$bU)iNwA*bgPc)@Y{VBD3T}2it?-DfxnjAQ- z)5c_(!+;wp7VCboz{a#2Gu=rgp`Xs9uCJFh^*kq0$9Q;MwPTf!318HpH3PR}79ZU( z^?rzST;hbNu*dqz+nAW6(WkOC`DbH&b_@J4*N0o4Wf1#s*XI&}h$jf2vtJ?fp0~%H z1hz#`%w~+66(&n$Y+1Z|T64dT-m-16Kf2~plF3EP5GUgZAUkGR8M$a9K=#{*+-ek&f1P&EBo4{9kE%Q zcT^Rzr-vKL9A>Sb#BDuCrl1j4SL6HvU`Aba<<8Yo9$T^&ut&}Qc1&# zzWQ|cy8krO(yVnOUrDwbqs(ovBGGm!@b#UbzCb;_i_uc~TjhPFmH6OJmSZ8EIR^tf zI*Idc&)!umod{U?)g7UVae`4f=K)ls#19P4k$Ca8=Q+Az+XpOAVfBda(s*$Nj5EvX z{2Y)%@9}t>2DCO);YB2(Gjba*K11g^^+haYWHe#TGhbkX4IuUFoG5t{r3cY&^l;S- zZ2!tgF92D%hfAx_T#n{i*tK<>3_1ftd|#s%qZ|W=Q0ZCMawS*stC$o&o|!rqc`%|k zoaiW7JPP&kliQE6SWEsz@&Gnzb+a|-5uKOEa-1@E%ZQ;95b2*w7>$nxD=gJP6KGbL zs-Jda4nS{+{B9hzQ(6S3oaa0@d|+uzuUoU8?{LEvsx|&iGm{6!;ps7$Tq87Eq^}=h z95bP*&ur2a?YP!MfJQ1G324+*@Fl;Z6u-*|L+%09mzB!lnLFbfso<&*C`X|I&3xoRJb&Ddu`O{$8!7 z(T~qgB?a4wd|W0MQWt2-gyi+AEi8W1Ro_p!rs~a0LuUM>(!TM~WkPlv4z{RHdF&m3Lk<_IwEe*xzC5ilf zRN*l&XS{AsQsr!j7{n`PD)Z1oz2M#tPr`AQKWNaKNN1hiTmlm>q9--*M&q65C=k;&0-p(8!tXw;iSxD!H3MZ`tx_3c4p!wRJbHQSb zFT^O9NZYq)H2OziN+tdI)UysVtsj;i#I^K9x~~KBx7-eIqA6TB5+~Ur8K)e(h(jKC zKTqokZ!8Fkjy>GPbL+mqR&8QxVOkGmNw(5NAY#?x-_)ox)sv)aTf3?Tg*1u&jG?Xg z=RI`EN%B9pCSAt_l<6*SchPluidE38RqJw=4|cC3QWNqVO6`wVE8m%BQG9$j{;~fe zb&|7!uKiVf?9=eNX2mJ=sk6SjPSK_1<{?2xtJCKp3C}1wo_I=#FY}>b{}aE^m6!~O z_J7Q`6m#?)eg?vu2(R{GAyUV0&G0Dnd z)b>FOd&jFwu9#>dFIGH&k=;a6O-@-P`0Z#--ohC$zm#a*!8p#|O($UYl`=Wk^a5ww zQRemMXTe11p^lm}UmpRS?eVrOM$F#m&GEzt!L*t;&S554RH0rqy0O1Xe4;w|K)oj2 z)3LbY(1kM)OmhTNtrNLyQyt|^$hU!oYEsb?gxEy{IzS>cWqGY8o^P&neIJEQ?><+N zdxNZoCshF17$ENg^UC;5Oy^Ps+?B$fuzqN7vz{uC9RI{q%6%Gfw^kjqpf=hi+&fj}K&NdYV0y8VJz@h~HDVOmifD7wncE>m0 zU=r0mT}vR*elz*n+vME1yw=#2a-(0!Giw6fw2K>W-KNodJZK@7)G~2*TIvq_uHaLf zKYg&<3Hcqb{HC-vbtIoPy|SXr(Z>bn;|4wzHSP*~4Tb7wqw)z71woJ8hy-3y_N9KZ z>)+za)L5kaMAc$_o{4O>G8x6TzdQBur+__)5HVp7 zzhzf%F-!YhrlHZb)o5)rtAs2R$~U+FwFq<8euE|1G)l5UfE6_5<07t8=M9@XZ9WnW zK#?+eTxY4+XjeT;jnJF@zBr*34)09|hu8hO97v-sIgvY*hr;sV@;!tetb^QzSbVCb zTsGN}L-_8XDtReXSywE7{0FXA!T{^kru(|#(-6*cFYMc!?GE-#S9r}fN8k69lfK4Y zlCASe_WmZ3`&meV-h5jTyst}U9%5J2pHlPPLWEpHyB@SBDF@>r4GN5NK+Sb(G_sQA zPi&aQZ!hCYud6hExbj%<`!O4d?0$4CP}SDW55Uv=WW~MrInsZxs-M)%CWzhMm-Wrh zSe5!ooWd?M@_}-Bw)=v~pJDOO+@0sVf0xaOMEg*#AHZut>TDGs@s{*01dbaYF@-#x z)~%!G->sG*+%8@Ib3Bul%?8dja zsO}Sz44!pTHBe*^&D6|FYU)$KwH`lrIP}~5&YWPP=atTFLFA8~*?7=Cdz|IY)X!6% zeEO1lGsTkdW7Eq)?5rHb43gA{!SlNTdvX#j9*x=swf!bBeWpp!MI2u~_W@f1qx2E; zZYJ&xdbgX!BY~HU2;!F`d_6gGDOzZ_uf=`B!c$B&XS$X|@a{_Dhg2Zlhh6D0h#vvk&hrc} z01j?s_biB9EKp&8u3?pxuZ}*FmM^ySiON26Eocd(2XXoyOBo2mi{M8MX0eF*Gq#=v zzHghnZa&Ov+0L;)$^Ys|MY7tcSN~2?eERy9+S$q2kUo@A^HWb>DUpgcV_1XRX}+QW zh}h?&MWZwEZIA$vFLBFxHxMSASnIR?#ieM{nIV8a0A-K_bGxDkujf7S8jdPV z4mW{>p*8OOl#f#KNfY&x=1TXH8Ab>JX_>zr$X8t`po@p#kUM*r(3lh|lgbi%oSMTj z7m|2M_D}UQK?{OX)~m>JBM+f$sVE7(Ah{G?DL8hTQp`&rccTIN#^%U3TufvzPdf|D z4)3IG3}-x3ZK=9hwg+;0JUP&IzVS6^*~#Z^O+tKH-r2^*HioDCX3vqITr`mm#U2wzhvfv(6iBk_mCTfG;N&y@6WJpqFeK z2)%wp;0G*H3k zbi5?XyC~b8q3NJ~oxtq%wf2Nrus*&mR657->LhlEJOIDuT}fzbeoOYoUd^u3N`a2A zbDtGuvU#p_?o>+IRA;SLj|U@7jJ{B#h(o|M2C^R6qPP&=!-xX&_yd`Q+}a6xhuE;V z1V)dqyQGshG};&8g7$}M$#rk5u+dFLB)1S%2CS|2tJ+Tdk<=adb9GoH+YK?1%bhnK-w9 zY!;WO8DB2ckcJZ1RO_H;jIP{LO`8DvM^3#2xQKqQJd?I1Rby=GFXN<6H)F$LzFm6> zBRwa6b>nqKkaT*9^gPFvEpM60XGcow=W9d(&lBpd&Q`H!1x+wnK$K3U{@2siR}jlh zp6S?ySbd_(k+~gCsqE$i@e0O5)fOQTc8EJ44)F>wR)wxNvKxKb@;<*VguLQJv5TQS z&w*U%a%E6#uB%3W<#4*?RjIt8(9}UyMjs=Un!MY|$d8_{M5uCGENonu*g`Ul*VCwb z^VV{4jQ=%n}a_uarBU$~98n;;bsj8B`jV*S%{`SD-q% z{>M1=T+2ow?T}hD`4B=rc!z7LHjlPT_*Po@20qAkou=w;#g0P#A7Ab1LAU6 zCCpNVUc-dEkiGMLCY|bHoXk>Mn1eX986A)gTte1MZAH0Km~UE`kC5F4rcdv z8H}BgL@;d{+6%her4|pX?UrFNIIVi9e{T|(@?@!r38ypLM}pyl??`3FaJ0zIm#X1~ z9)06MDgHdg3M#0vCT-rNu?T5rXf`p^g^hB8Z$;Q6o8 z*bFOL_C)=7P&QVsoE3oSHhsq$Cc+JTtSbVETu^6$7O(u|7AePs9{XdC2= zYByM4)eKNl^^3v4Lix7ovM*bTj!;D`BGJLpre%)I-Hr3e5qgiJ&r-d+a-nR}UKNE6t1(^Cl|27X zF6qE3nV8)c2dsmzA-FBj+k_IMbEhn4X;#FnRNYX{l$QxI6*=zfE`wbn?Ix9+$MXsk zC{51(N+zd!U!@`2<7d@!fE00~^Us`n&E-uw<+I8I2$eQD1;y#<)3W!0|2HT`{@f&P zB#CBha9eV`{M)sk#f_qA8+s8EvcRdRb>&gYSB2I=EkR3UkP4Z846p@kLB7H9rjuS; zzdZOI&-r+=uQw1OH1pxzO;?zB1&8!lP9Vob`?|#~t596+aLCs1@Q5X-V?2CdXwG$2 zrj>DS^&%no^dU9IsYGhlgw)4%2GEXVi7_XS`o6BzT)}e?-Ch70FBcU01jl`1(l2r{ zI!{kB!l!6h7%Ms!f+fJH1nj#?DihAN?5BZ8s5`+C1pL&O5rrffnFWCgtR>wF)U3Ig z-ix)f8IN#yt={o4&iCAH@IY?5FQ3R#zH6k@c{yE|wb{KqaSD?|rIllr^wlQFy`cO> z<{qeui8ay@tZ~}Lqmp?$k^Kocgs9`m3ukHGx9I@nS`l z+<^*!I|PCG21Pl%$fFqvRZhD*Q=|L?47mr$jG*wxTCnSzRz*m@YQdV=^Iif^1~U_Ny+&suV1JS8 z2CN3Bkb3B9{<>ahxev<-mrPvGHMqBZx5daApRKyNV(#(6;c9&J%j-G*V=C!qSItH% zU@Sv7qcnsMIG$UR$K%~E^7;8B<&(K1pK@B!65FfR3(SY>ya`+wOJ(rk|F250CD5lL zsMz2>+0#0+ru=dzRL@0eTPzt;yyQH!mQ_RTx<-mvc;xkA01n&H=-H(x|*PeACq zwyFRP+plw|PrxjgNgaV4JDJef9Ic=Bon`9Ayk124JYj26)xS=;1jcJeeBO>(`gkIc!ZOAvG_WA0=3e|d^wr#H_?()mOX|TnI={R(1QV z&F|kif7R}pI7uI@NMcFT+vXe?*1NZ*JRsC$2zFr}SKmM)K% z2#J`xiEkfMe%kSgxwIa8psIiWr-MPs9YS@H$B4BIFmSw5=2;sYBSz6}RK33)DpMH# z;ddeLYs@zvnLD(+Pc%akXo+9jtWft)Gr7t4+oU``cMwrJmbUPsHy^WCsaZ#Q2(?}F zE*D)|Sd8&6ueXIGF!`CFkw)54C=W|aR#fN#RE{XK(R^Hhz4)4Ulv&^A`2zz`w?!@% zh7b!Jg#2$jEqNI*#1oi%!*AkiTW&U3&Iyevdp28t#id%gi&x8ZS+>o-nxBh8=BvIG5o$hU}fWyL`YUljx;myd$yC_;%BzKpB;~eP~*DoX`?z*q^V_P4=G+| zeKpE3yz+NvKf5;f=9!^~`!*+_#`$)&6^PE|b6Xs{J{(O8_sK35os(gmR}~(Oj@iU9 z3_?ynqhG%Th)b&VjHid;=X`WVb63B}t*hO&OV>gsPtS}_-JEM?d9@%(rn~mMM?1le zRnX1IA)=>D%t7&H(nLRVmxE*BkYU>XK4R5O@>D5{OGRUJ)td0+eQm#KvF@wk$QXY* zy{;J*_YHD~hS);39p={bR<_m*9Qk{4ws`V3hn>uoz#GrjEt^(sLCU0c59n(Pbq#f2 zAp;TOuhRRyTJu{Gf?_3~pCp%^e)POO2;57Zl&)`I1{HQIMrqPTd`k%Jhn@6Q;ws^+ zuKDM2eKqtEHMY*D4~aQJpVitzwQw>Bj^J+y!k`NNlx;8g!78a+LIaua@Zbw6s!c@Z z+uV@G$3Q)w;^#1=aV_OnT^!{GH<7T)z@-E`7FP^fiZac|C$MS^Jf{~uk#sFk{psaE zud0RE>6KgNtytCC*)5keMfjEE8286~dsEo(qL8El3(_w2?uGAWQ)_F%4>yk*1ET5m zndrw2gJX9{TcCQ?lNNpGXrw%~YDKrgs1B2;)zbS+?B}+vMC73|uHhm9Oi_fx*#gH@ zWu!)Zrw1W$Ls)SscCW>RK|b@OM_k^9h~{P{!rVQHdL*juZUY1>QtlROM^6p#r+?8M z4}34we1&S^x}$s-LWfxG&2me-7C0q+uDwcTJ;mj|=6zyflQQ$lGU$#jb0j%hkhnwS zcXG?pvH@^ou6$a~H_eAg)Qk#_4h~U%vbMIiMuQBt=KU?nfEN|PFacSBLY@P1Oi75) z_hreQa$mer$h|?lBA8eJ8k5B1K+R!0H}i_9%juUSqf4k8`pEmzm8rE%=(3dUJ<9E^lx4 zZT7a=(3E^O{&IJ7oyU_}-05r>*MmcDVP(O3%$gUh3Z;m;&+LA6LTxP~E<{2_&phYx z)P!+xCM)Yg*&PqQH}0jC!DC>cKaRf^Xo`4Nc&2D-@kl#%f*P{;b9o8TX!*6+sYhMrhH{@gW80J~US}fJ4{n!1g zH=*XoO{a7wb5D;*rmKnxaX~p2+yA5MEd#3TnyBGh1Sx3*N$HXn>5y)a?rxDocPZW7 z-6<)Zf;38(bax|N-#$KfykGq@;J~%7y=Tv?wPsEH2g=^9w{55Z2#{&OILiAOi$8Xo zh*mUuHHgh8NS6%R`96CWNoQ|+$vexv!L&m>@6@67BK(L%=I=Wh)W$t|T{ZMRCb;8Z zgokAI9?+PuJt-LY&R9jizh0@|0khKrtXKe_qBK*T-3lp`HF2mitC*>q|XwH^TtJkz)iVJ zO;5xrh{PWVsh2`gJ~W zo3OQ5lplreRP73LtTgcmH5|=i4OnZ4>s}s?WbHQ=TTf|gVo>rn0ZN+Y$1#+{Y@HpnAaD!=Pf%^EbH#C7iR|>0n#2MzbbD$PHds zeaZJv+HxM2WT7`>9JQk|p_%I1CiA?#6NIE*1N|WA?2-9c$f+aU?&LygMW`jr$h*K@ z)e)Gb$}pSXr=!xeo|3R7`g5+3J^KA}2wd?qF*%m`z8eLVot~<~*C>IgKYu!ogXtxe1vxDKg)!76wy^Y+>P*sikC z7D8=qcmfS@D_H=P+e>YNj zBGm14q=ncS?CC?uL9}d0=w$0R6hMSXGyo_4w~ybwy?+)i#Ck5Hwf}f5>b%8qDg=B_ z|82~XykFKo1p-iD00p1|a3jobh=;4E$0XvkA*u2$Ljq@JYbZTeCYiOLe*bEKOw&^z z!?MNYBxu3z7Yfwzh&6e^8%@$uo_bPeh3R`|dhRtkwjBWV!Qaq~^ce2IJB>-HiX(AA_B3P9?TANmKJ+|t6)0}x{x zomx44>{B5d9@kUjotaYWBVhdy_r^>PultKoASy$8G!}&f30&DGY+G97k$hXlRmxB* zM`Q#sA01I#BU#&##!LwspWE*&405qP8fh@%`nET|(q#@vD>12LBsi=W^Oz0I

S@xE@ztlW31(64e}tJ)IlE8#J*y zgDoRq%L-hVCR1eG;vccJcKoiX zoc(K?YZPo4V}iocN>UBWozT4Se!XP`2$52JyF6Ky*297GL@O6Ni=zj1hgr3U%W19r z7(21a*0Sd6rsAWn%WMKCXo%X$DLE|5{c;z!Zp85S4Hp*(kt&8AO9CEGPz-PW%B1w! zP(aoUabI-a%+i%P3>bs#O@=l5qYsG4>-sbVj<*YtA^qE{_b$Wyf{b`W*FPiW#K;?4 zi|Tijw`@!GCLuV7!rhI7iI=&hvb3V*w*O*yJggv36PqCKdPEoV-i$pnrRNhaX4|9oh4dF#kMyXk;J+n`h~d;NJ(ksLd9xM!{imF4~2 ztnNi2S!}DOGjtlv#n*h`k zsxNV#eZQ$}rj;PLHmg2ehJP@d^X&@4vJw18b%YbY=CD`_4kgHD?`P6#ZXG`xF^L*U z6%ZRv8ZSvkBmdUy>SV{pD~;U!tQ$PO?C~7pc)GT_`!}~YS?$|(gZpDWX7A^p(y9C* z#*^g2XhcLrSyG8H)8Kh+bj~+8Sfu2*lTcr54JG21=BInA;dqwrr+|}?w}eLqECd@)(48cZz<*`P0ZP!lYCVZp(q~}^cOyk&2s;F_#IO*5d^@O z50l&^uU)*w2#}@C{Bp69Bbsc%76NP?I3~yx#d`)XGavUoQb)II#H-+_lqYQ49f1(t zv*ARS;u$_62#JPbm(U-(-2#+195<% z!^G?l8cT5+0lY<|ltXMQLRVo)d7zel}@YVr*)mm=pw(4nApAF7V%>2<3!mX$T z8RV20Dzem_8RZI~E7RbgfdwOth^ns!=!ew`d10i+#Bzt0_ic}?K;RLE7(mDWqllFO zyM}x{(3@`&S6EhDr=mB&~+WVU}WhYIOCeyUo$c7(=F*cat^JAVOQtjvsfR zOZBpjKT6Z$mIua`a#M9eJD*=g9+U;UA)IB%2kq!O;;-|Dj5BWTPC$%{-Mk#IEU8b{ zX;LDSbb<@tjGq}OKv1(XQIu&eK&h3|YJ4q$64gxCyZOeRSD*@)pT7ydAoy0!ZqCkK ze35Wh)9nh9p=Qp%fvWv+#Wba5$~#v)iIne|P;liKnB;!wyU`Ed;c}xYNLzB%5l!o8 zb3xm=+}TF$*ELtZgNuYR1H z`gk%;T=+O0ohwg-e7qQ_kr>mlc*yvcLb^TK_Z~4h0FchKdNM?_u>QqTrTY^a8+|2@ zEmD1kqM&3ZjQt2qe*^vH%fB}4*Gt1pC4qlb{K|a&WFsgYPvL)Um=8P&E*5-e285sU z@)+tRFeb#YRk{>?!>vL%8ZJ2g9!-iNfRAa(<7R16OE}lJs52SPh{0Q{M-%fUvevJP zDwR|iQ>wVFXP<(Ou1Impa1Mv&t6EQ72Sbt9)WH1*BAMJa`O)fS6~b7p;$*(yQ@;Jv z#nINHf$B}mgi$Qa7^N8}4WOXGf7zLQr94ubww~5!IIV>z7?tb}E2HKEok@`y#DKL# zsyKIHeSXt7Rr@VgIwY<2)r7@7?A7neX^@Ao(CxJvJZqilIs}NC>`22uk1ldQpeiCD_#)%on+BcgLZByan-*luLwdG56QU z(}sKCPip02e1B~~4=6%Um$OF`|Co%!I=gRV^*Mg>ox_UU5jeeu^r3BX(=_;sE z`{N~o4dMc1P)0?YUEfv~+53mUTh7&a@!q^{acA6ib9&iU1`EgxnRwf`pVbgJt;hhn8( zbCr+g!TQAJNyD?llzd#uKb#%0mGJbLo2>bA4@bQ;5iufyYLiZJaygba)R@G$!cq9* zb!#>_uZbTb`&rm!oN<>nDXyQ4AS`Gi^9)M7@SLJ(b?E`hWVdLgoZ?!UnAveb6S-h`v#l3D|}cD|9q zj^xWL-X_Z)r(UHxyeEADhfB5_gyZcdDddMZK>UiwOMVk{veGXae|81+#!tkx}K`jb=xi*2+9jtEwdZ02TZ>ibEPgLiD?>i4?96VD8w z+~Ey0tPbfJeXLuHdnX>>K<_cfeRIykt3$j$V1pNbUcjC|R2u??+2>?q%?FhqS-{fP zc9AyUpvG9+rLF;Iot=hKo2?7Qy=}n~k;=A=ed6LVV3|$yp9KUCMj=)L+7D|Nw6!dw@j{`vZgRC9_`sVZGmTVRq2%1lf|aP1C`uMi{F#-%2WrozCU06~x@J znbpSds6y>s;k_yExUe%J;!I4>?}97AnfEwd_g~JfEdHW4Ha#&}gvBO0#lBvxi+b!8 zy|SwgFdd_gZUDxKwGQX1_EX3PPDDxB!say4Q8xa@cWHIn$JI1FDBLuhDQCNf{(a+U zdrZ0Y1>bvKndwBg$GpkQ?k0}~XqUu8ah1_j=vBC)> z2XVjaJTzg;SD(PyN-Q|7m5H;|ge)g4(j3#wx-PiAD?8O)o^}ciXS@i9zwx^5&TTt7 zvrVf-=k#K1fhG2BP;8mJ=QoOXL9&UPHfrCQZLSX6@!e@&tb$WqLmQ|0cDU>D_ri|+ z(JPlj{>5psW#bRnO@Qt~%bP(e0Q2IsMqBu3twmfT#n_2JTgG7SyoUb@TtMA!ngL5c zsexAymEqGDYShI4b@`oJwIXUluZ910`5~%AmJMA-tQ<@UtzKhh%B~U2>6K4t-*QKY z9!7Iazoqb6_QOw@F%*UPLN64@ZFzc3Gp*=t9X9#`e;xI{EnxpM#2E09f9dOm7LjdR zh=n%({CJYJ{rf)7cp1?`i*KFyC_gjoHbL$S_rm|=1nW|V?r!7D<+UZ?5cSHyzej&~*#g)&A02G>4;vRhTy=WbZ>U8tEwsUoKDE z)h7}|ta{hQU>!p7DpuW;rqSu#&!-7pnP>fKZxVq`e^9VLiss|112A9i$QNZXlEOz! z{M#EBm4eyvV5Uqwh8~CC{UHEoj&ypxm(kkFT(U&K!ZG5IoSZ!NM~>`?zus;i)4_xy zAW8^unaIe(s6h=x{LenuiB$BnAFH1-S-`#WqaHokwTyThyT`J8Jbd> z?7CuHZ?)lZfAmB7ou+ljw`$plu^kMX0u8RH=Equ}I>E#vNXkNFi(zs zbKa9tuIRt$Eeq_YC;x;W%HBf_-tlunvs>Pi?Yy%QEAj$5fkea)Rd^apMvAwl@g=j4 zo1CvRlri5czf$5Bd}YK8skJF6T}W|nF;<(>QsYFOk~->Mp4y*Pp698B*!+0lqy|}g z$=g8aFm-7lXh;O(I~-jwJ?E^k7_=|RW1RKwK*EMZxX^ZVt{PJUWiETH1k`_4>H%GKeJPosOC`P^I2B*5IHpl@8i#WI)@1|E}U88dm=uvo#X z1v{8iTlWJsRL0>ynWxS2$mQb0bCBr78k`IH(GhERo@xR_78k~<1S2W6Mp$>rtly7} z-3tnZ)Gh$Q-Z+uAvyMB)Ewps}`d zu0c6c7rW=q7L>L4UA^eYZ#>^D%%`c9sgzviu?^GI%D}Y(B6|G^sLaVM+DIKQ*JyBK z20{jBty#C{T*P%qyykhP7}_qzu3QVxr+>a$+eqPQOUL6NY7P_?T~E8*3?)mE8!cHsrliX^fkqJ%EM=o zKwt9qp3n=lYWB{?ZGA3ra_dqQctDi#j-UJWFbxX*(gf>7**R@Z=YO!nS!ftlx0ti zf9vjB)|g=7Zrm>eWyl&AQKd~mi|mwh*}}Yy6N+gXp9-jutHpIDD!O?B;r_P!F+GI} ztKD4|8a>WiFWTFLQ!}TuKDI z7KH0_5$~9x$7^)1Re7H_o3H@ylGEB9CGKe!Z@>OMf|MYsXJX?%IexyF+n1f_c)>#Z zJ}r{B;qmGCz?;RZo|>p)Uji0sG&XJhVeqt8y@%!?*ZjBPMp*w0J1y%N0cdG=I)9lb z76HpB`+Ob-B%2&GqLuE0Oe@3Z&(jSX5Y84AnbLZ2q4X2(p=+)M!xulEzwplS;QS}~ zk_3IUP62t3EBy~!+!|T}{7u~pruW9LDxs_~%>@#<6pt3~wX?VP`RyfY&9LyhR;%tJEK^|0CQHP)bJVk$H z+>n=QYD14;XpU-s&1P3IqxryVdG_GEVi^J|s`&=IS@x|Cw!I&Ox%TiZu+zZGLL-=; zM8li5GYf~oiCB1q7ybOOM@ab0Bju&N$t}M@?e(HZ6F|BO!&-Av_9)^IW;d&16~oOl z23eX*C?X#K#R;$QDFAj}%3+1%jHt35od4+L&~`Nj#b3KNyWM(yXVRmJ++SN zzr0(mi9$3~Vo$mVmQ2z`zW3=){jOsy5VmHx$YN6x$s2{Pc=b)_T!AL|C{5=N8}L)9 zdJ-NIC`&`?@xqwLV6Uc9H?4_?U3fK=*YAC^9YN%AbDr+C$=jj8=80uf#d=mMeOUY* zN`}G7xOEtyR0&~)oix*MEmR*&!0PJnX?&tB$w&w|9z31nqThx12;;m6XSw1dF;^jJtg>BxoVP59%b+F)s<{!p|Y}^=bI9x&flxrRltOV>M*bWcCxnH5`KUZzP#4 zd29{@@fT}+VsjJWYKoJ3@}cF&GIT8z3Z@l|I9i|C4$g93?be@f5Ktsv{88d0z^&W~ z$P4;FySs%8P;}jJA$F{6>&<^CS_GhI5Ay&*2>>XRlHi11cToSwXMe|r{!}33HKW`r zd(4BI$GCEJx>$g{kb#J$vz7C=ltKPy&t+2*Pb0!#n5s4Z=~Qc>Z&ap+WaVfaIVf?@_JP_zo3mC-#m- zd)zwsSdl2qTx$x#Jg*sVJM8;5e0M@A2TkP;3*w?bK-#QX3wpipE05R$iBKL{|KpBm z>JYWAzPFS|aoS=w%b2LUOb>5*7&FJOtSB{!W_*WrxiaZYIPe_~%pe(4@l>)nJ?vi8G)`E)<8&uVFO5O%j5xuc_Kx128(q8!gXI9sSXC zEGAR*&`VjiCMG6F7ZSsD*2~n%5MFseF7FzQXX8qu&1Myb-O7?Ubl9il3unq5cyUdi z=o(YU5s&;tz|vW)w^M0!EQ7J!-`fl9kEZDUb%(u@bvxF5`ejsE7)NLTFXM$nw!o*NvAN}9KmAmqCJUlzdLEu&&Sx&t94u?oSP7)n0F zC0AFWsaTqkmjTJpE^yQ_8=?)BnA1_N)fYDbcgH)4AnqZ}*Fc5Pm9V^9xw)Ig`bg9i zFK=cH;}xCr7hy`7HLxm@mtMdn7;qlM1oVgmtiEzd2Aj6Px_>$mV_H&bgj#KA&T4kQe|Yg65`XRw7LR+sk@r~2 zefv1zGBu?}u7jKhS2S+OJ6lwu&TO)cWkX&io~U8rUTCm z%qbM=vpg%3b;aqAyY*{CH#a01Zm!+PrRV!g$j@K(o^-W#T}EqUmd3f-?x-5Z_lyUQ zBj{|*qcIVH7e}ES>aJOP`T|bHWn9>&-)kAo?G^p&DS?^WkK5_EqevQ>O)?2E9#^7~ z=s0Mpe5TkMUbZ*4(S+&`GE^6mhbPCu2YjE9dwn=WMq*lQ2j>MIzbcu`Pu{+8b^}6F9%o^)MSKVF&_XL{ zyUEd+k^VXUqChD#N+QaL1xj3(Dls~9FoYk(v+YMBKRLllTJ!)nXvE9r%!oY*b6v^T z-((Q()<&k+A}Rm6bEe*XL@u__;@1;JIE|pxplliip@H#tcWv7YF3b;Xta=0QNNQ$Q zNC7AoPr z(ajV!+zR;#8<=*$UCCC@EoO*zy1!yz)$7lyE!^wRmCkf;ayo|r#INXD=W4@;Oh%#z z&L*sf$LwpfK=k_M8niqnQYSb@kEaJNCZVI|^fo;WJCPj3kO<;~)>c7&l)lKHZXTXz z_jh;R>Jjo_0%H3fWJkdNDUbo5UqR@O_+Pt23eWi+S)~cIZS(*-;EGICVbM+(BnK*y z8TqGoBEAqTFK$;|S#`N8S>m_L7(Sna;iFI(Y*$^58_6NWm7-#jM_CC|HV;vX|T;f_H!>q{kL zt3j>(LWa6Pf2Q7wR&rs88W!rjKXZaF zvY!d@XE49-g)J}mAH@A)E?34y2LybZ6b%-RbivM-o6vdjw(chcOVP_s`1W0{MV46S z9Y4+y{Z)!KMGiGtpUngqCsyhIvtj>y&Sw=RGXkrKnwZi z(DpLfqy$8##cF*P{ZN7cn=t-%+Pdn2PZj;prw6|hzaH=L<-SB2=xK!p6D?reI~4Yu z&TEP%GH$6SZeAhQVf_Eiq59ouehdU{m3gW|&UvWchKuOz6x>5dTWAN$o8vLt^O*GF|O^r-23ksp4hARsW-iosbvx zONs$CJar(j#{P3U1M~NLnT(V@O|7M0f)*%03KlSa$tQf!&Jlx10VbN#36=v;IB}Jp zXAB?PlJ^a@a?xL$c1yzD`(|H>Eaywi2wb0^kf6r*;Ezy_%TfgpwU4S|Ep3;Pd28K} z2%NdJce0#tXO#yNgY_z?v;=IUy#VqAM7yMR@?tNOW-8Vu?g+GOo0cT zW$J642fweavMZ^KI~}sP0ro#3%8LFe>(Zc(UzsL4xPS{hzQxF7V}iETaDiKyYTQx@ zri^)c!t`(q325+fo-g;n>+@TUV0i#;IHaX&unXb-Nu)3T{;ngq{^nc_wb|`TpX?4H zW{Rtwul)Jx9_3^6h|^Oi4I8PZcjqc29jl)Vhyn7Gp^_iIY+q+dnAsG*Pw`_WH6o?Dp7g3r)8Uv z#O0__qMl3i|6@4=_vUJQK1mI{jQ`lsI-0b9()Sj}fDUh2h9}GG8ic(k3_4xRkT=j7 zl3s28&q2lc!5M_$A$GkFkbVP=4vxP9aS~FY*O{^}h87^R-E*tq{-n%!2a+!YZ_o`J zNtj)6E;m>ySE|LGPn$GG-aoS3hSoeChb_0b3GW{Kk}LbB!D+^oRl^8u-*xX8u}8~Z z+ov=_CPGw8%;LproSwz=kF+QW#JI}UszXa9d9 z5Egt~>A$PC1~0I$OakYW9eBOV;IKN_aiI~RUwrGqqUd92>4J#=eCtTS<-o#QC#ux+ z$~?qW=#vAO*HQSd*dcL}WElNb1Q(ja4S{c0RqmAFU#>Ef3_q{y55=uVc#Glk3&_aLVB?TorRdCEL-4l*ZJKz|D9Iy;h zH(9@QH9(cYPqbuF&y@S$7j5_njQ|b46I?q`dP~7W>-cT*V-jIys+aPUtr)eo;LA6S z167OUcpO4TCu&85i~KF1Gp4VdB52tJg>z&VDd7~4{c*-FB zueTKK&rjC^H%-rJS^lA%L&=!jpJ$0&Rel8qfC*9UPw@0_ZYjo8_7y*Q&8G^ux6Yrl zJj`xe>;=z8Pzu|31`!EN-O=H`h40LHskCu(?)*zC@1^P)iTL$MBES7Su26bVYMD^D<=ip}l@cecS)STYYImFv!Jq2|Lg&DegOj1?G@@9Ew_ zg;yyvHd{+#9=s1}ei^dwA>gqRbp6g1pioSsauT@vd!Cf1k-mF1u@$jVs*OKOcr@1N z)5=9{e^U=qe*vi3Ydj5?cdo?j=#fzYN$8Kca+z&bYQzhVBgye=IA26VKdZHQc--N9 zhH#wVc*dN?yr#xv-THwogK3JpA;VFXCs_y8Qte+Fk4*xRM}O<=Ry2anQ@w{=m9%aV ztIWcYPPd`ULZh|xx{C5W+Ri33;b-@f`_Z<<*pYO#zY_QhX0v%=qV6^eEcz=~FI|z# zvctn1(~Su#tA1bTMSMAF^UaZoZSGpnwfjt&J6sBHtxsASli^e|l`*@ik?mvfA#!~G zb?nTPi1`RGVf{HgfvC}Haqmi0PC0Qt#{~{#p%_!Ha8f;qy8E&E$JQm`eI-V(`A42N zh!5UZ$u1e+iY^&0i}nE>@{ACtx)g4yKV8sto~Tpf1o#3`f&mQ%bQOa91#zg*188 z-6!P!hV*|n&d3D*uKay;;gqu6j(4nlb%ruSs-l>5#BE|aaL9_VDcnM zB-}BPrgJk&wRXH+VU-~|e1Pd2|1r@|_IAw=0=WOSLiW>tl##0Y%Du~_)4AB0z^t>@ z?=g6OH5j*@1-=U3%T+3{iOBdD_`I#CwFg@de`wHNGNLm(K?ft%F4np-Dh)oKduwNOeqOQOtb=Jq!~4B@J4g^hCqBKIdvs5%xObuv zyT7lN3$tl??RO!t{crBkqIQ2%(jYY5Vt%f%ps4<$!w_Z>S2sNQcB47ZiZLD zg-{a=?X4qN&U0ZBrD{$_a)LpL-oKWdZ>grAl6bk9VViI7(sr-Xz@$u) znjufbxe4%geM;ec!O!d6S-(3>JI?Ct>L>T)wFmm40o#68QvkW!(9iay8L%h&AmH}tU4!d_$hYDkLXQ1SX6dDn z3N`uLC!IfVtbn7(-3JRklv9{WwXYOR=W9hJ6KL6ubti6&sMX)!5su$qoRZN-55fv) z5oI@h*QM@F65h(nil-A8 z{3)RE@bDm)Vbov(QrkP3RDL97t_Yf=|M5oYGIq|)MPK4s9WQp!0Q2DM1Btq{ z#uv|@QJ~?`TYX?j7DVf;H!W|=D~BJphVXt28rItBYqVp#JlkH*s*i)tjqLH_bxo(V zUFm@DaogO1f{^_&l|eHp7$PN4u(SD89+hwqRW~U4B_z|V&i3YF33fe(Gt*US(PWxs z(*Db|3D{c$a`r6uCTNm7h9k&eP0h^4%5=ph@)acw2qXSzdG)IM@0Cd5v-rNi=8RVh zPpxtJaL=5`*6D|==fu|NMOhmZxpQ1*=O>Q=uWDp0Qo8d$PS#cwb#&j0M=%zAHTXmd zjC3QWDQ(G4Y}-sf-3OS~k6WHY#Vbfla6o*F8e75_7W8yMbPQ&&IdGv8#Ukz}Ul7H# zgj2vTh9XpaY~tgy!??@X@PX<=(FB&mr1=`m`7K1z;&+KV_AJE@B7@cNb{I5~Ojvn>Hx#X_+))#b7NP>`xJo;?znFX-uuh8Z~oL&7anu;~x<# z*!pJ_!?b1W42T43>7?rqK5n~rRGN=_+?@~((PFK9IL9hn_NT4F+b!<&%)7SG685jp zc0$?XF!8UKnrqJyMBD0)>GEs}T*^WE$7~;Z9N3JnpSbcaWZy0Yr_R6&_^=C5(S`Da zDAZ+fMMkqI{|nbpPm&WO%voaCRhT-}%Iepx-S?NY!RxqQg4-w-fP((!SDU(XSjmY> z1tNIN7UHiSd8T}d;X>6taEeDp`OS=1JrKv$>-K*{eL8bLhqsf^@A}UV7fU^JsPC4|OjukVw9y&mFb8T9m#$~`V}~=uDrnWeP5Tpt z(~C?H)y`Jx5N=7^ZrELYXSVHwSB#+2`c7^Tnr21fYbPDoevKtO96{2oJn9G>-it@e zA|Ypyw|<3EU+L&v;YJ^%%bc!B6bdl-1R|>1jR+}2VwQwMGbz&=H551KWU*=FKOd)4 zg)NMx)!Qb!@0VeLFJ6G2^jgsr%ou^h(EZ5*SZklG(Iyv%Ld_=bDJtUfG~r}!JIjk5 zxnOJ-2%yRbT)GFrgsA<`3g;%FQD+UUH{e&eii$6^5>*D}*2>Vd434ayU$Z5wPB^OT z5JBRk$Ok4SCUT_9c;lTXoPh_N45Al6r2;Vhg=8k!h8mw-u6=DpRm>aEo-H(!7dJ8b zw*yJ|o5b<+&~{V!ryie9mRWb(2?o#kfCB88J}s40BE8YtzOab?4KH&^y|PNm;^Opmxu zwD&g9nSXK>vTb!Ce$O6m*8_v;Zvf*Pbe>XZx>zf$jg*zYN{l`S*l}0=EtK)^%Fo!B4uaCMqSdp`J-*I}O;|WFQt!FNpN4lXbdHTv= z6Jyz_ztuxb9rKKAQ!+L^>?Sc^9W(hQ(Sb?3v{N7h!QGT7kP@Xh^RAYEiQ~YEE|?Tr zdVpSioI=`nAsyQlLwAc-N~^Y@q{lrxjJ9Bx5JLpwS;%) zEJvg~RN_`1VL`w3fC%EunPdI~2S6*ITW`Hmk8l8SS^!D|^fuw;j$L%%4 zUw_p7yXE?V&1YWDAm~~O*m>8@eG{aa^Cc1bePyrQ>7z@Oe0%(%_5T6BFtN^6r2;Q; z%1_X>AwPa+#Kr$RX%b~w@WDxg4o-_JI-63v!r#9-Dre8I{5#e<#A75}SVq@}MZWCQ zx``?qPrcLVE)MpFXHixFy<~1t-IQrztC{=!+Kl~$-&o(#|6#MSRZG07S4e>Rm?YBW zq+GWAFm+DG{hk$=O-eoIQ?(#12T4%;jeZ-@^(TExwi8MuT3}j#5SXlknx%CRi71v1 z#D96ID>m5Qelu>EX=*AXn#Qcz{Pq&}soF1TC4!HJ29F)_!qH^(p=z+;z2HRx;2@JG zu!rGWsNUbuV1S(`T5ib{scJuQy@SddS6QEEawy}*I;%OI8dEjdG_gjy2G{- z=Sm~OBY~*)Ao-#H8_jo#ZP_wN2@?`%99}YKidkGucu?7INcP82DO?YZ~ z^@qLwK-7SKqX(!(Retx$MP*TR%AvwFphR~UD3?^81wbvr2kgr(*2jI#FE%N`hBp74 zR26D>vau(Jp1*)kkaM)<{L{YHZQlykeEWKJH$?vCmJd7rEJiT9x+9#zg9gb>pvmPY zWDty(J4EGU)M7xcb=VvDn*d1{%#O!9xSJ-|;LgwT#BRgw)Qf+npJ#axYV#wXLIjSR z8%(z67DE=3sqJgD9cr*=7UO1g=ybl5!c=3&1u)oaPj}xxkFXhRTOMs{3Ql26HJ#rs zxNLn%=4z2=+jiZ?`N8nD>r=$kn}sV)D>MU#lJNOvyC>o`$}fJEb%E&_f0;XFBKv>b zd*xoO`EK))kHq0Y1w@~#vS40AKFHQvS#(MzL2O^uu5YOlHM-ktO_5mq?55sX`SBGt z`uee8`$R*4;F^)B=P!?P_);-?IeNaY(BwSvN-fs#u|^2ksFbFVsYx4ThJ!?}4QZa) z_OVp4P2bB<$7=^>;Yfv*FmW3>ddf=E9$ob;y3#l=qypyqbYNdv|6$?d$jRRkmJ@$j z|AY^v>4WR!#0v$vZkBD+2(dB;B3DA2qk7{oO^qMgWXe2}>CCnGLx8|Y;#6NKo?3xQ z`+hGl3a5O3H#j8`OL}Ex>u0UQCB0^gBO>idPG16+qS}>k0=?5k){{=6KOfd=U(>#$ z<9=YF?l38ao~xI&oou}{9v=grfg7*Y(Fw;wvn_nfuj)@Qa$)KsbeUfk?Qd3FmX%m0 zvUIAWEzG@+U)O5zJFpgOoc72FJO-1jZxbt-%6Fki$Gbe7@Z$*R?2+dEvDdywa@jAa-(|EB>4R zx3~e-fa&yK94C16=qF%uT?-R%7n}Cdy>P@Kd1|&@4(71`GmW44Qzv1046@dG6_NGF zaA-z0U3=cXpjD$zfs~2{;Zlt-Z84f-GlruG?L4ahf!RFJ&H0XFr+)X?cJDkv(0&em z%GB3Br~QC0P>HoIO%OrbDm8CEJ@AB?^5=$`5YrN`)(swlSF~RvH_&9QkVJkjetx~* z?|W^T4a^^FwaLrkB%_~3?U3d~ASSQJpk{qCx#BC!hmZBH;&Elftcts&inby1PVSee z=7)*?ad7e^CF_W~Q5PPL?pU!?h)_@Gknj$wUPSH>v*bhbu*z23tvaZvPlp{QIG#^r-63%2RT2);g@J7y`^&93V(uhe3J@ae-! zwd$l$t@A29E%!vnMRp?`O&Vz`IJ3i*QC9hqTD-Lm z2o(LwBD%SZtZ?&sJbX%h)mKBU1FZDAQ%Qf6a%pDxgVE$0j_;jazMt=jluk_1X;mTb zy=OlhxjVS%Y-^gg++Cn~xVwF4y~W_WrbnA;er}&WH{Z=+w3&dUHy>}-6sr^S>ji!3 zcPRCKR~D@FdTzB(KXN%(A-o~r35YTp&lJytH=NdevqljR7a7U^Q%%>!W+&@5gQy&z zN@V__aEA@mRR59Z0++HnUi!mfV;`C2;~sR-;WedMeUSSXJ+K@#8eyi~{@2dCq>kjo z=}*g~Sk@af#2CSBKj0pVzmE-;m6x%qhuq67_Cu=lbfwK zEKC0JphOLvu97Wrav{ff%u#M*D%D&3nsl}p<|(AQ~sekp%;lt&T4dv(mGX=$n;|IIk;SaoKT4z=G{;e8^HZlq_@Qkv}8+fs)= zdXawD=-1f@R%bKcZ&J@Y!ZH>UYP7#c(Q6P&sl{K_Z4CbvnJ{{1E8w~p5 z*H!XcCWbCXkm%~yBJTRsSZJ=t9e=D#?pHMF<#)Y9jAyoPw>7;~31di{B9&Qs*!l1y z>$AoiR2hO}(hl{-1*s^jIwFmE_MY4@qOpopHhA=@yLpSBbIaZAbfxnq2No%N>F4xnLh(M zyk2B%R|VPqec)#pi;cwXr`YJkwks&z4jv{{iT8=FN9h}wyd=+Jmr#c|MRD5eFg^%ap@Nm;!_vw~bIX+h^5k^Z(3+~Ok zw_99u86pU%-09YaU4e7=_|Yi?U@WK7Y+eZliGUkjB+%FOnBUs{Kj%+h)!Ldi)4y4GewbRG06)DU2rrU zFG0?#ccXySbBRU+B`m=xBj~Lmj=4m8I6ijx%{g$*B|FtwEG;dusy4gcZn#I&X167D zH$IDcC}=oTUTVEIkM~e%Fy>rufXy!8XqBCoLTtA>E}E%v!hw$}^v=LAmJs;6(BO`< zuIxzWqFHpr;JePEOkch9-Qu|Rpz23C$(t!{kO zk49y_%||z4OJ7Gl!2w6H(r=-R8+d9kr0$_R8TsW?(XhRrAz7VZdjIP3F&TFy1RRc_kMoo zoOcFh_8*3sz2kdbpIiakz_`=-U8I;dYcrIa98K!22p^t)pEt!ZDt_>Y*=fr-rgpKD zOW~x`ZFLU-RQrZ6&rfSY2|cnGZXkQ?^JO_ z1oq?8lVXVy-PPVicWyw*797y(PgiKEH87-v!q$8zDS!@(f523_)z$_?+t!i;iU_5@ zwUNgP*JK<&^|iuo2&$)V9$*15o6lYw$p{92P5OVepDafF0OC#jvPrq+Ps}IWgDsB- zdB!&bD>HkSq8E`(mICzt4FzTyF9CBL2Sk~}`}s^&-s&peO8Cty9r}GSi8XGsfmGgl z(^`rmK@P*duVV$fXVM45%s&Eabe$fkl>;vJc;WsO?b%)$OXs)W6I}Bgyf4XGz3xFV z%9$UyU^$)H|14G5FiF@cLGP-vR(LRXrFO*eQSG&H(A8u`sY7PXw^~_1BwC`=8c?9L zHRISut3iXR8Tdhj{1s3Y^n(l z!IW-jQpprSyH?VH24?Fk^+vr)^h|+34`dSm@d`T0Pmmu867-6FZK?(nXR7oDz4%6% zPlvmP*ZHwYMZL~5Wa!xrrvsdOJm(ya*YTOWtsZe4VJBnCxy<~s>Jhx>U(2rc!>lt; z2a#5h?Y)j`MN&bt@s65qq@gR_;)^vBq78kq=SU<(A7WO!_Veg?7396+V_2ykW+F^~ z^H)0bIEy){9>3QYvk)3p&ur>C?uNT@G&(7t(bUqZH5z-!Bts;8lU2`8u#1cq`+fD7 z3|}8p#EWeEft-uC*ULIXvlLo{+qf&b#wlh`@%}DzL)#Nw_0~ho?bu@!wmI}~29FuF zzQfN-8rs}1#Sm)~r=}!LSL35FIRt%)Xgg8cpdvybHLZ?QLBrHGUT%4a`>gwL3h%U_ zdgYw$QSd}vqO_m!!M@uO)gn(Zl|hI$k}K~AsMU7!Yl?`QHWoXzg8Rjx|1+R@Ip-ql zVpLxyk(nr3+K1Y(9N!kr$-iOAmOan@cJVmVjcWUHcTL0AeEUymH6bzl>u^trVm{20 zc2N6U%xnGzg59M>8oBWD;xFf|6qSNiL2Mi2_Q%LSuJ2>cjmq7bv0_lBy*yo&eU|qI zbnSR4GMBC(2oUrT!tS(e=^uLStQTO{86LPeLbb1x=6}~#t+A{HB_PV7qaFMA>XNFv z?{zkZ`h!sqAylqgk+-8hBG{m8w7sH;k1r1~^X?Sw_On+;r{`VB?ybFP`#aqg!GaKC zA;FVh{Os@iov?(Gvrjo3bkFYcSr^FW++-#;BQr06Jr{! z4QibkMb3KyYYa>ixNUv4ykHGCr`4j)$hHYxtQ8%*GO=Xk_;EBji-y*el&u%yIL1>e z9A&NYlp?`C0n?5%Gd}2ppvr*T)0JFlWv?=uO`ypvqs0_L<_-2;(3Y`pSjuua;79QJ zEuU!OM-XoG7dZQo^I2}qqyZRb;}PuXm68HVtCt8$#AtS+0r@n_p9shsf?+c5p#f?; z(Z@5g!i023rW9uFwz!Sg0)=26KHf^xuaYb&LMwu0+PA#!m??F;iO7V(G7lLpFzr{}%qXXUn#tys>fi73&yyZO<&b`%JUm zuAeHH+3TF{U^p9oytfUK7GLV+eITtr3SCzwNJa7c`9hbw+cS66@ok4U<% zs;oY4BNy{h!~Qh+W?^uB1dU-c{PrYQI<1h`Y0=TI#W>|6xy2awPtgyi2rKQfx6x#^ z-nb*l9Wn?VsESR-!Vzhs2@LG5G51DuuJZL(ih5o3YA0xE-szdb4)w2=Dwi6OgIy9@ z9G*x92?nXv+iHwl(dibL6| z8L!So@WWZBkF%q-@eG@e*X#Jf_KEKa6OChv$1#;q)|^nl*d=wj)Z+G9K2vaFeG0G; z)3{h3dsx-40wI=)IpU}#gFk;5%~i&>3v}Wjl{=#_@w=T^4_j^k$9V#ZkxDiaIluFs zzrQ~M=0qtk*jNYi!!t{^{kG+7Ic67So@5M~m=3= z{y~>6Nbrw6z%Le4sna6WaZf2GEY1v&MqDwq6_Q5S-|+9uFdwRo3m>izhc3hCu*NzT z!B$3q%j-fg9T=yISx^RM{DE8uw_G6kMu~h*kh-b}6`Nqsf>?e&!JeOb0Z6Xd+*3T4 z8yP+)p~*IGy#WRbls_0_?_&AwMZLy`H;NafsS;t3Eug=Up~|SMez1*jj8$9#MT3=Z zHsX5QDZ&DyQPZ(i7}In@ql|Ksccz)kKH?muZ?PVeIM}RSASMEAv54skwlsNq;v0JA zX)JC&F^6?vEsau6y@M_3(2Y0S@0xfts*VvysnqExRDXpX%ZJ~aKeD*C_#=-Rtf8!|w0FUC8UE zoI~nC!1ag`7SxL|8-|=OmtMUzw(a|W zG~&L|#tJ^T`{vM!?6F`m$J=+oUrX~WYnKJw_UyVg>tpVtEqoM4MrWCQy+uB02@qb0 z3lRd@&VSoOlNk9hay&FSZY?<9x&N9z z-z-`>!s>y(o@e(m*2`$#y&Z?&EUf>kEwPTZVJ$qs6d{`4;o!$U&V33e6~3`JZ3d zOPth)+Iev2{NZ#$J6*xRTP4CA-7=kF9l}ge{+vu{Nz_gan~R?+T9s;tUl3D*|FGiw zvLETiywlqGtjBzgchRk#iTB?X8^)eZxfCw4ACJp&7l%J#@ zZ2VR`P}|Yh5+%c!A)otR{Xw@Lu@%`GRKoxz>`yn=J}Ss2%ok{RUyo)zoK;4DQfVjQ zbCvMUL2-JXR+J&0(2`Je7(Cpv(fP&2vNn6C*gE8|$f!7~%P9Gb$SlU1A|#e*R!MIP zw6Tj0dxNO*NCijn@3E{7U>Z)_32=LwwYMay<0p71*u|4+A5=7R{9SMklg6f0^h*@J ztJG!-@SMvr-pbgY&{HG(X4}oGdNF+iYZWY-90$1=-;6BvqU1ziZr7~#h@vtl+h~-v z9UXib|zN`hM+$Gqvo&RJ`*>2_48NLuUe@mLg!MsPfECN`PvpH}u!SA!J_VPY~o z&@uff{9%&&zI^gATeMf_Ha zN+ajW>ED!0t_L4-?w+Q!Fr!sd9e;`@I~X?uNuXJ}LcJ?1i)#wZXFImSn3z+$eSoZ} zfZ5Jozh5${s>B|C2v3?{mi21beSgrP@oSKE*^V+ePr(kEYT;R3q!7 zxKN@$n@+-hKqwtlb(^j7fC1m3DYG&%PXTNb{(=Q-eRJJWJE}n!@yXuHS_zkYWklDG z=+92cw*f88UENgDw!s=jB1UYebWqA_+qF?|;Y6ja(xeqIz@9Yz8OgS3>z zh8({*)Lc^g!}XKj9LNF#G*DMth?tRLyQPf}H>y?04giA`E3*8J)UEc-3TtLY<|$8( zIS*&vzdGSaGsAeat;O4(q$=}r1K?iKQje$&qNNAu{XEA3*j$u3YOt(a@t zVkyY9OKxV;J=uZP(?a)(z?MFLp~Xr&16nlZ{us%jSYzU6k~fwGgU5sS%Ce$LH|Xx* zc0weffPiT*U+@3NOm?0EL&+HO$aB*~m>=-#1Gv@_DdVLH`>~L6opI9|!~ya_q4>wS z!r(M#z(N*Y_VKBp6f;Cg#lAyf)Fq?v8bWS4)BR^=@wNp0HmK)_ZES6+DlJ$st=>Ee zpe z-e4b%L&Qv@%G+a%3d&X6pE7h8R~$gWnpX^D7TUWF&H z(0~X;^v@qPl<<<)Bh);yJ&zx*7SlVCCh!{zlvok5n6;ElB2ODID9<*p05c+;jM+Ty zz6!Jgiy>PK8YyK^qEzsQIT7e>0a`@!2N#k#jG!e^CF;`KngzN8OzS0{KZ``sA27w= zR8#p&jz{@ZQETw4sj0og*O7*@8t9_70o9MM95&2-yfysqls!^;?ASWL{w6&f_95Xk z#_+x0CM=njXpD})vc=9#$aWueYYTE(L4EO;NYZ&Eg$ z7Z0en{Bup`EM2WCR@3Tt&Tr-ca7gj{z+@8~ZGp|-Wr%VO2m~-n-C~HS-yi;({6t>m z!n`t>0?WANDWrST`;?7z1Elk9pHsc*-Mp}KRdiXN*zv<}B%i8i2L-cgwxdZj9mj?! zB0>(5XU$i>cR|wIf)2o8JusJ|4>zE!3wr}l5AdY}9xuj15&1YSB zmGTEdLvC%MJ^;1Tl9N$Ysf8lQIPIJOTjRzYDzuz4AP$kRH=k4#Z1D}wI<Tl$8Uz2b)|1eKMq9;-z(ph52O*CLMyNX?+Q z0-D&N-B8EgU5N(k1=`R-czH-jNNZM^v-U;i&=rb>N0r*GQp0_%>CD5vOcC1m2@#;D z2ebczuLu4VjHxLybVrt3%9lm#Y%N&|hv2;NJJ7X5ahw5W#722gyGdJ#_vj64*4Ldn zzT(|j+(wner(IT7VB}E+PLSiF|~V`hHbARn*euFpu2U>hy@n?LOB@jt8J9!5X2 zm>t1sFs7WVQYHiqBwI{0+%lrCg%!&%d^*zLV)ReZXD1AZXxkO@M10Z~lwYHu6GYz)l zC=bb#F?yUILf8zsZ5~j95S|E-$w<;N(A{ScG9SN-H-kuss3 z_%;cyvF>%Bg^}ddtnM_+wP0l6zoC9cX=ufuGP9L8Cc>~z9d-dTNV(H-;P`m8iC84U z3kAQ!Ff2)YP!Tg?jVYsL4s#wKr%4iLZ=ML=U>7gd0ea+eOB7a@bOrdR2IF_7gBN)X zcr2f)V(yy*`5brI17})fP95SZ7!IM$;~GjEfACh%*qMbRwUBN7ULJuw47vm_J%!@* zLZ%g7rNnBKB@)E>NR{TU%75?w)~*WUKoQMw`Nt-ps0)_3@#p_Vxm6GcYk7fRBPG!5 zh^B9)TpvH3-s*{=&YLCq7|+iEu1E<94p~{woDZ!vbO3UDp z_>qh!-{uUydwWK#gpd_TN#*nFrhhlT4dnH5#eMU7nC8;VbuVg3w)bbp19rPFnPjg@ zVi^mM;4dxa6~~T!EH}L<(62+Oj)xXEWBgI}6IwNC+=U3e+N3|eH1=sVj)e2z^wQdX zleLDQ81v<~Ka)l!X>N3PVh^X7kGiYZl7cy*W!c6l12?y_tNZJtU^pe=sdSPQm|mQbY~>BQ0F78|UUY5d#V;=kqbPh@i26vVzeH6ba_DlA zC`>gpPwxV2T+NTEQDTJ1QO@Yu3iwSZskdK;UR}m0cM^`h*QzAFm6q4Ujy7(Cy+o~4)IBu}puXtYr~u+{zX!_SJW^`CdD|Gfx~Zam+|3F>2YB zxZ2}E`Km2`8&IX&9x6q5F}M}*dZquNxK(?$hCOPEAzCUKEGv0T-h+*Jv1lSiKh^$@ zGDNvR4!NUD%(EeroV>;&qb1l3bK=7Dcr`CbdojYNLUpQsxuQX_CLCGS<7j#aNUaYU zL!pvZowB+fe{M5Zttyr2FgeA0&swSDRq8)lk){vZ!TpiN@h&>ErP2?geExD{;*4U8 zY4C=T&Kb%yS;8VM`6H+rtrJVG&h{h{T0ytXnHdE1JpY~Qf7c-7aY4J$8&yX5l_*M- z3<5NA=wUu`Dh0f{QvTNfq*q=YR01JuO6z}=``*1$lH*60Crs@-1QW zYB21bm5(8FFh4JEKafPvPK}2|gu@V=n+|kyAJ~CR>ze$2qvm2g)}i<$YekB_HL#_j z{U)m2nYy#fc9|BGl};}J^wW7xSo>Xi7i~}td0g$qy-FwTECJ#k2CU@97zKl4(Qw9- zapbsk^MBwGS3v1>#{lepwvMqsEV~*=^nSdnsg&y9A1Gln2MIAK{Ig251u9IHCX#M( zR{R?Cr9N~r<|)q!SE=Zx4dTtKg--z`rxVA88>}-iu(kT_V2dWdV95KcA@6#Tgci(D zm2!1OxtLM=yyd2m&t{{0Z%8*W9}@uyiEhL#JMlUDLqzFeH2w2O=<)Jl(nOO4g-3p> z3prZfic$V5#?q_gW-NRwNbLFn``tcGJ!6Jc<*dU|*l4%7|93Pce8}IgY{aM2W-O_$ z#LQ2REkMj*^X%l}Zwj+js)oJSOnsMNv!|{`hkKUV1^mvfnGk2*L<`|?VfC1YUuSEs zR2K=wpCeNzxt3X=1esK!~Jch`& z1tlGOr>97^QMdB|C3O&#z)MBt;duOnmZQqWD6WzkzNOP_e#(Qv==cUH!_)T6L!3_I zRi%;~xT8@HRU7r#ahW$XtPZ&t-dy9G#%&`WgjV>(a@}e`+*;)*NaHRwSiWA84QVu z71kbRU`qxo9VwK6q_-D*%aGrQgxyfNQ#g|=rT$(#+N>{ zKT~E+*HtJp4ai+~zZtQuMGgN}maKh)IQH{#Asq8c&ZH9=*qYfx(Q@Cnv`lm<* z8hb0;MVHDX@|aV!T#JtV?9%ckScfm0s{8@lj2(kbiv#J z&mC2&^_O*tU2bPxrkM)BLq2RmGa`acBx-WIQYK8yM)nN5iCx0!x&{{@?Gb=)Vn*ORFl|B)x zMW9FWF|@H-xKXkpv-kC3i`?q>!7uwCloC2vWkG@rz?^=Xwer@#C}U~vEwUSx1>2Ob z`L`&2%tjw~%g>KH;6LBr;LuT7o;)VqLV>W9xKBpZ@h*HUc{JEdp0E3ZUXS(cS>WlqkGbWT47U2Z;Y9#$9bd3wEw zYdfD}m#(T3V0Ac)NzSb;eK-!X0`rN{$5t-J{zo>rdpZTbw@uKrMasF-a@~qkxUG13 zCk26{Z~t{2(sV*_WM2x5jq@gegC29n7%nHs}*I ztMKvvWdSgA8OMY9L7`GbCxNW8h)HWc(*_HOl$U`nmrp_FeCGBcuLy8 zE#$@)9p)J`T?%~OD>ZND*PO!{17jVzzuK`?V*`J^#JzwK)y zWQfHiHZKknD&|CYwG3>7arf7%o4T`ofF3s(&Bd|h&6+80JN%BI zPq-YKS@yk+{otaBk7{-7mba|4?3OLFP2x$hy|CRx@U@vcsjSboHQ}?K{rAp#16*!p zi`0f=HnSxK6UQdALrPvIZ(a`ifOfc`a;M}YYMD)TU(?tR@iObZU7{kB{-MfO;A<637Ud%B^H7g+0rCXX z_WUrkj}f= zCT;&|7Qf$!4iJu+0?EKmcKtSS}S8tpFh9R)x& zzpH5RcU>RoQXxM-ZnlN!mjPjSm@L*ZMpx|GjS9MMJ3$B^ke7tL@7|OsTlruH!cp!< z$WIADzWFq*V~EHSEn0yIDXMK*5V3nvKvE$13J=j1T~;sXgLtPZf2R;$a+~)~s6sJ$ zxEgzAxUY<0a?vB&SD5BM}8XOI;$1qSW*Ei|YqxFnx ztF|;0Gc%9i)^6aw@j2h3)=ZojRVzJKa+zBqU#cPa`(U|yxZ`ApCp|2@*W&fA_jbCn zTc!Q=)zhaPAs=%>VITJpoQ0!UZl_n@T(wxH(3VJ8Njdz~Pu06TeHqWX;i1thDs-=y8) z+a`=KfU(aR{dDy$*YDqj`|Di<)@BMJ&mS|6r4e;eB`0Z|N{<|rr`IfF3k$@Xy%ta9 z2_MzE1_pkc)D)qhPN?eO^8^Ok4KZ)c5tB~D( zKa{lxzgbsMk*2xfc<1dER4=oj(W#LH%&M)D23V3dJ+!hl}RLhiBX zU9kXjL1$Df)v5Sa7DUK!orj}j`eOT!F}Z3kKoZcOTow81{vfU^&mY!P!fCMf5G(gr z>Jp$KBCCpow9(320`!!u2o>FdqSfe4#hjTpDv|9=+;t4m9*w!NLGMWT*pt>TTM~Ph zBP12uxAj4XU&H`aLOI0*5#ej=_xG9+-b0a!+i8 zt$C&e7aN|*HL04BAdgh5KGm}xb;dXK`=5iDK|7<$P~^M^@LZ5|Vigv1PpaGdnGmeWOp~b0(!VM9X8IHNGk+2m;^ztDOO? z$p`*`U#ZPYQxsM3vJ9JB`$Ji{-;QQay5OVC&5blvtK|3W;pO44P{&0zm#li<{jf%{ z;Q2s~t=K5^(r?Klud;5ZC-Ki|lEfYk?}N-Q(EVE471v3majALZ4wuF;z-(-5H)5`| zbrgH7_fYU1{u%L)sqv;S`CP##fIC(0*T0`}_zCoxuM_sba#Maan$m^>0&ai9F#+{9%J27bMTtg&bhXXxAtw%cyzKl`~V-SZPpEH5;OYL?n z+hSYx-7j;u9_|Zt98S-$@|l$=f3-9XeF79NP6JktRD~j+o8_yr^zEu-IQucSRsiXv z8DYcJU&qzI3o2q8<^S;X7-5Ur(^^!_0kAV+Z;3V+Yp!aIwIKkjq~z*Gww=j5TX6e$ zhJ_K9$y-l|?rNu^=*S0%c&F{~CM$j6J7BWufBmS3w>j<$gPa+bSt-aBfatNi$qNH2 zRiHJx2<7(PIchS|y%bSNELgxvY?kXeI{!)w1VpE8KOZg9RT^U57v)lN5FC41{CBp} z#Y%me+2iGnsgoMFxoYw+=K}{wFprcw1l3rN=2u}YJ)r)Qp)P5-eB3tzjV38orUqrs z`ok`ZqH|p`COOBb5k(n(#H-^Mu~VWgi(TguZ}Y$qi$nO!fzpdcRX%O1>Py zs$-0tC0`#&Kz3eTsFSrl_Y%=Pjg%7n8Ei@Php``b05&aqBj97z1pD3O=KDd62`VZ8 zVqZEw1Hi&mi1_`)zyWs>6eE3tg<%yQcg)WNEm0?fGAc)i!%e!5-4}l3!kBAv47Z7 z98MP`cxN_@Zm*F0LQ)ScbK{1vzAH014gP20xpOgE`U8V0lA3}5kUd{T?0^O3iKo$Di2KNhE<7_a% zF@&dqiu1i*o`nqiqFJB7R&$95S?Q^nQy-^@6XuIg%FrJA`$b-g2PIIo^9~9)R(4`C z2|`P`YXR`voSNp$=#>X4K0*mm83;3F6~mYLm%35YVAYCjOG`@-bBHrmIw!Mq*_Gu& zwZT_D72X*OLUvu2pbnJAf@Ugerc&qwT+0`|vcaT%%PC^87O2ZauR5RGXaeShkC-Mv zY5H%aYsoSTtTTc!62ai~au#wfZq88UL=aa!jBu}AazG}q!!^fhSifz=_B`Oxw))-i ztQG*PZh!_zkoClI+w`yTG`R7G211Xa0g0=2jm^!2h=fLc(f`JC7U8(pOW8=C9lnK6 zSIaGKLmEix^eVk08J5x{0a{*OUO+ajeBwV&)~1_dm=O?4>v)C+D{*EK5koqL|5m(r z1v20r8&Hs1$%ai%Fs9!gwfViYduLXs1C^l$K*|?q37|QF%!_y}16w74*kVqY4yzF) zz@o+fe9@3$F+;HpvGEIU#QdAuZEPDG?aVU{$2Y(N^3j z`Nv^3$|h11J~Zob{~Swzbjp9KjJ~110se|)xhPNOuW-&FY<-bXl6&|QqAkOh9}#o% zr`?(q1aFZJ7X4ug5>Xonr1qr$(4h?;X{fmXHMsGs1Gvdd_jUN1P-IAN(nAj_(0ytO z0RQrtN>Ln#n!#VrKuYu+zw6L4I=N;1;GTgg|837v(rBHJ^l9;C?H6>=V<0Kd-hK+{ z@&ij{lHELU^eDFpLPYQVC{o@>d+CCCu$Q=7f7fRb5tjOLU7Vz`ti+!@l&xe)T5|#HH2Q{Q^JL?tIKe^Jr1;5Sy7HUX4rbqtI)2?2i%U58NrjIQm~PkSN#Z|3kd3W9M1 zQAJdx!j=;68@WUfg5`zgSb9N8vAb<{Q0X4&Y+Ox)2LmCp8l%50=|X{ZKgNHdnw~7T z<2fVPOJFg*9?6WqrH`03kN;> zG+I|M_$iceNt0v^|8awudFLm6L^Pv)i`Ni8&dH?AP7R2j#`o!w`1|Lcc#BBp#)ITv zGj5n4Wr0KugTI8?24!-N@VNiI;`ATm*y})5pAeX@u zwm71t2LgDEp6E?_Qyh(rc$4qtxtI2pNJO*BkZ8%Ut#-@XHh#Vw#~Bj!CJvMf5vK=~ z2TX+|%f{JsK(22EuQ)QS5Hz}LEwECA7$_T!cdSq@1Fh5SdI#CW3AzCHX6G1*fiQ`e zOZ5eQIYu3byAE)7M5$a;nZ$|y+JAA0Ro~lNVP2SUmTo&97|il~fU;IGlv*iOC^H?C z+-e0lv%u8NDnqu1@m;&6tRf;jvA?O1F1)=ms7EuPFYTYiXHx1R`Zbm-`#nLk86XF< zwIH^ht$2@L&|R*-b^QgDQ+yfRGl-bbNhW*ChpYWH7t;X_Z@`{UuYaF}07?IouKZV- zFA=L2&n0*P^WG85-s;4PafzhL#p;$}QN&cHLbeQKPh;q2;siYSPx!X18AhNg@JA&A zR|!@gTp_G{2RAz^~~}ja&OGt|6T_P-Nu7)kO7=pXlElRKU zHi7OZH%7s=8-Q)wQ<75NDxMlZEvcLT)r8yf=T#`)NA3m|`%Z4i1gFgh#5IDFB@Bz& zo$u*)VQ&O<#bpi@bbEa;?WO(Q;2SkR;)F>L+#uz~Ma)UGCTPa}*Cu116XqHo%`~7S z_M{AQ);;&i790C@yAN`7p_H#V40{kH8%6x^%0tq;x(>2`qarqr5CwVsl}r{b*)a(L z`~FYrgV8j~A{#LHc+l;&BL1(&vCkpmyRAmcdm4DdXGPmuv?cyomH=!sxoo4X^|ut& zptXDhA+ec?Nqq88W? zc8`w(C${5Z)x6+RHnuUmx0QUKw9WJjwkp!rJvusIq8^3_i~9m8ET%!m@e>dzf&$Rp z2TrIBxas!XDgB$Lg;Zw}VnK)}HvZgO&!y9>RUDmc1`@#m0DY8y5Y+FYb?L!@H2SiKd_U3&O&TAQe3UlOUw{)!Y z{3@Q&%r{brA-DU;o5{BQcYNlP^eE~W*p=x57Q6%_WZ2C6H$-n;{kT<9arzVF566Db z&_6LCLk`q|LVCM)$#N06t+v`|ar)tj3z92p#6WSizGebX`F}eT4a^VoFkN4V6%pd6 z)&ZO}rFAq%CdL6;i4W)9=<`WzR5P|is^x($S~r7HGo>IT6jeA5Ni^bDu$##an20-@ zA(74b`#e~Ria0G72K3ivK+*Po25s9x^>?PJvWlqS=SFk7Qd=S3@>`SyI10lJP1ueKj`F2jNVZY2}K z(udi~)o->#i+az2-(&f0dQcI|6E1~*N%E{E4kiF1*U;E7%#RA+Rh!QIVSpz)&vAQ@ zlP{qM<5;4{$7U@N=Ir3m33MoLU!4J_hTc+@vT@*7;UEnd*-+Q<`Q-|%f3B+n@CfrZ zKX0(NliGTN$yL252pq>MMmZ>MT~#QTq1m;@JiIum%>-alCku7xAnf|B;&AEtrDB$1 zXo*4hZ-e1vj>K9qL|M>}EwJb<9h8-tsY@w1R6c{>#DR1t0CY|#GgQ*I@9yK!p;Rct zgpXVD`v>o#6#@kCvlJ^8gfB%a-fN;g-uFG&!<g~3Xmt{pB_t7{w0O^Nw28UZuZB~mEolfoWHhe( z7^p#k*Yb*{g>{yJ6MB5Ow(I`h`CW?R7WUN54!msEf`_7Rnz*(!8-q24-Smj}M+&!L z`gAnvqW>=p{Abj#u7^zG*~>ifUs(DAk<8$~^uIn?gOKF`iEC@j1x250)C4Z2Fd3+F z+XsYu^Qo8gDIGuZpx*hQ$pAAJ=z`VC{f6nGXW}z2T({+UbA(xXe4$b8WcEWudbxw| zEL@Z|!IBRnJQ}%%NUpE*J)r7A#2?we69g`5B8W{so)IrFC}_Jb+JSp5QT5I@y})W0 zpm!=5jzy#YaDA{Y>A-H}QuQD20lyQdF;rkB)-IPbn?4lLd&on!Z}~s)5(X3J?)NH_ z-LJCPkN4dIkyS}j%r{B}khn|E%@d95tod35twNX1HQC$PPadI>w{1fV!ANK7ORssO zR)zh(T|_o1mKv~cRnQh9J&pOXBtq)-xN^wO5Hohk63;uZ`Ul;fzGw^XQD-k=|6uW7 z{LjQJ)iM#9MVp|DhVL_Wsud+hdWvzzpGfg6sYQLE~h6In~1=Y;V`JB zB7eOuB)8;#Mu1;?72r7-Dy-gSP9LdI3G5#VNb4w8_Dqm6VNGSkBugb{K>kohAQi#z z`czt_`X5E%Ek-*nTe@nCB+$Cd{U4EIJwmTX+8AXm^c21D-WEu9K^E-$0F+?7W)!$! zd~4dzKBgn>2Ut&g3TBW^K>xya^FOev0chd>xRl&icO0gIAeXj?m*@91pt!jn*Q&7N zKIw#a_`UFfJ2(UP+EE}kr`|Pc%-3y?jSf-joYtlzJg`*suZGo6mM1OuOFa z{Bc^f2qHTFn{#jk^K8W$1I#A1bHps&W2`5^*)(NcAYxUhOJS){Y|+BEl>c6%o(0cW zt?h^Gw};2wWuX~gXqe@jj5B*0o}>Qrw|B(l*reUhssFbRXj)l`G`eYJk>@Cj5Yql6 zc;M>_y8N{Fs+4f15Sm^y{SKe(;Gi$^SO%$~b1Z9++jTsHH2cDO;6jDN?$}mHM?KR& zVs~w+jm{QTS1k1^rFyeRR>(u$z5pp;!B^xh(fPBry3M2?r#-3jF1=;K_#&H?D}3L- z##UyX58!C{zmziud9w+9-_WbqxCC`K&dj`Bpft? zpmf=#OTfa%Q>7PmLavEb46Z4ENj5of;9*noElXKas;j*R2+8n@%ukjHOF<85iMcq#r2T&~$sP^@_9yGjccBl8qS3}w7~K%-1*P8eXQj&YeJ5#I z;%6>@SQ?Mr2Wf%|*&&Nwe2{7RRsb@3eiwVU`4EtTzUZ%&7w}>2KdeS20>i#6UZ1A= zBj-=xM1kx|$&hXZ&u?h$E&d$~X7=8@9W9M?)^Idfm#Y{V=mMTW%9WNd*97pT%Z;gs z@kpLnY_BIgi`Tz1T9eZH81r10*FovdTIUxNvgUws=I-iG=yY<3ukY=)%a8fwIRj(J zzgmEck=t8F5rZJDHQz^;BM;?x-R>m#CrNJJZ^HjmAaa_{o%m>$-@F{|$`>0EN|)k6 z_9{md&iA{$+*vYy=XnX)3#T=*8pR{} zJ>%WEl#s|5pUM$1w<2$W)*?JrdH@Qez>#gJ$<;6kC9otP=H}v$0RDoS|JqK^(D}Nj z_?j^Y{LWGUt(!swH(VTzdok@xm37KlrIZgC37=|Sx0-C22@DZGql zNZP5E2qs0CR*L18${N2P;Ihu)uRK}e$3C6p$*!wv?7($><)O!cB{Vhqi;T2#e{i&7 z&o z#C4XGuN&pu_8%?kof(;*Hh0U#uhCfZMF3(s7Sm}W-$gAY)6e@{i7LT01~~U{_^-Iz zB+1Sfex0z^dj<2^3sft=J6di)RI%jhdJn<%Oc^xV2P_b`vI}=wh>*C7qE!xH{RT?b z0awAhrnX(+$3u+8;f{k844Y2v z<9tDa6q)jLZq^CVhH83fiZViPFZj)tmV~4euetoS2%K-n9q-tuKyWMs%O`y44n|0m-b25H>5f|7qUhaZKPjbVSk&El(m8$ zm#q;pW(kCS@df;U6B?qB#B?MrV#vfUQti%{r|cbm1IEN*iWrIL3+~s} z$foNZahN+U78KH)39f=9fhY=*Y8+Qd8lOJ?Pcd*Z2AC0p=h%VVivt`iFAE?PNvK|g zpi%Ct_POHy{5|Op01qw>EVkFG2_`>TX-6$>VAIaI)=*=~jG^{v8N3R4s{A0$J@tHZ z|G7x9EpT=OddaK zvP+@RyxmF~BU9YQGxZKEA^v*tD1O{E@Cur0D4b2KGM50 z%}Ox9$F0`f z$;aqLT;3VbaoLwNc~+c{6RFti0gm*Zuy;dy0HH(k#sIUJ>eG*3b#-QA|MA6vge-Tb z2(}uPO3GTb#$oBTnFcWwLgL}?nf4N*4<i?ah*dq&X^YkWu1A%XjFDt*!%s8y!0cH z5~@N8m^n1eVl17Hrs$A+=QFdAm#1g0?Q%0`s{MOvrocUv$pjkznJPVzcy>LCV9-7i z5>o7EGr9dNZX1$^o0*lieuQ%~l#3)FeW40oqFi*ac7}d#&FyEaSQ2~I!Dlbcs1eZr z{QRucq-hf(Eq%TD6n4v5y8revQgH$X6bo2P=8GxB-gt8@E*IKc)dNmjKwnTU z3uJep2)4}5K18?mu}aKH9LwN*C5mURr|fZCw~P|Vo>S)$dX`(Gb1o?X=^WI|3S6x6a$QCU-FUXbLl}Hfx8kVXX z5))*bCrejBKIgW<2`X9DL}~0N31F89NmuxF`4K`vg?BXfszl8NuoDzix(Ytq?0%`I>Q&DR!}t7_E-1r zdDXMkj#pr>5s87{LRb7%l!u`ok(ga?ycweowdg&s~%U#C9K^DP@LA%ttxwLoJQlcze` zWnjG~nBfBTQ2E~zY1qHNbTj2lODDiy87;+iXxs28xZ>L)seRe(KexYawW)1TQp(kNVqaji zTP4iGGMc63DtX&Vy*3p=KWp`98AI48EaB?QNwib`MLvbCpE@B?D-^~{0QA0>F5Olo zm13@uV*A1-3*iiK5psOjvpfcv76n*3#Rjd#s&(CSwLnPFJVT-;jiK9Uoe)%mB8M~@{g^qvvTbD+<1^t0W-8^yeY%B${EME!g$v4wO{|g#lVQ& zZont`N*Ln!2rpxAL`(6c4lh4}cR3!)Osz%Vk>h|3fDXtcbNRLsCCwi{OwFnakgA$$ zEl+LU7d4X0_y_yNwd=g8u8rC}ZP6f%VAH3SGic)EVvT1qJ^sE5do?XzQ>*K^q8p!6 z5HII}PriC-y6%&9>F161@{w6TUnOLEiH-c@0PlWWVcvKcm$r@bLYBe zueY8^p7w7F*>Fj;*UR-x{eN6-&7L^WfhG*43K+#m+=DnlC=9S~faXGm_FZ?edibA~ z8^Kq$%%9!LXTt-VO`G}Dj^w~_%|r^WNrDQwy~SM=$!HnS-1U69g9V6+{e>IQzh2>- zH2sBf;6p+0fmq&RHij9oN(cEp*3FER!bEDWB-l6`cL0MH`tEL=bYz=T$uuq?awvG=&L0&3_#2O6wf`59bmDKjTa(@3#b_9SG>2?3LQ0zE>`@C0c}?kFulK zC}K!tQ9sE&X_nq(GCA=;Y$u76lxUz1LSl4F&7lVKN!LVgmQ>|p?D0uYi)mF7huPU%Os7~C?Dp#=#PZW$(>a`Ej@py*~|EBe|>AQwFbU zDeNt%;rYD7sB3Sz3NexSBfg}`&u}i#+z=57Scq;*W}WMvCusTIHOVM`L)k~g{opyIiR!xR%nQ;dr0fq2@1e3ls_xLz(&CQ? zYJ&`tfXyW%9_fipzQo}O1ZG(&A^^y`5se>-AmEl%i<)^*uyF(iVQN+Uu7=Le&RHJr zr|Md*M=;{ll-zcqs6}Qiq>i57|aDWc6LIAvgtc-s5P|^V0bfAa!J0! z*?ggFBYLsvTK{d~~+6^X@d5W?acmMb=wU%P3i?f?{;oN9^08M+%2>>SedT|3ge?GTm+$4bSiD`-zBo~V1u7mWTD;kN;T4vEV zDZWZhF1wBSq8%wOGXPP3>iSgB2mxYBbI>O^bWXosjv(UeXqyLUjknKer$YW#T)C?s zEOv<`PheZHT0tHRWZS9~mtR9i(7nin82+d8esdKsiLI&LPXI^k&)iP&%na>nDV7|0 z)o^?YeM?XE0(PHNl3FPGyDQtb?$PY!$K|TmPb{Zg(l>J3z8eQ2hvOF-r9b4-je?Jt z1h{pRlU=q$<*}6aN_4u}cFMa%8Q0a% z&I#vlnXrwQ?s<|`>7NYcp3EEJK!C0jwod83Uhm7gS{!!pd)-+b9=M` zIfzkYug%#_(N(<*0_Q4TATXKtDq!gL;1j5Zkb!V5hNf|#g(B_n!zx|BQ;4rbF!b5(Q0* zW|6vthUGS|e=t9Ys>OB2iKH579$Qi`F>N?E()`z+TLqyaoC(~pf+Wju_Zz`oUrF}u zl=YATdc~S3q$j(SS(il^HXoS|sL7eOp!(tEQPtgZyDvCg4cyt~jZ_V(cBdMwF`?`? ze62e1U(F9Lac3yXwdNku;P`H=bePy;{BVQl!ruqdxbi}W0&GH*jfBGndR#Iox4&n|U9= zfkgYZ#40=A7W+QohK4#E3ws| z5dn#un9UdG38eGkWVzbE|8E~5e5Qu!HMn=}0F)OpjBEO@X1`)7{6$3a$VLyWQBnKp zH?X4y2zdrpLXmm&2rt$;{D5*mY!*Xqd!-}xm|ty@+ap?lCAl%lEhZ`Qf#pPY%&NWV zPT7oJV*j&k1qnc=8Jq5EM$PNfBK>wuJR1oc#$NlzXj!prB(oBKG;>E548Kh$npq&! z6j_fz5b1&jr-JA5Xex#;^hcc)=2Xg8>QlVK;<-wco7=QNXhDfu@`v zQ3k3Auh7z`?S^}|_*nyq+ciGFl5g1)m5?CY&ynMngNIAY^(m$QI1FqK%B}AIHx3om zrM!`RQ0DY0&WAb`92KTkj)L%eO}w4FmyblwfH=G+6Y{^i&|Ui>*hPPhdiH}?q?G}8 zM8ShFa_hB$*k*o<1_tQ-lOHoGxyKm}%M#JJO+-!X91v|ZF(}iRmvnzrk6p|Bhh_&S zTi`unseho^0g#{$=R1h8Qj7%OzOXr;Bh18L3%O;vNg06NaABI4M5A4(jxN*C@X zX-#v~iTLv4gzkJf%^zu>=vG$o{X_>XoS&eG)#1vKMym=V3A;M7OgtO3CrAz$g^wqI z{XHxKJQWs`R_4s=*R_Q|H2BPRgHZ2=|v(kK8J+GJYPP0?C+u<;jFS^*I=>EQstt7 z#zy$%Z!e7R zPik3CSFkv>=!lOJIhbt5IOxvPY=K=D~hex;T zvw6|>B3gRjn1ZrE<^VaeYSH9fdKCh6L-{~X@M{@(<7ug(*j<~5L;pGfc*l>;S{bkU z3h{IjzgRAktW|mNv-0%@A}$2P%{)LEurJB-mORaDo%kcW0ZrR?+ioAoUH9mF)&@O} zEU$~$lPa;Ve ziTAu6^H`J>%e1oD@96l?4=tB9D8B9{F6y15tZ=6&Dt|V(ouPo_#m!}C^-v{&)=!aMQg!HHX$)AxKt--7a9Ud~`K-ErzYjfHA%MEusRxPPUBk z(htfcy4~4fmZ)kH8-KX7x1J%wJjvUU`HsYFbNKH|>`EeIFC&t%XW+MjuEdN3qLXSU z(A%7L4KQe*^J#ctgLiWU7VO09PPF>&X4V(r%?fU2^_280c*sj~WDBE*(%2z5^xOat zpy1W>t^&LwBtJ6aKI43875GPhy{NtDze>7Dp!V^}+uJ7yEQDaOyeMe(spG!mb)rN4 zPUoy$>svKe+T-glqr&^qvve-Iz2RbC>)1H^&*#U8MMrf+VNcqkj0*Jr+XMGqqUPz$ z!httZaLoi_t-s&ApqiZK7~*>9``h=9y+4;0ZtihfB`9gPZW^;1Q`F9MG7zmZ_v^fq zS#k-loIpzTHngIJNR>49yl}zv8T6b6Yo14ONGObEGQpK%4Zl*>NOp7x#0m0*r% z+<-?btWNMm%{HP^`Dv2+a*b!@nz?Q_4f5u11tWjAf58{sP{t=8i4DA;tZD->?C+@7 z^PxBuN)2vj+;9~+iUQ&RjHV%>5i|^ti%sT)hT(W&w#sI`4pQQt$uGPf&XLOBW&pNl zwIJ!weV1Q@qN9X-!X)%R)0V$z_DKBAcq72u7d+;92E9tl?5t*1%ogP@vB}m~Va8PCIt^)_II$k^jN0MD6`>xj7(nbtI`|?xq zDbuc6Ms~E>#TXg~Jxaj8S?wEiPjZAGvW4qev9V?wr|q>_ZAYW6wAyIY)E#kGWVaiU z-t6e?H9J*@k)SUD-?z#l20hum_Z_!y%N0=t9+*%I{zb$+(vZ0a2f!d+1ibe+X2UjK zYi#Z2e;!)@4Q{(KJWRv0Iw63R_m`k2BfWKsRr{YP6{s8MGS=uPx71@sU$F_>X!%si z1eb^X_4c(U{t<0#zUg>NgkNzjwVsZa{b2d3B2KlsO&nd`Rcc}I=NJRJEJw^cV^Mx& z%Um4mXzemF{!$ScML$jO9~=je^WQQcmmmHNA$vDG^NSgb#;iuM+vUFPuoO>78TLo$ zQz>WT)*ioK^R}rTIm!JpZ7}6Ks=XuRlI6@7INd)!^^R8{dH|VN?MV-p`wser85KwJ z81?*gK5a3)3my4_j$?gm{3v9T|Gp%P@Z;Ft3^4zOyHSw zefwao4ELJb=DOTo+K|Z*skBofq)z#2WDD`k=!Nc)#uE`rk#Sqq z-zfwFQr2*zBErlV!1rZ(}K*3mZh}k}Ajz3u#1)gxWy<=%DVQe{{tM1t!O)*$)-&$Oa5G_KL{~ z=kAq%iP@B3dLC;OoOjjgh&aC2~M(_?q-9C?-7T458ig+n7~9w_QI62pwiov z(231e6PDBOg#a1N-y7DHcRXB#TLC1$=>1lJem%#0sisWY9)gDe(rOqvxe~COp@X?) z4Jtd{-u5j~-gWtc>x;|0BX(4iH~H@$0eV6lt3-bcI)#Kl0-i#4{)HYj2-U=g=vvl> zliK-cw%FR*dgI@rmIPz?EKP8qz_7{XS1>}MfFPPYE=f=H2s|2Q0s#;J(Z4+IXM)tV z^gn@X+(v(i=7srIF(f@)b3>oZbn|6*BoV36YF!kVC@kJ*%e~}TrJz4kA+Q6rMQ@Hs zXcS#Ch<)eGbV~`K^(PN!W@ZxI8=5u)aDdp`%OeJR&E(~F90fJvG|Db0N`uwCQaJ7E zVlv%`qFx(drxs9@QrH0mUO#G`g;Lc>%H9fZZ*OUf1n~+Ga zTPU5}6Eun*IZdf7%v3Ne=B}Yok-?}RfLNRnG^})1q3!To_tca~Lw>ENCi?zLCN0sQ zC_V=;*?zjd+B%kZaD#Kvz%-^}$qlr)=>KdG6$*3u(tg%O`%qf9X*YKgeX-oG6KI@T zXl-(1n-&O8PIHmPwEzg%>4hGnJ4;>;8BC}`gaR&XUk=?@J53lH=u^Enu;k*K4w?7) zk9i}iOtPOlu0E}Icyuo}M_fe3SFr;l6R26 zQ$L<*{J>INz!$iLBXK_zbE?R7@)a~*(uZh4%+#YQ*}|NGX;iX)`q5Awy+3{XED9JP z8~JG*p%r_k0=9l*vmM29`D}nrB(z0cji0qjqb=ju^8!wVF3A^koREo z%jlunCxU_#;cOb2X69A}vWJTrB;HP>fjRw^uNYeFqE{Boj=4D;(qNu$uVK{=sM-Aa z168RFnv~&-)?_e^)!CT+%rFq7&|vfwFJt7OE6SIvOM;Bm)`-ZM7K>@6!)O{IwnG{# zx=lS&+t+VjN_2j-2l`1Uiho_H3(0BAW+^WBptN{;csl$sEg5p?DK7S!WJZ;l$=5+5 zkdrsfIO*vZB5Kmu*WU z+f2n!$7!t|dWPc(hVzTdr7sezDqKfQ>ReyN<1sE{3U=2pbvxVL$I-RW@`ioZxBcj@ zaHK9W-(SNkyCd_eY*6^}r7u`8Rn}iuo)cqQjj^t#TYgAj0!?3tbV%#?iRmEfG-f}_iV+zD#pNROhaD0-$xKFg zvcD-a>^trz%N!0HCqlc65*ZC|@!~ZC3>gw%Gn&K`NtllpjsmAT3l-@++};C(r=hq# z+$y*bZjE$#TuG_LJQ9>_nI#8nLoewz@#(_9Oy^Au4ON-8mGxU5KKKt4&2#IW;OHMU zbuC^e9ar=>`3z%XZYK0hru?g=jJ&-0M+VXE<~@tL$)dPdHWWo&tFEt6LN%R8_y4p2 zX7*#a=<;K!rTPX|ln5;k)Mgkm`J~q6NC~D%?jyr!+Xv+c`Qr8nrin#{m7=5bVxYzd z0J0U5Onpl=QTdtrq;9H6?ams#uA~Es^vKNM^BjlK z(YlO&4lexzV|=?RZxRk%WLMM?{dNx=s&sssZ~|rnRx=(+P5`PVSpT1`S=hiMUHM2G z?B9qu6J|-X>Kegf&iuS9x2KDQcuEh!nRODmiD>}56Ixg`+t)vg6G&=1`Yx$bqE7`Q zjbe#psT~2S|M&OIA(nWCq?5bX)6v3<`^B5ZcUi(^sLaonMOu~QqN8g;9DpwB`q!{j zOew#sdR+aJ-!nYaW@I2-h*5AcT*{d}@~73WwzR6<^~A+6BH1>W#TN>z@_3i6b$htU z0RyyoCsK!o6P9kVP6m6_)6^gC}{K^>8yF6k*S}o{3}f$8wr%Ms`F^P#ENy5LWC%x%*Q}i9rJ?CFn?` z$U)!1HKZQ`6Rq(!1JPk&Abul*S9=4iGN81t{BVr{v#RtGihU?B!cgEEb+Mb|AkhK4 z5SE_EuJv`k-jQsMx7TON8kJ)ox3PhvuY#uCgM+F)`&dp<)mmn8C+(7hx*!;c9zmeW z>=hJ$fQRS_^il~;*+aGLy=NiG_SJ#Nk+o4@H8^lKvOi({+NZb(0S*pUD!~6yd9`u+ zX_kUXpzkD#Zm3d%-lpRj2z3-8>W;|pNZo~@kOyEI_wp=)tj%P3P(+E5bs*}V&Wh52 zoBV~ruv7A(AMIIxJ-}bhWe1VTVC>IDwG4_S45YsphRGL) z7RXx^;$gNjr_qd75^nD=-o?vMX`o)o1Qr$uDlgxp<_w05KkkMLrP&&Q}0Fw@m5{l ztuq%ntsAw-djYvAk7-Br3JSC!7yJbe<*%$Dv?Pz7hiC>KbLm#N9t-JGMtL1?{#lZ& ze!os)z;@a_Bo07ee5`3<8X4c|BednRM7XJe&-(;ioq5a|=}QA}Y56q-3OnUN9G>L- zll8eUJgsP+p3g%sG!eW$aV`i%p_q0VDse0=D9C;*2clX#SSu)#rt-`sFpY185u1JT zPA7n&xRsA@lFw1LU1YDj20*%Zx^x2vGyC5mwi1IhM(~J-Q80o32Og$ik1jDXD~$1+ z7@P1@P#7h;-^vibd>+c&$9tc$gYB_UTCnV!CR%Sr8FxPIT{Bw`FL}Tv15F3Bgu@St z4SJ(ZRh%dNge1wBUG;*WhOHp7`L}?U;W|(D(67kRVlGCGr=2l-;iznV3WCLNvq+&N zhiT0Ig^38r%*;tYsBg_mz76St()mW<}W4OgsF8)ZEd$s`5f>T$XQVrB(WW z+3llxuu7(t1}7HB3T(=4`bWO}&~A&)Ra3?c3#!{TkICwIrBgED9#vE7PtVZPDeMW` zkuuP&PoAkJ?r1{_m|06S-B;7Y@>@}p58onz0FUr zau4t(V4mgypVJn0_Y?0qm>W6QK$om)2OO8ExmBxL1{IU@S)JDCFi9VeNG6-?1p<8Y zqgNX%A_a|G<9dzJYGWf)E97@0EYMSFSO0zRMqvaVk+<>xzW*fP9!TAWNRxsAxh@<6 zSp*dv3?6y%zYwk`a495$;{1n7{NqA`971lh%zyNhIY*4`N2^f`09})K@8- z9MMuZaDBfOslp$dlg*fWme)cZIe+Hl5tae(jR4*TfB8If)={;}k=P^UPGa7+FNV9{ zu^;)w1e#d=BQDTj)Udz`^wr-@vx927<<2&`{}35aD-oL1VoXXL*X*m96RtzeafJ!4>dYjqkIkH^ zF;8QDR@F@i>JW*$NQ|`X=6ip}>$l*dvIH^JI>@%cwnbh-uLGQjywOLX%s|R5?H6ds ziJx-KMnb|hs{l^KtVDq)h@ZFz#+Y%F0j3e9f-Rb#4v0A9fWGuS=J|TNK-&W>u)Ff4 zrq#PO^&9si4gx<`yB6d5{)*KNHh6Ir0^I?@*VF0w&fkWf9K|8TYfv%?hHv3Of-_=*(GOri z0Opzli>iBxv`xgIH(TXzgo~2@cWNj&QIq&zqQ!;`Mw3u3xB8j6m%6(6-Cm!74kwTQ zYUlU2LGumaE^D%^IVUkl48Ij?RnsHfw@g^$`aQ1h0F8uQC zGfn=Z23Fj_Jqd^MWVDG)(BR$mdDQpn(b%WVzSx>EB4~d}<$*Gp0v83~4==9_9FitR zCV@b>ZKopzMU;J|ASP2n!xYW1nQq#7Xibb{Y!^|9Gnqvj3t&*Tb#{Cv)oO|7AK)RM zbXrn>c^f1OSzne9x89!RWg*xLsR?&wy#I0iv|W<-_qb`_e_Z&QE06+)qZvBA;9TS_ zqV$BZnDhviNySluof{5Hl3`wh~g%CrFTkI6l%D z9x2F?`rERhovGce$hJi>=cNetu~=6MOryw5@cH!9dXjFXU!tz?`FR%b`WSmoGh|^s z+u^X}%rRhCbe@-JhA&Go1d%O0>v6Fr@POb{Ut|(wP5ZPYuf0P0s*B-$KuGHcZ3G;Y z60eZo%1v;;8Xu1Xma<-^XV_Y`h0+f(gM1+9M*HW9ixDI9{$I}WtK9i0HTOtAP9_M4 z6f{3Z{}eFw$VSkj--dM1?#XP3U=kQ@$CjN^zKJ#yhGN;evh!!Sq1Uit#w9KIPG-Z^ z9%-QYOr#l?gr}H$VO*cTRzVy%C`5_-xogU*(iBJs&D*Z7fBzj+>F4?;6c{zu|2;jk zIpqRP4glY&pi0ekW(D$*bg=jtE!0BKYv`J^MZ?c{!=P(b9v~kDbH9ltrC4@i>_-t- zx6PPqT#pW^uBni2ev_Xj9!a+otG2ba5G|v(oIzO%QR z6E%?bZ2p)TO?l;uDo8(61ldwwN+x6<8AcfYqZ@+UoWJ^u=BGJQ9ZJmzxye>A8%I^B z0wa7++VWo{G`)2Ub_*vVhG`s#3f6D}qLzl6$WbRDxCXr`T+eCceMK7Gy0&Q=g~8ZF**?WHBj9xz;};#@J#9{ITUzd1P=2 zWqvEFuQulAqHV4Oe!TkHlSM)>a!12U+t^FlxGmvH!I-N+)c~=n0&QwThFoR(@j@Ur z=SxbZ8?6gq8qsZMn&z8Gi)UnS9{f7D0*lz)J>GGlF~9Tz(sK5wbZYt3=Fbx%SN7`3 z&m)0gNh{UFCk1Ds-oxPzJ=0^iXsy+%3SI6*H%gaee>5d?>nzy&!|8O63%c~1(V)tk zee5~mk01I2@PM91mmUhbz00QY?y z`|IO2GzG$GL>DE}=64Ge+x^D1`_=s+4`~f6(-2Avh&z8Gt)Q`$T5pIDdBhvYciL=ji7=OZx|}toUdmAatZ$P`fX+R%L@D^j^&8f+HN&g!flZDM3vo0*6K6_`WrXDDPHWg%lUaaB z#)8297QF<8W2R|_E*r|;Es)e|idC{;hI+;n0s{_4zbv8erzwvI4(8oe>HmSAc)q;^ z$5AWdmiawgZj+hKmrd^__h55a69a7L-`~@Ka?Ci`t5{?#C}9LWxeEXe_l?RbWv+Ey z;4noh+Weym`B4^GEPb0Uw=Ru`Z)XOPisHmFK99w*Lf<{FD!%xM5ECO;eS@gORz(I6 zfN9)$Ypj!1Ahi;8i^aUXl}RXDithY{vNNWOtZcTNWj(d^B*4i*D&=Mk>! z`NTnHn3yS?3!*IE`gwN*3vhn%X0ljC;_-aSPQWK+HD9Lg z`%Swg3vh=E1C7iaf|{AJc+HMrrv}MbC_8?Dh>yJ@-9O}&qqE&Pu_BG)nI+w9<%-kMz zyiLa?kOXS7Sj^V<-n6D$#Nb$L3Z+z()g0nTB9KTfT(df8h!|91n>>zg2Y3yH-=29q zyxy17&}cRnY!RZ2EDC6E9Cmz8KMBm;|D`=W3v`uJWu{=FqA87r zNF_@wA>u0XsEHI_QhySH>;2SID_(zQ8B_0!DiTXxJv$y0MRcp}G5lZYx~74;2^XRNjKu@`Hqn$aY6q;v zaFRLCqR&v_*q@hw<>muDM^Lusv*9Omvthe3EGtM-y&Pc_sqZoRnq-@I^W~bxb0vV5 zS@Z8J6KVt$+xLfUq}a{T%R0jz`e>cvP8o{t-;slJ4heueVYh}q(wlTdW(Jhh4*S*9 zmtV*w~=vGx(RN*>l-c{(Y2hFeJN)K{xJY$_rV^69>1) z<-xId;t0S15|Qn<3x=@h&|FBUv?t4QL8<@J0D5=lkO`F-2+m%RGK(Ro6Jqs9ua z<%>1HXJBzQYBubAWhNhqM9oh2OIbI`#Xq501~N3dM2lniUPMy~EG{Zq#4{efN{e-H=Wd%Rm`>N9mL^T#pz$1W;*i54^$$=Lere zX7X-6-xEnr9T-O73Hp6%-(rEJ;vg3wzWOY{zO+j%l7&oI-S|DHeK^-Y z8+_dG>8W*p0LUj`Z#oz-H-h{^6XdPlqy~F(e=~Da#|YG!i>~h5Ps+1&44Hz~&r8r> zCDS;5!;0FP12|tyjm6!`5{B|hwoqUWAU-gZu8C<#f(p!g(EwM`o+#oEPYE$>3^NK4 z;Gn6@`ELtw3>U|jIgbMR?}vJ(WUpf08sMw(lXZrJpcDP*wc+Ss8ZlKh>qKw(Jdg`{ z9J@R~q%XIsTCpzBye*;hQUzJc6Y_@91~TLgQ-8owze@TPXpe47!1k0=v-oH7ceNk` z&H8Z(l6(qwm{&cj7h4olg_^V*E%;2A{45vN+ucK} z$)JBfC)^@*0S-Yqfv?14T>!KcBmgw@*_X_92ctqLE{+cun6#C~3pj{*r_Pg1 zCG-zX6nQ4}jryiPjH;L)s~3_{w=c?08O&^rxd6FN2!#$Q(VdDg@u*R zmS$LFVi`U$TPNrV3x3(FmuE8Hi^2>-;^+e7if5RfYf*2hY* zknwN8O_&V?&t61+Ex1zI?$YM@t+Y);8p-|Ly5iK0T9zm%8UCkpkjTPCR@TK+r2+Wb?GN!;7>QdEk0=W%u$CrS86)c{nvq&-aaWa=>>7kU)uaa}- z-h#Wwel*Jk>Yp#49?53w@ghL|Gyzw9RfbS!+Lt0YscclVuhArbqWj4VAaiA9M=oy0 zF|;@u;K7U{nBGTSLUL4Aytxjwc{dR=wMPKCku{`W54#NXv_e>w%h>U_ff>Yx!NHy? z-u%*JAXMYoZ%a!FMi0#{I--OU;TfY>F0tyZ;udE3#qGRpM(_tsE0O2xn?w2h^Snom z0{52Czc%Zp=-v(vrJ^)UGjGTGnJKHs9oXzLT8zn#KVzF}QuC|%X;yx2-8ikrTKJaH zj}*L<*(oj&SE>asv+Mvr=W%WOQ*-~Y!}pe`$i2WrgkHj=%sRLRd%B()e($>l<8d(u$6G33ddbaX$>u@X%KI^-%E zh~K1}37@2aIl3Zvu0FrSZD=a6+qDg9wgXCusJ!t@ETBE|0b=4dAl!E%z6_Wo-yF?_ zLQ*OS0VTDw((ZDHyQ|yV3l18ktih4S+1Z&|ha0E3OkzY6d3-r8>yC%j_CUB03Yp{S zvOmzKF=2qL);m77`-_xIFg^9k=z&0we@nz;7thTVx8YX&> zF;3dFDC__|OA{6K<}y&5x5(_+e7(^J$O~@;B?*{cvK68zc@6xLw5ae?f(k*?7EVP2w>OLEz&37pYb#^{aU|CoG^azI` z78=nWMXx%<7?*H&>jKt0-J5YHJUTwH5xO|JbT6*7^i@fJ zDr)xwdKk-($o7+jOt2~cq3&kBuYl?0Rd$O0+Zv+qvVF_8J??RZ?jhW|;-JkX2nP_{ z0T&5L6x=o}m#;TGs6J~;jTwBDr?bu&J{b>Hk$jDb<2dPn)?_OajX$c_Tgii*uhaCbn$d+)ZG(ZIjw37es8i>8)RQ7Y0Rcn#zbzy9=3a2EsRWjar0 z5N4_{!gaIxhFk7|)qEbVeAz*v4~~$}&C3SScL|?6J`e$=%;XE1Spz;cp9P}b%u^;S zHAvx|MJj>rWCscl4-fF_9-`tA5D+MPmjX*mPiHg;I{PPAXIX83sPORcP}O0L4|}hW zFIhc9+T!@7-O+%0^A0en%=%<bk_u+a2u#h6V|@?XeUxrd2P1s{=slgjZWnLU*0X zmkIxpVI42fi;-~qvX57|jxyl7KOTp=+as4E7a+4G+*Mx4g~EE;!8XDNvgz+k zo6`U7wY)*4!=8mnbi2zIrFFH(t{?h!>wK;j;-L5!?}luUFqS>b?e&i9EupX3WgM>} zS7W<3l{mfbL1v8Yb?R?btuWI|EVo{fFt*3@74_4owb0@6l~akcWCA&vX7~FL8_U6w z*WT-n#A~PL8~;Sjl?}W1OMPt~csI8rMsX9# zLH-UYhr^hM4y2Oo+ky76m^Z4`W7NlY&rDWA7PKzdWFU`3aW>`wgeW#GI-|?mcjYL| zxk84evbxS4IkYl63WVN(KX$jiwa?9^PWsk~6r-}k`lf>5DEI;Q<|cKW{O&lUvM+b3 zmv3I((*F8!WdEBf%IlPqe)i@M<0qy-wG2i`rHTecv^F<3>cG99EHN7lWwqM)gJQo*^aLS6BM} z|Ctk%b~>qyjd(Kb0Vx}UMAvRiOmx>{I$YKCQI>}~ty{>92`9NX>g)9Q3{GTsk^Z6t zarHCTh}o!j64ileVSDonBTxR;64(u=+Dw=xzB2K}{qqklarbzt%>f!Hw!9}YauT(r z((dmSL9>|80%RK;0#0Qsb(R=uobKQ=dvpV`jp1;~ssxqR)u?KzO~W-3?A7!YQ8c|q_b5~f+LGeMg!L?Wry6l~fp{6U3NN+%qY zFJmMUGL*XAyZ}VJ54*nx`H0ryN@2mg4z^@k)ru@*`QCHneAh?Yp^u2_c)k{1Ad^~B zt9nv56~T6dLc-1^H~ACp0$xq}Hd-HdvjJE{6diP{UF>%`M*eFJGXJ}!QLf#xWaUxM~b43g2^rwHxB(Bh#?C;PG!wLG@f<_NL_Pld? zOhc?!YX8V2V2PYCyMYg@miv0eP$ zW1-V4doS5ZNqX05CMk((C^3wJf?$Mc+7Fow641@%^p8{en;440rv<@^p<=ey0M_?~ zghF6CTMGl(1B>Y@jz#M*T4dhO7!DJrgaqEDU{1+*Iu|zguwWQ%6$Q8#>S!n@ORaGj zg}Aqk>e|WTiSHTl-GHNP=EcF91*q8uQXl#sT286s<9BkQW$y_Lbb9Lj<{75V1S4r@ zR0$53;aPEdYSfZ=AD5)XzW~U!4)o!Gf8qBkLtLompg)6Al}fB>oNbU&1j|hQ^DbgK zTb0h24kf#1yE944`J{FuQMsQ|mgNMmSdy)eUu+~U9U*miTE<=|TC_z9wEUA+V>mMT z+WIe`)Gtr3#Z(d+diO}A*0!>kT&C!ps3yF`ztjCXS$z}%u*7;qH!D9OvM zbUS~|ggi>yWP;LF&-lll#)fFZFi8FvlT~iOgK}UXScHiSP%KS0qlPN;Hh?h)p;mi| z6xF7mrcWH^hgVkc@BR=8{r*g1Rt?gx1``?SB$nSc?|@pp$@TtQP}0WMR?ijr7F{xn z$uzMdMe{nh`;$Fj&UMOLY&SL4+4=s)eRsY-fyqbB1I&*mkWB9X$s{fM{|Arrn%E;- zBAqM-O}!e#q@K4=45!7D^w6iHD{)rx><=Fye2;lIvA6shStya+a6TkaR_Q9sm9Cd){}*L!B5KLwq=d=Hw)-5Sg)Lq}{4q3+ ze?mY%ibTrMg!kwh<^=x8(?4{h&_T!@TCKFQs=P`oiS-|4)#4kmfyO`CplM@|=gFpv zG3t}j-|aM8Ar!@yM*Kj>-4BWidzb*32<5+8+=a~7TIw)vI5RogERZX#_h;bcPM>tE zp~I%T65(--23_%tNBlqwZNlha#;K-S5(b`QmPc+>^*4a6lnC*JZ_fmfQ4yjRtbh?mU zyqQ3!jrh#t{!fB2FG`Kr49+cP_RC>%%T3(=9mi$@IBK(FPhIm+Y-d)U!7-R>;u0N? zTwjHzRh{WN&O`>!fQkgh!ts#69;?$o)4Bvub1;<$pdr)!P;3{aOF9nK?mQ0Do%YhU zK7vFp8UH7wRk-C#lVdV9gyLE&;v=!Q{qJ8q5+WQM$+2WCv6qi6O^3+@EX4Ooc|EuPhHf?&GFJy%r!S`7<<|l0PHs%P zf_kX(8m@5_Vb?=nSr0hie7~Yke-boZuon#b{xNRsl;0iWCHRQQVXD* zCgrz~1DacV)cjaRkJyO%N7X@P2j=a(BT+R-fXo)~fz1VnDHg=Iz2s(>C}u zPVK1P@6BPWCk!Q~B4#Fv)243Du1AQh+a0mh>&vV&3BvF2uJ z78|d}PwD?7>@CBh{JyYJ0ZB>e4(XEaFzD_^KuT)p?v(D5mhO-k8U&FJkq{V4B&56J z-T3>z=Q`)p@spS6IP=WjYp;FRGLP8RE0Ypsg?YT{VnjMPfHg;^^8O+JRkH7697QgY zSG2By3(0ifir}nIJ*M?17e%Qh)}r2fGD?Gw&vFX_kUFg|}; z%y2SDaTHLZQvu})^i&!tYbq@yhlUA5k!4BiS%AM2jI(M$B&@*Z0Mz>rl>x*9iJEh1(&M#^Ur8=L#6VgZoy8XB{u84g5{ zvq809%fYZd<@GCxpG}JEb^DOGBt~^5`a4G-FLy{xhwx%NuQz5^D-qX>CNAU*wG_{N zFla9Q4^I}I^U5z>JQm%IISd@gUuY?0TCLgZFZ?s;TDPNA?R%U;|3V9WsGKaU&6_l( z9L!J=yMhi}{Bh&~DVB&QSRT>QpSVsK1=gL>+3ePNBZu9Ms9Z@tp%(!nM<|(sznXn4 zeTy+lJ~`Fl*NfG!qo5~F;I@NzTc|%Uj?SfjD3(C-v#b%7C}ySht#-Fx&R6(c8GXCM zV@1DX`d_@WK?8G$dlVLnu z*LO}C4>Wy>YU|V5HANV%225#uojAbOBR~8mb9G}hvp=!Lc{4U&Ob%1r@79>e2_C=) zP7N>qZy6mM8&g32^u6rbRE(xQj#4}au3z?4qPqxJW1zGPt5y3Z0iN3qyYZA9m^C8) zEC57r=uNs2*&`DiWC+AmM`}bWqWR$25hXLl*v$syzh0gc;H6pyli@d(4 zxn=f_fSpyiqNzmwKwtJNCS_`ODon$GGhIIjbu$O^H zB+p;&@{UiwIu`^2+nosOj!C>T&Ac&u5T8~Y<^fH z)G(zFFWE*Gn*&wmxw8j zq=br~3&d%U@4t{8Y8cSZM`Mk6YZU{@NGn^P+2Mg_LmpchWSL#*{zzoPQsIoD>p~Pd zG;89ALkDvs?;=Sdan(9rO|7Q$Go5+&ldqsMM#NDLGss~WCsJ42h7M*i`U#m7>zc(l zQD{fK3}cCrsbR7hldI5JctSO&w#2(r#?IO_7_@1PR%ddS=8<)#7VMHIv7$_Z7R@wT z*-}*;&SmWb(iGq4wSe~R#SPTdBQEueUP|Dasg>hr>wCOP#q3Tq?rlD+-g&15CqZ4} zR9ms=g&Z{(IxV+qak_bL!AuK>iM~wq z_l8%vp?vtE6scG+KMftwr7~7T`B0~tnv+Z5cgnClkWD}@8_K|{ULb{mPQrtNLCQCU zI)n;!8QGjH`phq))|s_yUERYr-i^1Kih{|e-((i@L}*+4;g^T?g?gdPR|3s5LOsvx z-z38SRX&Dj%$_|k@mH7f(@^<-9H{R|24dp_wRovYMAplu@v^R++Anhp+&Dc&L@n2q zrb;QjL=>&We0?aH)Jr4>oiu6b`d&>jv5!}@R4&I2HIk^f32m%Yk2=)a_rsKy?*?Sr zSNC@GC*4cXM~S0$7n(3lkzCMt*;T|z#Z~1uzkZ8()eZlz?c{tBZc&xPu2&2 zblJD&D=5vsM%Qir4p{)`z{g z9SWGNO3SrK=*;jh&hz(v^=*5_-1c)b%$6Pyl)i=07v8dcDd9DRWZuVSD4s$tXx|O5 zFAm~DpAm93&Ny$P*O31x!){o$Ior8$MU<14Jjn4q+ zk978FaN;}vJgc;?n_BWTKPW-pKXF_Bg32CUwWcxkR27*Ie&S~64G4!?ufKa&{6Dkf zt`;^#kU7Dd7a*^)A^Pg2U~C>aKwICxo-$Ruud2|rWx{4!NCet~A)^kj&}PTAo=NvC zT*%*3e0kK{;vB`xK7~hb0SeoYK7e@4sEt3|b9|ZPOO5sT7(@NY^qIWKdl(HXbFhj0 zL+Iv46Y`46jpn~vmVgWSX)zGuSMVnS@$G;m5KkmClZ6(TmP7>fDu!C~QHAP=;dCzw z5+_eN$gcLruZE~F53ima@0**VK|2xj z8jZL!3Y2oW>uq<+$!@sV7ys)^3YVg_{Q(K2)tO1lHKGdC;YtA3~U1zj3*58sVH3%x4dQoEls_plBGX} zau8P`z81}&UG}imMB=*4%vdfd=faQ-$tT*EH8yT9#woXS`Pl1)D}^EezjnMbl!6;@ zhS~x&bFc6USZCy#F`j*UZq8y_Cm~U^hSIVc1#1{sE{m%??YX<0270So5AS@f-s__~ z;c`N`(eT>qsOx{_NZ*f^jcLbyUpR(Uk#t zu`a?ZXnNDELs|dIkm^J5HNy2qW63iy}KPuZ=eU?T$Fre{~ z%GOsyW>znbhM!}Q6^$j>n61+9kIkfuLwrUM5RL?M=-I2(t>>`S+46%^OqWJnO`U3! z>5C$emyYIu?YA{IbI`#6GuHd#M*<-*!xF=v#*Vt_63{8*lZPzWBwpKo^g4Ejj_#m= zN%bQ+ec+>BkFwbim~4N+3*TtA)&B*i%E>WmwZ1Ry+%2jvnP{mK$vN+&h&E&Dp-`?^ zD^<=>K~S)6JsTd#RGpS9^M zeTtoZp+CW2@R_;)2&^_~cTp4ZPtQ?hhzd0Y+~kmd_#cYMq0e9abw$kZm4x9z{p_a& z-7fVHYSQ<2t@nq#iSn5rPDhiZu~eICZ}nYHPtCR7p{WF5h_!aMc zTFr7SQp{ToS;5s*nGT74%}nJ)wf8yE$0C6x2l#(pGCoM1aHxNe>B(>5&ZCD(;feDS zf7*PjU9yT$YhCtCuW={Dv)TslC6G+!sjyD*PZ+t-E7NpO4x+e}_jY)1M1(O$+*<-D z5>w`r>(<2QT>)=j|5l)86V|FW807od(lWTL>45^>UfYvR(e^hbUVkmuR;VSP`CCL( z)RphY9$#Wi6li{!f@Y4)l8!mUWOdcyW3x+Rj2@oq0`87SR)b=&JI9$libVa{L>7XJ} zV1U*#IkkP|9&RHIHVV*lb;#?jlfLtj@c6elw-#_h^ld8WRCB=JB*66n*D+Zpx0BVA z)$j30i?>_Ck?lVjo(MW^Vx?f_PVg6VNaM6)?)Jn(Ms;A$%6?pk*gyxV*81X1Pe?B| zHl5qdAe*7v_1vR4XgGJ2h$;McCJpR9Id(#q#~FQwHN%RLrH_pZ1)3_RuR}yB+)NtW z#uvi_%J8~~yO6{xD7z`z4D+leI1qPMmyjD~&o^S;UnhmuuW$O@MOvIgTN)`_uzB@| ztrIOV?Z2vhY#Q;MMm&+3O8w?}@*6d5It@SJY_NMf==oI|O2?USoJ17dm*1A)viJSi z*;*Al@B#raS=%JxE$8V{&1_o5G~4_(SZZ~5YjNT(0h>{<;(xl%#@6=D6hZ~ro&T)= z?-&u8ho*EEtiv6I&CMunlkkp4Id4658->#9++Kj}18aQ6@kDTO@YFX~@-tAK&8nqQ zIHk&y?9v4ujuMC@JMcCED*-ALuz%7((SrZygRRoHKwzWi^au_LiWhRVw%7!Zv6=>v z#rJKJpX%%8y`Lpm28N?H7t=#V*Xy_!oRn~0{qMO}&ku8|i01Ugetf%FV)&*UAFmk+ z+AhzhqW)p)C-kJd7w5!caCU9y(urn+x+EXn?7xha`FPMOf?aG~>tHHd1a^`O6fBwB_mQq-PWHXx)4+F?8i2M4Y z-?({A0twZf8#%WxvD^k%b}zFi-61w4;?=LFs@waI?19zK7_gFhEK*sI zVSHu%sq9t47uBTl7h`y&a4u6$DOe(=uexfIot$E!@vF<--+ghtdW zs&*hQWVcGO_c+14H?j8W|%+ICvr=0k033{OKN)O=1Tt@(( z*AunD3XK8^0*FX=`y}7P9{_V!L58sKT#Hjkp?=iVrmQ}6>+1?i0GO9Gtj$Kh`&+F!r+T%F|2`vGo z(vM;#)Qv)V*l|uS*%XF|2kL?^K#Y zd}w(Pd7%IH@g)D_KE8CG;Pyst|GqF=qf*lBBO;pZBPoFT0y`Z2-!-8Hpwr$!L|dN1 zG+>{tR!J%|3SVVEyCsqBnj~m)r_D>p|5W*Iyky z{43wJVrP5*GA%!$$$l@%2Xya>z< z@mPGOU@;I+u(F>?MmSgwpc8RCahVL#yW$cF(Z|BV`t|EqZD9oK2O02cnXjx%m~vkl zbyAtU@r3AiDUbG&v}Mo$DIo!GovJ8gVq9D{k@k|YOa}OP#JCci?ZI|dM}amR)dK;k zfU8_i8$FF6j)B!%OE8iAXk(Q0*W938T84u>N}|vy7@INCV5PnbYr$QB+FO?YSK;~D$t<(t-S3tM*t$@JI>sVKE(Q_^3Llw!4VJQOS~dxjowJ|e#YkaTg??} zpB~IE9<`i*>m8$GOrHPW4LwwWz-D9Y6Zn6#0Q|6kqa9(4tZ!HBSilHc`5YybY?BELD+0=MOu$~heq;$_LUWB zb^HpH=KjD5-OvA$M)UiwOd^e9>6fr|?Au!$;182(f?s{Xs?t7wuuNss`P;-C$L6jo z#la>5P1GKNO%+VxSORLR7jvm)8VFH*6cUX=Wkj!y|4}%VH?c%E`T(>m+bcc?y*h(^ zmo~kUVuwbcGUaE#zqYIc?Y!P9qx7c<-a7`_oR&cfwE%LGs(z@ z*oYYhxwJv-N4D^@o!WTnu6OP40RTx!kp!LW^X0ws5|v0Il= z%Q(us*Sek}ikZ8SDVU-;^oT&7P@Ke;BhvmcY~8ueg^ygQpRcU!gr@DG%yjEVK9ci! zD?tbzlX;(w6UYC%a(obrL1_Z6>|X}IlRmn?E^oyzpEEw%c#9_iF0h4EdB8!1MnN31 zfH}I;3kagHVE=AYvytRabI2Eedo(Ob<%b&OX%Y3EF&JPorG{9fZUgZ6*Nzb@@)Aak z`PBeb=)Jj6`J4_K_N_}nJSGY+itXfa&W45*|ETIEtT#g%)LoL9Gu7R-_o6CaTm*N8 zeBcqk6hA4O-WPO2D;nOuCy?R;hw~*6GvDju-h01|8cRk?I04hu2A|u)nmGa8Z^z?k zEgc>&-#>e?Gm9lrO9wPqgeu}w$zZcm{``wo7$P5bVfYM>F<@u5hMWI-w#C`9(y%Qx z8}DmxIe)9FPNZq%*Ef|A_^`+C#$EI3Vy`ps%k3N zU8tAAS)iFuu(GomOqS0i6i433X>v%+#GpS(A*l1B`kI*N`r)*Nz6fwa^Ne>OsI!M&I z%0P@np~bF!{}kO<7-+Nm@aZEhfb)&>Dy%s&RTN2( zQ~1Gsa);`=v1S~A=g=2kjbZ)o_~XAURhmOYBAs{(**`qip@Jv}8!N%_>~kr=V-X{5 zP^6VUAsA)_fCAVm)nv28CFfP4dL3GnPBdefb%Wh9HUD++KR;`IXZweI{uIsmh*GF7 zlx7(+6Nw@Gc_Dpvg_IyP){zLBqkaPY zmNex@=+%Xo5IxG;qctm81`G2jB_y5p`e5XV><&V|NUB12NXYxnt*Y`sj zm0t%CPBEcnhGckYQ-0ceVqd4aJ=!;wDdnwiLh<@Icvszkwj+IGA`Nlzz#Z$;myMMl zzfyivEU{2B&6R30%#{2(0z)^%A8K#axG-?d?dwg4Py@N2JS}y@CKgPEfw& zx?3(K?$F)VwW9S!8oMFdP?uB;$(vOz3?JTg`X{?-D;uJK^!X3N^9~!3YJECbPBV-!>%G;G1=?mI(&DfLwV>mH>P-l~5jH}wa zmE3QCyRy;ADpxbQ1F-CeiFSlyR)dP?nC_`a46LE(?)p8 zv*P?BLwk{CZ(JTQ@#Khp%Eo$$b1^xLD2phN@1n+w|1r-P}{gI*6o7?o;u4Ckr}(`YFxFVRDKu03>P{6+7v+}Oj3^g z?9J6LDhdo}81*&t4bNQd)<=bbmrnxi5AEDWm2kJY=hiY!TWXVl*DrEnE{mQP($+4? zgF-)qJ_c^U$77?W=B%9-wSDH>{I3=QuFji#g~U3UWhCcp>+dilNQtZ0AMQGhDCnXM zBgpn-k~vCDemMy8$`D2~c-P(u%>vmd=W|xU905mops{;@@AH;u5eP~Vu8#j!lV9E3 zut-na|Eh)CTNt*HUZsYCsI(-UVA;Dy06^r4oMD{#N1#7O_Y|+l-UF8D>AEcGWcWk| zqbg1I2LxoyZ$SMTPp?SQ?sKJfRG{b>`fT`M0tB_G7RmrkmX+=Y=Or*YP3K($TwENo zM{#c$MsR)oEh#Mulq_YS!x}_nc)A5 zXc#gnjuw@13<}Y;8^BpeY~+#$w{a%k2aRVTBGKfrE^JugbqP4$OJtlLL$uIb_I~TS zl)j|gjtZXBYJa>kc=4RypE|Ci6ZTLB;-&g2xq3_GiOWcMiiA za7kBu6?)hgMPK6e4$RWd1`-XIJ}dj#*~xLy8PVXrT;31O@-*+uHT`(rUFI(x`lmp- zdA+%sZf5IRa35o}}0b*8!bcKq;T!@|<6FG6bE-+>-2yO|^$M_hVYOqzO% zIUcN~=Ml*Y%X7jiU&2IWt!1;iZ{QrPsr~&Cho_}BIa%Vld_vX!BRBifW3Q*j!3<6XZe{d&xyumMq2rV$OKBD9V%$(#Zy*nzN2STYu3{`r*%0g9hH|eP;kvpiIG8+*szCXh+vxGK| zIs|Y-ZPMyt8)d3W<#Ta7x!)t@<9E4ge+erb)rU=x5stc+VK6k#$EAno1ov~)kdvmG zP9Elr>~pwMXSi++#(ug#zQR4X(=V|_(m&Ym-w0>SyE(^jNZv>t;7RMja>;Gg>l=|D{3*{K!M+Uj9rxL}kpZG{bV(&%pLm3M8lQOq= zDtbRHxMN|ho-bAHe0WzCZ%_(i+Lmr;v!hc~`V~P^6wQA;e~nsx-YZFV5dvbA8&;)?mS0pIi*UlYRodqPllypB*%&OpOYhS=||DaQwd>pyF)wqn*ggrVP;vLUQucRv{joa2Cp zQwp!^@Hr&d2=TMbSi`QP&_!*(L%*!d{qkS9TjIucJyHPSXBSou-Q-Gi?*Tv=XfgVY zY4VwIUboEK_C?|oucp?tO%zuHuMGDWmNPr>Eq|BsrLBDP4F;UB+~(S9MRdo^xz7MC z2FAzR&T*Y?(~V04k2f)p==B@<-yzP2NZmOxFfeGn<1N#!l9H#D+@{2(P8(|$>#}yl%+lZtE~W>bXQc3Wg0N5lSm3m4MhrDhCInNbO#{XCaj!q zm5TZ?4`n6u`dnfigoXY8)_1a=D#7mT)|0>l$QDsMpKIjWkB)`XcTmoaYD~cyOMrYn zhntS2gMlWdf zXhB%3+I$or`J`a%IKaAT#wqxplBN!Zh~%V?$MD-Gto;LP+c4ZM&^$oLW^S%6o^<~P zDIpBWJt5_Z2dMHlsx7JQuK=(tzY4Upv5qbvy^gJf3U4o~Q+;PZL|L)zj{I^t5-|QgwftfZ1}aXWe1( zK&B7}5}(r2fZ&&fyea>6Pg*?hCDAV|ADUlC3!4k!Q9d56X}>jxHC%i;`w_;3H@OzZG| zX8B$z9<`f@wqIibJfP6;)3n;hf=*1>Wj~8&F=!V-@B%=|5OT%dDF5})cQp!lu6cnR z7M+RFw)EEZSg*~DZ$pW!dQFOdYDxWO0ct3^Q351Ry=A5!@x)t8M!6f9r0ukJPo>I^ zHK&z&Ac&8$0FWSpuhGsJ^r{;TyVjz|PUkS5Bo*Ysez8nb_R2d1)Q44I7if@>l4=ZE zxF|$Cx@DeS10yyM9Zm4OfPjGUw#L;IiqQLH0!6Fm3FtWXgAVYBb3jEN^ZBjog0B-H z{W;Yu+~I#zq&dwWrSvwE_3|k+{3-0!^R*lIt*KI)7kkGjJoXaSb+Cy+S(l*a{5*Wc zf+a6*njA}1PRtvud?$nAk9crSK6L&CL1_h!GA3zL?*-vxQ5khd{wV=KDNG&u#@~|E zVbum9+H4Q1>;W|p<1qkA!vm1JCZdIg&?O?#cQmUEDg1*Ky_CXED0`X1YsO9t@N783 z(-!@3_Q^GPTr=w-3wnGQ>Bp5qmGhk^D~`z(I+Bjy8!cMSueQtFDol~F-Vwips(yU_ z0hW(JP{VVp|7YD1n_O>7`O;tw|xFmdh^}$_zzrJ z7`=RIG_r}dkYJEf{7P8(cLwF5gZLuz&rT|y=)@!l*jML3-X9&k051D)zlP{P#pVE{ zKIz3v+El!FaldQY1Z{uD7Fqzw9MMr1tjyZu@xM(Ce-6PYDswBiI0f}|BtmAzI>qwL z{SgVApjYGqEqjeomlQAsq>JBiyZlCL(LauT*26~45H0qo`P9H1(r1Ki&xSWcpTbow z(N!HcK7D~B{isIyuk*~XmPw}j4ltFcMxX^!hIujUsVGN2)VmX?I4$TA-7gp;DE5v_ zaFk%E_m2GcOZMMyU}1t7rVAIhHs!kGm6mQ6gY~3~&TjpwlATT6lO+{L!EGk{v{8)` z9lUyCPph9p^op=!DPe2@sfzvg6P0Qq_3+S;*WQ@9VP6e1O_t9wW;UgUoyc!uaGumm zs|q(?Y_cVfB`65UUTXSh*N)XvRDF{OT*$dA!{_s)pNluYW}E^hY<&2)Zp z@0!ZvW`lP_fsC0oU1m!C_JI+sl%h&S~zDvjxiwHr(y@L(^oU4BnZ}0sT&# zH(_XYxKR5Zjv$tPcN=4C?+SChR?ciPl6bw&t5+eIJLYG>vy9M}WVjqmRe$7G@3am? zD3E8z`>Km@?eczgHL~qx-jYap>~$PIeO@xg9IWeqGdmI_tgTdV)QzY&-&naX((GX- z%r{ORS;26DcJba-s6eg_=l8E4U2dW8X$-#Qa+t-K*GAsYDC`9n=o5Uts$JJ3zj=u? zbKghp(Dp%sH0xItk;%*D>3rLG0g}D@w6Mf4H$b6Ur7Bf zwPVYm>#SvEVO!nl{W41av+G4ujS&Q4zIZTQQD-xMTK|QK{_uTo%1H^f7Q#UNhj`W- zf`))IeXpn@T!__bhe*3Qd0GH0iH5V$mh>aTQ9$fAYbASCh3 z0B9pGELKx-Y?nL9-+sizw>r$4>5z&(+`j1ayVHBp2qGe&-xd8EzR3?8HF#Cfde{UY z48KNgR!kA&PApOQ_(zYj&L>7HZ(Zkwl|D3jE3;`|>?y{A3)IW=>Nl}P93@TVPd)NR z1om6&`Ok6F+g0}@T`}5hS%IEO(mI62N3AG7>s~T{xI!t?9sT+2wV~c>wy` znW@cG6T^_EJymx5UF-a;j-`kps@(0Qx#bJ6=Yag=vP^29>vYqDc+XrG~H zLaOJ2%XY+eBl)Z(j9x@BzZ8C=sA!Q_Kc=6yKZYm-C)le%=4dhZdCjRUm+8!AQWZfex_Y!21h1VOBfrl@H#`RB$_mE+m+<~DeXcZ zf`U!Yz*n6Xmq3}!af?lp8cxB?XvE_P26(6j+)X?TC(u{J+eAF&PUhU#)0Q^t8)UjX zWvgqu2KNcAnH)>2m+lucRDiisUr(p8dv!_`I0UfE`&_PqgIm=cm@dxyo#ik zH$r`V^|n&-IL>rioXkzK8{|@$-}uK;$$VTTbJP<;$@_t0-fsKR{9zq--Tr9(Q0hTW2a6{XH!14}QxCJhMC*N-p*lbLF z<*$OPA0kf~YruE7QS9=&cRR7@khdt>v5!>8VZul+ge&+`5TKt#5hlm?!KOPJPRz2q z%D!PRu=c?U!D`v}q2m|9xEQA2>21Mlq2vh@*4m7OGfm9><-4`8CNS2emd1uMPIyz{ zWU%0d#;9(M?%Rdlk`K$sEb{0!I|J7)w07<306?J{UU$#R#0#{H4w+g0<%G3C?PX|R zyr*4A864|5%J5&xRJOWW_fi=wG1~vp)tjM8DF6?-yIDeU>Gbg-Ovvw>VIB3VQgKU- zweRt{yG0$RT*QgDE-X#8Ys@P8YICrBi>Q|uLo81GCKPoi$z9y&;r0lj)9)(80f%Pw z2Ai7fd%sWP7$xEynzq!*>TuOPNc@AZdtUSnD}(MGg)jm{m>@3hv_&otQuBA_Pzu@d zyt?-r=DJF&qdkTSh4EUEWDX?`_iLw9LzkiNclrWHJS*q=6M_r<{aE`}3nrb?(K?Rg zJ?LV8e^0g~mFlu)9yVQl%MC9$LyQiwyY;o>R1S})mh>{=iNcl>(MGUnNJ48qgI&B{ zSFobu;9armwliK5Uf2LD29+aK|ETrE?(X#h#>b?pEENosi34-k#r`60>K7D&+fqBh zsy_=8PmohZF`6;ZN9zx+e*ZOX_d8QN74?t&O`gL!gbX(e-WH8s^sjKT>Ba-AFwg23 z?Y?kwZJmDJ$k`gm{j@uD{399nANZru{s*2)@!j51=OQ?F9^>!sh$ovU&8`dw)z{{} zC!3T|Y%U3zZ;`l!CgeUl+kp%8Y-~{u&6$gf!v0jR^J#m$N-L~LuDlE25|tZU8B?_g ze@s>>A74+i6v|=idXNgcvX{?PZmP#WY1uEozkT5dslR_+PeSsp-hg->LLKV=?I2S? z1iv}uqQ?_iNd{NIoH9vR@bKk`zq9gWZh=u4gMyrZh{>C-QF1}K;QfZFtHaf|U|_Vo z&Mwav4tvU+gI=)kB_9NpvIN-AI*7wkEnf(De)LI7V^Gcs_bAiXK8EXd+mHyH(z2)`rNW+U(c_-ELXFrSyMAFH~DoxVh(L z5n-)o;mMXofyNbq_QcH?O<018A<-N#TASVs9NRpKRxdh4qu8G-cs6{xmZeWXfs zP8rQBgyZgHDb4ME3NiGhkm|0gFhS^9&Ra6%Fu#?7+stV@`sLu>7$BqFXH@~Gj0~}J zt{6*33W|FyWOrU^7Ehp^gD2l(NJA0z!hr9#`4?gz|4}K29745qccoMREvFrLW7mbr z;+7;FJBC~=hL)`=v)~1SkfMiT!57ezr0#htfRWDGT@s)l=Z&EemW&jFG*XI%=djcA zav4w>oJI2HJX`#PEyGjXBc%tI`Hyl^Zdn8}9j)#v z*`bRGGi9>*U<6_Q2uWuUY>%(y3C(HWIj>fs@bYHXrzrmSWZ@BEBwZ*CV}j1dI%J{^ zlx^;|I5}SDlwqlRZ6wGl)o|5th%lt)NWi!vgpoMRNb{kugcXz^Ku<( zn*%_S-0zvI7XqEWpTa9-M$b!U0K0#2#*JjW*U-83U)O2<|149$?~+eL5eP=fHaU_S zGa95nb`}`S`;D8>ZU;&K?@3aep_Ps>Vx$*?&zn)~mEyoL4N4up1E~UK^-Fsjj~YH5 zF7JF4aymV9^xP)AIVb!>b6e*0$pB}J^drNsWZ+|5wuty16A>qQvmLS<6(N0Bz9FZ6 z8^(i~XMkXUfYyxRfM4-683~jHT4(Crhyj6> zAD8p2q#}(lyN}TR1mC89oV=%79$ftrUHznM9@2Ux54IVPv4$I-1F0EB?ocTM_z-Yn z%1_*2y9;ihNG;QV`Bs%ssOH2~?mI_ACAzm*C(^v~bM z3~u{h1-Mbyz96LfS7>n@GO1HZMlj<)R??g$A&rUN=jQex7j;`qAxm}J-6@o_qf}m4 z>=XANTr{fRaI`!60eAk3m2+62BGGaa-t|k-kC#l7`u3aifA2h;E|9+9RR$c2&np$O z63xSVYbi*!MPw$3X*=4a*Hy`{^n7MZ_dCUX6N+j2_^d@xn>Fnk1nptaDWp#YCKqbF z1=$+iRo>$=S6U<})g&t2b`HK@wmU~AA5Un+X3aa>`X%_~l8WoC&e?17E+(}Q;+BLcSQ^fV9W24(6j&@zPeIDE>ei*4(-qLJ_7rm184_g_mqUR2 z{Mg7Hgj%tHV<%@DN?4+Mkf{6D&s$k%(b3^&fa;to_`kh}w*BBG|J%@fDil?6-*R~l z*%S-YRVl$yk^4@=NNNqe+4pFRT_{Z<+y_77vEvD20^JrNhJ6gKaH{EUY(HOWpc{L3 zc;AcpybpV^rSpEtykp~(;(5LaI+umI-^rVQ)BL7aH0_vaR8X6M-``@psDvyJ1;RtR zQW*9w#kz|42I>ezHY5MLXl-6qWPu%B_PC?Vd{f*UrvBT}WVyC0u%zt*5IMw1$u*kz_NR<>)|$7 zYVHk<`ONJWmuZ}d6geD}JgQ$hOr%Jqq+cV`!C%xn{C=8y72H|}v5c&cTB8U|4~wC^tYY&=cIWLll{ML zul?fHx{OsfItKV2(5otVg6ok4YAXX4R&GNO&X+VOMUBsH*uFtP3wBl>uwcKscYGtt zyfSkjq`}FE@l^A%gSk1&0ef8=qx|rzCW1wZ@OIMUVrcHv4fHnp*VU6Y&uf-3VO(~B zU87Ws1kq+o4|FbxrSi^s!>C$UoXc~4HcWVW@Cya&;4WhSEyD}Xau>hI@yc!hUi7yX zIpc7lx1p28q2T!A^}9bbN4z%7pi%o%y2Wq7*CQRi<&^b$ zu7DW9CpJJ|+UxfEjAb9ziX_%1aD*Gt6;J(E=r}gPcYbXzQ@d2Ji*C|vfcX|N?P6(F zvErE)#z-dD^Gt0vi6l&4l~OawiZ-D`U4(yIxN2NbQw&}nLA_10FJf<)^K3#moRp1j9$hcUV)~w{v1Wxr2q84mi>o0fMMmlyj>ppm}7>GM}Z|FsM8LGBA zQnF<`XkF}-U>WNaw3k)|wjna}*0=hzAm==VAxUT7G`;*wYUopOr?9*=l+>I4LkT?b zq-B(caUd0=taW@Ne0y@Cjc3D$j#KarFTy~$6>-7x{LN5SkxH|P|AVql-_{X{!&6uo z7A59tukN*ya;_+JNxG2o1&u;F$K}Pc|Iuxqd_~(`V7;vJH7|)zecan@7L2Eo7>A4J zcq@F2+sdGCcxBaXPr|X*79_|AR=FEPAYrRL^xWg*8h@J?1krqATe}NPYn5ZF<;7kI zDHEJNz}PLRoIH{EwN4@9hq(<|f!LDSUHT_*gei ziiUEOl^M2-j2f-+`5>_HEJ5dd$F=WpZg2lvImVG1ILP`KK9`4ZU}70U3)G}HjM_qB zxIIpn-&VuT2LpCod|VQ{J=uZ1QohihB=2|kQ$4rotk&=9pme%WROpOyt)w(=cQJNj zIx142e99(}g2ZJ<`|9SPOO;mLz~}z-hrWhM&wT)%6&K23o!igYOQuMh)^mb{?A~kh zlZg^TUs~A&l8Ot%FKyeGr(=7hjF~KZG49Uhx#Git3_IUj-ELf!zCR50z zpGQ}Nj&PIN!TWj(E}C=-aZ{Q6toXpb(~FpgzQ zlan_C(=f;=O3Rt4et|Hick;&`r`0k`NYn?WI4L-*z4N|aaU4AaPt$Mmk+rKd9w$x4 zAD(3`cER<|EJ~D4n6w*W?PKO3!Nzj=NPbG+pnKIFK>z-tyj&H3GN7KDWPg*`*^+DD zm@*MFUO5hI?6L2c)IKt85MU2g&w+o3 zaB%Mx`P!UynLj%f_Nu{SP$FMFW4(J(KGi;-!iJ*MlHf3|XH5;PQ7u+|cwKID?5n*c z`%>QJm~9Q|N!p0R>rs7lQtrWRi2sW1WRhPD((=~W!Ov1vL(&D^h7UM$U>KUQTr!e~ z6oL;F-(iO{?yb3m)k-En(U$QwzTi0A?C)M@PgmUPaEr!Q)hvAlS;8FX%CVk+X3zFHTz_7FgAk)BO)5H73 zWqxeiR}KSJEbp=OQwCjo%*{bd3J#Q{g#2zjPWKlVIPM=at(`YUO4W)YuQzz6;!XPj zPx9IC?ph{Wh?m{aDZ9>rtf2Kb=z2Bx(~T_6$M5}6AjjFCZRZs?3!Jq{oMXyKGhf#G^HE4(>WKsUutmYX_(;M4wgXj&L0^ z*`YW7u?&KP;C~nsGne0T5&Zn$F$y=|L^KYL;KNytd)!Mc> zjZ1!uP3!I#d5Vk$+WM=fut~J>_Q4mGso_OASNHAy7g{-y%U7gvR2}D?+kN1&f4;QS zi*)MvDvfhvxzdX{&y`{ALiQtDIbrW=$3jpCMWNX3$?U(A^Zx270)6$|-S*mk%FnI( zExb1Zb?ofwl#BT&_jj9=E;*g@LRZ@t>ucUy8Z>YurkOGWc$mTO6~AGtWvyx82r6bxc8(LCbS|7A+oWM`q0;IAn0~{i58x*XDk}=`r=x z2K~8N*To8T@yPAs<9v17U6w_M|l6DG%MoFenH3+p6|RlX35%n zwW(xK{djR?(L)pS1O4GTtfb;@39OE19ETq%{SMPUa$1g&nV_w_@ZhY+rNc4Zsp=;cz_!JA3%55JuM~%&T@D0p1+EVBaU2I$mVVEEmPy4??q4>@Ch zg`&d<7*(Et)L+*;;+LCW%!l8DkiBr+e*fr1gH9jf-8NMUF`sZ0oOaU8W4Xlx>FOm0 z!qO}u*P#Pcq+p_v54~N)D@`W>j!GsIj6dE}N!ea#-Cp+#Z{~s#?7eZ{9uq$Mb7>aL z?5_^gIScil6%M9jL^Y8?TQ+tjuwZVKT&TKEe{h!`F1j98uacw%ynkaC#}QM(N_$B+N?2@-l_bY+JIIfMd zGYzUzW!lw9Osmy&*O=!QJOG*j7nF;f1me!z#jcpMdZc`vJ*DtWo|vDk4qv|=1ZPm0 zc5)3A-d#z?+Utkelw5q4+C*g!?DUfzR`2ywFbYbg9r%8!-8bq^!CnsKHzrup)c}I7VmaL1Uq&{$VSPDFRULx* zJC04pd>OpuOpl9g;vVV9u!GJUcA3Sbp~{C3-ARG^dP4)5{58F#iph*PG}2Av-cDP( zhAJc|v={=JQ|P$#JT%t0H1^9Ky_@4km4axLVq|_3-=F1nd04q}3ppU+Uh+^_;N?20 zlYoEY_pjT~&A$|X!#p6V!cWQ_*J{g3_X73gMc#UE@a!f2W(k7r2~xx?T=GN? zSO@{%vpZx}a$cWJM#Kvj#>GlA^!6w4VzCPfB(sY$kK_nQ)ZFDaJIeumS<8F${q>=Q z_cl7s#Fr2FD=5Jv#z(1+PVvwS{8{VZN>P;ZEGHu6-xMbp-pa|o7?^{sh7Oq*=bi`Z z5v6bc9i;1bXiFkEg-gM)7(-U9%gB)P>4V6P;V*AAcO?A%NoVY_U6s_^%ceps??q4{ zVoYJ|g}U|FfrD046Ue^P648X zF<8{&kM={+$zug_&29fkmIU^aNcE6BDt*3EVl{Y$Iegzpt03Ka?wL-XuHRBiL4cmS z02%agnBBdZ$p2h4)X@I^mC345Q^n- zC7ODZ%WlwmSC}{MV9!S%m}k01ql+~_2d|_`xYG`yKxmf>n{J-S?o-FVaIDQ74d*0I z73bdK%mOlBw!-d!pt#`^f{5v^woBsaG1%0iguy6&;#z*uu)(qfe0{&m9H;cp3b!?70^;&yfP@1NBWzi;;h=u(=}+Nkv5)As zY&5?_(|_ws161Tm*HToyUM?W9HXr=duGbnI`R@oGc}ej(hAv34%L@lFtmltKS+nI* zG~gKAXu9%;aKm@m`IJ&R44dg*1O;-q>h0U@6Q(_q`Q@Yh<$7m|S@^|AlDv_xq_TsW zva$EF7ls`eaOX{>&KQf7Er+Wl0bw`eLa1`Q2&#>sO;mK74wAD7h886;<@IrJ za}+Wiv@7iDBEgj@%2xXM?2YAcJl)nWp_9)s@gg*$SqT`veKMo#A3MCZ=Q<38%R&p$ zmoYH+V3?6^n7Z}k!}2R9XmtipqUPk=#vA~RlUUwH~LL#Uo32lF()^i_P2y_^){ ze4_QPFQ2~co9)TZW19#U_r0NtDfNABxU*VCXxQRYeq+FTpFjGIRz0_mq%W8iBm+Mo zT>B_-UO_%ur8$YesCLP3y`E|Re*IfwGvXb^>5yZvjHp(PqbR6MXAWo%n893$VU0V& zZ6Ra(h@M|EB`{Ue|KoO>0}mLD8&Q|OV3QNJ%t%NT@$@cg8;VyxKllD#)8Gz>Ye)IH z!u1f57y1%0?%Z@t8W$eniLb@ZH21@G6eku!l38J@#~tH!A5VAwzVY$8!cpI3kw3Ew zjc@V6mAU?1f51B=0rnJY^%H@l%?0+sxan<{@_?qFeodJ>!^i9AsjTkOa0PYs;zhd@ zw3#@EDDAjodWV=1h3_LJnIN$PgV!|f+%KfQto~wn$FL|)|DeCrhN1nuysw3$@AN8J zE&R@zjCl}@HLoPteZ?T%Z`I8WLSAk2B5Ek9oxF|8c7)7o=u5P!Ea}Aw;Fmp0wD<>4 z>iPBM2iuXB=yq{5<-Q9m z0v+}Fk7E+4`+cy@ou6#sDZ+S>f|PbK8kwV5>Za>M_2_U{FCjyTrV6nV7X_m%96oZP za@^}@vE?bHH><%-$+7fuIa3NrTSDgSU}_`rmcII3v1Tz;+s-}uF#&?5fW`CeQ8S=p zuG6c#&UUstPo>~}%0Ce3{=Vjrf^6|hDUow^wf055_Z0*fb`WV z`a}T5b6B{>OD{oMr8=En?`l2|w+Fg0t?RS{IigC3RdE_ow`b}(GE%^{9rZe!Pr$Aq zQ8Hr^!v=H}JgCO!DVd7U#Ya!_ky7_J)cEJ4Z;RmHF@WJv?;k<%fe9IT$*|Sqh4SCg z-kx(y=zgz2oh;ztq%kg{m$VT#*v7s>C*<GtOM1qh}B^lakE zCV`M-FhE~m=TA@>1Gxfw5})l6T7s9RZ3#(la%H1l-nK6NY%*8me)r*Eei0}l8>o?7;FCi&-t_W<(RS)C=i8jps>s+#tSllDxM&#>8}{~Jrx_4B%? zmw9alO>XNz436e5?l|N>)OE2tSp~>8X>UC>pqTeFLzxm1 zRIg9O>DYiakEWUBS`sKno&95l?pCb(QR%_1K$lzSAt6Xf0tj|7$;Zl!=g3w8vucZw za9%QRH38e1Zh%|m1;AN#!)5C$irFuC)G|$dPCaLxr_4!Zg7yn* ztWAD@fG5v*@kiF~Xi8$BS(D7dX|dkk^ljv(42=W($KGnaZ2*ChZEk+SXRdI6yI--h z+$8jkRSn{g+v!wXa>%`CHp9O^qx(0m+H#cZtV@BMOFtZI;kl>=*4FRaa5C)_!F?uh zGmMTq!32I1w)X0do}AlI21w$_v;{uk&M4Q883E(>P&zdoWwHmLaagw*wOJeI?iyGeL)`cIfuCLUUi?P&uIMH+_x&5H zDHl?*x;U8fv`Cf4HLaMN(Z3K5uMtB8wkYoW-(x_hVCan zVQ_4Its77>w}t?E#T)jhDV5wvbm&>-rQzS9INg#<;ZNk* zDnSWLT8Wj7YVBnY-rP+7XD8w!LdDTQrK}Qb>Z%v0Da(G;M9WInD5=Tz>-E?X$o_sX zL5g@gS2KTM<8|f0kN0|yje2UlODSfU<5lXiVaIpjl!GlGzUxvzP`<72!@&a!5=q~m z3%#g9IYHZ1zW=7|O z`LC#u%Ydm&+^zsYuY3G4b4Q^@;-2wk2*b*mV%R5dZt(H&*gFEp*Z<5vdjiilnu03h zl2CxQYMbFYEiq|Jj= zFKL90Y>J{s7PswuhE|&5&@6)Sj$F>~%E&W<&Oh>*<-_}W0lNxX1b>N;UCeV|`Nazr z>hFV5lM5R}^{)41JUDu-a_=r^#RgyL4Gbp(Ze+R(I$R~asTAp@HEo^EaVS+Sc=F`= zwhQOWtZ}13!N~xya;6HtE8kd(J#LlV*Ze0N62%zgL4oj^>S30k$}nx!O2-6NLdHJH z8n!S3P=@yW-Ss7D(nZP3GscJCt5&BU*I-`0m3GD;9!_Laws#!8efx!1Cf_k{b*Bn( zxDIp!@9P?Kbv{;zFV2o;R+{)w)2#A*l(RTb-AK+UnsLDHl#RA?&75K9ethdLiPUac z&t2PiZhVqaVLCpO9Cyr{@2UE>)pg}>0_wYRe_j-=0_G05&S8DRlR`$)A z;^m1{M6wt6g3Bu{JlmZ^N*%G{V9D8kuQ^tgpCL14v~ebm(sKBOKI6R;%&*!N6%CW6 zPXZFsNmMyCi#~KTrdM1r`M-J7@td>-O8w@!ms8M;f)%al98X0R5|hLL$jSzQ0fEWs z=cwuy*qUA#@T!h+_J-R67vD^>W@}sa+28(PbN*14L{8EF*6043P)xM0a{}G)@Xd05 zcLX&)KUt~F-_kZE*3*3~_~CLs=(8ICBUuEQ7{-jfL>@BSaFtOo{ugoFwB!dgNb!5s zUgDALu?71wa9ua=6JbG?g`|AvBQJTZ`kbZx^ngcez4P`61+QtyiM&pPF$M!RQ?~4f z%lJ3*6*AWCq;ZEu^bJ zr^7~jAnFf3i%2B5n6s|NsP@v*LVf!#>{+6HZ1L`Ktg4I#CK1sC(ZK%)9S%FziuYg24m2~VKsJ$mpY z{wQ}rIAi1KSd2lD_kJ7Uq{JhM0;}C{Rjc^}_q%zE+)d<1D`*iBo~%WKo%)7YJ8x1laarJyp=md@rGK*;=TEYtI=gIrKi?DTO#p-|96|m-&k3fR{e_M8N8-st!CZa&IKxV^G`%=uAmUZN2EWKQuQ&C@vOCluH8{AYkm zihs|(Hg}IHP@qe~)m^;$t3caqq3j7Gl0A<%@ z&U>~CS1F^rx2-Xffny3Q{Wa=ZXXPuV*ea?jR*F|C;%ClTMYYUtuD2tF7UV zu9MgjAs?*M1vR3te@@SJ3Fqi)``&I_j74&Rnt{nw>N?kTD#ad@p2V)cc`P}k$`J0gnN|-OZ5u95l;`e@Z~1x4}q1XPYXr@NUjmM6NemOk9Lyoif8V&02)}n?q=b31_oX0)6Z6Yo&Dc?#*_!0*ziB3Ha|eM`tp(uFuE%S(&(d!n zHi-mPj;v6J_A+DC+CfZttxEM&!E@kd2gA3WBX4{Gw-<%5{)Zn4cI~~Qu26ZMK%B0! zAi*eu%iPKJ<~_2BfzEA>KgNW?14b)G5H55u@Wb^juvN)x6yvJ&mT z=+OQOfJ4`iIJyYCx7s;DQp^fpk$_?lQnGd+`OdPjZ7js9YPBBFDdqe;Lzzvhl)|bZ zM4I3SYV%T%%l-8!BhB)g6s51)iYNb|7J$WS&M0oA2H1@Mr2^@m&>(TN;sIwpoc3Og z(JAAt$`0LXKPdcHS|j3v@78WVDW|p`wp-^7t_g4p`28_{MmMMYwmkBaZMIWP<4>0A ze&IshM%uZi8o@7*WM~#~8Es{UWW+1CIx)aUR$rz+a0b$-`z$t9G)uu-Yk)nP_Vx?c z;m=5TBnfwn=U{WIY$@R{)VLYR59p9$%^(ok*W1g(D8LKE7OU}B^a#j8x~m4zX>u~& z`KzrzO=$R7I0RWN*By_%fx_SorFh2BA5)g*A*5J%>R6*=jW0qgxlD|LL~BX9fj1ov#O%+7IKkIhul)iN&etp`8)>oS0q6{(j+F5{byLFKn(9L**qMa9EXAO z($a?jV3D$R`)D&c&bcbV37|xv>=d%7vklcS?PpKK8TlCi1}afoZso{?E2c~$5+|sU z$fp3l=)cMT*LmYS=?j|9=WDKs0UIEyB-32|xP_gq3J%?J1^aF}Z+jo~2i1nRA7zSO zu>~){;+q{}2Pc9!%a|wmIFZde+tBQ8IAkS~2F?^JQx9KuXkmBN_*BO!S8)e73k4O{ zZYa}d;!ezwof~Wm^MZ`_w}6yYPTJVv!F-KYkuC~s!T~_2(S1g?+v^kUMPyfJ8W+CQ zJPlpH0!(0ep!e_uSdVK4ENIJ#Q*##=jipmwubapRor`nM+TD2?0X-2!h&(?NH2|ua zG#~nGWv$L0x!C8dp*IlUvN+!CrS7Oi&+XnpRHX3=6`){Z2V8$ffco=|ycHaVA2}4# z-sU%Rz87+zDlIx%Y?VUt5*-!m#9!wO#&Ozc(@MD9nOfz0^LwCGuBsI7^!WP6@qEb@ z_E#0T>-7gw=tidJ4U4`E-axQPb0|}* zdm3)Q4In%pXznnf$^oYL_jrOyZAYsOF&gs;k+0#)kZokMo~owy!w`mLUds(0Lbt=f z5{0~uFbylNCaH$Eou)5g%|@;JY0V_&e!~=N&S*=1Qy4FtnCqI)YhQz#eO!%p$7$EJ zjJ|A_iDGruc*T>MVn>xr_`K6BxUC-AZuMAX8>jrXelaFi*63tw&Gx9?i&CBOQ@FOU za$~?N)>SjFU)_8rw5QF;mW- zf_Xom> zlxGDaurxSR>DEN>3;43nhFW(-@)(sW{%QTBTX9k0p;mUcKVVRb?y^Jms<*7hP&o4s zmukY(IfI8)98zZR?#S@|>8I-6CsY?~rpTWWAGW8vQlXAdHX+Yw$yk2IN$$`!zl1y3 zBz>@~yHn{d4ij=8rhdg)Po#8M_sDiJqhCS07zyAk|I!iaRf~4xaRs5^lu;T|y==Rt z2*I0XKOfP*F10>Ji(MJ5RZ!)qir|565^Ivl()zy@7J3pi2BLVj@trEI4NxozOYYcPCQwwhFqTNR z)Jqe>V7%48wnX1JAVyw|cWPkjI%VV4+umdpY-O50Jn6D)Tm)zR( zBNo=RbkC>;@nF}RGDu~#&_&*ddP6`!B2K_ZBfLnmMFh9ggortApmm0xvx~lu3(lf> zmapI9HT^kNEOrq(5t5MY6-7kT|CgRSGf4UVq2EP6s~3gdZ|1xpv~77N;D7cNXaYu09l_xsZ;=#v~O zhm^%U@3B%ebV}2Jt$`S*@*XN5`22;+4WwG_iao>2TQIZjw=*_=JVggAR&`}^GLUp?*oPI4f$HQ#IB6d?E>sE5rk7Wo2}kWY}27(m;>f~|i- zg-mTt8>Q!R-beyT88o1pb1y*Xw^Y&yLhNo{Zv7EA!E5<5lCG!of(fnTFh21W9z5qi zW?cXq;6Fi(KpiiFywQU7Z(^CFxj=Hx949gnM7q=6e7&?Xa8Fnj|ej3tw#4@{MCW3EWTQs`t(s;4TDDUr)05W6M#K%HA zUDkS)*HFnfPJgiesiUzC3Z=l$Y-6tf7IbWR4UHI$0`cc(PE9d>!#*p5EzA zPf|jT0_TL?I`!{+ttIiiS#@k7Fnn36YNDH*)Zlqkif7sSCPT&KY59?ou-jo}i7!(I zo{6B{_JtdVwF@8=(|7yIb^QsmSl_E)&$O4p-?2U&u-5Ln>Wt2qa%iL2^bF3n=cH_g zZ1qjwap6L>>gpu%D3|Oacz1t zoKjb00wI&@sSb6YI+7x$1JEGYN=hZIb}m-d`$MO}KVFv>R${z2Hjcq49{~M%K!qDL zBbYTT`*Ye{9p5$@$#eb?#|U8&dQnF*A_{ZJvg3+!EnFtgWK^2k>8xNP$gw-hM6WFk zb3Cq{;-92c3O9RVW=*%H|h>zS@8l zhatPv$11q-m0G>*Wg)|0$sc z+{bhex0g-`eCPv+cf69q&(fKa@rW)=5?eBdf&eF_I+cRA6Pn|u! zB_S3IPP8xe98Lxc@hS8LlaRRgpXo-K>*7+Pz-EvzFgXVwqMn#Hig=CROpsSzJUr*3 z3yUEJ`SunhTrxRg3^E5wk#z1JjIih|te*KUI3F^}OqH%L45r2QKp(CJ9V!bQ0v2(- zwN2HJ2RfDPGgY_=7|ma${&^giY({3u4Zr)f;*QNnQhl+=0=-jCd08|ze@FjSg&Bjj zZ$_o>r}{7f$PdQ_Y*)--DAo{Wl1PNL>hrw#{5yio>1kqI3%BM7306y_-w<}yXe>2~ z1F!YR^8+nD+Y$w|7BvUGfUV%Y@Y>=8sDu~Z+Q2i=-bZxu%hHp}XMbG(dsED$2*Rgn zvp)?0og`&?9*)!gfF9q1z6C_)F+K=m{XXow2yS0;s_{bXt#tk_>k;;N>vo{yFxzmr zUS*c#NUbV&;{8=C+^RS{0Hus)4i}_hK4e9SYwQ8$_y}AO09EmF@>32#l4ZR%#yC+c zyCa9*U5~#rf1Kyz7Vz(pBVpfbQ88*V#Rk8wt=$!R(K_9W%xK*8lhg_fi}XMqS@mM% zoL^|eGguJp>1^Of>u>TLb=8=lk zYzg$T4dQ{!CW7)?gi+Me>%2L)Io-bl={+o-X>r4OjD7N7J0=pj_sl9kHNVRqed#uc zzhGR{5DO`8gSc>ZQPj1?9;Kf4pGg31wcz&(hQ6K`tPPr>RzF@ML5G%JqHSLlF3bBImYy=Euj0 zCrS`*+3>9~d&}C>2yh`uwQ6^@xzWnDIvb7gmYhr_EE?b6dc)ql{J@s|$#Wf8K3=5H z(}Gl&x42Y?+3nVFme%H_pa%AwGD_|vnxcN|h^(abizV&f_&l4F2pVV|ow4{yOa&+jW`eBHc^ekt+{da_40q4rzh1ldB-i{f6J2LRxy>oYv(g`)i z|J9g_=^n87c{*}!rMRobINS#u$c>fP48`QEZRn!EnOp_-E~%9uh@2$ zOcyJ(rGahzLS1>69Z{vsXawB9PY&FWj@OFGWU2EqRPDtj3dDle6fcW*r|gajxxuSV zYJDzYFE}fUJ5fGAFkmL2Fi{bEsW+M!zpPOg10}|VK*B_WI_eZvM5tpgl)uanI}q45 zW3 zsM!NBD77AjxXR7Rb#OI0(KT*B7hc}Vp|f7sUWvN@PqzWrs_%}uX4$N?u<}~H>lMR- zbo|jo3BvtU}+Q#p_OlgtCtvLLfUh`#=PQkYPa^{mS>e7*c@H4$ack*`o zRw{#w-#T&l6+f}SouCO10-Tv$wj~y*UQUm~pR$$Td$W%Lu07}8v!^?~x}aFr>x)N$ zqPDwP)s0bSOuK+ZiQ4nsGS0=L%av=Ibtc)mIMvCf`gC2UL1_)(qsdYEk|k+>?Ameb zXy1M}sL@=G@n?j1_b_ddPIUW%c(ic(8F#o;W(t#Sf${Q>BpmoON6#NKH4Mm`2+1gP zIq4G2G|4<@lsertf)O{i!T>d2oHDJ#o*mAt!robnu-LRuBz4-hKYx0B|#viS&@H9%a07U0UC zc;X(>mtIJCVQod~ELmN6@~&? zCykrESr$OGl6$kyq`Wp$NS&3aBVFZ0PMX=u^oEO?{kw(ucU+z=!LiF-=sF9m;pKr` z)TBmQhsc>;jagr;sW+5T?rE_|ooOgTY!R$|jcA%lul<3KzOm>w%Ld#ED@8dO<1fyQWq;(1?GbciGa?AI)6wbxwS7nH-$CO*QynSix1 zZIge&1X9@FOqlhVd;}D71Va7hY)dL&#n1|o6g9?{DdA7HY25a3N&RnmF2IKd@MOl1 zp@{bl07p3ud`oo5YidWgY0=-A6wdNt@R4ef;&RyvFB$hSnX7Kdq7iq=iJaTIyM4!? zA6TmMjirV{d(bTR!Q}R{0%$1zi~#US`0JuWg}-rvt65s z&)4w|oy(l`GAsGX62cGbrsefbX(6Xxa~q!_R!Cqd5t48z`pO+MN0dzeF1J1@0-I?q zX-yJHr47D_4VdHxhu$gYR5H>&w4e(@m3f$)FPp7aira*6n;rLd9r0hHB3H)%5f34*Yg*Y!KBxY1PG zU3I^!l-sU;k9V{{!|_**IH@c}NSnDbQ12#0ZHHLaqKL;sOIR2b7oWFXO<0=#%*l7M3{!$o$BP9O?(@UKem`(bG=^4XnG zGO)GoTa#~pI(1jc8YZtcM(}}k99^x4)EDF4qHgGLG5@_+x2{&NZZ}sLuSYwIo_4LW zv4VH*@>q}j2vHkvyE`{qvj-X6xL?cn*@J3U~;DMY9Yg<^&YQAqxp89 z15$ab`gFqPR@dTBfl2G1pC$`7{uaI-3R9+wX-V0_QSn+6-S?kXN99{ohzSyTC6FpWCQ|) zo@FG)TS~aAdD)DiIt@?KjCIV*H#?aL7$#ld-b(Z4TPb7JAoF1x(WC+xqj8(;58oFT z+Y^xyE5qYewK{7%jZXMpR6MpClZDvBS%r#;X8FiK9|X{V@X+OROAc*v+tR4DGTxmP z_c2?lut?1iZp>Fn)`B+GImF)76lVW#U(2=L+FI*!k;X#x{&HfIKf{EY1U4x(@Zmv^ zE)<{9j-lSUFZxCOGq2OV@nk~T1Z@VH@RzFKHlzg?@R9j z#y35n;0xj;kQHL*6Y?bBW>Z>9BEcqpmJr@^@XK9)Ctwe~c~ab$zeT&d!GI&|?*P|* zI@#Zod&F;70^q%%`Q;|7!O$!eNIEJ^|AQ3n;H4h;)zm}n3L9HS%ER6 zmO(JzyGzohJjXO0ZX&qr%%h`JJCIunsapo%GTmTN+b#S&fP~u8!r{B=-WziL%3M9gd5owsfW3i2;G=}w1rZcET{=Iz9f=V|qNC4Xg z)2+0oO*?k_%dV~&^o8$=>`J-0=3Gd2`JUMCDFVZq*AliA9I)@VvtV+9(lyUgnv5Mw zW(gRi8HfCdUuwxO2LgbO-{9ptp%on%Lz32SASH^`Nd5c&H1gg4GWVacon5qRNdXG6 zdF!&*{|!jU{q}J7hF;+VS-q)LQQFqKNAEn<%%0Q;`*)*(YgQP-YtJeZkg!*?6{7_2 zlu)amHJ~ibuqC3R*;-B4TFw7bom5U>pf>GOHvX7Ii_DjSwREegHV$@=%_9tX{?qj! z%Di~u&9rz=bT;kE2L9%F=+>KFWc-4R_Y{gcJw`mf000dn5cX>=M8AqTFvQE>`A^vR-H9`)!#r6XbuW`iptcod z0b)YH5RbZac7$J%7LM3l{6~)NRIU*L5N>b;9zSl+h0ZyWgj^IV@Gy^^_pP$c$j_9~ z5j1!l2rtvkd0;R#4~e-Z{#-l4y-|e;3C+EXTRSY9Y;wFCG6eWmSrI1t*2p3Ot9;>A z!Ccl$P6`xor#|E)3U8t3Ch0_G_D#JBh7`j7)<8YPkE8 zxI#chEz16T#y-^$4+*`}!CSN?qUd~!)loXmC@jAbLz>?;q*C2QRiPH^sZ>7im0N%u z+wJM$kIC^fdlBP4Z=m1o;qGBKQ=6y2%_e?000jal*x|G_cl40RAuF-P>i!`^?l5hY z&RfT_7BN(B|I2OvRf)i3=`i_liX`vKwxhk9wo!+*ReWv&J}EctU@U*erM@--zDI6I zC@xM$FeZquy=(S#RYU9e0qw6~5U!qWA)qOI)YJJXt$xMmOx^Xj-a9@V?bJ8TxF@VlCn*Ew)Y zPv-VhTSi4-7S0lp4@;Wl4d7_07sgs}Dy`zbbdj=kuI>FzONWIzE<$F4<{qGTnTkEB z6ae!$-7szPhS1WoX)sqMpdzCI2QP}|fu6IsVH=hd%8`u}w1?J2SXu)u>pNO2#*j_! zkMdjtdS<9{Nz#&lEcg9U)#?b?(0yCESsq6*soedl*tYuTWK>5zhy=DzajP0QPC?)3kLv6wpxN$Dc>>+E8rgUsb&V~HGFD$pm^RP5EMrfydGrJ0>HGG zrT7Pd3N3Wt>O5IxoU&e`&MWLoXL2|~`QMqnMWGvlMJ65$Wf%#geOLQ zutL^4!ufk(uqBW=ko8QBqiqT~)GW1h+kzS>9CvbPN>E&@2S}+L$k)>y|KdR)5|ah4 zv&rH`X9F~VB-YE}`LN5~7xV7f(+hwL8BF$tEw;DWIv;#lK?>!_?DlVK60DHx`$F2I z8#%S>2!u+^XX^XY8*JiSB?HJ2?eZI&&i{(7nuCJ=MCPggkpTKF@ivJ2KO?N%voImcb*&8+ z!$d9)>hA(-<<<@Y(^Dk_VoiY%sR6#)i9SwX`1peeqf#x!obP%B6nKDIAT`7|q`r7J zp5-b;S%*j_WumrsdoKOunYAlEJLcyA)DfhnVx~LOTZ%!Mwh#xJ-EUeM@)r;et_o2P zJVGX2t>z}wrAupVx)4}YVhIMg(pC1t;!P0}tbFF9hP&6=Dr>reRmLOp9E9$RMTkWx z@NaAUq3Kn|a5WWVdL;@-v{=w9eepiuvkvSoY_RK_vzkpym7LU5> z3!uE^gACH6vlbniaW%V5ejt4|vYKt~1J2T3qN;Kl5R;Kh70C~E-VzxebH3JeJb)Scu+jnpe(7res;3*wrb92-a#((Tk%}|=0s*$o6;3`MYQ>58$z$zUo5eQcfVco zrggw^2z*>vv|4>r`dyst@XNy;b0)f#ws#}ugrTW^4Dog~z~P-+jwHbg9NxG~ejevU zs7i9AjaGtN^dk_XkX+kBM&AzhqH+Hes5{z{QkH;X!MzoqNnDKh)A+5E7;Xp=1b}aR z0|2wkbhG#b!jo&+` znNpWfAWxniR7MqclHtNB1ni$EZC##P8>6_%wQc@dtmrODKL&hN^nce6CnH$eQ+GeH zUgcTye`2)r8;q4`zCirtx-ZE;ZEKSN`+UJF3#^+bGQD|J!c@ly(~W{bHM?-`9l`G+}I!p`Pk;? z%lq3(Vh3=PIhI<#Ug?%-flRDrdb>dDz@Eei_hZhjfW@?ly~uIFz-L_@^FRuK0mw>N zEz}lA_ueX(Jf|tjhZ-B=&rUdDvvONoORLW5p#DNF!5I2En>9tPo_OY&M(T#4(`9Y+7I z)u(29G_`7)|d^CD<}Dwl7Fc)mVuKLvO9d- zVYdacEOJT%ENnPt`u=M3{K5z*zd&r19w=7E9+M%zW?~TLBIhFx&pq+|Is@f4Y_>88 zXY6ur4#HJ^1vm%*(jpIRQj<+F*Xu+dxMVCdA+l+5`8^SLfqj`Uw)dUwqvT+c*Li)hsF1xwdJF8S*;z)-(hw5^3noBZBgO%i^_jT(+GAK5gs59S#5&B=*MUO(0 z-rR=y4+dMdwC>+;KJ3A_!p!ulEtTnsCk=$%?2GCRP+7XTw@F%FlynGCk1jRWqI{C~ zrO_4&GUd$96%c=&snV6#I{#R_*EAc+ls zXd;ns2f;$OFHdTznx6KI1lud0*bsM}59fag3YLLixpZ0*arvO7x?uTmWe9X&?A4vF zt+W2;P7w`CLgT$LB-W>s@JD5|A=^3#g^H9Vt+Y8)|Lbg{Hi3={1gtPIwUZSiZ0bX3N)Uzr_EeN0c)?1;tVKvSp% ziWF?kUL|&d%0@HZmNtaR4fm4G-NaFAtBX6ZujiY!jTbG~248UbS)VrisUT~4P9a3T zB(7i4)j>?2WzK?INskKA;iUsMAd?newwI}id`D!wX#5t1O|ky-K^v&T%+E;L-G$x0 z;In2>(kx};Vq4R)d9~)3K8=Z-{3{Zule4mFpIoq7MS_KxV9%W8=4s}OtlYNJQfamy zfo#7Peo%ytll3gO&W29*eQ3(-G3`ANxckcDZJ3Jr7JyQR(qHStf%=C>aaWSw=R2JD zFIpauODhuk49c zxnAUM7MQ^Zg``X!4Ul1iHaNA!`~!JS?Vv=dtVCnm0U8$c*NQ?YwP@CCa_u0@wZ`oS zLw)WED|(!nLzdVr326hhiGB3-Y6XW!ZE=S7F+&vw~<7%hk%g3$kBqSLZtqSX?*C@(Z> z>)B7=4D_R*QQ~}>#OwkB1W=y`m-`0!ug-T~R98xi-9 z8jZXF&h^=hQ0}SpFf$PG67RYAF$A!8Wxt&=NN zZ4y!Y*%~DBSg6XiPj}ZinfP&i?(rK8@3jW+PPaO7?(Z(z>^0umpzb|A<~}@tHcV)u zl?MvNf=|TzckI=7>WbB-V%|klxFCCyg+ZbnN3O z;<}I!M8fMdsQHS{s8eMM*$?4Bh4rk;cmx-CJgW{@x*_e)#2^4o_N>*r)BrRLUs)#< zDf33lv=mu&;1w>cw^6-Z2^A`B{~=XQ^#k^>k_=eyrp9Hw#+}}OU8{bHY2TsPOHw7g70~Tv#6o3k@v}3N6sqeI{Dr8v}e0@d#T_6B@gM>_A)fc^}}z6&M~*m zYBUq<7>#QK)-t!Vw5B|TC~up7?GL&i^rfvUKr=} zha~uij9s^Qo~%igaQg`rs-$X7nM6m;U}68!7)Szf#Ksu21Zmtu3SEu7cV{c;fSvT* zX_S4yhhg7*LY?B;yEjdC)b-bt;4N>-lKQ9EffXR^7uutCJFZu;)nIs`1+|_|GZVk% zrHQ?R-pg|nrRArJLHA3SnatA}g7fKqyUe%lgi5|BYpxN?w^*U%=X_AeG?oAc#J1Wt zB6#{+&+32y#7#1Sa8WC0fJp1RpRkUYfk1@N+oNxV_aKvRc2cIPj{DxsQc0_W8v*5>q*UCj8Nsd zq%lyaRuKyg=W!sy30OALQyik?%O1?f>7Spk6FctoK7lL~Tbx)1MvlESk=_(D&pq|c z@wD+ln$Xf7-ddjhNuSDQ4EL^X2!CIsmH+jt4nMxWVBIGQO1HIUeAgaX3zA}L-{wGH zJI$w>it}{AfU@B~6j4k?^7v6sL2pMLk|Jbsbr@~QO#QLQSGzf_)FFMTaf08SIG#l$L5mmAWFWz6S@GJE7l!QX8K*7UeoS!G|| z#iYa#k=ii2P#kl}>}Yd)(KgzyC-E3(KdX{;S*mw$4_OUmF@)4KS^X7$PxTjJvWEq? zSkqd@utqW#J@vs-ytFr>`xiYp-2)*t;V$hx6apFX;Mc-DQXA$Trw78!O&w8&v32pnAuj z*)Ho~)rl0Gk#JysVVaYMD7^*F3InD7VMKKsXxqRfGf!e=8rBL{ z3{6M}!VD{qRLB=TKF1u1mgX_w>qpYW_qa9kuGm5J@QKe3BC3N0M%NIGlf(nZgecEz zmDT5fZk#!)oTxN6o}T^JclSOY%R_06ia83$nQ4jJFF?(6_JJSX(aGk(M7m12$YT60 zk)Q0S#9vR;Zg;!F<|_+eQ47;+Lav$s%Q|3}7;Gz*Q>kM8q)!G;?nlPLk@6(146pR= z@ON5w%H6oDah%_DO-eAo{4ucMLH*9`N1NAmw*WJ#rhZ_-SqX|`+Vj%L20?-;;>OY} zb_eCeu_eOzI)`^E*~_nG0~5<^9U+d>5xW^PzzzTKrB`$Z&pdTua-g}?Ca zOJ+Y`pLy4fzUO?czLk)-K0_o$BU&;==f^k1ru`QuRj05_iq{Igu9M5a}+H!BM^19dVj9j zV84W8)vUjVw%0iYv+JdNJTMj@$)eNmygt=D2wZKfHU0h=(ZZJdG#hShbxNIa0v)QN z$&W_I`IaG0&osujHej`0f9lU=YruKv%;$%{xp2Q@Hjmn5k1u0^d!-&)=$Pv7y+5bx zs8_3lUB`Z#eUQ%!^`G}vd7Ib4PjNrvZG6|$+%{7qbmi@b{_xd<>}3FJP{K+5dcaW* z?6j_or1F+r;!9O1HV3oA$Xu4-$@phUco?RBZ3{*m+xDlm)$KVPPF>Sb#q_B?ifJrg zc*oTapZK1__JIVFnX{jasrBw*7S!K|gWQTw11_rJ z6{E5+19sMpmaB&1@!1aXSseR2bX=k&-vq&oqBNHC`S3khlJDA|%ByZi6_M}y3h4B*c>jJ}Ia|We$a>h%ex>=LhaR0*IQm<8o>SxnH<9`mc6Wm0pP9U6YgM|Zl zjWhCJY14Qn`7j746UGpmvEO;>j=q^Vr9%4qli!)n=@}b6*v0x*PW4kXe_vjwd{++B) zXZ_Z`Y#8SCQ$NrGx$y0~)bb?yN9!6fKB+d;ek*KIafOgN+T}&N%QfSqNtakJ$^=c0 zn&59C&f*GT;+;h!)ztOI&ZsRfZ314g-gq%3njGZj6g^Qqy|gD!hQnVgSoE7CzCG*m z{`YdrFNs!(@pwAGuKSC)Ku}sA$yMH==g2(co17?>a62}mGG~3j7WKZPAoBevZqa{9 z`3HwjKEwmMggF0oG2r_pc~n1pdc2e%t=8v1mspPJZ;&|1j<8RCb_ic8+XTO9?Z2I^ zXdQ9hWZQEETU7m3T&`91?FGwuciko;L|M!eD&GfC&Q5BF(H(FWd8g%5`2Ch(rO%@R zA8$V%N!42nO9f~z9xXP#>3ezfrzXcay3vG{*hc(X_A^|Wb}^El{}d*-6+p8eu)ld^KKQtyn1$SVRM)1%*180 z-{LiBG@YMjBQC)@`MoA*A`D6vD`+U9+YK5*ej!i940~fnd?;>~ zet&DEkigF27*;3UDxHt8OSt*WrtGH6r5# z&%b3QU_0W(XhzN;*>o}+cZfLXm}c^EP%Xo61P0Q7P^2F1(b+Z*5E5FhdGJf@WKF?I zYdkm;7C-E7VxdA@CKyW>6TLi$cw<_*@od*DN2WE7STODk#?{3bfe;6Ar&me-c*#}q zOP)O+1G6`J<&2U)wmiT*b2<54skHN60DmS4U^DpOa{H>w-9@8AI z5)KAC`}WRV8W45da*JbVX>bBF=E!ZMG%jLn5@x zdV!lkq_V3BSW?5{obVzcfh|qHW)DJyq33=)3-PHBbv>|NT|AEG?pIqXhRvfwUmwDAD+E1B$5r)w`aG}EDMyriRtB}T8<-|2-{NPPK2`*aR2NhRR`;9 zS{l#hHzkUt{1<6&{(HRd9rl?d%!c%_$h5agit0mv*0lUvNQ;=IS%vS1jb&4~i8({s zUuiRonLYK=t-^I~biLRHUy^Jq)m~WTTDzLUjzeki;X*3to;Z69$l+TK#;t8I^9Ui{u1_zOyN=F->iq{%1d)kR=$pdv~*jl@59r`cY3nA z_iiGF8KqZBSNzH_WMaX0G=1DUXUbfxYrX#6t?Yz0cW6)h!UsHNoV8|BOkBEpx#1SX zu4)hE4%Yq0+RAv22$wMh@j-0#^~G|eMjFLo*H?QuNQb%5hs#T>oVnN29}GlJtUXmMQ0-JZ`8A=tKG>YfvB!qLm`pq7&I zI^v^y{UcVKFf%i7V&|~;ld4%UG%{BwwV9@)O?X`E&(!{jO;eT+uy{r(YU*_%I zhLE)-J4f?$=ysG#^lKLoOWIB4dozvBaqmxV66Y>{m|tyo`E0Arto*j-j-|r}p7YZ< zCNXzpX5-y!{~%fFUKUOJ3O}trGP+**qR&KL*ON%D^XP9K3(UTVfKvI~cYOxp$+SL; zW36gS&SOv1-%RCcu14;sW;3B8ZH#rVY!H(2&0(n-iq^8TA0$@DJ739dLD`N(_y4^B zhOouE;Y?8w;ceCk5qZ;r_ZuoVTVM33d0fnLEmFUjUv>ogz8lnKM=jJL1_(z7mh+&U6l;sM zB4w5~+$bf?ZpbBsv(u&&Nn9hdZ}rY=JDp{zx!9u0wKrqHdOW8yH4j1YOKk;@e5&l+ z>Q~o6MH}c1@auc& zP$#9CUxd??ap;%ExOil9qYW7W-bV6gh~hYF}Gr21F=k%o5%>e z)lPG!A9;X$Wfuu z)XL`hYXXcpheLmguh6dd{S!+)BUlSOS2r@T1ls@f6Jwg>pmS$tvpSBUDe}( zER$@{XAoaetXgO?S$|dI83fV$e zvYsXzYh|7$dcU4s(#ozV7U~R3*(B;XH0^?dlL6v#I(S%RbKPEMp+wQoWqtMOXO3b6 z?Y+Ht6oN}jzlUF`ZHJ0r>>8yEuA^1W3U!LRQgiX+t%rRvF#1?C*7a}Q9L0Sq0`Bw9vV8J%L*wAB z(@Gt0empYVFtjo+_?DQzouqOqI;|F&H zXjU1BS8^OkLr2*0t2v_GTU`p?4p5Z@SefXmSCU-AhXZ&oaeyAzd_al^$K4YrJ7)VzS5(%l6K}Bfr=&R@eE)X#SYT4#u9zX`8@LWIrt~ z+N%4}NRzLSfyKM`AUqYl?CsKx#JYd~7}wVJ#5m=txyNZZ8(*NwlHUH?fm`Op`F2yO zRzKiGJvx0ev6J@Wq4ckvz@8OMGdvMNKp)#L(Z3YF<=})``WJ!OS+R61Zb8k8!-O@5 z$VA&ZNqJ`j9VQ{EVeNWYtPi%T8lB;*Ws0RMQkLtox}mGU^LPf^pDLsX=b`!?5z2cJ~V?3+ZCa;r(e@e5QabPWiG6 z8M&co^aV>UcBpgowo#X-!al9rm*k~SI@k`014*$r>I6#X+D^sp%;Eu$Uqcw1DV3!6 zKFkVc0N>3uqn7HE~kuV&5U2YhNHs?1+s6|s9+DEvvUGI{PML*g9M9hBb)De3YW z|M{fZ=#RB$$Q&F|xShm=&ns{1(qT2MqbHcpWjUlDo*BQw{P%cVO@Q}qGTEJ#NZE^t zyM#nI#2;PxKu7tl^54nnu*d0XzbUoF?0!VutI1zguWOtzOHf;CTCiqmX;(B-)DeE# z_>`25cTQQ(>-|73hiXX`1%yx<0- z&EQF+V<(})Iv91$gH#y!fhKu0$f-2{72?OcQ1SX@PX8>FU&7MAn!NJU+QsYH{kxm|+IB~5 zvG(1Ul{QF)evP+hV#egSgmvw`e9@=LFOcQ9wnGR<-tTuAcb+h z6-5o@oTNyi11=x!4<)0&%s{G(gY!mk((9pr-Y+By8|4Ij_reDO4WF(VriC@vv`zJlsejkk|=EE()`{otpZhl6c4$p8Rvm_ zFAEHrcHWmI_0-b)I2IlUXO-42U-H1V?DG_apz0WoLu0SnkZ$Z&AOwl0fLqT#PvhN%WM?7;Y>hbCKrRQN9 ziq$`)UEW(#vs#q%z2xYM5_)YtAx5ipXQqL;$eY5}(Zfrc)ilv8w^90BA>iLz#?KoR zM7roiasf%sg5GD=zbFSi*1O>jG&>$KZWc=CGPp=u`mjhy#00 z!b~j3r;r7CU}6aOrBYhM?z5L0v*!V?uP>h|WHW~~#An>EpKk!_iNjpYHx_#xHRRI! zp0W=oOJpjJY2bve(_RxBC0L&@SJY1eSm5I9HKR5f?#XKuHLC`?(>>6K@V-{(*>mXa z8>Sc2h&@R;`9SXaN6_-~+oF?!nIHIq%0l9tNwQfww+)>ry1Um?gNt?ZW%PPyM6+WA zm!&P2O-Hj8gyX;@2BW83quMOOTmnQ-HG{9n|Xr3ve#50kFV3<_k~aqN@TEY+-YtnUJT)jIop^?U0)#1?;(sL;Gd6qTWNwoqrbAHDm zJOzu&Wfqp6R2FoZg*vGm84?z)=;YeC$i)BoTgY=S-gI&DIe=a!I}~4789wWwlH5WM zsDb6`aQRlM9Piudj(}k+b;O+N!9mmAx8J1+@nQ)U-({yE)wu+w`69Ouvm9u-Pz32Q zwNs2mWYh zdMGW@rbAiTg5H>4`^rPI%rk#kxXk)$P5CC@iOa+GSm%9KL=G>n+Y5)fi3n6D4`Q++Aaq^VRh%t~Gy(q_KP%o;5 z5=#<8Y+AGl8)#`v^7{zZ30lqaQN1Q8Ww-79dxJ$4nHxZ?x93#0tW5VUw(9vk9B$9c zWn{vyR(eaWAh2F3n_Xefj&v1mGN?yV2YvP%Tcn&G06rpR$TKBkU%GGuGJ7tjw2SKXKkZO5ho1 z0oR6x(Efj9poLzne zWm7RyDZp5~I3@#xiV;lf?> zJRXR5V8*i);HNlVs&G%`I0qJ0KV44(wb*kH|DJtA@LvaJw_- zV(r1@+2=T85h%8nP-!qZWV z+0S81BRf)PE3YqNG&+)44NymbXVWZsX{1_bCau@zUN!oY7{}4U``t$$yMGj) z^_>~o(A?tR%hBCGXX}SHQ3>o^(j)H#^ppiU+v=lN?mIsB4k}6{o;D@To_TMxPsZit z(f9iV)Gyfz7%}-)THy0Lp*P%r+-}(&%`bzAyzhy_7qK;H&|k|p-rYDA#OILIjY|Lb zrlEt)7<`nrRSF0ilo6lRARPo2TPptr9+0T$;e4Hn6m|6E`HKiM$jr~1Z7s`DRNoNs zzb^_Sr_FMiCX;LBGkPA?$`05)zTSf>ch0m29TQ^S$4ml(4Cf!Of^bX_HKBoFEH73m zH&ant7+3fPchTS#TiuYj=W-Xi0=oEm1zli$)8EcZILPsP^E7Rg`lJYi!BBI%Lp$|fp)p3JlU5x7v>m1e(|K6Rr&zk!w4`?u07pU!g@M3f%`eUsfeq} z(f=KrRe$}JH1AUW@y~*3oARb|>ma4M%%mrn2k%Fye%1uv9}`WFbmx8i4}T+ZYNf=G zTmn&BJ{<)f5y3f$2X>*X{G;U~j|oJDt4=n+C4xJW5R?9F(aVD8D6EG5)crMhYZg_M zT#z7BVzba{9dKrJ($95I7&=`)j4^ooyh93`g4Do~oM>gXq_s@l1~i&KGp8#F6dL`~ zbma$V&5ka&m|nUexkT4#Ja@_mKSigD*plNq4b@Gd(Vq{-PL!2ZTYxYyOz;40SoOM; z(<7!tCFZhdkVvPuRARk$2_&*%m-1x6j&|AmvO>Sr`K4iNUYUeG!$Pnsx|sv;=q~ee z{oxIzOXPa@lRl**;X4?^On}_dQV>)PqgR?Y%?FE=r!db++*b2U4}yzSxV?E zvP!$gB>V-~_FCj#9JS;Gpcvj>3{eRZ%a3L3@q2?=ge z+hsX)xlTTtfwU*~?`P}b_50zI>c$GjH|4N%)-yj*Zfs^SPAeXQEW+6z?<{|9_#MNs zKFccfoIG|fZVu1!7k{hExl`iT(8y#pu@w5}Tq6`ja4OV!!F=7J`YK&o&vS8{G2tF4 zTEj_2`yrla;N0X$eEM#QXdnqr4n}n75~wIU{Tprg3{aAOg|(%@-mlt|659+vRSX2a zrH&mLtHdAONgl0s=Fg*Qs1{7?(wE3I#uA(+n^kt;`%Ob?f}ou;7~n1GgktpxQXXuc}JUcMn-?<;9#%IuY6_vo;vJkL#n0R(F z`X(y9j8j_i(+_(mG^=caF}$esuV~VWH(?7(^nW_hivkOT=?#iX-}xAKn)FtAbaeoZ z_!mf43Q0g`S3?a82kRKDnFO6o(){l@P0p<~3;R?TP;I8w?!kj<7JSC^bj)G*jo^s%ubHynjxpWh(f7&lR z5j4|ZmFOnjYpRIwn!4tbkb;y(&B>I$xrp4ic@e{>Xrh!k28Fz`RybkkB{(j(*kSR|zX+GM zn+x3~_^JiDTW4jyT^)_7E5^Si*9-az0wr?Yn*%)WusZm8WQ9moD}j>l%0{xG>I^b2 zaubi*vT_e&=MV~b@Xen#uj+;l!|P!8ab&a4RT~z9$#i7>N{I?(6n2j$R-Qt%IrkR@ zqPyTBpVKWR13jY9ph(LEGPA)rCAa-q?zRp3W)LSwTs-)fA;#FmECVPI+OeH4h~cFF zQy{d-gf7u=h@Q9Mi{mo>TJd-65+!AfT$9U|0Y^w#@()iuw6j+yH;&zW0OOm>MmV2Z zKG-7Y#lmL*fLQ*?c#}r2RJAvTls7I%#7{xBVLE=-IaEl_1-c#_!!#O%fMN}7TVUE< z>lg&hlhnC?jQ_(loK$|Ev>(aJDIG}`^m#hs$_dSH=4r^ERl{nJ_-8w zLVC!M1?woxsaczK79Ud-btnf^<{3K<6r1cl_$EPgucyfUwg4ZmO9q%9O||= zjn82w1^DC9Nhdx0ao4*e^F;_7USx-h6-P^kbQmp@Ajj%bQ*U0es%aqy9ox&;Cs+Og|ykY z0LtCfHwQW?BWIWbG>xWk(@UrOyZ5o*3EaV#oNBifM$A&l5u;QtRR!ru*+kcp#S$I5HkN5!= z>`;T@@U70@-QS#lxT>`jmP@9^luu>93X@<>d9UAS{ZbBcvmILvs1J}Jr2ys71d$8$ zaKyrtvj^;TKSP&ljnMdjw;st8_nM$jyIk(IO=fqDW76wz%z?g($43sA)eDl%6kaLl z#O;pd2*3G}#zsgwVDaBti)`;kx>x$fVEokHOoj9+o}a4SDF_}!7lqF6#rh*;Hm-L1 z34%n`=sXitc*?8^Nii)_OQ{=3hk>i&7?j;|1pnq@$w~S*vwBg)HI6+Ek|`x!%MNCW z4e*(#i9`M<3~2;0tuHoy|0H!TQl{7wW&LN(~6f@6T5Chhy1;L^XsEcX&D!(?Skq^ndOM((is=K69Op z1%TMgCn+RVM9XqG!xKE0Z+1R*vni(rFY-X{?TLbFV*=HFyF@ypW4rv7K4Cuj-0M12 zbgfxwKhYDcfz`HFruKzxck>qlY zz&YJg-0@iA-wW7c|6$O{9vHnA)~s{psZUzK1)(UH)<1uyY8LovSy7q?!~|+UJoP_+ zVEhFj@v%9g=Cr(isJ>`;M#EMJ1fsR@o7$dnTH@Em{bvm+$`!RMsmDTR90ca~#GW4r z{CwZX!gt!MtQRcgWL*({X@j;f`b{djo!Yq{|;1=clm-Y@3QD+u`tO=cWKWqdF$6xy_5-wUvM`{Pu zV1!lEIbysYE6T0?ZBN-P;`c=8BRVu@PfdSk{L{OUz(uuuBT|r!5FiE0L;j<7K4Ubd zg$!B~C$~;$m+SU(%du=-?Cm09e{t_`?gu1IPOC-<1!s=`NbF9a$}eMpYzgv8QGPzv z|2VpECs)`<2FS2VO4SPYK3^?-}tkQ@YEdkjg z`5;+O4cP4>qH=<0-*-;nk6(nm{!IWO-cu*^&gU&FSRHs{H(QCbins65#I#=KFQe5V z+37GN>|2v>eHgR5+7%G7O+g{*uL$I11t3E*qcGIgyUYLHdMM%LmRAyxBSLUlg+_CP zvod)c6m;t?^1l``MZ<}T_-xU(`ED;U%4A1fFCI|dVWMGRQR&m^QA}!XDN=CzW zL0DFt_bclavDSmtG6o03mTZvPrCcR&d8&}jr&j%P&B1N5$>3NcCh!rOSMXH60!HGy zwl_y3rO(!Tyz&{*-4@o;=LEyij?|(q(Z2^7E4$tQ(^&EFRVKP8$r#zh~Cz*}+q*-RlKu+E$4f2Zf90tpSD zy@U*JRaNHQ22oH3mlax*&DzH>C7zf--Y1O)0tPsyO0R;Z%&L z=vum^KadA8$Zbic&i7u_bC7Gg=QrP8Z|7?K{`SCKjQ%{Q{I1-#Fh-8DoPEvHff|Y$ z2c0XCOYCiyMIiL0_P#t+Vl(c<&yvJ!=d*MJz(OH|^9%Hv*JiS>%&Pr&GC-9E_A|oR zj?}X5ae`sjSfyki`%GBBfHsOM0uBKg^2Lq5dmx%HKF`~z-axeTRKBT7kwh_#SOH^tS*Q<(@&sU>uH%lB+`2Fb5^%LN@@F1tUPGXG&!ou(ZC6n(Ld3vBVj zW$5?9kCzON?T7?}G~QGc&$;ZW{_BXAYISG%=2qgL4g~le8f5IQl=C>~Hl$>F{FNs6 z#&kJ+dGQDD>9sjSo#0E12}HpGRC$K;eh=Y@c-xDh_@kAHtdL{|-{sf%3_s?^K30{j zcFtOi4r&o5}XS|E*{$zhKC zf>AR9tlr{nW<1TZG=k5{cL4tffN1fP)cAyJ;8(sSS*&Cb6OX}QEa^9chKZrBr|-S> zpdX$0tBn^ZQ^BnVyJvi8xq$kBl$BR}DuZNs0JOpqx`gUFr=B?Z;yZ15_C9+gAXmX9 z|8AkSp?LcYe&s?KG>5KX;s5n-(Vgv8$~RQu+3#e!KSN4OlL3viO}bf21h*;;-rvsK zL%u&Nk$^?$$Z);|eN%7mA8><^aD0AzVoBj~&~vf3ZFOF6$J1m}NG%LgW>a9Kdxb&u zbp1**oJo<-uM4N+o{QWWFj~^996BO1R;Gl6_r-t%fg~nxubiS zLh~C*mSv6*GzJ8yxo7Vxn7stJE?~lLd-#^)IfgXrU|S1c(A{2zZqW2fv9&2wZr0D9 z6-()TyCq}q)@QZfsBXP1?y$ehcY;-hH>CG|CuG6_H=*h!x7qJES>!O6K78>!5#{m~ zOnVSeVj}#R$3^#is;P@j{hy}I?r9}|KNrJPQH$rh$GFi(i!lp@ERKp|z02eUhsF7x z4;OtnH^r88QIEQ2dTsWs z(NOq$p?bH+hkMODF}SP*ScDQi0=bB9I;&ATz1+7aW%QtHv5FJ_HZy|P*-oNrL@+LM z+-t>bJ`S+G9SK6nsi!l)h~6Io!~f75R#*=gI6EaEfKFpHle-KQbMG1$iH#meeokdG z&d~$bc71+em-)5B;%k@2LIaB)9kTTv#m@q%$~i*vOmC};L?5ms=l={PhJZ^Um>*2T z+!(+~wn^UFA45DAcMBD$9+)0hXf4JBRJZ8S9WFF4g02ez?n03Vjf{E6Q3~{2! zavIZf0MQ%~HD?6#%qkAQO0;%-*u}*pViyZE1R;Xp(|U zr$~kkp%~Yr-)(dQH4F6_vwWa8Vw+CM_l|R+oSsf&(SK*O#0|#rp+xiKc1ohh-}#q0a5h3_ zeGw9dp1`PtVBMq|-j%(Z{0}~zHk=Q=_h2O6U~dhDhwPt0SkI#)m=uA&MM;iOxl@8) zTvzOCI|wI+w)5K0s}`Z3TY*^z*jc1aY|$)JkMttN);_lh>jHUm6J3uFOe0qfR^!$n zcYceVLnTxLb!~8{TNDPz3d~Bejq2ZxGUfzPxrvDd{xaYEo1MbtHp33z{DBm{c~7}D zKC|vcG)odCNo+fV(jX?X?E1yW!z%0kcAM~D((yRSz%@>07ID$iHQ-B+@FI~2!jG4D z+iGDXtLeYD9|SUGF#ne0m_$#V{aG5l7%eCGVvgdWu|y#{QILU$^lRYn)hZH17)YgC zYDEIJ5Z&xGBM(=;nVQCD`G&nwZ#KBL8Mw+Pxo$?iXP^CNj<*Tde2o6|T-eV@cRfqt z>VaIbKRxEP(ygfuCRvUMHis!{XaD+L(Wkkr#-%s5D)WKvtk{(<9%OeF%YoAeW z{aq4gu}#U7l26u{3o0y=tyr8KhPBKkL~54U2%-yumchQS%;NxvK|p}8t)r5p3#?_G&*qEEW2@(U~(cdM=zQE-l%1$INQ z-zNb(Y^wj^!m64C1am}R0szBq{#I;+`Y-^t;No4c!};C}(pUVVx6CdH{ zUL^O<%1er#fUU09%)!~$t zNVl-LI$rl?>U@Wo0)3M7{^VTO9%kB>GZX`Lk2P>0o*mv%?0?;-v!pv8M5db#8&s@k zaaG^8(bfspO|x4qhH(uh0XU%tARb2Y2q5b#9^GIJZ;+L(kN|}PcrB{gVd>pPVb`%LdKDFZ*P4d#FZP6>Xn+x0 zpYXu=`)r$wyf!hBS7q}HE~P?M$mV+>gDXQ4Fs$X!mmzC*7GmF!bUEddXx>?c2Kkzt z+JWxCzC0xO8EQdMNo-Yp5!H&Y&xL9tl{7}7%ypa3WwkQ`@rzRw&~&^$L$??I2h1P3 z77Ssm@}tco@z-z_==z~cl>S%Z*t6n+NM&>1m`%7&z<iiBd@lS3Zx><*2%K@ z8LalorPq8n+(ElyU&^>F;Z+?_QcPujuK%G3*I4UIAibK+{m7`Sl;oxdmq#ifvS6IF2|(DM#OI z5c4r~>!(86T6WVC5q37!rck^Nzaa!mp$E(ptF>u9&$o@fjqCWRz9R98p8c5H!Kgz= zWAYwpwwHZfn`-^>XOMDW(Nm#rTsWXvVs{7bRf&Hb@$^E3YUD5(~K zO_mL(<*kJGE9%~Zt{Nk?-}S~3?&ReStL~&yyWD?t`#O|0idGv&Uk7G^4Uz`iYB!Q{ zUTb+RTkc|dwZh2G{?^=1LKgy7-5lC6W47v=N7oD^As+=vpBB6Wk;OyrQ2_{VA1PP! zpD{t#g6m!@?58`))$Jld42Sjde|J)nEjh#z(HGSPPw|f+;2WHOK_k>OFlu~-KmnS7xJ~ws8cRg@Yj=YCvz}VkFg*HUs?MkVA--c@aF_ef0qcW`#`uqz`9ka-$!35G6W`jDRyo^R zJOPtooxqd;AmY5hP-z)v5(#otDbu2R5M>G@WMtOK?u9W$bm)B01Cufe!gP2%(Bs+u zS7rfVDEGf5>uP|2ajS08JSFv-5h7UJk}1Nv+=`JjM{FmA(>i}1F<yRD-*?NiI4P`F^=Inf>w`N zQz^FhO%_j;>a)~Pd7Q|L8iTLzgLQ5fta8-=joj}^yrEPkhVEf6)nCR%*!;prfDl!=Iv1&Tzt7Du_J-J1i7=-Mg-93rdQyl9| z2~R1~v*1v1#(Q-(95wwzWl0~wZ8#y?;>*iHFL!0 z1bQd%94*tSWn!?ivN=j#J1+C(C!qs3j2&K9YWvcq-WV|R!;Z_pi~bk!l_K5rd$<~C z)cd&~kUW$}GQQb9&we6f)jqqSuQywkbn?WT#69X#H7q%07EnY0Fl_;}(~6YL8B+{} z$iGq&5&91j_noBs!;T$8(5`oXo_r4;;&Qqdk0KBb_YFP#-6=m4^^QR5cX(BsHJVRh zXckxK()q{7{GwrvjPKqTn;fa*Sqh;uWvkA%lg({l;mlX$+|em1j7PmQ>wg@_n=8xS zDq`iXE>&?dfGt-Ena1+ssn#4;5x_!F>2M9da|W#c@n?+Z$M96^OUnH|VSMMM59B89 zQ%=6bT&}ND>5a8ocZaK?OJ)sdy`Q#rH)IQ9{m<4YUN9IY=7qDx;;dgRroMUY8f=3- zy|d()!Xx=^_j3+V!AW!WzqkZ0R(S)Nf-xePvwJPhxjgRdN;h9AS$B70JqQLrewf4e zYN^y!0N}Xbc}F-z^ln`AzspHk`ks{tZtnm3=$l&@9Wh*hgxIU~*<9z%c6NAg#P(EY zrWvEUS_CSFIN`ov90Eg=ym#sP#;f zXsHy;+C8Bu&e5;QguOLQUcyg5>=HV-SXc+aBNZj9A`KLj8gb119U_bgG()Vd{Q|oU zvFBRXKKZe|^I1mh#ro_nVm%OX#p9^{lF4_l_znrR1dOEMnuAnpa0l4U<9HEK+Wd36 zOk}gcO!Y`Wt$tJY&zTl zGp&qrZSE8L&5$s3LV~?!Z>p9GS9QpgkzuOKzZxrS_Wx*{#W#)_BTd$Q)2}YtAuT_) z$5mrtk9c!gkL~iPcyz!n;h%j*cJYAqS!@N>w52@BB z>6nAbN&$zZ+9X?UTS-5E9)`K+ekc>smBVY_x^;{z26#qVt^=H7avaBf9y^uQM++~qKeS499adT2V3<{cSG=#@WDMLj z*HYJ(%D4k_WBzl}2c{Y8d4;EoRrrp%ME!*bi_yqO!tu-^hT&%3>qjRpOh>Te`j1$@ zOIU9%f3%D3rQglD&6VG(w1cFIcl6+RF2A^&!ZyA;X}m#U->`c6?+jYyGiqW;wc^~KURH>J~O&K`{uWmq9K#6c4>&(5X#FHx?gmhFk)jK##d@~Imqf1Fb{ zCTw}OlfzX9tUQGC`8`AgMtP%<{kkCTucBKP=p{8>!^iJ{gTq%ypO?~mTDl#k=W~!^ z{JwV&Tcp?>O9m(&H!R7~`R7M0%20JyeAzT+U5O^!8BWndYcj^c8mNOpzj372lPhq2 z`584r|2H0G#~#m4AmWioec|X0+Xm7=20!l~+?Mv4qZw0;#W8il_};=c_NlK_1|n+@ z`t9PK(SvzM$T9GZ|1e1Q!ny*g^jm1LN6tyT&Rg5m{humN^?0smjY{}@1dGakhM-5a z>c)&usYXd0eRMirBHi5%YKu&$nGhC|Ny56R7z`<6E)hajgu%sLXJKQl z&(Qy!e3ts27}E&&Vvj*+1Fuvc-|*>#J|6K#qw0^(NLs@ zE^U0gP*1KwM{gsyqEOBDJUJI%YIm1v4ND@&Kd2lX_Y<7#CB_4U$iUh6)`ec;6KZnR z&4YQL(sOErIOi*aaV)qkHJ-5Y!Zq#Wl558cKEGWm?|DIgPh_;n1i?wwmT1{k(hjYWOT&I_IlnDc)&-t|-;`LEGyTSC@;_2vj*o&AIJY00!^HNOEV@)EtSY zioT`XOSC&)Y9b%3wO?v+V-zxj*#?z7mO%R^m-!>qK7iGWfiP|3v*&Y`-)j(Px(*v; zfbJXl3g^srsZl8Yo!skv{=b;Y-R0$dq*4&|@BVOW@3KjAEHXo72md2^cXkP}wDIhD zBmDSaR1;OyP8WItmhr&87F6R?#J02896n`+5=SU{|6IQ@6OGH`vM*}jbsDTR5lpPg za!FOz2^4Y3!dh5==q*8Jy$wl&G|#P7wDXQsH+=%v5r7&pL*vx}Xdv3?b9YgE)8~%a zPaL!e=D|;ZfTkjVr?WZ!k?i?1c*-`|7K$mZ@X&kT{gcxpkP8TBWvzz9gLK;r+;kUd zWsVUR_3^GYen>PDb2}H2F&!veR7b%RW>%l#BULF529IwZ7d>c(gm_8>EdnLfOIj2? z32YM&$TI9krI-hBkyay^=6G!^Qb*ri-o`~L^|$`rS%78~%ECZ2DQ=Ld)>SkSmvGUr zM|U}$lQIi5*uED%9hpL%MaPZ7_TeTu4!U*ZPA9+V?~2U{7r;inW2<0)nY1o;{X3}6LFh`6xC1>a_s=($bJ9#0mc{Um40&dK5M_xBg}hjCRz z{xn;WVXt3jfiYcbp62B0+O>0cdGL|)yGRHsVjqsTuK4VodD+iSkLR<{u1r492@pgQ z6t7EWz1q$P@O+^YJza%NUadb8l|;E3rq$R60455SevN4xC^&?pAMvvL$Q&+E&Wz_c zEsYQ$)wWdCT8(z69o4-dK*cYp*2@1^n)9m>1Z3jYs`?Uei46LZLBh>i&sF);suq!v zKo{Er`iwoWN}^dssIgD8&Y;5whw3*T>b zTAn`VT7mNO05cN(OKp&jH=ol-epsVnuEg&?cT(svMs91Jke^msn^LU0+G58sZS_*) zVd7Pkf7jBl+`u-6xD}obW@lU#ZDqiRH3CmGiOzlY@la0#fe2rpt66 zbuH@@yBtk)qlS5on|PIsbx-sQxV^U3nW7dV!~S478_0c$;&F%@H0V8 ziMtUp^WP@w3Fy^2Lk5crGT6?L!wBd-VyoOf&UvvN$E!Sv;lMf<&1NKnE?Ch5SYe13g0-+~r>`ZBu^>TBfbTa!dE)f^8 zj!;v&EC2v1UF;S(FyaVz-0jop=>NL9GtcTI-(>T=IT0@T9fijn0OrTOvj$~J_7`Lp z229)X@jsrvqJq=c@R|$vaJS?$=~Sztf@)l9*p+tel=441!1g663Y#@pCEpotKv&dy zvgtcQ?Y0333PMThgdio(A7yfrXy?KJdmh71h`aR=Qc-2V8p$gr_2Kb?D>A@YtJU3M zeH*p=DA~Y=1|f>obX5G^seAE(Uk&K>TEQ@rd>T2!{zZib3MiTXP%F z2SLEw)(&og_j31Jr7SH>oW1Ay0(MD?K>1&e`|Gv@Ry(0^bNlnBN6!FWCs5Rg1qWyF zAT|g%+lkR_%jHG@C}l$+Dn21poR_ImzdehEEB^J=4R|HHDc(P52yGhy-v+f-x`e?C zX)oGQzN`RBNrbbz`f>v)y)+Hnt9!yE))Mah4m&Jr5^kLMKi(^2V>ZD`=7FdV#Aa!f%!gXf-Q8W2b{y6G62W+sewv z0a9PZRF;CsZ$QhF1CT>Fp?eT%Jq6|z8Zkz{Zgt#3%9pcBbLv;}fko!#*hzmYh6Ds= zaO>1!L_!ueWSstDlq00Wn>1U-BPq-#2omAi-$1*ag4po__X8Lni4hbv1;r|barzEo z&+n(~K{@q1NQaNw>!<-??*2(Mnj|vknPb)YoxHZ~vaeT3 zq^$h?@sW4nd)_k?@+|cKZYiYf?IL`CGK8WM_>v72C?-ATpMF4OxeuDaA8u6nH1!0WL!2D-i zFhJ4C(}~w@iN9R7A$8MlYd5={*k)h})%6jfMJ%cE0jc08FkqodL_Zvx?p?)}zzD3% z-b7!3{lR`ZR(GAowORVZ0se~&0o+y!#5|HHbZLW}tm?;kOR!=o4 zPX;xqRu>f43K3g9SsoxXQk#HeyCA0FVls z-3o7Yr!&y9hGCF@sY-r+VVDR6d|ElboB{c6w>HBU!L1!oDq#W8bx-fX__Pv~J{ts> zmzEQG7_)%j!jW(c!1G$~h7A{+>FgA&_Je&sR&MMYkKug#`cntz9fmX;XfW)AI#;d> z`)9GKM{&7Cl|502KFK?Vi(gXfElgcp%sUaVd*sZo+yx*u%!K}JV|;5^S$<*aquO`y zlhkL|cK_wnvz@LQtczJ#5Em{NCIj>{fJz z8GK%bJE`hrU%YrytNrm%qwE_Hde_8Z*V)0G5*TIcx@UIRA=Asf$pPI}CMp>0MF3Ey z{cPggqW&~hG|`gc3FYtv3|BZoI)BN)+bi68wO_(z-2N8rXdV&k;MSXlc3YlLy%R~gO% zkEgoox{C&yZkwryE!C0$DY4OvARRVz6xu(9tOID_?gVxFvRqFp3$RM&!)f^dh5`2~ zXl)r)V?KjI>$)$DbvO3~-@Mp(Y1n}P1HE4h&FA~sdZqQ{TIIkZ{5sWnz&*?%-fNd^uaq|8S0|67MZQgMUEyoy*gS|b( zFN}SmDE`QE&>;*T@|yhR-qpF@9D2h772)Uf^0~Rv=Wxl_-UADWi;nlvOQ!YaZOjwU z=_2-_>wJ#=RHez*^!dC1&&qfm1x6c>2pZunLsScp7xP9E^CVUMg%2dhDAnNj#kDCp z`U;-~!ILOAbdw*giRz;`AMzny*eNk%%2)|0O zHd+9DXH+W|$ASR$m3ryN*Z#Z9Egb7N;?#qNN`+vz7&Bw}EQ>V;H&=}8MBuab=H$g1 zN6L~uvp{8k^=msp1HIF^oW1T!m|uDQ#N-~R0t(Oj)>)ytzyyHVTY>UaZjqFc44#I$sxanjKmm=I82&-tw2fgh0)A(()5U{yBJ!CT2KHFz=782* z84$Ik{Q)Q}H~T>Ipt_dR!FE7phKvSP+do!=Y1uzpjz#Z0e)f()m?P;Q67p@2l{f zd-->08r7nhxwQ-+V}^>w5k0Y8ZvJWrh%_>Goz0Jc{{|E)r4gEofpt;8_{RhxU6W(P zcP9N2#_dvo%+O7Z@2&-B-Kx{kvVo9c01v1;v`M^2xpRO(H6;N5;PX6)w_F9lqf*Z`8F z*jp6JVtnK)(00HLM4zbrI|2i+VYSmBFkL@qmAAo+QA@^e$(}`{GFepd$AMf9K z>rv-6y(dct{88`_Uqvktx`kX>I}xtC-uF*WH5Km_$>Z+@HCZ8k3z)lMhoW7u$d#|R z%N;B>hgk}Q*oOm(gh0xWZXiSKk^m)4*FeN~Lzu&VrRnr+|Ass$2}R>7_1kDA%jze5 z{|sUX$p+v5PZhY4atjL2us*I^A{?T(5%x zEl#<7OE9YoBSME6E(o$1>r)Qr5zM#u*GG%y@1nYwmxFZBfhuqM8=wP}U!r0)e*mPb z8!=Cvyw?5HxEoK60NoDsyavqeK*r0{=6)I=2=ZZ;xCugrsyX|I!GDSGnk4mo5SknN zG;BE1=CCPFt67ybkKA3A4E8SfyCwY&pNueEMuwGqm>CZr=pd&ie0(3Gb%vhm%hCXQ z9gsA4t{dy}WRHXq+6Mq>94T?GfiKpNODNmwf(Rj9;-Aom0c^S^)XYLugFPubTVi=iT+j~%D4De_7#)0Apa+luV_=eqS38iQf^ zmxg!bu!r2pI-~>5b=-&rrw35zQ<%6*&&m_9WJpLY;gdHmLa_Bs-Y1>7}{EwT>BUbv73Z$JPaGzfWKEhd+GcuW2b`%*+|Q=D|dGn=0X zAy1u~XKe{D)KF?Ay0?IPz#Nb+j6~xEE#|_zDxH5SfSfs96oUWk;qvGL|6E{7GZ|X< z(>L5)E(eyie{y;lHwZhyB|M4wNI2f-X7(B#;PiwpHQs1k^33FGJ}`ZwK7j{4coeBnJvA9J)&h!fqen^rPlP7bHZtuW0LvY{5%Y+==1!LMt=k#9R!Z z4uxcYTr7|y1hSmSy0`Du0Vt$*1Ln^56awWyO7OmI2h|6iJ9`>O5FJ}7=gD70Trrb-@n8?Fc9V542Cz@Z|Ka9 z?ii%$I6xuGYj(M#4Gi@dzW*ApbMbNKcSgVxLJJV`VXA(}@7h+0*kiHdyuYU@QI4ih6{GzXG6Y zjzy#Pl!o4TD<2K%a1F`~A@KL+c0{y@4ZyJXhB|5=CDfLa<|A+>c~}YA_lj$MEq8WK zhz7Wl3NRf7xdmmsi`+`9c{QNd0Vs-=?gs3rHg|^&v~77q{dO-YaBCpHel<8r-9znr zhcZm|MTAmI!Lh$5${y{te_}BGzlf1y0B`(}T%VDALomAj8GTj=CuE#%i3G^0z??`5 zd4{-4NFPOCMTHB(GNb6`h}(ErWSlj1JalUZWzd3th2dHPF`Nn&zoq6&N()kMI|^T5 zS)=GX1_SP#ceX!(*h9p=$nTx8*NP6$6%N<{@j~&Qtig17 zHj*vs{TW*%CJ37vg4pnBm22QP!klpDB0@v`#GdUv`8_{|?WO7Lx7iAdmiOcss)u?X z$c9#0oK(mM3-XKLGCphceDFZcn8zLc5LbOg$a+Nu`Dttf($<^vP? z8Y;}8w=Xy}s6kw>3?#_v7No7xRr{ix1LnH1M?KoXk@}MLl**8N10F~5lmbky0Uh+TlHik6U7rlAS z0vrZp5^@H-ZegDiM;MlTi3CDuXIY5N3i!9up%j2zcm$j|g?1&>Zy5H(;F@^7huBa- z{!@Vk>R3onjL>H4r>lZ3Czg0;!$0(=+^$1Jo{xNO_@$&wUL`49Cd5#ju5dC~B$RqlKC;^>(`S z!hUh96XjGi>O`ZZuQ(-HctW85gH%z1afg+dpcr0I2Vh`Qw7$VW1A3;HZqSn{oQREl zjrCtQIAgAlOO=4}m*)i(b*oHZ&BFs&Joohv><;&+OpL!!|JxU^jG^&aM38DW`6cd& z(7zE4VVwW_j;75r81W&^{`-#9;W#A@F#wcK30`;@Q4ToZqT&eHD-^qBTTBX_|#z5Q6YjsF7C`iakY&GG5}r} z7gA}|oi0)ggwmizUxT(B_-k7gpfW}vRG0&jw}AgOEA;O6+<1_Q|5ibLi*T(G-ydWJ z0HO2M{mxPg>3^%R{LBCzvCdias_RD(>si?*CtnG4T+`|$VY8Tcjwum-|JztD*i^uZ zXHNx1JKQnUxcv1^NInUqnwgYZ>pn)q_W)phemxk^1ZLdlQY+=m`TFVg5WQH#D7$T< zde^&&+`E4M{mMfcxS8>INA^EZzAK+M6 ze>=wKVS~#`p8VgAshsSrk`O1u0z2acIY5eW#ES3}c|i^m9e7~A@ZDhjcX++`x9pAa zA)#N;qm;Kxz;{;XE1VXw&l zb>NG8Di%o)S@275ySkA#4iYs11K|x+yI`aDebVm3=NullP~}4Q$IrX*=)!Ev=QsH> zqUAc6ebEYRCU8n4DZfJwz-*=4l=;Gz|J6>*iQj>Wb`rqDMc`RU04iBG*aNrqL!g`e z_$y89MSKiOG@J|U(oeG(cAs9E@|l9CNa#g?32~$(XV5=V& z0yHgcgboRt$UZK%=;7KC<~G;PE+V2QH^pf+6PdM!yvIPWEaPK?b{V;;BDV`aKjV=s<9JA+#3t#mR&1|Dt-CU|>+ zdB6jG$$j-xxadv6(m2l7v4;Ndg)@8pr!+A4ak!;zmsP@%scO& zM1X>0bs=Qa&T|4zfD4;8$Bkz2cuaW~^*3L>J>R%xrA=q9msA3-0m~!*Vf}>Ws&81> zrX+woygpf-Ov9Gh-Rbh)+fVGE*Oz}4X*08R4>{F%+kmB})9aLcYxW>{S8eAOzE;8S zB?8u?rfQS$C7IzbPIoy*|BGlJU`k^@bKwIxXKiLOwO#jRfN254H^BX`QTX2Gm$6-P( z?#|{mnD5;p5Rps#593}q-^aBDd8fIR?RP`Pt=3D8O7G)3&p|AEG3XtQA(8SZ4gQ&O z9k*mn5&)KgG*QmDjp)(?3btYMs2o^KIHmfBKFhU)RX)@MkS$%bl3Y;l+Mg7jz^3Mb zVZO6qFkvttcXZym%t7OmlSiTu&M5jK$6 zxa|4?o zR`w?9@#!-K78&qvk#VxcN*fe`3SZCnH)p%&b(C^HD~6TR_HP+Eogaln27j_6Qu&YS zjvs7Pw6E_S@9It5_Lo?9p+Z?tt4PH=7cu^dcOLQeHc7YZwaZPW@f0b-~@G}rk6bt$*xS(d7vRO{dosn!KG`xslH~PXCdqqyF zfN!n)EldO>$QK?9f-M9K0skh9_r<{%B2=&6=J7$T`1PF$7T-*Tey*)M0H?b0NG*>W zpAz`37}BcFib}Pd?zn*bnz92mS1Z>;so(mu<;Vmy7QdH!VUKh2z!x!m!NLFZcF)^`(+MgM5zO!MEJ#9 z241HH6nG!O!APKa)AP;V+C>2%kdK)F2*~)SRt-N4Oc^WHU>y3!QK_kj`m+IW+&E)l zgg{=>#vL4wB53MlDrowh$Bh99HyA@TtgnF42J`Z8UL{5+z}*n}#s41#z}9H#Zks=Y zu^HXs)7O0f?)Eg90@@U1;3yX*L~)Gek+rD5J(jHG>G4w*Kqv+{8J3MMP^!E@tEQE$ z^Hy}rsq6<;0ho3mvjbtMmkA`q6z)xm_&&~s+J|2Rxf(!l0`=fPfCZrn=CA5^EAqgT zn(iLVR>A^;=CZ)+gY?EvIlt9pMGzaOegj3GuL}DM-Br{^AHn$F^`5>PNz!&Dtw4fi zBJ;h+GnYa1s#(`B?@f2UyH1IRTwRaeCM;g>6+JBaa+_ArZlY=p-CEiKEBebb(y%_d zX9N=v{^If`T)%pukgmc_aV!^nZ-Wa8@Rz&gw}3_zXRpilkFP;{mL>>vT5K@=&B*rW zzCPiDxqe#5ddwS9GME9Gn6a@)dJ&LnW=i52wD^H8S^1#<2P}I2uv#A6FYU?X;4mdD zx$(_Wkh|HHzE@}3MYO(B;iRz7O8uwz=s@E+`(a)dCY#c#UU}V^GO!gP57F{q><8{8 zfuXMw%V3W+aEKs4tw=WN@mjq`Ia<~yO9A-ozJMcv*{GTyAYVnmq`rdbaPt>kF6=E% z-jtZmQyy0FB#lU`XX!$n*)Qc!E7iCzyIYxdV7{2bkFUEBNKA^%%1Psfq96yr(9dj3 z?Z1;Dopg({kB#|GmT46YpM_$uw{Tvm1;NS`jc*+XiJ{uKZ=%P@0R@|-SaLfY?6=}1 z20hvpfg%4NU3gnSX{PU4*XZIAd8`CbC#y1ha6b&nw_^(s_Yhh->TV;{XPs~JR}Ea z;Qj_?-~&aF4)vmOE(*J9r}NQ5qIR7HaP66*UxQl`8%ac`-kP~(6T!%i37DOM)i6P8 z5BU?X=KFef@R%3EAPPU(pjde`SrJ7ZtNl2*x?2Fk9pR%KvG9?f{To+JPCE!;`nz^g zfd_!eAJREz+@}bY18kdkCl3bbI%0zs0jWHpKtAw|bu34T4~QB*=yiM!f2Y9uEBqU= z3vNaI0bZpP6a^NmLqH^b;E7C)X_A$B{X_HQ3OG1I{n#zK%p?Fc2=Dm+b=vbJrb8Nzw7{Fnh7SZyA0f1I+PB$uYUb8hssST0v+>s1~4jvwURoxy5jzu;< z@NZeS$2tMzIs#HX6DVS-5ZeYmdgdmpk8mm7AUSXF``EqZ@+E zOOIZaUvN!|hs<1$W_)&41$alYize-6y*%>jJ^TMk{(BpTeSFBbAWMh6`>3_p#Nv-1 zLjt=Aj?MaCf5iymt6||gFesz4YXvwWU7#}FES1QU57+@WD@!zAx6Qd-$>f(0bToQ* z5f=kb@j_VEtF50!@{vq)hm#o;14ds@{2X?pXZ_Q?+{9W~G?hHx7w@a*D_s4=6QDqf zg=u?f@fYYn)@;Dem@|fc<@4g1ir=q*_{;xExzCwb>k^K>_&KzANI#Yep<#$+ zvmg|7)Z8)ukq1hsOb$`O?6RgwG%8;N3m`2ofGwCE(ak9GFq>+L-{WG?vZh$zH3%V( zshrOS`l%WAb@j{p3*dVyPvR@my3Rs6vHRg5m&|Q|G+`6a`_uBc;-JLnBJ~D*l6H+P zT4s0}h|f64yG)8{u><=^;m=R&Y^gv)^-U_^C8+>he+O;UO;_06;~pC`kZcvwR~%i=r-hexuCzrWoG zVk8M4f!H*=k-&eW7uG+uR8TE}sv`+hDHd3*$~IOoqD@LUEgHQTQXm*{Xf&qjkp5s?59`^-e? z4l+*L)%J`mLu;Gkl{OiGHDcxIpi@@rwS0718N1VRTOB?d4ANN~L?ZUeLB_5BNRg;T`Jr2b% zAXa3*Crz^Vw+G37F-P6t!9-?okJjDZUmq82$!rf-_5WJ@nme=lH`MLouTUDl<$GfO8{`Zw zmjHh0*f@Td7!Vj=W7E!# z1zJp>_0?obtvvg2U+-3SUmdRqsq{zYiNIft|00~F@#(&%HY;IMZBTMja_wyt32-u( zS4l>t-_3B_oQURw8%sdUwb)!xtFs!w`E)MgR-$yxlX#L1-7z*ov$@yVzU;jIpd}s8 z4xK-olKP3`W(CW%>@_#XGXbLLht8uEp=C>p(JSRAOdOlYJc&zq)+!yVG^VnK6trHb z)pdit{A7cfK$@jHv%9%BbuznI(4O_fXf7)2^4N^>DKmW|;LY9^K`V)~Gb7R@`kny%39fP%RP_ zOXIM4bu{0c8AY;0cOHORu>dC7?)d%^L4DY~$u^+i`5XJ#Vn(ctlyPf$H*#Tfbh7uW z!PuVd^Yrjg<};x-n+flW*WhiSFmeDyXF>k~z73Ppyv;DRu5Mq6@9A zG;OCJUkzzxg~mwGdr;YWot{qGXfv4*9WAsbMUg&<`Jg90f16M(anz$kYt!|$!R7m9 z*I+lEp!B$P9*B~1b8+}Dx-MGa%oHg1mo)`@rS1Ow^Vn>5ZrM{J=6sW^2Qwo) zM`~a?D$&<>?loZ&e>67!QQS38961_XLW*BsQ&Lz#L`lF{A*MH&v^ZBu^he-ZZuEYw z17otey>6Jye#VJGxgAWG;!3?lhvkFfMJ6c%u)jl&7rqcAe)D8Nv0!Sd0Xqz-={{Sg zCBk_{Fai%0WCg&pI(U}pdCbK}_c@wzJ@zATpvGZ9%6iYSK@9&IAeETIh<#1K+YQ?Y zE7Nmxx@q?K7b>XvCG3X8^XL1fA|%bx0{INu)YGyk4kC~hs#^r7+3fp_pkq1^MI2NG zMwX0U9?VjDih>wl3eWYz@8WZBV=FDJAsIs*3Ly_f!P@PgpYb8U-6~e8HR7vl zo23yExeEofSs&k&XL4jtnEg^{3RBHXtQ{Eh&p6n-SZ}+~pNQV8egC=0xmom#(&bRL?( zIIom2mK_FR*x{MDvJ)a-!+UM#=LVf1_MUvnd)Pj#lP!Dtd)aIagJ^e!Mk@XSJvOt@ zGI&$S7^^c?eCkDwd>WB@D3-`4g=CY0rB%t)hZWvYto=t_tkHf+Z}>y{?N%AJ_n27^UToa{6Ky;-p4wyJO0>GQ|S}O zUwTMoH{c=Bzv|7@0V`3&$?f;2=Hu}1#vtD`h_rAZcDR{67msB@ zw|ygH)}XhZr6gYnraUq9=K|)Dd=REJEH@eei#!pAy?tO-#C8E~4bcc#QYk;EqBvpsQ3MS+_E?>*DYFLd34GWU!0P zq?HIttX4={NNxgVV;G_6lclD3V1gDKli{Ro5cD5(5^Jzs&U@-UodlBZTu`LS+{0Ph zj(s-tuhjlg0)+$N{K^j|sumWSpU6*6Gk)@tIjR~^pN(Y)3Id;hmxCmL7#k5{BV<2V zTyAs;f^YtL&V*&|ryDi0Pw>P@T>jaw90Qi2iIH1>e9vND4pWRJiWB*wxny_~{Ii zxYB20q@P;2MKCk1LtU7_JgxO`1_f4QJYr_yMzB@|8_A|{&Fxk78R0@Nh4Ul5<6+XK zQaG-Mj@Sc9o79t?AA=uJ2>JAyond(N8}gaOjTpPL(fXrFS5vTU=4-?P?lB-*)XmXe znd*-X&}i~@kwx6Xd6UQngZ~k0LIz-}8k<GxA00@!xS8XY#8~CQ@t~WziLl64kFH0zU8k6%E}%OF$sB<3CM& zj=b?EYWx;z$@mw<0hW8A=zNM>R)+%%+6-jG@0+Nh1EiD#CILvnP&b)IuneEQH2+kR zpa%bz0P(q{q2bq79|hp&URg352)lK9U(K6OOMgB39$6mQS8zn75(QGf&TkF{~a^6arF3V$eFr zKR!APCD2@anKKBItg-9AB)-+0_?xn^;NNsm*i|Pm^Awv5)^s7Z0s7Gf_W_br7xE2s8E5zKX9)UBfNfCF0fXrXDN| zzB`F#2izK=)ob8^i8**XcrTUS@bpY^dlx_RyXLX@J0{hgWM@UYsYcWI&QHz{E)<3g zkhRr;9~dDet6lFan{?ZsK9())ycQek!1iQlE~uC*_o-ZPn`e7WX*w_?f)sbTB>5oI zx8rrQP=Bu&ebK`BP`rVf(L6#aD7?>6*!9Dr=~IQ?&huYMojPkZ{08NW0+Oe6+mTij zlBc2;h^MseXtv@BpW_ABJAa9^?_Xr=Bcj&~9VL=;oJ)0mVv2<=iW{NjkXd*=Q%-iJV(YSW6B4J)fZt_^&s=31y)VX|r zP1ItFKT7M}z%QceVPepG^3*d>%!^yLWR0&;wKL=%9G+Mc!Rjz$j4$D5ZI*7^24C8$ z)G;|rQc_nuS#XUY;$G~SXzHGrcBwiSGrlsgJovR%Rre3Gd9mk{koWl?#=IdB9UZsB zf{m+PfhBU;<|An`S30_FeIj!UfwTGg z`>Y=IA-}z}?@Z$IGwfD;)57?a-@V`PpmgV} z(p(e1l^1QbL?v|0NYVf6d=- z2O8x@bkU7_tmes|r>(~4r{G?f^;f8M=sK*IB>%k5r=30>L^FdmZn4)hub3w-*3o3RAPV(7>jT8c^Kz=2G+>=VEf-X9bvgCdK*Pf z(as8Y&?dP?we?1~=jshxRC)}h9Yb=>gI81vi7Vvt`Te%|TlD(#iSKHgB3{3H9Q?7i zc0#h3lyOrj;|DKihICthh&j#yv!<@i_FrVx!qSl$8C5`We%fC1XcAbkCNnQ>p%GYW{NJAa;j; z&~|8>jzKrFru#&AYrp8Mi4Sw;yBi{Ut)*9<5MiNhQ^|yy%~gB^vKAxPUBlVVLw^NV z`Pn|ZZ9dZVjC!5eiQOQb0phiXo7+^-Rq&1 z-rb%xm^^hYnVRA5a?4v6eg4*OnlhK-DC8T8#-*y8ISOm9xJQ2c%@|XrAJdO0*^o;4 z@k`Gwt)CqOD>0oPWs)UK)o)nhaNaB@7q`6$%1RH!dgzP7W0*0)?O?BRYlJzL!>rP# zr~Xn1Eqk`)x%UaDSqIMW_x&mI&&x$huvmeo+^@qf>2q9?PF( zg&KE7+>-*Dh6~GJtF-%r=?i(TB=nnmZYJ-)p6dIFUF@FeLyWc+U_c~FTJ{cT>Q5r9 z`AL&Ut*SdHC8c7L8vNv}!kvd@W&F#DO-8KtZdeckMGtC<;qmmCjK63nXXeI%0f-WRUM_y;uc@0ZbX^O37!mE;Hb=5vk__iy$XrGuJ^IL9cxL5k<`K@6 zfmf&TtE-zxen=e{-)161q(7S8G_ zAUh>@*oy3K%7EDB!!zIBIW8%uX8kYgU(31KJ`aCqo*yNjM3oNT-+!e&rigNUT~*3B zuV$Oz2_YX$ga|_o9y=$H-81VnC_!zf;Gfuar zg@#r7ul-cz2zJ1ma{B#;icfXL~YL}(P<4fc~ViI%kXR```v1t5j*M4 zM&eZZ>=f7O5;cxac*c@HBT3;bM+U^&bX_>G=&vg$?iOapZ$0j9h7>#7a`0f!c@L{w z2?7c1>k+#}i|wHGus+wzr_zfwLlh{U6UwfO7K<4esNwGrw~C|dlVUzrGz9% zJghRbzua=QU6iG4A9|CE=tuX#W;*sYrIhr}Xl4Pwz@s2lG-;v{9mh%T)c1VM$Ne`M zeBNbro{2IuwATlhWcmn6*^goyws^DlFJ9bSuNHgxJ3FtBNCg-? z;s_`^c8Q~jPv<+mn@n;UHY0RlU+oF-uUCG<(UJ_YG!f3&PQ4j%xEkzpJSp|_&pm1z z47nBm9SByY*yKHMox@f;Xiz-8I$05)4r|_l-n}LeuCN=3piedNth1rMJd&W99CJ3R z{Oe`-zSMg9E>7#ZFIhkC{YCZaDZhXY^U@4;X5ba#j3?(D3O)CAVY0#J#F_UQGPObF z**xjoG5k)b+;w&#H6rNk_6JhZXI&vIpR($aU#|}z)O;3*ABE^3Y&a15?whJZw0r|! zuFV<$5%Ha|t9yYST-45YHd{#rf~DnU#y)sO)gn_dkEf;`%gHp#{dv{0=@e}j;=BnM z50j86_WP1wns!Vup>nKyk&JtN0fnY+ou~E2*%_T{r~9Rq1o2Yh5LHXn(8!V?sE&e% zqbmM-xbV2G@hTAH+FdV;28P-LM?` zo``6!xzht0{tMm5187g&eFz)|CcpJT>#C+sM5ZWHn0SHKhaTL=81QjjJ9XEhdvMP= zlL!xC4R1{fNh9GtmIH-^GDymzoP=D6&YkZ30;R4UVNf*$<~WJYkVaVE?CZN(@YKSG ziOJvniC3U7K?0=EtExr+Has(tFQM?C0}x-mBHMtKWx2@qs@e#PBzY}Js`birP*!+^ z;ysQjjrs3Tw}jTu=h8TW6zJcu;<(TwC=D5aJ0)ZUUUmpbcH*yZsMuYw;$Qn*?@!Cr z5N*^!G7;x8c4hnee|@WpYC_)3v;?4o;DT3CV;CQ_uj0yz#xUqUMi!_!EwPkLH=`w% z;J?YuI7n99X%@>HgxO7`{csn%B9|h{(j0X>pMJa&h1bE|bJXhah`0{rB?XmLB-T9KK@fjG42i!)oZ9%4d;C>Bi`avgaOj>D1r9T;nb_*(M5n?N2yLlIRd0 zpLYG--Mr)X>qsSkDi`E>y7}arO-i6^nywQ(FeQYkexg1(9i<-V#y*ILSe-y-Y!@X( z`l9i1LJjd1#}oL*NiLw}2xrs^uprd>n0TyA6$n;G%S~X45*)qBokz|`F*7j)7LC;i zRN7E6xC_kshysFV$~9oK()R0)81cdk^2*O-h&% z_m^=?A+EX|sJYh_r)e-XSHv4Z`N{6VV*d5*!&|1$92ki`W={Lyi@47@!Y5v7z%4O- z?nAbDo!K0#9M0lA;0=3N1@%C;h&(g*WV3W)Y=N0#XYl%}lfNsS*UsADb_u34r8zRv zP;tu#YCenpsZnq-fEVp}Nzgs&5QZrQW-eJD=WwiO^``y!Lr4S{veNAMFsHU=g;L~t zk_$EgvN~^u*?<8g-i{NKc)$-#Yo)PYhC{dQ=@hrzaNyZ@NyAXFUs6~l&!xxT24Y~^0_r~O2TI5M zN+;hTc~yoGX)Z|-`2{&qg&}u9W}w^~_9JW^5>3a>CB%EgJ3Q3e&UZtU)`)XD_C?5e z_nl9$e8|g)Z77eg7U2d;yYW-MkKozHQn6kO`EJgsF*lb!O1bGt@)dY15gvTdzqF(i&2@Lv#F(rifyc%$AUl}#? zyP*>N5NC$(jbW{|n`_@Sf_%p*rqksE_fBraz_6m%sVgNwr_JL>9sO4H^CNUA_Mvee ztO!Z%!k$CArv%iKbZ5ma{H4hJNyoEKUI|=}eYk9AX9yS6$?csd;RQj*wU9Y7M8tc{ z6Kn28vVN?U#ZK3+E-<@JGd=Ft0|XE}yR=n?-6UfQ=8(v|9S6qxFr~aJZCw>1*X|>4 z#zqYf#jM%GR?mvuaQuvIvDjJ<#A~vfV!LE#^#7=YlWshB7+%2j*2~hT%PXhfV!YM<+y3 zErgrnWdhyrx?5hQ*uvf@MtL(`5E37{F^TpVwXaoUR=5$E+$tP22yBuOxtyvqbPW6L zC9R@Bmy0kpLs_L5)|kPoTh2w|C8tdOMeRp*g6gN)4gxByK};2NxD1%KZuthOZ1b$q zzo?;ZvSls%s79gD*OL12Vw{Ke>C#ZRB|Zly3nfZ!L(-wXcb;s{HDpsUCphlOe_XV8 zE%c+&RKMTl<|^Tq-ZEm1lAgSE&vZZOPMMq7G>GICvH^!xMbVGmM&* zCO>6C2HA2Kr?({@D6yeB9_y!pm=a0cI?0Q%hJ%dUq}-om7$4;=u0#X57DV_Viw@=F zF%Ty3{nG3Cu@xY?f?9&Irc2S>ik)GpzHvKg;8A@$K=qm}C^siWR{w2agx})rwU5|xrvRFE7Z zT>})5md1@7JsL*GbKalt^}C+GfNPv{?s(NrWq(-$*)?I%QDC3&LHx8{YO=tH`QR^O z9iE*3O67)BT5OUrx1nNjYM{IS=EB9TnYZfKmf#bR#chfj^26_DwV!{wRtDz9@IL-W zoAVxt`kLua^Q2wdbl5$PJAo~|%){}^gOdZsxjxIPzpynJYTZ~?e1HRj=}nPf=rwCd zc|TarAAQR$-S#)BS+VAeCZ(sCh%c@Qc24CAuw5s6;+~&r|lC@q;eD?Qf`Tihv z3VLaVB9(tIC7xK|%y>{^{=*giwSSq%S8k^22}y1^a6lvd=0$|Xo5k)sEv*1fH@!mJ zRo~J@&J`!cDR=@KnQNJ$NX44VX1qt_2FHwT_8WHsH{$Y$_zrl^(re^~%n zmxE6R%fu(s9!$-pO+Yoqopn=&f1RQ4?K=4>D{alwGJi6ZHk^)uT{_2u&4V{KmLULI zX_?ZSrMceZ$!mBkE#|iRxmykOPGQ7LZ|r)Oxil3TC4=^Iy6Yi=(O}qi+yBD2XFxpO zxv9hohEp}x^v#}I{f}d-DsM8GhhdpAbjL-ptv``p^<#V0u2APMkv}<=f{M&WEBL!J zUKsOrdT_jL#9!(-vf3FFaUYWyNvNw>NV#mJsu5sQ{x(0+I(U{hBRuGpC`>wT z#_~g?>Pu$}By)6F*Z43{!;)bw6RtD;)}q=q3!i(>jDl{Khu-7z8l$*g=fH9gtNmkE z-rF(1pSPqClj0TtJ!gBHZBE_k9#O66->AJZeL=r2=*0np9lspZ6~~bNV1hcJD?TQBw(|ggZg-qICq!k>*Cg zS)J1XXAn6z9;q0DHAiXsBXDNU2 zegU>xW-PvhS+?;Wuq(^iaM7x35;XK=su%%Qbg}mgO~ONpT;?horGUAru2=n?%JqA7 z(&iaCRMvZrbvo2osss67>cQ-3G-#Q28ZQ~_?4b;e z)HRjy!+|%5wa`7qJ*Sra>tX5|uv`Uz5+n5Z+c|`1iUsh1r~oQ%+#S^UV{})%(M=N& zzdi6w0=VXrX4yB8OXR_sAjM-5^0Z@NE7?Uu!aQe)D=Z{)v{sIZ@*&ixSGj<{YoEO4 zH@g&!+=C0U*CsC^Zy9PU1Q1wr@5cEO{066ol6W>J{rVlFgTui4C0+bEpK?S+w&ZWa zcK6&1LhbENf#}^11&V09h9eD+Q>j4pNM+a>>A?Q5jl3v2;_p#QUr}A0*z|*(WhX{C z_5e_B{)$1Yp%zJO@&6e1NVaG7<%nL%Ty)p8aqYNryLx{+!#$Hwn8Gu%msjXB` zR>w9I^w5}JP08Uh^^B5C9Gx}zevDb$Ls&16(O4eFxC|aAGuFTS{&{W?Y?Q$0!noQ( z%;9q$-lP>L`G501qN7I{E=>=glwY$p%YyJeNS zSV(+^l@PCd`0&U?J+iTfe$!UW_Sa0#JAGg?vz=s8b^8-R#dfPto{=c!+`-Rm=YQOR zI+nM*b?kD*smQU;pn8Hlu#T)$;9d+@LkDbt25!#dLT{84F!Z-G$DtrJi2cnHg9la6 z~I3AJ%2mp`YHNCj!+9cB;BMR@#i-xt}7a4pY$X zJxXFTM(}T?%BKRq;}GhjbNKHBCec{lA)_@$XIBn|mv9vt3H&~neCkffdI;kne=oPP zHfAdLX5+qvM@8r|+FT;{_Eq9cDiuw&{y*&v@(UH9S`jDxnS&6;gvEM}^1k`0f8Igp zco$E%;BYLSIGz?8Z>|;HJHE!-EEM*qQN8ywRJE%B{OnwfsgO?uAo}6vzRMJ0e@2(< zs*1Hd^W%1aomCI(pX-;e>wd)ZPrT-b7g#j?9CZ7g9eY_%G*V9Z2iY31>j%SsjynA3 zb^N9Lu7`#))mzC?In$lQ0)k%fcNIQq6^hxhGRv=fyf;5QzS(Pa|A?AZ>P8-UMZQ7A zN0zS_--{S7YpuP9y8bSg`XIRBBt9*Pqt~c1Iqlpr6|X~W2$HzBBr0E+_G?Xiy#03_+^v6D@LIy=Dru_aq!k zY91tU4KxL{xgHA!t0kgN3yxeKnKk(-8Gbj_8Mf040`x z4NDdlsU#qEmm<(4l1PI*j)F>9lS6BMODsi}iaT^^U??l}P{HxWmkUYCgQv&(`7YQC#mR&^mOf{loquGelnwX-<2 z0<{)&N1u4Y8ohhEn0X$9A_OO@T+wl_5_Flga8CY9e|+wUE5YaqMavvD_}pZ+r}F+} zK*vI96(Td=e?x`NL!9$0&=^oZ5n_(u;%ue~Kdxpj}Jda}a*H}~pPP265iEwKtY z9Q+tmUtCZk4EA?Tn2>l!tXG%mc!>xH%KXcqZ+OX=i#qCKywRccj&Ou8fXj+FpWYi&357X#+*Cx#tO)^I zxv5_Dd|;1z;=7FI){Q7?k}ZU}nu?fC+y?H1GcxOP^9gdyxc6s#Q^UYoXL|M|P9q@G zSF)r#a*=txzogQdWNGxpaq`E}LQ^}TDXnXR#3^SNinT*njViA_N_zYX&1LW^eT9xA zy5#U799`bxS`bkd*Kb%Yzs<*LA`nmS->UXtx|JQf0zWO!>~s8{-zGz@CCS|`q|$&9 zIeJJDgr*pvmk)uXv%noudj+x9fF%rb-J%2_7$c4)?nW1kX*wd2xMG2zBD({rU*sJg zdPzUX;Tl{C_uo2gb2p8iL(mbpnbq-JnCPIFcx%)*^i$1=6X`DE|n-N-A0KG zZ{GcslHYuE#0fuNWPYwt)kb{I^C=AM%N;x>YL86uCIg8l6oGx)z-2R}r|WUTH$rwyX+v zNGXX!(T$Hfs64ODSVG&+`W)$;6gk?2V3r=Nx9&&W5Z<}fc)x|#Yi&lUHK|2r)WlbA z%d;)X{2SU3A=8azM4;qRt@pbOF$LKrb$VPEvi=uCZ~r{4`I!+ZbP4OyxI_NDqkZIQ zt*gY#soI>bu^cYZ4TNG1XggFEnmFK5s<~Mf^vmNGP;Cc4$mLV~$C!Z0uG~kzs7&cg zzrW69n1W3y$;Y>U7xtwPBffT0cr#Ap}UO;B#$-PJcI{`$W#dVP~|qE z!8KO$Ia!O%<88w}Lj2<$qmt{JzU$+fziI5>AE@_De@n9^^eziq%IKvV)JqR}Bme7j zkLgYPjfJeWCr{||URH8xS0*}7CgrOim!G=khEzx?$LO&1(*-^>6G-zu z*qCB`eI)(FF`+|3wtMMuzdzHD+lC)( zYWf^?v-MGs)tp^@7Q!iJXZWS5)^Ww+<>R8Cr!kR`S~&^lNk>~HQNZslm5D95&fZJ^ zvGD0}#aLGm2db!ILG8{!Y_tg0r9wCOyJq7ekF2w0b2z7w;QXfp5~Xu$I>Z%LZdu6E zt#;z;l1y8PER^&-)%L~;Nlb@lRhzXLIsSPLs$ZE3iYj(9)b{3HL?`T5VqpU}c)6U& zLRRBA#>%XXi@opUD``#fYyk*zHhT-ap5v~}CDe!})zYr6YbO;{8i3Dgzwzwt6D z=y0z@YD$Xl13%kTc+k`sDjP3kACLj%PT1b{{!mO`Lr(eh8O6|U`{SqJtu7-gK$L^S z)%ykvL+xQ{c-0+t6k+-B8QlXJk;T(CZNAHkp9GJ=+!V8ES`CF_rGs@%xxN_p*&*+Z`7U3DM;?K@if-EM@noeWELe z%kSIWS3XJ=3+RAQHsq45eFzyd4@`9^G(9JTlh;(;*;F<)otAsa+TEl#x3`P1T&=t$XIF`CgU{)EHPr@iJ=v6e8mn$}|iSADHLG zN&}tQicL8o_1+OYuYCu=K$^kt4+1Gkv}7n6)T;FD$$htc#@OXp1xDVr6;5D;s9B>se#@TK7m?c)FuEFJfQIPn5!^qwpxtVOLt_r8zQ8MPCrmmh(wPGp6>1r; zT|^P6Se*v|`*_$a{R|RaV8fp_!O4AKTJ!IJaCaEsY7_me>%$`@>hV5MPn>c9E{z!T zzh&Dt9NYk(Vc}Cg(T-VvSkPyA%pX454baXP;_`<0A}!vipZVaqd_;oRH_L1qFD_PZ ziW3$Ua=8J)G=GT0u8ialW&SusJEM|tL`3{Y@UX9cKi7%ej5>wP1xShC{;%;pWpl`I zc||;C&OHT#aZRh}>sk+8X|{M5IhL>ZfcFQDJgH7rkg@`b@inx|Eq{k(!a4hBQ8eac zQdC{-4YrHyarR`2?i_N@DOdb^xW?G_8bEZqW%(4jWN6tghcqoy4s|ZZ-3zD*;dNG& zVQ>S~6YLtyNCtKd`WO3#!Z2))Qr{fIP&{uCpWbM&BU&V{FJe?m{Vt;8p-3_GuJf4fB=v4gX(;I&vCJJVm;UD? zvCA{kiYI!uFqAeoN4LdC`_}Y}J&&CI#xnOyrN<`8H0Ezz3`3QeM2oEd*9YeigUf!j zNXw6URAZ|SP z*KzayC%<#d`#4@f+f5j+5;h&;5${6U#}!@#YB3jzf{3vpS7y-XD6+LxEuUmA$uAqj ztw}0dOxSU;4PPb3nf>$0>08mrs}V4Bi_?Rv3FwGvPPPS)V>#C!FXdMV|{B{y7W?p;CS+?q7hfGxn8 zW}rlw-kWQ*o?nN36z8<354gI|iziq~!Q?z=>#K_MAdEMH6TN_ zD6PnsfyIZ$6)b(sY7F^4yf zdtunuN35x?X94e1N~W*ht1Y<9N*mxy)M$eT@cJ6jRy(ebE?ni>Sg?Ngg?C^d*2Hnr zU_VQy>PhwRI#%dm`b}?(@5&iJHy@2OJ0UP$>jNUReZ>BnhWmkGR-A)5_bAvcq9!rHOzGcpn0_*;Ue z;(_`}z`fs$akNr4*c)Sr09Kj-6jIn_9K#3yBM_ko#QeIEl}?Bh3vS82m#Vf!nO_aX z&y9-#mJll}v}6Or7Zxw;7)stI$Zmb+9m9YLm(GW|LZW8vvKznNOXHaF0UZk=ycv#U z$~Md;V2~_NN1B*E7!~-0?3<_$Mis@K(r3|Qb1ZooZSEM3vAwM3AEf=cZ?8Rr!!g4` zqXO9i{qt)PaFu`T2oYWvRQaY>?LvaC{=>Y2&#>mUXX{ML*&aQL^);hGed3rI%{h%D zwQky-_zqxwBvTe4UAeqD?pddTd@JT}IH*TZE*%@@Qy%=lm&G6U{G_VzD$b?kw6k@k;v=#R-3Qm0wCa=3 zQG-q6X+C=t;Tvge^H5$!N=6hSe96a1j3t4x$*8$~rT6_HA@`pv7Zq&kKA@uF034^ObVUq%4sY`9AnS zH*ggji)udG&w!3*ghgHIU`xBnuEJbUBKUVgi$XYM z9iIm`B*!*Iyl0ugj3Vv*)k33S`t-a-TkwCK66{zZ+*hOh>s@n+b*B*g@%x;KW16mV zk75ZLFa=})*CG>iH^G-0V`DCh0El`QYD)MHk}TQz)G+~^gi99rvh($uMDlUGO>bc?1j zZmu*lmmJDcXx<}^>4jXoBCy!ejNJP!f^gXvzFfM*0Hs-m$-q&>4w&y}g3X6`AVxjL+1t*zi|Xm*!O^zd_rsqzf(sSbdH1bV@VYlkyY!M? zPVU@`Mu3C92z8oNRmM=#ru7 zxD(#?UFdN9Q8@vPQA}%QMfSoRtkl@`ttsV!0*K|GRheg(e`yETOa~q*@0e&>ZaAtu z1LyJ=M?PQ`4kyQZIDuf73Nj|rye2>(I9pc0#jH81i>+Jatj{9!TKlZij@5#z)ewfV;{C+MS^AX)pDYO>CT;jvo#U=X-< zwWxn{=fkaALv*~-lSIdfqOvA6f9lKc+_OS2bpP|Xxx~-OKA+ZYiAl=8M3+@3I1_CP zt{N0IljSeyMg*3!^RaOsPm1Q|V3})|`5grVc1x;X>|tGZ?B1auuGMZPsw9D$B^ZVx zLk$1ptu^B=WS*YQ5~yw&7dAp7Q(&dNFF$=w{nc%+4H7Di%5G^Q-L{8 zLQ?J>?3_%2$k#eKiy%hk4y(3DQzl0nt;pMOZ`Lbj5~(c_7W`{HMV4; zA|>7F!VmW78TB^#zz?&_qd(|YN7u;j7Q|^Y`NI|!s6Z!@{xB`7-naYCs(#yK$0D!a z!vUC@?{<$^q4}+^d!sFpj%eH&ZuAN6rK@92?a9WF)BVjO4A!aNohYaI`!z&vOtloPW^r(pvJF?S!rb>)a!l{2)lz*vl75#-45`bZOv!=^QEr zAAUFQc*Tjr{d8uP69xuYxO~2J>EL(Et)w0&BTly$ZZ;_UmZt-k3e%XsM3G}<73kCexHXeabzUnsw zZ{`+MYTaxlUPzcg<|%kO9@I;QoDhS0moVhOrC&GXL)Yw*rN@sk5ULqIG(Af0!B;Va zTNP1-c~om47%95Di1gfwmZNQ#z};2l`9y}FV>iTHYWb9fl!AFG16Kxy-m*zWosr|a z;(jRuZsmXCegfL%5+P}A=l!iC!i^ifqx9gKBzjlZN;Cv%U-hS0S>yvlJ(JHWm=wZ- z;_~6u{ec}f0WZ(l`i^km_k!XM0;XSCx;Wk>3hKA}!{X|YkAIbKf{7hQ`^`zOMZlWw zO_J2DRm9WBi2%XnNeKtMGNDQ}grLkKeux_r#_9ZCR`FskIJt2Ib+~lAxDCuM>%zNd z5r|?x$AmF@FIHsY|5%+8vjo7u#pxOUzY#sc2%IZI8%IWhZvH$_Lj^7WI zj|jQepAu)^=7XcrfvTliPv-Zsc#dvIb1W}d@oT4cB+Ns_Qodg}n)BGrg093>0KKTX7`9+y!ZsE3)tDmv5S2XVmSFnjp71F^g2IcViP*{cze4p_?HI;>Pg{L@AuwP zrmZ0!R^R0yuWQXk`$ZV!Y#O*0`m)Sf9rhVH6NixOuDw%;Hb@O!)wEej$xaaY#C%V> zL08oJAt=o|4su&s`bJDq+50Yyh;QhfifkpFBCtZrI!mh>SfQ|j0_DtS1PyEwx{^%P z@d0&>gZ`ay+)L^8=Vl&mEvP8FlwG#l4}#TtpSb@g`~{q`I%YpCq3R0^>(iji^t-8! z^!u@W30KkFKGaEY$JEo3ds;$~Cq~cO5n`T_!AWh6_t+_C_B$3UpM$C3_TFoEHCsPZ zbGuDR5X?cp>hm5vNj&bt#^$QsXSRiY@Nu&BXFo)687Hr`5E(8sMH)}V*}j(2?jNZD z$xBpN@l0V~II8F&%T_!HH3?wXfA20mKg^x_LD&1w>$5MRUBadRE6vhv&($yD&iJ24 zdn3}nS57A+K1jNFtaJ$eX#Zs{U6L<8J)blc-8c1R+*KCKr|7Pd~ONc?z>n491KQIW0Jl+z!7Jz;^z z7hG2Rvt)Iwzn$o(l-rCk9^X>cG|ct{|F5^gK=gP7@?pq$9|gepOTT5x{-u%ge|AYF>&((x3vj@h|Rt98u)m z>QD|iGCC-Z$dhYx5v`(8exLZ{+oyD={USRWQ`TnX0F9%e8*k%&$+Zcky$L;RstZan z*PV*}kT9gY@*mr={@cWwwyo71G@xCTWK`#h&|%S4o?>nGAL^lm-ec!ZNP<2GV%L#< zMOKYdFgPBg6F>){Nwy zb{f%#T_3_$c0m__)+h`U2-IYV*|lr*2t2n2163(iEC46Sw?V`diX0h-opi0M)7e*}4C$Yn3lm+J;Xy1W9?jJu#AM zVVl`M{_07MoN#M5(o9!!`tt2!w_kal$!@21DJPX{n#ij2RY?f1-oF3wN7$f!*GiJ( z`61+Pp?U=xsP4?YpHc%xGU^oarx|Hcwj1UJ3N9YMTfqa332lo8qo=5&CQbGg7PF4&jg4v}@MR z8Fy8`u2Fr(pXlPWZ!&CtdOVr&Bqiwga`Y^X4CiExM_A!Pi1j%|0o#n#WR}9u=#L+c zEdms&!1=Q3Aso9-ENfOPyV!)i&1jx_G8el&nz8r8#5`=O-uonBM|#RHBlOZ(moVTN z2r6zJeE!R$UYl!gIFjCj1GNJp7zk#CcF9R8IssjZrQl9TS?E>l8(Zx<#yc}JzbLh8 zECjsd240b#9PKPDbO;$8ah;hOn>RGLSs{@@xxSx>v-;%j6nwA%r zU~u|tnMg=SPcN7+%%7PCz%MzE7B9+i?{@EA49)%**f;-Y(#Zor!2mZeIelKyS7x;W_AJkDd#KZ39e^4#9uUJWNRNo2ksQfEYk&v>1Fc}YS!bo8bCn55e1GCg)vvih+-5CgV3R+TCNkWcZ*yKUrp^ z24urDI#66HMY{O&pOD^26DwL+WM*cw3WLgS^kqe7W ze&E%Pqo&Knr7`qq9ExOKRB0$N`R5_Wq3C7a{d8G=it8r9t2*j=78SmqP>P{&l+*qf zM002bSwk;j_Cu`YLR5v0?oNpk2$*_+#;!o<{~3va4@BMx;y&G2x8CbZBCG-wc+R4iE9UpPs* z=Fb&Rg&Ib(37H!n#}X2gc?VJQ?LD~MQ+X0s-f6zz^w-ncxDdOgLR2S|v=GEuwZVD2 z3CZzv7K$P=PBo47i))J>)RHlmsIzx|NAz<4OLs9>hclGIy zCoU|d-C2ayG4E)%!l1vxiaoW7>@+E`8*vch&3X&R(CGf@C;i3#xV~@hZ(Xtd1jB|( z97C5M+ve#yQ(XCA^V3?*Z!dOPybhFGc!-P%3N`&X4Ib0{aYWOf_NE;98n4B_&Bhov zZupAp&f0#RuXO%h$m9N4xa+n_O<#$l9+jB2xH?c-?X))R|7|uPq_5F`I@oBQsolmcy|VhqZ>U`U z<+)ytY`xR&>-uk=M|BUREjF(osU$>dPwW)P_$;SFRVO_o4`tLxB5=3Z?HmxlI|P$j zjm|t&D-8ixLzz9Pe!c%Jm#4)4ESEHwigySeD1@kM6K!;G%ehAX@lWmKfUcZ2_jR$L zk6J-w^Q+1}+0+MyDcMtNJnO1lg_6!+cOEJz7#vm~mN!Q$w?^rh3%BW8S16Dlnnn38 zE8dTSJJn+{^%FtAYr<0_(xzFr$0cE)`i{k>dAN|tk*B3^cHr8}35VPd3qM%`uSR+* zSQ~eTF}DLC=b0WjQs{bO;GApP&X_SQ4EdPs!K`AE=(on;Pc0g)&K^RUTlB7a{HYPB z)W34}ySmNLM2&YEB0OpIo77^OB`JG9eAPK1QzaE-n&dMvS;J zgvsdqI36kcp2VDyRaf1>*260KF>U66$ch!sYHcva(1(* zdr^+`;#gk$R{H+vvqXe^`_$?k0D8wlH2zkod(WpmHZIjJy=F$_RgQ#nR?X=0zZg>- z=G4C^U#5M^fpimi^P}XC!PkQrgYV_$YS3FNv;9Yu`roy0ntyX}Y{+~>(BO%b_NOQ#BWU9!DI5${GEqiE~u8Zj|JZ0lP zwOojlyV895#pLEN)%%cn#wb*2V4H5+)kp`Cc^;hmT;tOHTKtVBkF&>P+fMz3C~J@T zJtN~zm_K!tdGgH;OTXoE8qz(Pe-Zoc<6EkXn;k9`+Q#SH2|vAY3|=G7BREOFDIS*d z7i!g3ELh`(ju&+a?nJ}R*JpbI$~ZMkwSujvEdKW8f`yI`%K2P(Z`#IHt;t`1;ulGQ zus)&T@Dg22?rju}7iq(7m zsmh+6>?VHO-g~^vj_x_b{V&f=tKBQKoDaK{75hX^7&M!;Qp^0ZsvCNhDR&*&D1q33 zkZ{F5ae;Ev(m9u@2GifWk~uU|JjuGw*9yIYb`Q7hzQ6yJL5@vqw1fhJL-!c4x}tI| zY2SAu`y6hv?yAB6W-Ls%1C!oHerNMoLZR2UulhVg(OHx-h)MCOYsyBW+ zTCSy!epn}4VPd4#^I0me9&n8%-?b)yw0ga5D|5@0PijqZZdsYkvpP;7fnl_9q!Ib# zsporF1Hu_ZN^w!JLsf`sT=GJN+Q{?LF->C2b*&V#YoaaA-`kbF&cS;FhE|6q@;$s3 z^j_~L>g5ve{Tdph%T=GvZ|+$23`brWiG2qu4HcxRe4ZqtN~6yc-cXu6P+=eB7~>89 z|Jf9<)c8 zS4TgX_nCo8rKzy&u+xg-V1;@6Tto>v_+G>Op{Q~9U6VY!{BDW=Ixs5q)ufx(T%Nz7 zdPNf;yDQOh!d8!J973JzoxB{~&wmVeTWHmte+JLc&75~IyWWtu%~^gJqxGB0$T%iZ zZCJuM{e`qiv|0}KP+V^L$*WIOb-Rx5ZRtg|+EymcM_pR~uSxU3>NZ}TJA_vFsu#1M zWEKr-kfi?>yrAC2X0T6hhv|Ru`9$9$<94Q;b_#uD_iQ3;c<413={nNb`bQDI;NoE> zrySFkFeDBUECM+&VPK#}b*nI;<$SU(+L$i$jTB`;MGw{BFp0P1+e@x8#a%q2Az^P4<+vcA90@Z!TzfIDv2z#H$SFo@89rG7{KA}P z7;**YTm6M`!B!)xsq%B27u;AE`*e1PSJOT+ZZp5Q{dbC%CUYNYjfESUTP(Sq-44sG z+2`W4X`rbxVn7%0ME$%eJpF!FT?FqAaqc?PfERxjJ_lT#qz|pWS~vLA(*UM+@;Ca- zisy2Rb2|FBVhr+J`4hLSb*)I0dRe25HjH5Qi6zmO$H<0|FQT7oI$tz4%{Idd>d$UL zvBPzC(%1Dm$(v1u<$&>VsilJox}OV6P8~r=DUp?sI^kEs%-TD`6xkc~JBc*BU6_RT z1lMCthTyHAr0(iU{zd9x78QM01|VNyN`F%^^*qG}aQiW(>Q@6)7r@upO51#0>TUd&{`eHKH?zy~@{eM{sr?BTA7s86b zC*yC;A|ldequ!!4_e^L!*76XD9TJ{!SNk)lsb+NU6Zfcy?P-f({=Z)t+eRd(k*>+H z^27K@Zy(xyv@-^oKrVt-C`Ts5!&5lW;&lX7rB`;l@huWSis%5djoi#W=)Jq6+_G`! zo_Z%UiBXXIjiiz#4uz|ASk&V7f)ZqLQ5;$Il8Ks`ktjz z1%54-KkqAEUx_t)J7Xa~!k{*!GiRYcc34j4HDP;BXl^w_E__1e5A6awqn9bOQVUP^|Hyltds zU-Vh_SgHcXduMAt>tSfc7w)Xt>I=<{JfF~t1>7}p>&*gW5_bW zkM~D>LrHC{rr&mt{+3A*xL*^U|vb>`_A91ATYmxoeI+1`^4yHmn zN3SZjrX`k*<~mD&l%tr))~TJ3WCHwrfIJ|E#MJ+c{ec{%9=w~6wh9t42xeMOYO2V2TZ3L+j&@{L}U9DnzIGw{kJxm!x$Un}vk<8@oQ*C+I&ZsTHDj$?!r z7k4|g*R5{&iWkQ{b@e?`o8w`I zMzk8QLcvVpr*d&@!4~Eq&LR9(mW+J20!T{@3$@@I$KqLsIgoNPJv!~al#TItiB$f?T+-%5|oGMwXMDD=yE#?JxXd64MrDFwh?b7P$i8ZgJ7s=sYOSB zG}E8<7!>-iMjJlb1p33idui}ef(d3FBI9e24-0ZD#_k_} z+{qh@;V4AJz_zHzw7Bbw)5zk{IKvZRFi`T}$9P;}5D0kz`J(cCW3Rgj(=LIu21mI% zb$HWn$0HEDnjUsNY-r4~hpfAw#~AHInnqSwRukSrzd}VRQ_LO97ixL}x|?H@g?Xt2 zK^GHiu5n*P*?UKk?OVKnHGLattJYev)jQ?ihn#QQln>4z10zE)ziyKH>9t3bv>{BkF*8mk(klzKn@ssePnr2u4zADZi{QxZeO6TNTVxP|Hm{%q~NI9wPx8IaMK$ zt#`z>F~0YyodH7lfI)uRfCOAvAZGWfjttmnj~sg!WO*@&U!=&!RwS}hv<`gZDlLJS zNSC(tu`=Xn$1XaD5fz(=_QH|(4?M32L|xb3hn-g0X`40Xz9FQ3h-0s@HB@$9#c-3z zbt&|132|-yf8#^>6Poy<#W9}%BTG=mveQ}#b|AT_w}iuX19>_#p5A5%8-%OF6C~C`}rbo@H4_um%H)X zTrRyI&uQEhWeP5iFs5-)(JGy1YICB&_gEKTDp(sw;}3L3QjKnx za$BK8t^#{CWb|~y*F^#(1f=^iAWd)0NsEe4CmCIf;VOAZ0TAeM#R{Q|@K(dokiLSp zSEMD&ZRT2+(9*K{iEO#hvC3Z={dRKN1!kxF2*kCH+K6Tt7 zky-8Pgi>g_e<2|=LTU0!Y0G#hQy$lM>~nr^%57W%+{jEV z-}GJ{XyKO!*bevLx_Jj|hqHN76fgP3ob`pL@6fIJD8^eAgnWb!5_?ht8jy?R)`X}1 zyax*Exjd3iqjxDzP8D78GE}b|W|Ww6C;i%icIbQ`y|(2RO!Qw5O|lwkrn46!8ClnN3Tk3GO5c8|Blje1&uL~H$^>U$38l7GL8`L5Oz06 zJh>_4>%peV(xngGKC)v}#^(i;pu0~xVVE_cD72XM){GQ8j+|89mL4CG|Cqsg;lAGN zHOUa3Ajv>$81Cm^@;m{6d%+{_Xx8^Bfd9-hyIgJLR3yldxA805rd_Px{pihso=?lF zftwts|86~{v+HCe;Yc2BZrR$`$PXbN#G$&|Q_m@Vk95xy$UYZ==v>@M`aOtizF;h} z2|y3AQ9=O&Df%=QLwE@EAq|oO_WTmt0iBt5Qt^*~bI?4o`esrX(DY7G`a&+hu}ElE zEj0eF>20rw{q=3>k9P(J6&tNQCpaD4@*8cF5G{a~1Zn@*mwDHG0^~2TVQ1pi-L$Y` zA>f36Yw1~waHq3Rj6vl+tz_xc=>iwug$~j*7%zd^DBt2urymaXuBg`mt!kmr+~hl>5l+lcvsCLc}wjmQSgh z=Y-YKXByWAgt3KZQSp*G6)!g3M~p!MfITPN`}F&!zVVNFM(ao6e@9IYoMk7uEI5=d zu09!Gabhr()iL*tyPVK~6{pD+s%9CxdcCVAA+ve?e)eGrSUQ9f+2QSV%grKZ`@F^{ z!i`rK;(vg-xSMsT6Op0gWq+B2ekIDWgd^xjzLAc}xV6 zcb^>~0#paL2abe7*2>sl$u^b!kjWlNc7X!5Daqm!kL>Mm#jvir;nm*j3nneU8 zZc#Ff`n3Fkt_RSk=KkADuh9C2gAf+G8NS{b^$@Azgj5%FEHe9AUcWPXx6+bA*JSyz zbcN61PR0L9{7yKF6f8*A`Nr|V4O2f;=&d&D9_rAknwdkBG`K(u zn5b?azz@WYokfgk?RtB+nS z1$zt1`C|lK_xO#|_Q#`+T-%vteKW-Puk5t7?Wg5Qklf3>E8um~&$MXBVQt>|@#9#$ z55fXVYSqf@^J{f4uMLlUng@fi&zY1*i)v9Ho8QWspefjnygNQUwfa4RE&jj=jk_~l z@9;rZkI?|lFYyOD{=A1-J6BaedI$IdJ*2|k0e+qa-6)pN9~^zLq$JFaFGE+w2Ur6mUx7RUx})^!cPSbyvWidO?j zX*EU=i&{j1`XA0-OW=f)xS^HMe%L;ZJXMu-cv=1CgLKC_m>~An98Ak8pXM*%ED#3xbvje{{diteXa8uwIgyq{@K?PLP#d^Z*N+~+rpdO^uY3; z3=#D=W%(By9XW<|_dI>l+f{R5d16bk0@+#Vp?soq@DT2i;1k5}D8CPMX(t?Pn*w^=7f1X}lX2@ec~ zL0Gt!PmA{iq$YE#_jF$95}lNm{5pBj(gX^gJtg+#67Gb5_BfdL{Q%MGaIrWN{TgK+ zEaE22m{g_0CN7Yk9hEp3$s^_2Gi68d?}2IE8WM+r)!*#u&rwzm{38H(t8r21BG5T4 zoKbhxutMDsuKcTCI=&R&$xqc#B zi_k2#pm+m2)3;RJl*m{Wgi2|9{5hyJ(9|zZs%67IL^~$6_oS#R$@t)wkxu-Gc{(K3 zMm*a5%YUR6?T}uX=;Fd@NZtQ52LdIFxuAy-P-vM&WOY!nugB|#^71J7VQ5ENJb(yW z;lI;-NxUj9hx*uMY*jo8{6@BOabU)*qX4_|%zRMohT~?z;moTgx?eCS>3Zaz=paSj zZj$hT|Hv)7c^j|O$6@IR`?&6ASP49z;E%XTcSI~c{@%P25&z6cI9vLFC3Fumswvad zR~VN#PC9=bIGzFo?y!qOUH{VW>G9uU@ew>`_JVbZ|4TEf0(NM;&d6V!x)(5n;#=33 z1pdLdL`N&)=yzl2?NvE{b<|ykz1q&mDi4K=M_*wWXGm+?d-e%bS3;%29^z1lw`<;GZ`n}l_LYykAx_(FvWnEdGIf^FCQhUVkt0ycQrX2jQjeYEv zZld{w)mIMfLE!r;p7pD}w7$Y~zJH;zvnO4e<#1xIe$#62E!r~pPpL;)k!Y zW1yG8-n8E~^E>1ll0bZ!20Jsu#`H~#vy$jCh4|UdlXjBR=ghzlcTJIm|Bti3jH`hCTfOLa&clTNN{QmEF$2i~4R|d83 zd#x+xHLp1b6BDKnfT-%|cMG+xdDsz+>MqCWoc&Oei2dz7&|o0`p^p{03O_#ZsHyOt zI{XjNFQAp3yNo3nzInBw^FUphm!tPCoR|;B9REuD)FiCOe&Vj7Wq4pmjYfYNeRF(L z7e(A8Bg{kXH)6{IOtK>2rD2yF+xpWUKK0p7=~|gW+??-4xTDaTmb`eK=ZPXwTuaw+ zQm2FvqTjdW;b2g-9W@eWt-xcmMD z;}gacb*$fdub6dtLa?c;S6;JXhY3+UAv|3Qyq_f#4>S$gnf02nV0h7(h4hsX*#?nP zBD$l@w8JdD3&$|)AW}h}*8EG$e*9G_hcVu(i6@+pQXQ-VTW0xP7_yM!1o@Gy>&doA z$eFB12&qFj`vo9~ZFR++oH`Xddv=YVTy5|_WGoW%Vx06!o%UIj?FeoY9ptl@Y5$yD zbW1kq3NE_M+D7FM<@XN{CS)gVx)=T8ApLW%^G%cE9V>DOpBuaWW;adR{P&{Qn^%DN z=Mo(KT(jxxa$o}^oJ!YFkCbTj`|lcsQQ~0@<6nWmortHJ)(OI_#OP2UoD64y}Hh|LKI* z{r6`_6=BkT^$5rN^a5}rXur7L^trFaslk_2E*?E|5tumo&c5(7p|N;)3-86d=<1A) zZ||GV{SUC=52;VEzKTi4(qLu~4b@jkl_9d`wjI6vQ>Kp{ifS-jrjLKK@)`Su35}Up z`~GP+DeA677%?2dA+^LWTVD`{aVP{zfsF?>772dadlVy2-LJ_Ku4UN;>Y^V4H z4zyiSPtNHY1fD>U@33S&Uea$+7Na1rE*KfK^EZ;WtN!B7Y2g}=47d*d=)-@1>1WUp z)YyVkOoS%7VIPpz)!1k3+VHJ`C}THoVMhNYigVo`jX$A@2Ni<`Y$joj%ZtljoH&Qt z(>zDKzVo!#-1{Dp$(BUhqfYqC>rKTscYW-7yUP4z#?CWz)~fNFIhqfz|Hc!I=6knQ z$EW^Td@d1!cfwn3#tr_3;a{BdPd|}3zNprQOQV8YrkK)E-w;Wy;M*=k$tgXA{OK3-cQskcS29#ur)}xS1rFDOAbF*S3ujFuxSb!#= zwOC?fz=3tB2j8+gCp2IY7me&i@GiV^<7DnDkK-;zTyKo%H)legC}2Xl?7dDJ1oqRM zbmfH)|E4gcNgyXSef?ILvGBy&2@WDW&PGiv1|Nj)bJ@EwZo}qc@Z^y)+{{;WQP^x;hoNu8v4HbMv(NW_9h9pJ$%`HiwJnpUcp?H z;PW%Wao@Cnyc8dXP0l6pKNab%X%0uAB25M6Du63Nh1We4CGZui{OND7Ir7v)T-HGh zUQPlY?e94)@(e9ipZF6?hG(NK)Oay^-YYV6S|xCv(Ns@)v35I>Rhe_o=yCh%m#clJ zEzn1_tZ%yW-xfZf$;e85Jtoh~OPy{i18>6oGs8R!P*CD1Qa!+vYrwL30v+0~a?~`5 zKmagnc!|}}$$6f#tuhCrPJL_#=1w#tYH{P|Gt|?uZ@?#U6bMsotwiwW0%yIVOrTOh zufhKPuf`_~vF}n;@5oWC%5`+_)SLulIa zk6dHdut9>zVCwx4iuSR*D1Al+;^0E1kP|*gfOSu;Kgm&EG{meYL$tyFD{PkunCOy^pH5EV zk1UIVBz#^3aV}WXk^EDl(FyE7;Lh;5Blu+3_)4c4WMQ|ve})H9%wcJ{G1d+VU#C&N zO*6R|hvXSsg;;M2RPc)O}AN#1Hq}^YyOZA00U0Y1;KR?CLg;1FBfB8;-C>`VE%) z!Fohm?V~sa$Jg1syV%rY0_00-IIstho|2+Il!kEca+?S=FNF~=Ec5UunMT0?Sq>T7 zTY&c2td)2j8Usd$r_ucIB zY2_K8i~j;F;i;K(9&2yOXYG3xhTSyaM#i#PY1R!M$Z;8_Y>noP0w)7wB5=QzTC+sI zXIe~_Dl~gsZT2&_DBr{2{#*dNS>;M23CUEhnwLO@?jx{<93bZt_ytV9B8wZi-nfAE z6;@B+2SQ^ul3i)Z^cPSOvHsk2;akfC(%1BC-3-m+df$iXeNLnsebb@(i*_t3X&Rru zYG$%;RLrgypzGI)0%;Klv&*(o)xHg09_2SF6jv+k1zU0&Wxd}CUx zK^){jPW_OjCadtwW@mGKbKE**=9=2)vn2+%L-mR8_Tq_y!QIWjr%6YP@Dz5pE!+)3 zi@SZi;{J;8^s)gPI(=|+-;QZHT{*FA{075N`ZJ8*1ZQy!Sf;ogb-vD7 z{M+ic1zq$y5w|$cQp%I>>l?~gZ_@7E#p6SZic+}UV z#~iei`Iv(?I$lHK8}JcJ#RmJ}&OXKWR_$WHoLbX}N1QPM#z_Ep-_u=t0?9f*K{nk3 z6Jd^=oz*+*1c7&KL4;g0u7Y>a3+22!RjhaJa5W+L`7P|92Sb$B>o~t^+1GJ2ha>F9 ze|-w8xk2VwB_!kMaN?MBG_PH6*xgRQ)VrP0;m|1u z0S%Q^%((vF$?VL={qY0jzpwN`mIA~~O;fbWjU?`z=T!gQz~@wi)V1V3hd@oz_On{u zQe19K13BCS#b?t8XqDwd_DV+x)Bi<1S0-6rLS*&Fs7LWts|cRJTMYgI7kLV9y#jtt zR4vKbd^C1{u|aCwoIQJJq~UdUmW5V|Tc9jFyR~*6QR-~p%ZAgppR8Xv#pLg2zWB>l z*xy@_PVSRO3CHc=@RK>;`{9l~mBZE-Y*)wvRmfs#ANHrpdX~fCY`Y1m+rOdqEBp{V+nKH@AmEMt zp2C8}bJT%t_xBgv)=W*&F^2`NCFtMGceBd~9sUR^LLoZfdWAP<^Q;{%Xb@(3PQDHsWpGOcIy?$wfe(mTg+?cvoQBq5Op z$8#66)`}$_=P_th@5G2b!-^LUa|rBuNY~e539T1vMVJaTWpf^S&ku5XkVTZ@)he-S z{b!9x%|Y+q=6w zjmvS|+3u4#wAKK#9BGvZfi=!%7I+3|lz$dP5EnO;N?`h)vT^SBm>NQMyHxjNY2|-@ zO#zNJ=F7EOP>5o-IHoCvdzul#`tKz2NnQ7n6qn`T<9X-BHJY=Z*N!dqPT@p@qG$v@ zjyn^*^kt1?adaxtAX*yJ4gtNE02ZMPp@1yH6;oTOfk6bzTSHNlLjipt} zww$iC8QD|e#wk-1syAS75&XL3c{av|F=WA1lr%%ETa zc~4{ct1g80g=(a1Ja8<0)S5Y1K9ef(_!2n+22UZ)RBp?|y}Lev?ZC$?>-}@!r;{KN zLxtS2lES1Owm~>menk3L~1>iv&B+aV3zJM#M zkKGOoi#q^9bId>j;kTkcpvcp?6Rn(q?eI805=m(Ik$e4U`fo(i-aJ! z9xMVQym$HXofs!zWO?coGi5h>2Q-U-yF~seHzl53X&KR&y(e~KsM^lR zG(l3u)vu3TWyo-}28qH~Kz{ER{bC@IoA}`bafHA~CnkacGBn->Uv3_mu2}6(PRzCO zI9!a~C@skKHLe+@FqL%TPp239x?A7bi|;t_5_8E>AJ0pp;hK9dWkS!abxW!hW@+=a z`NuBKwOFM})E(+y0L3Cd$pmZBCG%!o=wH~RXE1;6skd3p=tJ?=MG$;RPA*C3gz^b_ zZQT%#)4i`1YQ35zRLeA(PS$^iX%kts&0N@1*xQf-b+FJa|gW_M0O^IYr)`EH{7yMa#IPN{)GRQBz=Oq?{hESZXKZ zYCiE}%4bg}^s5NT3pnPsJxnnIrT}3r{|8*MFLy`X=}{cO13MNzgHZqc_EKr}$E;vx z2f;|2#WEvwE;ITL+`s@Y{<2`s-qX`jx&F@Adc{OXph}4XWo>T=4t=&>i`VvBT{Yk= zYM+C>_K|>f%@sT%r3HV+Kw<>Go89+G{NBy)dS6FOQd4alw%K2;B}lFH#oZaLz5TWq zlT=(PpWzD>^Z$GdYkKn%zM>0D1{SmE|_b75-XM zFcloq_6OJT2ZvX)^wvu39>=}Z>rnrOEdiV)vz3v&p7y#ln6(dOaCfr&DmAHG=yB`=UqI_B%GJ6l9X#l>S?wzaRVh z%g8{{xnkOY$~7r{LvFCMZ}V7? zriuz@26(~K;fm+^F6E56jWDuNgHQS>W<8X$8g+I#+Ad20+jb33d$C8IcvLzYf-)%@ zZC3RQHrL0tpxl}J@9<1wK@3+64>S=BNdJn!zT8 z+XL+uGst`{@tFc7c?)*Lb;o`5#z0A4qpj1ubvF+jQr%O_O9xVc*$V$zhYYKe-qFVt z(o4G(|GLt0OUrI$JfX;WbSn)p+jLP-V_`InxH$pYP^_<;xS1J$!jmFLG9iv`Lpfn~ z#xa)Fcqr^e1p9~==|R4T9FN3v{*S7vW!g+98-wvU{qabIkbx7X*d1Yt!5=kDK_T4| zAZD}U{*DPKYa-j>zZUSix}q*n&H)+;n!+=4!y4hpt_WkSMgrDXr!kI-JH9h^-ShLO zYx#?O=nM3Eo^?9gx)TBr3->%atp=?&BCqr}EV6vJpKE@5JF52d?-&%QZ&}t=dy&^& zojaMUOs@~I_3h#@_l-bt`yxm!VRCp(&Bb2IMAsAwx6e_D$(frj8|m7&ar(2xgI=NT z>oi;y!cRG*yZz zVOIF83Y2C8mZMJE#WpjQAx1{XP)wR#9}yCi|2xS+kH8KcHPJj1jKm^6pV+rV2@##B zSoPaINMCjxm|~k++s+G(uHf~S^&k>^knrD~#vETOXNjV2&DGiC4%wWxPwKqh-%;mm z^15^Lu{oO1vM#6|QSr=A+6RiX zs~`xfY2hrjLV)@So##FHhs1JvL)64YTrNt$@+O_y-L=Mzf)wn#K!PdS-1DE;OULj_ z=VkKT$^4$hmY1KCEU#9da$f!s&e6_!t9Uh6ulP_u0qWGi&F=5FSf;&mw8w)xqiaQs z>4iIaait`VZx?A2v|VEeygH(`XMRBS5(3_*#ii;&q6oFvC0m68)^<;rRW1e_cFhYG zi&ZFO+&_aF6Gk2>;ja~x7in2*IZftb(1FsClkjcU0pJtl*bEVT*ZJEU;P%r65_`d< zAC>$WH7Q(ljHEu^>13o6b2}9?Xw^yw@P9bH6Qm|7nJB69@;)^17xQf7ABn(DuzEhs zPSUYl2X7tieRq~14VLxRdU5T*o`G^2)$~5b(5+X;5C!&@wrwX4T{;Mry#PrfkhliX zSFvN&dBIf-@RpgVQ*3-6E6R}kRnY}XvY4(%?rEC#VZG0w&q5p8Q`1yORSGN5ztp!N z$IybkpjTeQ8(_ySKdWdF5SWk_ILhj`=>qCpu~V&XFOPhgK3Yzd_mreGLaAhaRO~$77vhH-Lnn$IU7HY?%#tf zd`qSSKXSSb!w&F2no}?=bV|Lg?*dLa`8@n9`Uy8vs3~UVyUTbDHx>As4lAyFgx&X4 z-~KD0slG*jH^u}-w_uH*%kjrx=_3qCe*$yabqrV{EUaK~(&-8Z*l!U0=(HH+sP0S7 zC>8_Y=Sx0F_xm@gzkYx7Q5XJrx@&}8#RS-Y@2m$o3#OWc! za>}hb&`d{_XOXq*0bDO*@MrtF6dqfFiIQaHLS+d=r4!cO+)WdU`s?kYIHJO*!Uoxp z_brbAm?NG$vVSjFgEvVE9XZ;y-o`jAlq%?FNwF*Ts3M=+uH-%LAs=b+_IB)J`Z!2v za65C}e7THr)&$rFWuF5-mEY-aI8+q~?t22f!)P=YXrc8vCvmFHhz@7A9)42J*lY3d zd1BR#1v%*~szpySe=OT5{A^H|plsG;E)Bdnmj%bIxn)^DHLJFD%w{W-$m~StFBf~K zB;K#~ciWP$`IinS67=a(r(AUUOK;6^iD{-n5P`2mJ51O zCP#At>t&Xzd0R7lT%KWYPRURWBvL2n4R`FR{lxeUNvYNjaB`rITDMLgMw*b znSn`6{zO&M7=a|aWG};$D8^<@xkejr_8V|my5?AWu^_25Yxnm5dg3`**d1g;jde2( zf2}HFaWvx9nO2Ufj_c=5WzPGK!+4K5p7I0st?Bw^(-g^%=28zwC~H0N&x{vh64ncWU0()_$gtl*dq)k;&|NuVHe za368^A{-%(pv9zNh-1E7mo+F#BED`9!W=eiOL}iAS}XRkecQ07E7G8*13RskT3l*X zVnH)8g?BqYYpej@=f!-;g>yHdGtKckIQ!!T5=lQ)BLl|GFzFE%THBKW_M%`mPq~Lo za#n@k9Z$I#K*cZGb+7ptVNiY4S3*+wqzaLtF5Yg-!PKu5mUqe?YC2D3tU>yU=hNUv zKYEV(HhcG}_WSN-hIQD*Lh-p}E!O^@3_op$VG;8L!qoVC5q_KK>}A5oxDu(?IF#4_ z#T#3gBwmNE;?-T}3py~&ugYM6-x4Ircfycs4#t3xR#uY4&d;W_!7K0(n6upE8_kAF z#nNP4ze?fxW6jmszrr<0hlGALNgMY4IT}Get|M2s#1ET(GF)7BRzBw!h5|^9UR~XT zuyYpkF)S6e82JQkSQEf z8c3$zkx(wjcFN?Ba)efVvSW8pbRH;T%38m(ClY#~O(y6u7`1r6f*Go<`OXL{c z=>vi9^#D05N()TFUL&nTe08vWxqynCI)Y-rzw56QP%6W&M~Z=vM6KaJJI&lg<6MJ6 z51Dm3NPvHaQs@k2UuDT#*T|!_qt#U+c6A7fMRTp5uQ|crda!YBZJ>phcs)X&i45JQ zI7N@hn|D8t8I|Q1b`|ja@akYz-ot447(M5BT4kK&p%Dox$9t5>v(S?8VsiIe{K#$Y ztWcUmc#I>d95mKY?~4s$-Eq^|tZ-WMi{5bNmdKOBl#Dhx?=zVKdkJ30;s+TwNEnZc zwU|iH{9z~2$0r7ddB{+Ii$9m+poULR4M-yCZ+jD&){ZWA*Q9 zy_?!8p7J+tA2&V|q6jsXT8Qj+yO3XlogRN|(Z}yj%9@ zK5CX4IV77~p00I`kwVT)yUN8-rA~9H^muhF>)}0#ww*d=?UKXuFrtk^mHGgx=F~5< zjSTS94ts}m|E%>NleJ$DY< zW7UAtSyo$5*Oe(Z2Tv>UqB>Wr$eV-T3!7_xLb>`Z{W@Gw-H17PD!b(|`KM zYj&*0x5XOQKcorX-t$#^+a!Lla*WtryeQheHZN-Aym3w9cFlgptRn07GC6mdNNM#G zt(%=XaRdbfodICK3`j;;OSln~E|eK%enu~R9A~O+l5^!IXJstf7}14^LoROY2RX$O zVXfTAp>~HoS=6WiK`G+d{k!xk;zar_85n`YO;)+k&(zE8~wCo&>TvoJ+;8ObQ=^?;#W1GL`;hdtRmDsKIg&g)F z#4-ie89p&m+H<{VJQ-BF#(M7RK zK3>*6QnNzaf@<-Iaq1!%czWAi1D&_IA4I>^c?4UEMBLprQYu(NX*N;P-L`4hmeO_@ zf^u3ur5M_t!tcVJ3NrYQ-%;pm*uc?VRFBFkO>#~+J+(g)Av1L5cY4}~ad3j!ExC+@ zFs}AI&U#sVIuX}rl^jEvJBWJm6B3l96BgD<>{6f8(po$424(5BJM;2xRv~fYuz9>$Kd`*X=XssqKgC+^M*=plFmRPHApp84yx$^>DQBrbdNV>ES~zbh zGiK!=)KNUiK+|Q5lI^f7UZ47BqC!wZf*4-ck#?LiD6UMejnQ}vL4BQQ(epw_W!J^Z zed;~wyil>RDTe>Eb&oQXS2QGGXd^$FzjDooa#>cl{?>7^+G4~6mq|OnZPpvtN15bb zpQ=n^G5Xv2u}_u2UBZoCk4s1`TS(gC#9^**Q4jciJ$RG63j2ers)^>W$~Ru1pc`ds zZDk+$@-3g}JS#FZ(n?S3HjS)y+l4wV zGci!MdD*U}tu4%Vbt%l5=Qe<$dO-6`6mh1-I$c{KuikRDUSkPCS3L7zB-Doc_UJxj zE|hxZY_>T<(-?X>5Wwo*71}pD`bS}f{6H~*WxOTcCfVHI>KfPQ5(6nS;{5GTRv36& z>~gGLX)g`eY4iMVM4v}XHzygC;&$!`45ckK4}WkF;(3Inu4T7jFEvTK$%=advokyU z-#@t+a5xg^cG7(I0Cf@T?tYi0CRauIdn+%!)SA|gR8;nP&l|?0^XJ1z!+s{CqdF9s zyghM901iI$Ly&}qC= zg|$#lj8?5Km*=AesvtQGDadlOr_MD|;)= zx-_h6?T5q?Z?&07G2*XJB~YV~dh3PEh%s>uuM2;MK&$1xJp8(qBVsTsfG>zq0F$cx z&<@kurMwWBEsbc9P!fXHn2xvcg^;Fbg3m9bZCA@Rq>Q)v@S%3pD@{vl&*f@!%fCp< z{S=Hffq$b|iyJhJ;fcBNsS*u)$Xfo6>q@f%fKUwZgTW<6q|tP3jCZ6R&v2W`hIlVh zG+(u{V7E&nkxR>tKKy8du(&Y$m49mSou45H6&~z-Ut%_7g8AGNYk7BvHch;4*br8qihh2DgqM4w>l-pmJ)Q`B<9%z&L z9x;Hg{K3UooPr(~E>z$HycZ(NaD|;yJVV>wV41T&&vd+UKoXm2l(vV4r=xbmOj5`P zWLg}%LM5tjd`jMf2B|}@2J?9~$61OwK6c~y5A}47%L`#eE4Ef(>f&SvB9N=S2^|@& z{t*!hs75cGw@AQ`DyBk2dN~6^;2N4x> z%pDzn|CPgrbj$uARb%_U@C_jX=F-&}bMQm1CFBir@aE*&0RO zWy$52&{#Sh(VU_O&+A^Uy4yDUv8@|?XYnH?sZA|2^0^;xgc84T?8T~?$i{?QK@=09 z9yiIaUX&C{o$5gT4H)01rF=jh7z+1Nbh|*B?B_&DK>oBP9Yul!t+gJEg$Tl3nXO2huWG}LZcJku4c~G#@r;-WJtsOp z49e{skS{n$+WN7I<(aP6Bj}RXUi4OXDFt44CT0=L!(vVO+P*|bQqFN<_BU-bT9mQj zeE^`QvP|3Frk8VnBdwfNQdMDZ&@}OjeCL7ja0-1xuVxI(KRG zxYW8t1(s>g3Ul*Hzf=k3T-QymrAz3q7Nk{^Hbz}Cpb>R*(0+R$?!Kkp(1Olq^KdV4 zZsdEE5lDp9xJnK>1zsu{85W7;!IGEAc@q4aFJ|b=@D^PyWmz-m-(d!Sb~7Ty>>$HM zGLyT(2t8XSGu2$LV?xyRKcw<6|A{15hV)6hmhHQ-dIWo;1P2>(lk|cwON^#Vs&Pa2 zYh4$?IN_c5RIZ$P2dIiAb*OcHG^f_rr(01atw%QPvd?9Gehy@(+LKM=4Gy{f|6P8; zsTILg>qxBy6Yp+yZRW2eXhh>0DTT=8r?W0phH7sdvyH_NLNQ#yZEHAw(MA(eAPz&!2Vug`-nu+TAovOJobgXnp7za- zp-y*-%?dRhPug>F2>HyVrrrXKJLE}(*VfoGLrh4O)azMn6qos3k?GEw3;S!WCZhKi}C#Ov#Zms3v zt}MmrR)1TwojzG|t*Xe_HI^}%y*C9{|gp`-J_2B!x!3U%7re}ot%Yd zrbRmkC5udXsk)Mc4VVxyG(wuEH+&R0^eRzM)zbcG+}9>eA4K*c&Y@(JkOe$l#uJO4 zAdTjZ3cA}+6t-hDh8J=_O=@ z^OCy>MuuZ7WQ9uEIF{i8t*WG1MjcDDsR%qXbuZgGNU?(;ncs5&KTk339w`f%F5YJ6 zoBDnuZjsD$85nPEPw>cgvmlGlo!tp_-wA_{beq+X>e*U5j&)y6NrOZKk+AltOQorn z#s~YxG02oQksDpH98=OwCXcONzqkv}{6xNefO4^ueoxh&M%2za7&iU*GG!Pl;PH6* zOSU@4J+`mUcKVa8n`uEy9z!ZT*TN471aUx7MhdX}#wlJNeO#ItK#3?QEB~In&@8_Z zx`BlI2M}Y%&0Ow&Xc_Okd$=0%j?G9dd3A(=Vup+kjT9xV`{6$ec;3QW;tZ#PBzP